{"text_format":"1","workbook":"xlsx","n_sheets":4,"sheets":["Purpose","Instructions","Corrective Action Plan","Value List"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Purpose","index":0,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Instructions","index":1,"n_rows":16,"n_cols":11,"rows_kept":16,"cut":false,"hidden":false,"merged":[[5,1,5,10],[7,1,7,10],[9,1,9,10],[11,1,11,9]]}
["Archer ID for Findings","Agency (Agency Name)","Name","Finding","Remediation Overview","Policies (Section - Section Name)","Quarter Date Applied","Revised Expected Due Date","Revised Responsible Party","Submission Status","Remediation Response Update"]
["Provide the Archer Tracking ID for the finding using FND-\"12345\"\n*Note to not include FND- part and only the number.","Value Selection","Name of finding","Description of finding","Description of remediation steps to be taken","SEC530 Policy ID.  You may select multiple values. \nValue Selection","Input which quarter the CAP will be applied to.\nE.g. (Q1-3/31/YYYY, Q2-6/30/YYYY, Q3-9/30/YYYY, 12/31/YYYY)","Add when this finding is supposed to be resolved. The date format is MM/DD/YYYY","Who from the agency is responsbile for this finding?\nList out full name separated by semi-colon \nJohn Doe (ISO); Mary Lamb (System Owner)","List the finding status. E.g. (Not started, In process, Submit for Closure) \nValue Selection","Give an update of the remediation response applied to the finding for the quarter."]
[]
[]
[null,"Instructions:"]
[null,"Please fill out the Corrective Action Plan tab and send in to commonwealthsecurity@vita.virginia.gov and/or your Governance Analyst.  These updates are to be provided within 30 days of the end of each quarter- March 31st, June 30th, September 30th, and December 31st.  "]
[]
[null,"This sheet is intended to provide a description of each field header.  If it is labeled \"Value Selection\", that indicates that a value can be selected from a drop-down menu."]
[]
[null,"Also the Headings on each column will provide a description and any special colmumn formatting."]
[]
[null,"*NOTE* Determine whether the findings is based on family controls from SEC530 when completing the Policy - Section Name area. "]
[]
[null,"All columns highlighted in Dark Orange/Brown are required"]
[]
[null,"ISO's/designees need to enable macros to address column F.  For multiple risks, that will be addressed when your analyst completes the upload into Archer."]

{"sheet":"Corrective Action Plan","index":2,"n_rows":1,"n_cols":13,"rows_kept":1,"cut":false,"hidden":false,"merged":[]}
["Archer ID for Finding","Agency (Agency Name)","Name","Finding","Remediation Overview","Policies (Section - Section Name)","Quarter Date Applied","Revised Expected Due Date","Revised Responsible Party","Submission Status","Remediation Response Update","CSRM Review Date","CSRM Approved"]

{"sheet":"Value List","index":3,"n_rows":362,"n_cols":3,"rows_kept":362,"cut":false,"hidden":false,"merged":[]}
["Agency Name","Submission Status","Policy - Section Name"]
["Alcoholic Beverage Control","Not Started","SEC530 AC-1 - Access Control Policy and Procedures"]
["ATOS","In Process","SEC530 AC-2 - Account Management"]
["Board of Accountancy","Submit for Closure","SEC530 AC-2-CE - Account Management"]
