bmad-plus 0.4.4 → 0.6.0

package/src/bmad-plus/packs/pack-shield/references/nist-800-53/control-families.md

@@ -0,0 +1,450 @@
+# NIST SP 800-53 Rev 5 — Control Families Reference
+
+## How to Use This Reference
+
+For each family: key controls with baseline assignment, critical enhancements, and implementation guidance. Baseline codes: **L** = Low, **M** = Moderate, **H** = High. Controls marked **(org)** are PM family — organization-wide, not baseline-specific.
+
+---
+
+## AC — Access Control (25 controls)
+
+**Purpose:** Limit system access to authorized users, processes, devices, and types of transactions.
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| AC-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| AC-2 | ✓ | ✓ | ✓ | Account Management — create, enable, modify, disable, remove accounts |
+| AC-2(1) | — | ✓ | ✓ | Automated System Account Management |
+| AC-2(3) | — | ✓ | ✓ | Disable Accounts (after inactivity — ODV: 90 days typical) |
+| AC-2(5) | — | ✓ | ✓ | Inactivity Logout |
+| AC-2(12) | — | — | ✓ | Account Monitoring for Atypical Usage |
+| AC-3 | ✓ | ✓ | ✓ | Access Enforcement — enforce approved authorizations |
+| AC-4 | — | ✓ | ✓ | Information Flow Enforcement |
+| AC-5 | — | ✓ | ✓ | Separation of Duties |
+| AC-6 | — | ✓ | ✓ | Least Privilege |
+| AC-6(1) | — | ✓ | ✓ | Authorize Access to Security Functions |
+| AC-6(2) | — | ✓ | ✓ | Non-Privileged Access for Non-Security Functions |
+| AC-6(5) | — | ✓ | ✓ | Privileged Accounts |
+| AC-6(9) | — | ✓ | ✓ | Log Use of Privileged Functions |
+| AC-6(10) | — | ✓ | ✓ | Prohibit Non-Privileged Users from Executing Privileged Functions |
+| AC-7 | ✓ | ✓ | ✓ | Unsuccessful Logon Attempts (lockout after ODV attempts) |
+| AC-8 | ✓ | ✓ | ✓ | System Use Notification (login banner) |
+| AC-11 | — | ✓ | ✓ | Device Lock |
+| AC-12 | — | ✓ | ✓ | Session Termination |
+| AC-14 | ✓ | ✓ | ✓ | Permitted Actions Without Identification or Authentication |
+| AC-17 | ✓ | ✓ | ✓ | Remote Access |
+| AC-17(1) | — | ✓ | ✓ | Monitoring and Control of Remote Access |
+| AC-18 | ✓ | ✓ | ✓ | Wireless Access |
+| AC-19 | ✓ | ✓ | ✓ | Access Control for Mobile Devices |
+| AC-20 | ✓ | ✓ | ✓ | Use of External Systems |
+| AC-22 | ✓ | ✓ | ✓ | Publicly Accessible Content |
+
+**Implementation notes:**
+- AC-2 requires documented procedures for account lifecycle; automated provisioning/deprovisioning satisfies AC-2(1)
+- AC-6 least privilege: document roles, restrict admin rights to dedicated admin accounts
+- AC-17 remote access: requires MFA (IA-2), encryption in transit (SC-8), and monitoring
+
+---
+
+## AT — Awareness and Training (6 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| AT-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| AT-2 | ✓ | ✓ | ✓ | Literacy Training and Awareness (annual; new hire; role change) |
+| AT-2(2) | — | ✓ | ✓ | Insider Threat Awareness |
+| AT-3 | ✓ | ✓ | ✓ | Role-Based Training (before access; when changes occur) |
+| AT-4 | ✓ | ✓ | ✓ | Training Records (retain for ODV period, typically 3 years) |
+| AT-6 | — | — | ✓ | Training Feedback |
+
+---
+
+## AU — Audit and Accountability (16 controls)
+
+**Purpose:** Create and protect system audit records; ensure accountability of user actions.
