Guidance coverage
This page shows how far the guide has got. It is built from the site’s own content on every deploy, so it is always current. Each control page shows the same two statuses near its title.
- Guidance is the “How to apply it” section below the NIST text on a control page, written in the AC-2 format.
- Policy clause is the control’s “shall” statement in its family policy template (see Policies). A -1 control is met by the sections every family policy shares, so it takes that policy’s status.
- Draft means written and source-checked but not yet reviewed by the owner. Reviewed means the owner has reviewed it. None means not written yet.
Of 300 active controls, 221 have guidance (0 reviewed) and 232 have a policy clause (0 reviewed).
By baseline
Base controls only; enhancements are covered on their control's page.
| Baseline | Controls | With guidance | With a policy clause |
|---|---|---|---|
| Low | 131 | 131 (0 reviewed) | 131 (0 reviewed) |
| Moderate | 177 | 177 (0 reviewed) | 177 (0 reviewed) |
| High | 188 | 177 (0 reviewed) | 188 (0 reviewed) |
| Privacy | 75 | 75 (0 reviewed) | 75 (0 reviewed) |
By family
| Family | Controls | With guidance | With a policy clause |
|---|---|---|---|
| AC | 23 | 17 (0 reviewed) | 18 (0 reviewed) |
| AT | 5 | 4 (0 reviewed) | 4 (0 reviewed) |
| AU | 15 | 11 (0 reviewed) | 12 (0 reviewed) |
| CA | 8 | 7 (0 reviewed) | 8 (0 reviewed) |
| CM | 14 | 12 (0 reviewed) | 12 (0 reviewed) |
| CP | 12 | 9 (0 reviewed) | 9 (0 reviewed) |
| IA | 13 | 10 (0 reviewed) | 10 (0 reviewed) |
| IR | 9 | 8 (0 reviewed) | 8 (0 reviewed) |
| MA | 7 | 6 (0 reviewed) | 6 (0 reviewed) |
| MP | 8 | 7 (0 reviewed) | 7 (0 reviewed) |
| PE | 22 | 16 (0 reviewed) | 17 (0 reviewed) |
| PL | 8 | 7 (0 reviewed) | 7 (0 reviewed) |
| PM | 32 | 32 (0 reviewed) | 32 (0 reviewed) |
| PS | 9 | 9 (0 reviewed) | 9 (0 reviewed) |
| PT | 8 | 8 (0 reviewed) | 8 (0 reviewed) |
| RA | 9 | 7 (0 reviewed) | 7 (0 reviewed) |
| SA | 17 | 11 (0 reviewed) | 14 (0 reviewed) |
| SC | 47 | 18 (0 reviewed) | 20 (0 reviewed) |
| SI | 22 | 13 (0 reviewed) | 14 (0 reviewed) |
| SR | 12 | 9 (0 reviewed) | 10 (0 reviewed) |
All controls
| Control | Title | Baselines | Guidance | Policy clause |
|---|---|---|---|---|
| AC-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| AC-2 | Account Management | Low, Moderate, High | draft | draft |
| AC-3 | Access Enforcement | Low, Moderate, High | draft | draft |
| AC-4 | Information Flow Enforcement | Moderate, High | draft | draft |
| AC-5 | Separation of Duties | Moderate, High | draft | draft |
| AC-6 | Least Privilege | Moderate, High | draft | draft |
| AC-7 | Unsuccessful Logon Attempts | Low, Moderate, High | draft | draft |
| AC-8 | System Use Notification | Low, Moderate, High | draft | draft |
| AC-9 | Previous Logon Notification | — | none | none |
| AC-10 | Concurrent Session Control | High | none | draft |
| AC-11 | Device Lock | Moderate, High | draft | draft |
| AC-12 | Session Termination | Moderate, High | draft | draft |
| AC-14 | Permitted Actions Without Identification or Authentication | Low, Moderate, High | draft | draft |
| AC-16 | Security and Privacy Attributes | — | none | none |
| AC-17 | Remote Access | Low, Moderate, High | draft | draft |
| AC-18 | Wireless Access | Low, Moderate, High | draft | draft |
| AC-19 | Access Control for Mobile Devices | Low, Moderate, High | draft | draft |
| AC-20 | Use of External Systems | Low, Moderate, High | draft | draft |
| AC-21 | Information Sharing | Moderate, High | draft | draft |
| AC-22 | Publicly Accessible Content | Low, Moderate, High | draft | draft |
| AC-23 | Data Mining Protection | — | none | none |
| AC-24 | Access Control Decisions | — | none | none |
| AC-25 | Reference Monitor | — | none | none |