["Center for Innovative Technologies",null,"SEC530 AC-2-COV - Account Management"]
["Commonwealths Attorneys Services Council",null,"SEC530 AC-2-COV-CE - Account Management"]
["Compensation Board",null,"SEC530 AC-3 - Access Enforcement"]
["Department for Aging and Rehabilitative Services",null,"SEC530 AC-3-CE - Access Enforcement"]
["Department for the Deaf and Hard of Hearing",null,"SEC530 AC-4 - Information Flow Enforcement"]
["Department of Accounts",null,"SEC530 AC-5 - Separation of Duties"]
["Department of Aviation",null,"SEC530 AC-6 - Least Privilege"]
["Department of Behavioral Health and Development Services",null,"SEC530 AC-6-CE - Least Privilege"]
["Department of Conservation and Recreation",null,"SEC530 AC-7 - Unsuccessful Login Attempts"]
["Department of Corrections",null,"SEC530 AC-7-CE - Unsuccessful Login Attempts"]
["Department of Criminal Justice Services",null,"SEC530 AC-8 - System Use Notification"]
["Department of Education",null,"SEC530 AC-8-COV - System Use Notification"]
["Department of Elections",null,"SEC530 AC-10 - Concurrent Session Control"]
["Department of Environmental Quality",null,"SEC530 AC-11 - Device Lock"]
["Department of Fire Programs",null,"SEC530 AC-11-CE - Device Lock"]
["Department of Forensic Science",null,"SEC530 AC-12 - Session termination"]
["Department of Forestry",null,"SEC530 AC-12-CE - Session termination"]
["Department of General Services",null,"SEC530 AC-14 - Permitted Actions Without Identification Or Authentication"]
["Department of Health Professions",null,"SEC530 AC-17 - Remote Access"]
["Department of Historic Resources",null,"SEC530 AC-17-CE - Remote Access"]
["Department of Housing and Community Development",null,"SEC530 AC-17-COV - Remote Access"]
["Department of Human Resource Management",null,"SEC530 AC-18 - Wireless Access"]
["Department of Juvenile Justice",null,"SEC530 AC-18-CE - Wireless Access"]
["Department of Labor and Industry",null,"SEC530 AC-18-COV - Wireless Access"]
["Department of Medical Assistance Services",null,"SEC530 AC-19 - Access Control for Mobile Devices"]
["Department of Military Affairs",null,"SEC530 AC-19-CE - Access Control for Mobile Devices"]
["Department of Mines, Minerals and Energy",null,"SEC530 AC-20 - Use of External Information Systems"]
["Department of Motor Vehicles",null,"SEC530 AC-20-CE - Use of External Information Systems"]
["Department of Planning and Budget",null,"SEC530 AC-20-COV - Use of External Information Systems"]
["Department of Professional and Occupational Regulation",null,"SEC530 AC-21 - Information Sharing"]
["Department of Rail and Public Transportation",null,"SEC530 AC-21-CE - Information Sharing"]
["Department of Small Business and Supplier Diversity",null,"SEC530 AC-22 - Publicly Accessible Content"]
["Department of Social Services",null,"SEC530 AT-1 - Security Awareness and Training Policy and Procedures"]
["Department of Taxation",null,"SEC530 AT-2 - Literacy Training and Awareness"]
["Department of Treasury",null,"SEC530 AT-2-CE - Literacy Training and Awareness"]
["Department of Veterans Services",null,"SEC530 AT-2-COV - Literacy Training and Awareness"]
["Department of Wildlife Resources",null,"SEC530 AT-3 - Roled-Based Training"]