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| AU-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| AU-2 | ✓ | ✓ | ✓ | Event Logging — define auditable events |
+| AU-3 | ✓ | ✓ | ✓ | Content of Audit Records (what, when, where, source, outcome) |
+| AU-3(1) | — | ✓ | ✓ | Additional Audit Information |
+| AU-4 | ✓ | ✓ | ✓ | Audit Log Storage Capacity |
+| AU-5 | ✓ | ✓ | ✓ | Response to Audit Logging Process Failures |
+| AU-6 | ✓ | ✓ | ✓ | Audit Record Review, Analysis, and Reporting |
+| AU-6(1) | — | ✓ | ✓ | Automated Process Integration (SIEM) |
+| AU-7 | — | ✓ | ✓ | Audit Record Reduction and Report Generation |
+| AU-8 | ✓ | ✓ | ✓ | Time Stamps (synchronized; NTP) |
+| AU-9 | ✓ | ✓ | ✓ | Protection of Audit Information |
+| AU-9(4) | — | ✓ | ✓ | Access by Subset of Privileged Users |
+| AU-10 | — | — | ✓ | Non-Repudiation |
+| AU-11 | ✓ | ✓ | ✓ | Audit Record Retention (ODV: typically 3 years for federal) |
+| AU-12 | ✓ | ✓ | ✓ | Audit Record Generation |
+| AU-14 | — | — | ✓ | Session Audit |
+
+**Key events to audit (AU-2):** logon/logoff attempts, privilege escalation, account creation/modification/deletion, system configuration changes, access to sensitive data, use of admin functions.
+
+---
+
+## CA — Assessment, Authorization, and Monitoring (9 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| CA-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| CA-2 | ✓ | ✓ | ✓ | Control Assessments (annual or event-driven) |
+| CA-2(1) | — | ✓ | ✓ | Independent Assessors (3PAO for FedRAMP) |
+| CA-3 | ✓ | ✓ | ✓ | Information Exchange (ISA/MOU for interconnections) |
+| CA-5 | ✓ | ✓ | ✓ | Plan of Action and Milestones (POA&M) |
+| CA-6 | ✓ | ✓ | ✓ | Authorization (ATO from Authorizing Official) |
+| CA-7 | ✓ | ✓ | ✓ | Continuous Monitoring (ConMon strategy; ODV frequencies) |
+| CA-7(1) | — | ✓ | ✓ | Independent Assessment |
+| CA-8 | — | — | ✓ | Penetration Testing |
+| CA-9 | ✓ | ✓ | ✓ | Internal System Connections |
+
+---
+
+## CM — Configuration Management (14 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| CM-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| CM-2 | ✓ | ✓ | ✓ | Baseline Configuration |
+| CM-2(2) | — | ✓ | ✓ | Automation Support for Accuracy and Currency |
+| CM-3 | — | ✓ | ✓ | Configuration Change Control |
+| CM-4 | ✓ | ✓ | ✓ | Impact Analyses |
+| CM-5 | — | ✓ | ✓ | Access Restrictions for Change |
+| CM-6 | ✓ | ✓ | ✓ | Configuration Settings (SCAP/STIG/CIS Benchmarks) |
+| CM-6(1) | — | ✓ | ✓ | Automated Management, Application, and Verification |
+| CM-7 | ✓ | ✓ | ✓ | Least Functionality (disable unnecessary functions/ports/services) |
+| CM-7(1) | — | ✓ | ✓ | Periodic Review |
+| CM-7(2) | — | ✓ | ✓ | Prevent Software Execution |
+| CM-7(5) | — | ✓ | ✓ | Authorized Software / Allowlisting |
+| CM-8 | ✓ | ✓ | ✓ | System Component Inventory |
+| CM-9 | — | ✓ | ✓ | Configuration Management Plan |
+| CM-10 | ✓ | ✓ | ✓ | Software Usage Restrictions |
+| CM-11 | ✓ | ✓ | ✓ | User-Installed Software |
+
+---
+
+## CP — Contingency Planning (13 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| CP-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| CP-2 | ✓ | ✓ | ✓ | Contingency Plan (BCP/DRP) |
+| CP-2(3) | — | ✓ | ✓ | Resume All Missions and Business Functions |
+| CP-3 | ✓ | ✓ | ✓ | Contingency Training |
+| CP-4 | ✓ | ✓ | ✓ | Contingency Plan Testing |
+| CP-4(1) | — | ✓ | ✓ | Coordinate with Related Plans |
+| CP-6 | — | ✓ | ✓ | Alternate Storage Site |
+| CP-7 | — | ✓ | ✓ | Alternate Processing Site |
+| CP-8 | — | ✓ | ✓ | Telecommunications Services |
+| CP-9 | ✓ | ✓ | ✓ | System Backup |
+| CP-9(1) | — | ✓ | ✓ | Testing for Reliability and Integrity |
+| CP-10 | ✓ | ✓ | ✓ | System Recovery and Reconstitution |
+| CP-10(2) | — | ✓ | ✓ | Transaction Recovery |
+
+**RTO/RPO guidance:** CP-2 should document target RTO and RPO; CP-7 alternate site must support target RTO.