| AT-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| AT-2 | Literacy Training and Awareness | Low, Moderate, High, Privacy | draft | draft |
| AT-3 | Role-based Training | Low, Moderate, High, Privacy | draft | draft |
| AT-4 | Training Records | Low, Moderate, High, Privacy | draft | draft |
| AT-6 | Training Feedback | — | none | none |
| AU-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| AU-2 | Event Logging | Low, Moderate, High, Privacy | draft | draft |
| AU-3 | Content of Audit Records | Low, Moderate, High | draft | draft |
| AU-4 | Audit Log Storage Capacity | Low, Moderate, High | draft | draft |
| AU-5 | Response to Audit Logging Process Failures | Low, Moderate, High | draft | draft |
| AU-6 | Audit Record Review, Analysis, and Reporting | Low, Moderate, High | draft | draft |
| AU-7 | Audit Record Reduction and Report Generation | Moderate, High | draft | draft |
| AU-8 | Time Stamps | Low, Moderate, High | draft | draft |
| AU-9 | Protection of Audit Information | Low, Moderate, High | draft | draft |
| AU-10 | Non-repudiation | High | none | draft |
| AU-11 | Audit Record Retention | Low, Moderate, High, Privacy | draft | draft |
| AU-12 | Audit Record Generation | Low, Moderate, High | draft | draft |
| AU-13 | Monitoring for Information Disclosure | — | none | none |
| AU-14 | Session Audit | — | none | none |
| AU-16 | Cross-organizational Audit Logging | — | none | none |
| CA-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| CA-2 | Control Assessments | Low, Moderate, High, Privacy | draft | draft |
| CA-3 | Information Exchange | Low, Moderate, High | draft | draft |
| CA-5 | Plan of Action and Milestones | Low, Moderate, High, Privacy | draft | draft |
| CA-6 | Authorization | Low, Moderate, High, Privacy | draft | draft |
| CA-7 | Continuous Monitoring | Low, Moderate, High, Privacy | draft | draft |
| CA-8 | Penetration Testing | High | none | draft |
| CA-9 | Internal System Connections | Low, Moderate, High | draft | draft |
| CM-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| CM-2 | Baseline Configuration | Low, Moderate, High | draft | draft |
| CM-3 | Configuration Change Control | Moderate, High | draft | draft |
| CM-4 | Impact Analyses | Low, Moderate, High, Privacy | draft | draft |
| CM-5 | Access Restrictions for Change | Low, Moderate, High | draft | draft |
| CM-6 | Configuration Settings | Low, Moderate, High | draft | draft |
| CM-7 | Least Functionality | Low, Moderate, High | draft | draft |
| CM-8 | System Component Inventory | Low, Moderate, High | draft | draft |
| CM-9 | Configuration Management Plan | Moderate, High | draft | draft |
| CM-10 | Software Usage Restrictions | Low, Moderate, High | draft | draft |
| CM-11 | User-installed Software | Low, Moderate, High | draft | draft |
| CM-12 | Information Location | Moderate, High | draft | draft |
| CM-13 | Data Action Mapping | — | none | none |
| CM-14 | Signed Components | — | none | none |
| CP-1 | Policy and Procedures | Low, Moderate, High | draft | draft |
| CP-2 | Contingency Plan | Low, Moderate, High | draft | draft |
| CP-3 | Contingency Training | Low, Moderate, High | draft | draft |
| CP-4 | Contingency Plan Testing | Low, Moderate, High | draft | draft |
| CP-6 | Alternate Storage Site | Moderate, High | draft | draft |
| CP-7 | Alternate Processing Site | Moderate, High | draft | draft |
| CP-8 | Telecommunications Services | Moderate, High | draft | draft |
| CP-9 | System Backup | Low, Moderate, High | draft | draft |
| CP-10 | System Recovery and Reconstitution | Low, Moderate, High | draft | draft |
| CP-11 | Alternate Communications Protocols | — | none | none |
| CP-12 | Safe Mode | — | none | none |
| CP-13 | Alternative Security Mechanisms | — | none | none |
| IA-1 | Policy and Procedures | Low, Moderate, High | draft | draft |