["Frontier Culture Museum of Virginia",null,"SEC530 AT-3-CE - Roled-Based Training"]
["Gunston Hall",null,"SEC530 AT-4 - Training Records"]
["Indigent Defense Commission",null,"SEC530 AT-6 - Training Feedback"]
["Iron Bow",null,"SEC530 AU-1 - Audit and Accountability Policy and Procedures"]
["Jamestown-Yorktown Foundation",null,"SEC530 AU-2 - Events Logging"]
["Library of Virginia",null,"SEC530 AU-3 - Content of Audit Records"]
["Marine Resources Commission",null,"SEC530 AU-3-CE - Content of Audit Records"]
["Motor Vehicle Dealer Board",null,"SEC530 AU-4 - Audit Storage Capacity"]
["Norfolk State University",null,"SEC530 AU-4-CE - Audit Storage Capacity"]
["Office of Attorney General",null,"SEC530 AU-5 - Response To Audit Processing Failures"]
["Office of Children's Services",null,"SEC530 AU-5-CE - Response To Audit Processing Failures"]
["Office of State Inspector General",null,"SEC530 AU-6 - Audit Review, Analysis, and Reporting"]
["Office of the Governor",null,"SEC530 AU-6-CE - Audit Review, Analysis, and Reporting"]
["Perspecta",null,"SEC530 AU-8 - Time Stamps"]
["Richard Bland College ",null,"SEC530 AU-9 - Protection of Audit Information"]
["SAIC",null,"SEC530 AU-9-CE - Protection of Audit Information"]
["Science Museum of Virginia",null,"SEC530 AU-11 - Audit Record Retention"]
["Southern Virginia Higher Education Center",null,"SEC530 AU-12 - Audit Record Generation"]
["Southwest Virginia Higher Education Center",null,"SEC530 AU-12-CE - Audit Record Generation"]
["State Corporation Commission",null,"SEC530 AU-13 - Monitoring for Information Disclosure"]
["State Council of Higher Education for Virginia",null,"SEC530 CA-1 - Security Assessment and Authorization Policies and Procedures"]
["State Lottery Department",null,"SEC530 CA-2 - Security Assessments"]
["Tempus Nova",null,"SEC530 CA-2-CE - Security Assessments"]
["Tobacco Region Revitalization Commission",null,"SEC530 CA-3 - Information Exchange"]
["Unisys",null,"SEC530 CA-3-COV - Information Exchange"]
["Verizon",null,"SEC530 CA-5 - Plan of Action and Milestones"]
["Virginia College Savings Plan",null,"SEC530 CA-6 - Authorization"]
["Virginia Commission for the Arts",null,"SEC530 CA-7 - Continuous Monitoring"]
["Virginia Department of Agriculture and Consumer Services",null,"SEC530 CA-7-CE - Continuous Monitoring"]
["Virginia Department of Emergency Management",null,"SEC530 CA-8 - Penetration Testing"]
["Virginia Department of Health",null,"SEC530 CA-9 - Internal system Connections"]
["Virginia Department of Transportation",null,"SEC530 CA-9-CE - Internal system Connections"]
["Virginia Economic Development Partnership",null,"SEC530 CM-1 - Configuration Management Policy and Procedures"]
["Virginia Employment Commission",null,"SEC530 CM-2 - Baseline Configuration"]
["Virginia Foundation for Healthy Youth",null,"SEC530 CM-2-CE - Baseline Configuration"]
["Virginia Information Technologies Agency",null,"SEC530 CM-2-COV - Baseline Configuration"]
["Virginia Museum of Fine Arts",null,"SEC530 CM-3 - Configuration Change Control"]
["Virginia Museum of Natural History",null,"SEC530 CM-3-CE - Configuration Change Control"]
["Virginia Racing Commission",null,"SEC530 CM-3-COV - Configuration Change Control"]
["Virginia Resources Authority",null,"SEC530 CM-4 - Impact Analysis"]
