Skip to main content

Information Security Controls Matrix

Control ID and TitleImplementation LevelCommon Control Provider
AC — Access Control
AC-01Policy and ProceduresOrganization
AC-02Account ManagementOrganization
AC-02(03)Disable AccountsInformation System
AC-02(07)Privileged User AccountsOrganization
AC-03Access EnforcementInformation System
AC-03(07)Role-based Access ControlOrganization
AC-05Separation of DutiesOrganization
AC-06Least PrivilegeOrganization
AC-07Unsuccessful Logon AttemptsInformation System
AC-08System Use NotificationOrganization
AC-11Device LockInformation System
AC-14Permitted Actions Without Identification or AuthenticationOrganization
AC-17Remote AccessOrganization
AC-18Wireless AccessOrganization
AC-19Access Control for Mobile DevicesOrganization
AC-20Use of External SystemsOrganization
AC-22Publicly Accessible ContentOrganization
AT — Awareness and Training
AT-01Policy and ProceduresOrganization
AT-02Literacy Training and AwarenessCommon (Organization)TAMUS Cybersecurity
AT-02(02)Insider ThreatCommon (Organization)TAMUS Cybersecurity
AT-02(03)Social Engineering and MiningCommon (Organization)TAMUS Cybersecurity
AT-03Role-based TrainingOrganization
AT-04Training RecordsHybrid (Organization)TrainTraq (for literacy training records)
AU — Audit and Accountability
AU-01Policy and ProceduresOrganization
AU-02Event LoggingOrganization
AU-03Content of Audit RecordsInformation System
AU-04Audit Log Storage CapacityOrganization
AU-05Response to Audit Logging Process FailuresInformation System
AU-06Audit Record Review, Analysis, and ReportingOrganization
AU-08Time StampsInformation System
AU-09Protection of Audit InformationInformation System
AU-11Audit Record RetentionOrganization
AU-12Audit Record GenerationInformation System
CA — Assessment, Authorization, and Monitoring
CA-01Policy and ProceduresOrganization
CA-02Control AssessmentsOrganization
CA-02(01)Independent AssessorsOrganization
CA-03Information ExchangeOrganization
CA-05Plan of Action and MilestonesOrganization
CA-06AuthorizationOrganization
CA-07Continuous MonitoringOrganization
CA-07(04)Risk MonitoringOrganization
CA-08Penetration TestingOrganization
CA-09Internal System ConnectionsOrganization
CM — Configuration Management
CM-01Policy and ProceduresOrganization
CM-02Baseline ConfigurationOrganization
CM-03Configuration Change ControlOrganization
CM-03(02)Testing, Validation, and Documentation of ChangesOrganization
CM-04Impact AnalysesOrganization
CM-05Access Restrictions for ChangeOrganization
CM-06Configuration SettingsOrganization
CM-07Least FunctionalityOrganization
CM-08System Component InventoryOrganization
CM-10Software Usage RestrictionsOrganization
CM-11User-installed SoftwareOrganization
CP — Contingency Planning
CP-01Policy and ProceduresOrganization
CP-02Contingency PlanOrganization
CP-02(01)Coordinate with Related PlansOrganization
CP-03Contingency TrainingOrganization
CP-04Contingency Plan TestingOrganization
CP-04(01)Coordinate with Related PlansOrganization
CP-06Alternate Storage SiteOrganization
CP-07Alternate Processing SiteOrganization
CP-08Telecommunications ServicesOrganization
CP-09System BackupOrganization
CP-09(02)Test Restoration Using SamplingOrganization
CP-09(03)Separate Storage for Critical InformationOrganization
CP-10System Recovery and ReconstitutionOrganization
CP-11Alternate Communications ProtocolsOrganization
IA — Identification and Authentication
IA-01Policy and ProceduresOrganization
IA-02Identification and Authentication (Organizational Users)Organization
IA-02(01)Multi-factor Authentication to Privileged AccountsInformation System
IA-02(02)Multi-factor Authentication to Non-privileged AccountsInformation System
IA-04Identifier ManagementOrganization
IA-05Authenticator ManagementOrganization
IA-05(01)Password-based AuthenticationOrganization
IA-05(09)Federated Credential ManagementOrganization
IA-06Authentication FeedbackInformation System
IA-07Cryptographic Module AuthenticationInformation System
IA-08Identification and Authentication (Non-organizational Users)Information System
IA-11Re-authenticationOrganization
IA-12Identity ProofingOrganization
IA-12(02)Identity EvidenceOrganization
IA-12(03)Identity Evidence Validation and VerificationOrganization
IR — Incident Response
IR-01Policy and ProceduresOrganization
IR-02Incident Response TrainingOrganization
IR-03Incident Response TestingOrganization
IR-04Incident HandlingCommon (Organization)TAMUS Cybersecurity
IR-04(08)Correlation with External OrganizationsOrganization
IR-04(14)Security Operations CenterCommon (Organization)TAMUS Cybersecurity
IR-05Incident MonitoringHybrid (Organization)TAMUS Cybersecurity (for incidents managed by TAMUS Cyber Operations)
IR-06Incident ReportingOrganization
IR-06(01)Automated ReportingOrganization
IR-07Incident Response AssistanceOrganization
IR-08Incident Response PlanOrganization
IR-09Information Spillage ResponseOrganization
MA — Maintenance
MA-01Policy and ProceduresOrganization