| IA-2 | Identification and Authentication (Organizational Users) | Low, Moderate, High | draft | draft |
| IA-3 | Device Identification and Authentication | Moderate, High | draft | draft |
| IA-4 | Identifier Management | Low, Moderate, High | draft | draft |
| IA-5 | Authenticator Management | Low, Moderate, High | draft | draft |
| IA-6 | Authentication Feedback | Low, Moderate, High | draft | draft |
| IA-7 | Cryptographic Module Authentication | Low, Moderate, High | draft | draft |
| IA-8 | Identification and Authentication (Non-organizational Users) | Low, Moderate, High | draft | draft |
| IA-9 | Service Identification and Authentication | — | none | none |
| IA-10 | Adaptive Authentication | — | none | none |
| IA-11 | Re-authentication | Low, Moderate, High | draft | draft |
| IA-12 | Identity Proofing | Moderate, High | draft | draft |
| IA-13 | Identity Providers and Authorization Servers | — | none | none |
| IR-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| IR-2 | Incident Response Training | Low, Moderate, High, Privacy | draft | draft |
| IR-3 | Incident Response Testing | Moderate, High, Privacy | draft | draft |
| IR-4 | Incident Handling | Low, Moderate, High, Privacy | draft | draft |
| IR-5 | Incident Monitoring | Low, Moderate, High, Privacy | draft | draft |
| IR-6 | Incident Reporting | Low, Moderate, High, Privacy | draft | draft |
| IR-7 | Incident Response Assistance | Low, Moderate, High, Privacy | draft | draft |
| IR-8 | Incident Response Plan | Low, Moderate, High, Privacy | draft | draft |
| IR-9 | Information Spillage Response | — | none | none |
| MA-1 | Policy and Procedures | Low, Moderate, High | draft | draft |
| MA-2 | Controlled Maintenance | Low, Moderate, High | draft | draft |
| MA-3 | Maintenance Tools | Moderate, High | draft | draft |
| MA-4 | Nonlocal Maintenance | Low, Moderate, High | draft | draft |
| MA-5 | Maintenance Personnel | Low, Moderate, High | draft | draft |
| MA-6 | Timely Maintenance | Moderate, High | draft | draft |
| MA-7 | Field Maintenance | — | none | none |
| MP-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| MP-2 | Media Access | Low, Moderate, High | draft | draft |
| MP-3 | Media Marking | Moderate, High | draft | draft |
| MP-4 | Media Storage | Moderate, High | draft | draft |
| MP-5 | Media Transport | Moderate, High | draft | draft |
| MP-6 | Media Sanitization | Low, Moderate, High, Privacy | draft | draft |
| MP-7 | Media Use | Low, Moderate, High | draft | draft |
| MP-8 | Media Downgrading | — | none | none |
| PE-1 | Policy and Procedures | Low, Moderate, High | draft | draft |
| PE-2 | Physical Access Authorizations | Low, Moderate, High | draft | draft |
| PE-3 | Physical Access Control | Low, Moderate, High | draft | draft |
| PE-4 | Access Control for Transmission | Moderate, High | draft | draft |
| PE-5 | Access Control for Output Devices | Moderate, High | draft | draft |
| PE-6 | Monitoring Physical Access | Low, Moderate, High | draft | draft |
| PE-8 | Visitor Access Records | Low, Moderate, High | draft | draft |
| PE-9 | Power Equipment and Cabling | Moderate, High | draft | draft |
| PE-10 | Emergency Shutoff | Moderate, High | draft | draft |
| PE-11 | Emergency Power | Moderate, High | draft | draft |
| PE-12 | Emergency Lighting | Low, Moderate, High | draft | draft |
| PE-13 | Fire Protection | Low, Moderate, High | draft | draft |
| PE-14 | Environmental Controls | Low, Moderate, High | draft | draft |
| PE-15 | Water Damage Protection | Low, Moderate, High | draft | draft |
| PE-16 | Delivery and Removal | Low, Moderate, High | draft | draft |
| PE-17 | Alternate Work Site | Moderate, High | draft | draft |
| PE-18 | Location of System Components | High | none | draft |
| PE-19 | Information Leakage | — | none | none |
| PE-20 | Asset Monitoring and Tracking | — | none | none |