["Virginia Retirement System",null,"SEC530 CM-4-CE - Impact Analysis"]
["Virginia School for the Deaf and Blind",null,"SEC530 CM-5 - Access Restrictions for Change"]
["Virginia State Police",null,"SEC530 CM-5-CE - Access Restrictions for Change"]
["Virginia State University",null,"SEC530 CM-6 - Configuration Settings"]
["Virginia Workers Compensation Commission",null,"SEC530 CM-7 - Least Functionality"]
["Xerox",null,"SEC530 CM-7-CE - Least Functionality"]
[null,null,"SEC530 CM-8 - System Component Inventory"]
[null,null,"SEC530 CM-8-CE - System Component Inventory"]
[null,null,"SEC530 CM-9 - Configuration Management Plan"]
[null,null,"SEC530 CM-9-CE - Configuration Management Plan"]
[null,null,"SEC530 CM-10 - Software Usage Restrictions"]
[null,null,"SEC530 CM-10-CE - Software Usage Restrictions"]
[null,null,"SEC530 CM-11 - User installed software"]
[null,null,"SEC530 CM-11-CE - User installed software"]
[null,null,"SEC530 CP-1 - Contingency Planning Policy and Procedures"]
[null,null,"SEC530 CP-1-COV-1 - Contingency Planning Policy and Procedures"]
[null,null,"SEC530 CP-1-COV-2 - Contingency Planning Policy and Procedures"]
[null,null,"SEC530 CP-2 - Contingency Plan"]
[null,null,"SEC530 CP-2-CE - Contingency Plan"]
[null,null,"SEC530 CP-3 - Contingency Training"]
[null,null,"SEC530 CP-3-CE - Contingency Training"]
[null,null,"SEC530 CP-4 - Contingency Plan Testing"]
[null,null,"SEC530 CP-4-CE - Contingency Plan Testing"]
[null,null,"SEC530 CP-6 - Alternate Storage Site"]
[null,null,"SEC530 CP-6-CE - Alternate Storage Site"]
[null,null,"SEC530 CP-7 - Alternate Processing Site"]
[null,null,"SEC530 CP-7-CE - Alternate Processing Site"]
[null,null,"SEC530 CP-8 - Telecommunications Services"]
[null,null,"SEC530 CP-8-CE - Telecommunications Services"]
[null,null,"SEC530 CP-9 - Information System Backup"]
[null,null,"SEC530 CP-9-CE - Information System Backup"]
[null,null,"SEC530 CP-9-COV - Information System Backup"]
[null,null,"SEC530 IA-1 - Identification and Authentication Policy and Procedures"]
[null,null,"SEC530 IA-2 - Identification and Authentication (Organizational Users)"]
[null,null,"SEC530 IA-2-CE - Identification and Authentication (Organizational Users)"]
[null,null,"SEC530 IA-4 - Identifier Management"]
[null,null,"SEC530 IA-4-CE - Identifier Management"]
[null,null,"SEC530 IA-5 - Authenticator Management"]
[null,null,"SEC530 IA-5-CE - Authenticator Management"]
[null,null,"SEC530 IA-5-COV-01 - Authenticator Management"]
[null,null,"SEC530 IA-5-COV-02 - Authenticator Management"]
[null,null,"SEC530 IA-6 - Authenticator Feedback"]
[null,null,"SEC530 IA-7 - Cryptographic Module Authentication"]
[null,null,"SEC530 IA-8 - Identification and Authentication (Non-organizational Users)"]
[null,null,"SEC530 IA-8-CE - Identification and Authentication (Non-organizational Users)"]
[null,null,"SEC530 IA-8-COV - Identification and Authentication (Non-organizational Users)"]
[null,null,"SEC530 IA-9 - Service Identification and Authentication"]
[null,null,"SEC530 IA-11 - Re-Authentication"]
[null,null,"SEC530 IA-12 - Identity Proofing"]
[null,null,"SEC530 IA-12-CE - Identity Proofing"]
[null,null,"SEC530 IR-1 - Incident Response Policy and Procedures"]
[null,null,"SEC530 IR-1-COV - Incident Response Policy and Procedures"]
