Table 17 provides list of NIST IR 7628 requirements for which the controls in this profile provide only partial or no coverage, along with the level of coverage and reasons for the gaps. Table - NIST IR 7628 Requirement Gaps NIST IR 7628 NISTIR Requirement Category ID NIST IR 7628 Requirement Name Notes Remote Access Policy and Procedures SG.AC SG.AC-2 Policy Permitted Actions without SG.AC SG.AC-14 Identification or Authentication Not needed in SA Use of External Information Control SG.AC SG.AC-18 Systems Organizational Publicly Accessible Content SG.AC SG.AC-20 Awareness and Training SG.AT All Organizational Audit and Accountability Policy and SG.AU SG.AU-1 Procedures Policy Auditable Events SG.AU-2 Organizational Audit Storage Capacity SG.AU-4 Organizational Response to Audit Processing Failures Audit processing not SG.AU-5 Monitoring, Analysis, and SG.AU-6 Reporting Organizational Audit Reduction and Report Business need, no specific SG.AU-7 Generation SA implications Audit Record Retention SG.AU-10 Organizational Conduct and Frequency of Audits SG.AU-11 Organizational Auditor Qualification SG.AU-12 Organizational Audit Tools SG.AU-13 Organizational Security Policy Compliance SG.AU-14 Organizational Security Assessment and SG.CA SG.CA-1 Authorization Policy and Procedures Organizational Security Assessments SG.CA-2 Organizational Continuous Improvement SG.CA-3 Organizational Security Authorization to Operate SG.CA-5 Organizational Continuous Monitoring SG.CA-6 Organizational Configuration Management Policy and SG.CM SG.CM-1 Procedures Organizational Monitoring Configuration Changes Organizational (NOTE: CFSD SG.CM-4 facilitates coverage) Addition, Removal, and Disposal of SG.CM-9 Equipment Organizational
Table 17 provides list of NIST IR 7628 requirements for which the controls in this profile provide only partial or no coverage, along with the level of coverage and reasons for the gaps. Table - NIST IR 7628 Requirement Gaps NISTIR Category NIST IR 7628 Requirement ID NIST IR 7628 Requirement Name Notes SG.AC SG.AC-2 Remote Access Policy and Procedures Policy SG.AC SG.AC-14 Permitted Actions without Identification or Authentication Not needed in SA SG.AC SG.AC-18 Use of External Information Control Systems Organizational SG.AC SG.AC-20 Publicly Accessible Content SG.AT All Awareness and Training Organizational SG.AU SG.AU-1 Audit and Accountability Policy and Procedures Policy SG.AU-2 Auditable Events Organizational SG.AU-4 Audit Storage Capacity Organizational SG.AU-5 Response to Audit Processing Failures Audit processing not SG.AU-6 Monitoring, Analysis, and Reporting Organizational SG.AU-7 Audit Reduction and Report Generation Business need, no specific SA implications SG.AU-10 Audit Record Retention Organizational SG.AU-11 Conduct and Frequency of Audits Organizational SG.AU-12 Auditor Qualification Organizational SG.AU-13 Audit Tools Organizational SG.AU-14 Security Policy Compliance Organizational SG.CA SG.CA-1 Security Assessment and Authorization Policy and Procedures Organizational SG.CA-2 Security Assessments Organizational SG.CA-3 Continuous Improvement Organizational SG.CA-5 Security Authorization to Operate Organizational SG.CA-6 Continuous Monitoring Organizational SG.CM SG.CM-1 Configuration Management Policy and Procedures Organizational SG.CM-4 Monitoring Configuration Changes Organizational (NOTE: CFSD facilitates coverage) SG.CM-9 Addition, Removal, and Disposal of Equipment Organizational
SA%20Security%20Profile%20-%20v0_15%20-%2020120930.docx