| PE-21 | Electromagnetic Pulse Protection | — | none | none |
| PE-22 | Component Marking | — | none | none |
| PE-23 | Facility Location | — | none | none |
| PL-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| PL-2 | System Security and Privacy Plans | Low, Moderate, High, Privacy | draft | draft |
| PL-4 | Rules of Behavior | Low, Moderate, High, Privacy | draft | draft |
| PL-7 | Concept of Operations | — | none | none |
| PL-8 | Security and Privacy Architectures | Moderate, High, Privacy | draft | draft |
| PL-9 | Central Management | Privacy | draft | draft |
| PL-10 | Baseline Selection | Low, Moderate, High | draft | draft |
| PL-11 | Baseline Tailoring | Low, Moderate, High | draft | draft |
| PM-1 | Information Security Program Plan | — | draft | draft |
| PM-2 | Information Security Program Leadership Role | — | draft | draft |
| PM-3 | Information Security and Privacy Resources | Privacy | draft | draft |
| PM-4 | Plan of Action and Milestones Process | Privacy | draft | draft |
| PM-5 | System Inventory | — | draft | draft |
| PM-6 | Measures of Performance | Privacy | draft | draft |
| PM-7 | Enterprise Architecture | Privacy | draft | draft |
| PM-8 | Critical Infrastructure Plan | Privacy | draft | draft |
| PM-9 | Risk Management Strategy | Privacy | draft | draft |
| PM-10 | Authorization Process | Privacy | draft | draft |
| PM-11 | Mission and Business Process Definition | Privacy | draft | draft |
| PM-12 | Insider Threat Program | — | draft | draft |
| PM-13 | Security and Privacy Workforce | Privacy | draft | draft |
| PM-14 | Testing, Training, and Monitoring | Privacy | draft | draft |
| PM-15 | Security and Privacy Groups and Associations | — | draft | draft |
| PM-16 | Threat Awareness Program | — | draft | draft |
| PM-17 | Protecting Controlled Unclassified Information on External Systems | Privacy | draft | draft |
| PM-18 | Privacy Program Plan | Privacy | draft | draft |
| PM-19 | Privacy Program Leadership Role | Privacy | draft | draft |
| PM-20 | Dissemination of Privacy Program Information | Privacy | draft | draft |
| PM-21 | Accounting of Disclosures | Privacy | draft | draft |
| PM-22 | Personally Identifiable Information Quality Management | Privacy | draft | draft |
| PM-23 | Data Governance Body | — | draft | draft |
| PM-24 | Data Integrity Board | Privacy | draft | draft |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | Privacy | draft | draft |
| PM-26 | Complaint Management | Privacy | draft | draft |
| PM-27 | Privacy Reporting | Privacy | draft | draft |
| PM-28 | Risk Framing | Privacy | draft | draft |
| PM-29 | Risk Management Program Leadership Roles | — | draft | draft |
| PM-30 | Supply Chain Risk Management Strategy | — | draft | draft |
| PM-31 | Continuous Monitoring Strategy | Privacy | draft | draft |
| PM-32 | Purposing | — | draft | draft |
| PS-1 | Policy and Procedures | Low, Moderate, High | draft | draft |
| PS-2 | Position Risk Designation | Low, Moderate, High | draft | draft |
| PS-3 | Personnel Screening | Low, Moderate, High | draft | draft |
| PS-4 | Personnel Termination | Low, Moderate, High | draft | draft |
| PS-5 | Personnel Transfer | Low, Moderate, High | draft | draft |
| PS-6 | Access Agreements | Low, Moderate, High, Privacy | draft | draft |
| PS-7 | External Personnel Security | Low, Moderate, High | draft | draft |
| PS-8 | Personnel Sanctions | Low, Moderate, High | draft | draft |
| PS-9 | Position Descriptions | Low, Moderate, High | draft | draft |
| PT-1 | Policy and Procedures | Privacy | draft | draft |
| PT-2 | Authority to Process Personally Identifiable Information | Privacy | draft | draft |
| PT-3 | Personally Identifiable Information Processing Purposes | Privacy | draft | draft |
| PT-4 | Consent | Privacy | draft | draft |