[null,null,"SEC530 IR-2 - Incident Response Training"]
[null,null,"SEC530 IR-2-CE - Incident Response Training"]
[null,null,"SEC530 IR-3 - Incident Response Testing and Exercises"]
[null,null,"SEC530 IR-3-CE - Incident Response Testing and Exercises"]
[null,null,"SEC530 IR-4 - Incident Handling"]
[null,null,"SEC530 IR-4-CE - Incident Handling"]
[null,null,"SEC530 IR-4-COV-1 - Incident Handling"]
[null,null,"SEC530 IR-4-COV-2 - Incident Handling"]
[null,null,"SEC530 IR-5 - Incident Monitoring"]
[null,null,"SEC530 IR-5-CE - Incident Monitoring"]
[null,null,"SEC530 IR-6 - Incident Reporting"]
[null,null,"SEC530 IR-6-CE - Incident Reporting"]
[null,null,"SEC530 IR-6-COV - Incident Reporting"]
[null,null,"SEC530 IR-7 - Incident Response Assistance"]
[null,null,"SEC530 IR-7-CE - Incident Response Assistance"]
[null,null,"SEC530 IR-8 - Incident Response Plan"]
[null,null,"SEC530 IR-8-CE - Incident Response Plan"]
[null,null,"SEC530 MA-1 - System Maintenance Policy and Procedures"]
[null,null,"SEC530 MA-2 - Controlled Maintenance"]
[null,null,"SEC530 MA-3 - Maintenance Tools"]
[null,null,"SEC530 MA-3-CE - Maintenance Tools"]
[null,null,"SEC530 MA-4 - Nonlocal Maintenance"]
[null,null,"SEC530 MA-4-CE - Nonlocal Maintenance"]
[null,null,"SEC530 MA-5 - Maintenance Personnel"]
[null,null,"SEC530 MA-5-COV - Maintenance Personnel"]
[null,null,"SEC530 MA-6 - Timely Maintenance"]
[null,null,"SEC530 MA-6-CE - Timely Maintenance"]
[null,null,"SEC530 MP-1 - Media Protection Policy and Procedures"]
[null,null,"SEC530 MP-1-COV - Media Protection Policy and Procedures"]
[null,null,"SEC530 MP-2 - Media Access"]
[null,null,"SEC530 MP-3 - Media Marking"]
[null,null,"SEC530 MP-4 - Media Storage"]
[null,null,"SEC530 MP-5 - Media Transport"]
[null,null,"SEC530 MP-5-CE - Media Transport"]
[null,null,"SEC530 MP-6 - Media Sanitization"]
[null,null,"SEC530 MP-6-CE - Media Sanitization"]
[null,null,"SEC530 MP-6-COV - Media Sanitization"]
[null,null,"SEC530 MP-7 - Media Use"]
[null,null,"SEC530 MP-7-CE - Media Use"]
[null,null,"SEC530 PE-01 - Physical and Environmental Protection Policy and Procedures"]
[null,null,"SEC530 PE-1-COV - Physical and Environmental Protection Policy and Procedures"]
[null,null,"SEC530 PE-2 - Physical Access Authorizations"]
[null,null,"SEC530 PE-2-CE - Physical Access Authorizations"]
[null,null,"SEC530 PE-2-COV - Physical Access Authorizations"]
[null,null,"SEC530 PE-3 - Physical Access Control"]
[null,null,"SEC530 PE-3-CE - Physical Access Control"]
[null,null,"SEC530 PE-3-COV - Physical Access Control"]
[null,null,"SEC530 PE-4 - Access Control for Transmission Medium"]
[null,null,"SEC530 PE-5 - Access Control for Output Devices"]
[null,null,"SEC530 PE-6 - Monitoring Physical Access"]
[null,null,"SEC530 PE-6-CE - Monitoring Physical Access"]
[null,null,"SEC530 PE-8 - Visitor Access Records"]
[null,null,"SEC530 PE-9 - Power Equipment and Power Cabling"]
[null,null,"SEC530 PE-9-CE - Power Equipment and Power Cabling"]
[null,null,"SEC530 PE-10 - Emergency Shutoff"]
[null,null,"SEC530 PE-11 - Emergency Power"]
[null,null,"SEC530 PE-11-CE - Emergency Power"]
[null,null,"SEC530 PE-13 - Fire Protection"]
[null,null,"SEC530 PE-13-CE - Fire Protection"]
[null,null,"SEC530 PE-14 - Environmental Controls"]