+
+---
+
+## IA — Identification and Authentication (13 controls)
+
+**Purpose:** Identify and authenticate users, devices, and processes.
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| IA-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| IA-2 | ✓ | ✓ | ✓ | Identification and Authentication (Organizational Users) |
+| IA-2(1) | ✓ | ✓ | ✓ | MFA for Privileged Accounts |
+| IA-2(2) | ✓ | ✓ | ✓ | MFA for Non-Privileged Accounts (network access) |
+| IA-2(6) | — | — | ✓ | MFA for Separate Device |
+| IA-2(8) | — | ✓ | ✓ | Access to Accounts — Replay Resistant |
+| IA-2(12) | ✓ | ✓ | ✓ | Acceptance of PIV Credentials |
+| IA-3 | — | ✓ | ✓ | Device Identification and Authentication |
+| IA-4 | ✓ | ✓ | ✓ | Identifier Management |
+| IA-5 | ✓ | ✓ | ✓ | Authenticator Management |
+| IA-5(1) | ✓ | ✓ | ✓ | Password-Based Authentication |
+| IA-5(2) | — | ✓ | ✓ | PKI-Based Authentication |
+| IA-6 | ✓ | ✓ | ✓ | Authentication Feedback (obscure passwords) |
+| IA-7 | ✓ | ✓ | ✓ | Cryptographic Module Authentication |
+| IA-8 | ✓ | ✓ | ✓ | Identification and Authentication (Non-Organizational Users) |
+| IA-11 | — | ✓ | ✓ | Re-authentication |
+| IA-12 | — | ✓ | ✓ | Identity Proofing (NIST SP 800-63A levels) |
+
+**MFA requirements (post-EO 14028):** Federal systems must use phishing-resistant MFA (PIV/CAC, FIDO2) — IA-2(1) and IA-2(2) are now required at Low baseline for federal systems.
+
+---
+
+## IR — Incident Response (10 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| IR-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| IR-2 | ✓ | ✓ | ✓ | Incident Response Training |
+| IR-3 | — | ✓ | ✓ | Incident Response Testing |
+| IR-4 | ✓ | ✓ | ✓ | Incident Handling |
+| IR-4(1) | — | ✓ | ✓ | Automated Incident Handling Processes |
+| IR-5 | ✓ | ✓ | ✓ | Incident Monitoring |
+| IR-6 | ✓ | ✓ | ✓ | Incident Reporting (US-CERT/CISA — 1-hour for major incidents) |
+| IR-6(1) | — | ✓ | ✓ | Automated Reporting |
+| IR-7 | ✓ | ✓ | ✓ | Incident Response Assistance |
+| IR-8 | ✓ | ✓ | ✓ | Incident Response Plan |
+| IR-10 | — | — | ✓ | Integrated Information Security Analysis Team |
+
+**Federal reporting (IR-6):** Report cybersecurity incidents to CISA within 1 hour for major incidents; FISMA annual reporting to OMB.