MA-02Controlled MaintenanceOrganization
MA-04Nonlocal MaintenanceOrganization
MA-05Maintenance PersonnelOrganization
MP — Media Protection
MP-01Policy and ProceduresOrganization
MP-02Media AccessOrganization
MP-03Media MarkingOrganization
MP-06Media SanitizationOrganization
MP-06(01)Review, Approve, Track, Document, and VerifyOrganization
MP-07Media UseOrganization
PE — Physical and Environmental Protection
PE-01Policy and ProceduresOrganization
PE-02Physical Access AuthorizationsOrganization
PE-03Physical Access ControlOrganization
PE-06Monitoring Physical AccessOrganization
PE-06(03)Video SurveillanceOrganization
PE-08Visitor Access RecordsOrganization
PE-12Emergency LightingOrganization
PE-13Fire ProtectionOrganization
PE-14Environmental ControlsOrganization
PE-15Water Damage ProtectionOrganization
PE-16Delivery and RemovalOrganization
PE-17Alternate Work SiteOrganization
PE-18Location of System ComponentsOrganization
PL — Planning
PL-01Policy and ProceduresOrganization
PL-02System Security and Privacy PlansOrganization
PL-04Rules of BehaviorOrganization
PL-04(01)Social Media and External Site/Application Usage RestrictionsOrganization
PL-10Baseline SelectionOrganization
PL-11Baseline TailoringOrganization
PM — Program Management
PM-01Information Security Program PlanOrganization
PM-02Information Security Program Leadership RoleOrganization
PM-03Information Security and Privacy ResourcesOrganization
PM-04Plan of Action and Milestones ProcessOrganization
PM-05System InventoryOrganization
PM-05(01)Inventory of Personally Identifiable InformationOrganization
PM-06Measures of PerformanceOrganization
PM-07Enterprise ArchitectureOrganization
PM-09Risk Management StrategyOrganization
PM-10Authorization ProcessOrganization
PM-11Mission and Business Process DefinitionOrganization
PM-14Testing, Training, and MonitoringOrganization
PM-15Security and Privacy Groups and AssociationsOrganization
PM-16Threat Awareness ProgramOrganization
PM-22Personally Identifiable Information Quality ManagementOrganization
PS — Personnel Security
PS-01Policy and ProceduresOrganization
PS-02Position Risk DesignationCommon (Organization)TAMUS and Member Human Resources
PS-03Personnel ScreeningCommon (Organization)TAMUS and Member Human Resources
PS-04Personnel TerminationOrganization
PS-05Personnel TransferOrganization
PS-06Access AgreementsOrganization
PS-07External Personnel SecurityOrganization
PS-08Personnel SanctionsOrganization
PS-09Position DescriptionsCommon (Organization)TAMUS and Member Human Resources
RA — Risk Assessment
RA-01Policy and ProceduresOrganization
RA-02Security CategorizationOrganization
RA-03Risk AssessmentOrganization
RA-03(01)Supply Chain Risk AssessmentOrganization
RA-05Vulnerability Monitoring and ScanningOrganization
RA-05(02)Update Vulnerabilities to Be ScannedOrganization
RA-05(11)Public Disclosure ProgramOrganization
RA-07Risk ResponseOrganization
SA — System and Services Acquisition
SA-01Policy and ProceduresOrganization
SA-02Allocation of ResourcesOrganization
SA-03System Development Life CycleOrganization
SA-04Acquisition ProcessOrganization
SA-05System DocumentationOrganization
SA-08Security and Privacy Engineering PrinciplesOrganization
SA-09External System ServicesOrganization
SA-10Developer Configuration ManagementOrganization
SA-11Developer Testing and EvaluationOrganization
SA-22Unsupported System ComponentsOrganization
SC — System and Communications Protection
SC-01Policy and ProceduresOrganization
SC-05Denial-of-service ProtectionInformation System
SC-07Boundary ProtectionInformation System
SC-07(11)Restrict Incoming Communications TrafficInformation System
SC-08Transmission Confidentiality and IntegrityInformation System
SC-12Cryptographic Key Establishment and ManagementOrganization
SC-13Cryptographic ProtectionInformation System
SC-15Collaborative Computing Devices and ApplicationsInformation System
SC-20Secure Name/Address Resolution Service (Authoritative Source)Information System
SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)Information System
SC-22Architecture and Provisioning for Name/Address Resolution ServiceInformation System
SC-39Process IsolationInformation System
SI — System and Information Integrity
SI-01Policy and ProceduresOrganization
SI-02Flaw RemediationOrganization
SI-03Malicious Code ProtectionOrganization
SI-04System MonitoringCommon (Organization)TAMUS Cybersecurity (for managed endpoints)
SI-05Security Alerts, Advisories, and DirectivesOrganization
SI-08Spam ProtectionOrganization
SI-10Information Input ValidationInformation System
SI-12Information Management and RetentionOrganization
SI-12(01)Limit Personally Identifiable Information ElementsOrganization
SR — Supply Chain Risk Management
SR-01Policy and ProceduresOrganization
SR-02Supply Chain Risk Management PlanOrganization
SR-03Supply Chain Controls and ProcessesOrganization
SR-05Acquisition Strategies, Tools, and MethodsOrganization
SR-08Notification AgreementsOrganization
SR-12Component DisposalOrganization