[null,null,"SEC530 PE-14-CE - Environmental Controls"]
[null,null,"SEC530 PE-15 - Water Damage Protection"]
[null,null,"SEC530 PE-15-CE - Water Damage Protection"]
[null,null,"SEC530 PE-16 - Delivery and Removal"]
[null,null,"SEC530 PE-17 - Alternate Work Site"]
[null,null,"SEC530 PE-18 - Location of System Components"]
[null,null,"SEC530 PE-18-COV - Location of Information System Components"]
[null,null,"SEC530 PE-23 - Facility Location"]
[null,null,"SEC530 PL-1 - Planning Policy and Procedures"]
[null,null,"SEC530 PL-2 - System Security and Privacy Plan"]
[null,null,"SEC530 PL-2-COV - System Security and Privacy Plan"]
[null,null,"SEC530 PL-4 - Rules of Behavior"]
[null,null,"SEC530 PL-4-CE - Rules of Behavior"]
[null,null,"SEC530 PL-4-COV - Rules of Behavior"]
[null,null,"SEC530 PL-8 - Security and Privacy Architecture"]
[null,null,"SEC530 PL-8-CE - Security and Privacy Architecture"]
[null,null,"SEC530 PL-9 - Central Management"]
[null,null,"SEC530 PL-10 - Baseline Selection"]
[null,null,"SEC530 PL-11 - Baseline Tailoring"]
[null,null,"SEC530 PM-1 - Information Security Program Plan"]
[null,null,"SEC530 PM-2 - Information Security Program Leadership Role"]
[null,null,"SEC530 PM-3 - Information Security and Privacy Resources"]
[null,null,"SEC530 PM-4 - Plan Action and Milestones Process"]
[null,null,"SEC530 PM-5 - System Inventory"]
[null,null,"SEC530 PM-5-CE - System Inventory"]
[null,null,"SEC530 PM-6 - Measures of Performance"]
[null,null,"SEC530 PM-7 - Enterprise Architecture"]
[null,null,"SEC530 PM-8 - Critical Infrastructure Plan"]
[null,null,"SEC530 PM-9 - Risk Management Strategy"]
[null,null,"SEC530 PM-10 - Authorization Process"]
[null,null,"SEC530 PM-11 - Mission and Business Process Definition"]
[null,null,"SEC530 PM-14 - Testing Training and Monitoring"]
[null,null,"SEC530 PM-25 - Minimization of Personally Identifiacble Information Used in Testing Training and Research"]
[null,null,"SEC530 PM-28 - Risk Framing"]
[null,null,"SEC530 PM-31 - Continous Monitoring Strategy"]
[null,null,"SEC530 PM-32 - Purposing"]
[null,null,"SEC530 PS-1 - Personnel Security Policy and Procedures"]
[null,null,"SEC530 PS-3 - Personnel Screening"]
[null,null,"SEC530 PS-4 - Personnel Termination"]
[null,null,"SEC530 PS-5 - Personnel Transfer"]
[null,null,"SEC530 PS-6 - Access Agreements"]
[null,null,"SEC530 PS-7 - External Personnel Security"]
[null,null,"SEC530 PS-8 - Personnel Sanctions"]
[null,null,"SEC530 PS-9 - Position Descriptions"]
[null,null,"SEC530 RA-1 - Risk Assessment Policy and Procedures"]
[null,null,"SEC530 RA-2 - Security Categorization"]
[null,null,"SEC530 RA-2-CE - Security Categorization"]
[null,null,"SEC530 RA-3 - Risk Assessment"]
[null,null,"SEC530 RA-3-CE - Risk Assessment"]
[null,null,"SEC530 RA-5 - Vulnerability Monitoring and Scanning"]
[null,null,"SEC530 RA-5-CE - Vulnerability Monitoring and Scanning"]
[null,null,"SEC530 RA-9 - Criticality Analysis"]
[null,null,"SEC530 RA-10 - Threat Hunting"]
[null,null,"SEC530 SA-01 - Systems & Services Acquisitions Policies"]
[null,null,"SEC530 SA-2 - Allocation of Resources"]
[null,null,"SEC530 SA-3 - System Development Life Cycle"]
[null,null,"SEC530 SA-3-CE - System Development Life Cycle"]
[null,null,"SEC530 SA-3-COV-1 - Life Cycle Support"]