| PT-5 | Privacy Notice | Privacy | draft | draft |
| PT-6 | System of Records Notice | Privacy | draft | draft |
| PT-7 | Specific Categories of Personally Identifiable Information | Privacy | draft | draft |
| PT-8 | Computer Matching Requirements | Privacy | draft | draft |
| RA-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| RA-2 | Security Categorization | Low, Moderate, High | draft | draft |
| RA-3 | Risk Assessment | Low, Moderate, High, Privacy | draft | draft |
| RA-5 | Vulnerability Monitoring and Scanning | Low, Moderate, High | draft | draft |
| RA-6 | Technical Surveillance Countermeasures Survey | — | none | none |
| RA-7 | Risk Response | Low, Moderate, High, Privacy | draft | draft |
| RA-8 | Privacy Impact Assessments | Privacy | draft | draft |
| RA-9 | Criticality Analysis | Moderate, High | draft | draft |
| RA-10 | Threat Hunting | — | none | none |
| SA-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| SA-2 | Allocation of Resources | Low, Moderate, High, Privacy | draft | draft |
| SA-3 | System Development Life Cycle | Low, Moderate, High, Privacy | draft | draft |
| SA-4 | Acquisition Process | Low, Moderate, High, Privacy | draft | draft |
| SA-5 | System Documentation | Low, Moderate, High | draft | draft |
| SA-8 | Security and Privacy Engineering Principles | Low, Moderate, High | draft | draft |
| SA-9 | External System Services | Low, Moderate, High, Privacy | draft | draft |
| SA-10 | Developer Configuration Management | Moderate, High | draft | draft |
| SA-11 | Developer Testing and Evaluation | Moderate, High, Privacy | draft | draft |
| SA-15 | Development Process, Standards, and Tools | Moderate, High | draft | draft |
| SA-16 | Developer-provided Training | High | none | draft |
| SA-17 | Developer Security and Privacy Architecture and Design | High | none | draft |
| SA-20 | Customized Development of Critical Components | — | none | none |
| SA-21 | Developer Screening | High | none | draft |
| SA-22 | Unsupported System Components | Low, Moderate, High | draft | draft |
| SA-23 | Specialization | — | none | none |
| SA-24 | Design For Cyber Resiliency | — | none | none |
| SC-1 | Policy and Procedures | Low, Moderate, High | draft | draft |
| SC-2 | Separation of System and User Functionality | Moderate, High | draft | draft |
| SC-3 | Security Function Isolation | High | none | draft |
| SC-4 | Information in Shared System Resources | Moderate, High | draft | draft |
| SC-5 | Denial-of-service Protection | Low, Moderate, High | draft | draft |
| SC-6 | Resource Availability | — | none | none |
| SC-7 | Boundary Protection | Low, Moderate, High | draft | draft |
| SC-8 | Transmission Confidentiality and Integrity | Moderate, High | draft | draft |
| SC-10 | Network Disconnect | Moderate, High | draft | draft |
| SC-11 | Trusted Path | — | none | none |
| SC-12 | Cryptographic Key Establishment and Management | Low, Moderate, High | draft | draft |
| SC-13 | Cryptographic Protection | Low, Moderate, High | draft | draft |
| SC-15 | Collaborative Computing Devices and Applications | Low, Moderate, High | draft | draft |
| SC-16 | Transmission of Security and Privacy Attributes | — | none | none |
| SC-17 | Public Key Infrastructure Certificates | Moderate, High | draft | draft |
| SC-18 | Mobile Code | Moderate, High | draft | draft |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | Low, Moderate, High | draft | draft |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | Low, Moderate, High | draft | draft |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | Low, Moderate, High | draft | draft |
| SC-23 | Session Authenticity | Moderate, High | draft | draft |
| SC-24 | Fail in Known State | High | none | draft |
| SC-25 | Thin Nodes | — | none | none |
| SC-26 | Decoys | — | none | none |
| SC-27 | Platform-independent Applications | — | none | none |
| SC-28 | Protection of Information at Rest | Moderate, High | draft | draft |
| SC-29 | Heterogeneity | — | none | none |
| SC-30 | Concealment and Misdirection | — | none | none |
| SC-31 | Covert Channel Analysis | — | none | none |
| SC-32 | System Partitioning | — | none | none |
| SC-34 | Non-modifiable Executable Programs | — | none | none |
| SC-35 | External Malicious Code Identification | — | none | none |
| SC-36 | Distributed Processing and Storage | — | none | none |
| SC-37 | Out-of-band Channels | — | none | none |
| SC-38 | Operations Security | — | none | none |
| SC-39 | Process Isolation | Low, Moderate, High | draft | draft |
| SC-40 | Wireless Link Protection | — | none | none |
| SC-41 | Port and I/O Device Access | — | none | none |
| SC-42 | Sensor Capability and Data | — | none | none |
| SC-43 | Usage Restrictions | — | none | none |
| SC-44 | Detonation Chambers | — | none | none |
| SC-45 | System Time Synchronization | — | none | none |
| SC-46 | Cross Domain Policy Enforcement | — | none | none |
| SC-47 | Alternate Communications Paths | — | none | none |
| SC-48 | Sensor Relocation | — | none | none |
| SC-49 | Hardware-enforced Separation and Policy Enforcement | — | none | none |
| SC-50 | Software-enforced Separation and Policy Enforcement | — | none | none |
| SC-51 | Hardware-based Protection | — | none | none |
| SI-1 | Policy and Procedures | Low, Moderate, High, Privacy | draft | draft |
| SI-2 | Flaw Remediation | Low, Moderate, High | draft | draft |
| SI-3 | Malicious Code Protection | Low, Moderate, High | draft | draft |
| SI-4 | System Monitoring | Low, Moderate, High | draft | draft |
| SI-5 | Security Alerts, Advisories, and Directives | Low, Moderate, High | draft | draft |
| SI-6 | Security and Privacy Function Verification | High | none | draft |
| SI-7 | Software, Firmware, and Information Integrity | Moderate, High | draft | draft |
| SI-8 | Spam Protection | Moderate, High | draft | draft |
| SI-10 | Information Input Validation | Moderate, High | draft | draft |
| SI-11 | Error Handling | Moderate, High | draft | draft |
| SI-12 | Information Management and Retention | Low, Moderate, High, Privacy | draft | draft |
| SI-13 | Predictable Failure Prevention | — | none | none |
| SI-14 | Non-persistence | — | none | none |
| SI-15 | Information Output Filtering | — | none | none |
| SI-16 | Memory Protection | Moderate, High | draft | draft |
| SI-17 | Fail-safe Procedures | — | none | none |
| SI-18 | Personally Identifiable Information Quality Operations | Privacy | draft | draft |
| SI-19 | De-identification | Privacy | draft | draft |
| SI-20 | Tainting | — | none | none |
| SI-21 | Information Refresh | — | none | none |
| SI-22 | Information Diversity | — | none | none |
| SI-23 | Information Fragmentation | — | none | none |
| SR-1 | Policy and Procedures | Low, Moderate, High | draft | draft |
| SR-2 | Supply Chain Risk Management Plan | Low, Moderate, High | draft | draft |
| SR-3 | Supply Chain Controls and Processes | Low, Moderate, High | draft | draft |
| SR-4 | Provenance | — | none | none |
| SR-5 | Acquisition Strategies, Tools, and Methods | Low, Moderate, High | draft | draft |
| SR-6 | Supplier Assessments and Reviews | Moderate, High | draft | draft |
| SR-7 | Supply Chain Operations Security | — | none | none |
| SR-8 | Notification Agreements | Low, Moderate, High | draft | draft |
| SR-9 | Tamper Resistance and Detection | High | none | draft |
| SR-10 | Inspection of Systems or Components | Low, Moderate, High | draft | draft |
| SR-11 | Component Authenticity | Low, Moderate, High | draft | draft |
| SR-12 | Component Disposal | Low, Moderate, High | draft | draft |
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.