[null,null,"SEC530 SA-3-COV-2 - Life Cycle Support"]
[null,null,"SEC530 SA-4 - Acquisitions"]
[null,null,"SEC530 SA-4-CE - Acquisitions"]
[null,null,"SEC530 SA-4-COV-1 - Acquisitions"]
[null,null,"SEC530 SA-5 - System Documentation"]
[null,null,"SEC530 SA-6-COV - Software Usage Restrictions"]
[null,null,"SEC530 SA-8 - Security and Privacy Engineering Principles"]
[null,null,"SEC530 SA-8-CE - Security and Privacy Engineering Principles"]
[null,null,"SEC530 SA-9 - External System Services"]
[null,null,"SEC530 SA-9-CE - External System Services"]
[null,null,"SEC530 SA-9-COV-1 - External System Services"]
[null,null,"SEC530 SA-9-COV-2 - External System Services"]
[null,null,"SEC530 SA-9-COV-3 - External System Services"]
[null,null,"SEC530 SA-10 - Developer Configuration Management"]
[null,null,"SEC530 SA-10-CE - Developer Configuration Management"]
[null,null,"SEC530 SA-11 - Developer Testing and Evaluation"]
[null,null,"SEC530 SA-11-CE - Developer Testing and Evaluation"]
[null,null,"SEC530 SA-15 - Development Process Standards and Tools"]
[null,null,"SEC530 SA-15-CE - Development Process Standards and Tools"]
[null,null,"SEC530 SA-16 - Developer-Provided Training"]
[null,null,"SEC530 SA-17 - Developer Security and Privacy Architecture & Design"]
[null,null,"SEC530 SA-17-CE - Developer Security and Privacy Architecture & Design"]
[null,null,"SEC530 SA-22 - Unsupported System Components"]
[null,null,"SEC530 SC-1 - System and Communications Protection Policy and Procedures"]
[null,null,"SEC530 SC-2 - Separation of System and User Functionality"]
[null,null,"SEC530 SC-2-CE - Separation of System and User Functionality"]
[null,null,"SEC530 SC-3 - Security Function Isolation"]
[null,null,"SEC530 SC-4 - Information In Shared System Resources"]
[null,null,"SEC530 SC-5 - Denial-of-Service Protection"]
[null,null,"SEC530 SC-5-CE - Denial-of-Service Protection"]
[null,null,"SEC530 SC-6 - Resource Availability"]
[null,null,"SEC530 SC-7 - Boundary Protection"]
[null,null,"SEC530 SC-7-CE - Boundary Protection"]
[null,null,"SEC530 SC-8 - Transmission Confidentiality and Integrity"]
[null,null,"SEC530 SC-8-CE - Transmission Confidentiality and Integrity"]
[null,null,"SEC530 SC-8-COV - Transmission Integrity"]
[null,null,"SEC530 SC-10 - Network Disconnect"]
[null,null,"SEC530 SC-12 - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-12-CE - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-12-COV - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-13 - Use of Cryptography"]
[null,null,"SEC530 SC-13-COV - Use of Cryptography"]
[null,null,"SEC530 SC-15 - Collaborative Computing Devices and Applications"]
[null,null,"SEC530 SC-15-CE - Collaborative Computing Devices and Applications"]
[null,null,"SEC530 SC-17 - Public Key Infrastructure Certificates"]
[null,null,"SEC530 SC-18 - Mobile Code"]
[null,null,"SEC530 SC-20 - Secure Name / Address Resolution Service (Authoritative Source)"]
[null,null,"SEC530 SC-20-CE - Secure Name / Address Resolution Service (Authoritative Source)"]
[null,null,"SEC530 SC-21 - Secure Name / Address Resolution Service (recursive or Caching Resolver)"]
[null,null,"SEC530 SC-22 - Architecture and Provisioning for Name/ Address Resolution Service"]
[null,null,"SEC530 SC-23 - Session Authenticity"]
[null,null,"SEC530 SC-23-CE - Session Authenticity"]
[null,null,"SEC530 SC-28 - Protection of Information At Rest"]
[null,null,"SEC530 SC-28-CE - Protection of Information At Rest"]
[null,null,"SEC530 SC-37 - Out of Band Channels"]
[null,null,"SEC530 SC-37-CE - Out of Band Channels"]
[null,null,"SEC530 SC-39 - Process Isolation"]
[null,null,"SEC530 SC-42 - Sensor Capability and Data"]
[null,null,"SEC530 SC-42-CE - Sensor Capability and Data"]
[null,null,"SEC530 SC-42-COV - Sensor Capability and Data"]
[null,null,"SEC530 SC-43 - Usage Restrictions"]
[null,null,"SEC530 SC-44 - Detonation Chambers"]
[null,null,"SEC530 SC-45 - System Time Synchronization"]
[null,null,"SEC530 SC-45-CE - System Time Synchronization"]
[null,null,"SEC530 SC-46 - Cross Domain Policy Enforcement"]
[null,null,"SEC530 SC-47 - Alternate Communications Paths"]
[null,null,"SEC530 SC-50 - Software-Enforced Separation and Policy Enforcement"]
[null,null,"SEC530 SI-1 - System and Information Integrity Policy and Procedures"]
[null,null,"SEC530 SI-2 - Flaw Remediation"]
[null,null,"SEC530 SI-2-CE - Flaw Remediation"]
[null,null,"SEC530 SI-2-COV - Flaw Remediation"]
[null,null,"SEC530 SI-3 - Malicious Code Protection"]
[null,null,"SEC530 SI-3-CE - Malicious Code Protection"]
[null,null,"SEC530 SI-3-COV - Malicious Code Protection"]
[null,null,"SEC530 SI-4 - Information System Monitoring"]
[null,null,"SEC530 SI-4-CE - Information System Monitoring"]
[null,null,"SEC530 SI-5 - Security Alerts Advisories and Directives"]
[null,null,"SEC530 SI-6 - Security and Privacy Function Verification"]
[null,null,"SEC530 SI-6-CE - Security and Privacy Function Verification"]
[null,null,"SEC530 SI-7 - Software Firmware and Information Integrity"]
[null,null,"SEC530 SI-7-CE - Software Firmware and Information Integrity"]
[null,null,"SEC530 SI-8 - Spam Protection"]
[null,null,"SEC530 SI-8-CE - Spam Protection"]
[null,null,"SEC530 SI-10 - Information Input Validation"]
[null,null,"SEC530 SI-10-CE - Information Input Validation"]
[null,null,"SEC530 SI-11 - Error handling"]
[null,null,"SEC530 SI-12 - Information Management and Retention"]
[null,null,"SEC530 SI-12-CE - Information Management and Retention"]
[null,null,"SEC530 SI-16 - Memory Protection"]
[null,null,"SEC530 SI-20 - Tainting"]
[null,null,"GOV-1.03 Roles and Responsibilities"]
[null,null,"GOV-1.04 Information Security Program"]
[null,null,"GOV-1.05 Exceptions to Security Requirements"]
[null,null,"GOV-1.06 Exemptions from Applicability"]
[null,null,"GOV-1.07 Determination of Liability"]
[null,null,"GOV-1.08 Revocation of Hosted Computing Permissions"]
[null,null,"GOV-2.02 CIO; Role"]
[null,null,"GOV-2.03 CISO; Role"]
[null,null,"GOV-2.04 Agency Head; Role"]
[null,null,"GOV-2.05 ISO; Role"]
[null,null,"GOV-2.06 Privacy Officer ; Role"]
[null,null,"GOV-2.07 System Owner; Role"]
[null,null,"GOV-2.08 Data Owner; Role"]
[null,null,"GOV-2.09 System Administrator; Role"]
[null,null,"GOV-2.10 Data Custodian; Role"]
[null,null,"GOV-2.11 IT System Users"]
[null,null,"GOV-3.x BIA Requirements"]
[null,null,"GOV-4.x IT System and Data Sensitivity Classification"]
[null,null,"GOV-5.x Sensitive IT System Inventory and Definition"]
[null,null,"GOV-6.x Risk Assessments"]
[null,null,"GOV-7.x IT Security Audits"]