+
+---
+
+## MA — Maintenance (6 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| MA-2 | ✓ | ✓ | ✓ | Controlled Maintenance |
+| MA-3 | — | ✓ | ✓ | Maintenance Tools |
+| MA-4 | ✓ | ✓ | ✓ | Nonlocal Maintenance |
+| MA-5 | ✓ | ✓ | ✓ | Maintenance Personnel |
+| MA-6 | — | ✓ | ✓ | Timely Maintenance |
+
+---
+
+## MP — Media Protection (8 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| MP-2 | ✓ | ✓ | ✓ | Media Access |
+| MP-3 | — | ✓ | ✓ | Media Marking |
+| MP-4 | — | ✓ | ✓ | Media Storage |
+| MP-5 | — | ✓ | ✓ | Media Transport |
+| MP-6 | ✓ | ✓ | ✓ | Media Sanitization (NIST SP 800-88 guidelines) |
+| MP-7 | ✓ | ✓ | ✓ | Media Use |
+
+---
+
+## PE — Physical and Environmental Protection (23 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| PE-2 | ✓ | ✓ | ✓ | Physical Access Authorizations |
+| PE-3 | ✓ | ✓ | ✓ | Physical Access Control |
+| PE-6 | ✓ | ✓ | ✓ | Monitoring Physical Access |
+| PE-8 | ✓ | ✓ | ✓ | Visitor Access Records |
+| PE-12 | ✓ | ✓ | ✓ | Emergency Lighting |
+| PE-13 | ✓ | ✓ | ✓ | Fire Protection |
+| PE-14 | ✓ | ✓ | ✓ | Environmental Controls (temperature, humidity) |
+| PE-15 | ✓ | ✓ | ✓ | Water Damage Protection |
+| PE-16 | ✓ | ✓ | ✓ | Delivery and Removal |
+| PE-17 | — | ✓ | ✓ | Alternate Work Site |
+| PE-19 | — | ✓ | ✓ | Information Leakage |
+
+---
+
+## PL — Planning (11 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| PL-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| PL-2 | ✓ | ✓ | ✓ | System Security and Privacy Plan (SSP) |
+| PL-4 | ✓ | ✓ | ✓ | Rules of Behavior |
+| PL-8 | — | ✓ | ✓ | Security and Privacy Architectures |
+| PL-10 | — | ✓ | ✓ | Baseline Selection |
+| PL-11 | — | ✓ | ✓ | Baseline Tailoring |
+
+---
+
+## PS — Personnel Security (9 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| PS-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| PS-2 | ✓ | ✓ | ✓ | Position Risk Designation |
+| PS-3 | ✓ | ✓ | ✓ | Personnel Screening |
+| PS-4 | ✓ | ✓ | ✓ | Personnel Termination |
+| PS-5 | ✓ | ✓ | ✓ | Personnel Transfer |
+| PS-6 | ✓ | ✓ | ✓ | Access Agreements |
+| PS-7 | ✓ | ✓ | ✓ | External Personnel Security |
+| PS-8 | ✓ | ✓ | ✓ | Personnel Sanctions |
+| PS-9 | — | ✓ | ✓ | Position Descriptions |
+
+---
+
+## PT — PII Processing and Transparency (8 controls)
+
+**Purpose:** Govern how organizations handle Personally Identifiable Information (PII). New in Rev 5; applies to systems processing PII.
+
+| Control | Description |
+|---------|-------------|
+| PT-1 | Policy and Procedures |
+| PT-2 | Authority to Process PII (legal basis) |
+| PT-3 | Purposing Specification (why PII is collected) |
+| PT-4 | Consent (where legally required) |
+| PT-5 | Privacy Notice (transparency at collection) |
+| PT-6 | System of Records Notice (SORN for Privacy Act systems) |
+| PT-7 | Specific Categories of Personally Identifiable Information |
+| PT-8 | Computer Matching Requirements |
+
+**Privacy Act connection:** PT-6 requires a SORN for systems covered by the Privacy Act (5 U.S.C. § 552a). Published in the Federal Register.
+
+---
+
+## RA — Risk Assessment (10 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| RA-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| RA-2 | ✓ | ✓ | ✓ | Security Categorization (FIPS 199) |
+| RA-3 | ✓ | ✓ | ✓ | Risk Assessment (SP 800-30 methodology) |
+| RA-3(1) | — | ✓ | ✓ | Supply Chain Risk Assessment |
+| RA-5 | ✓ | ✓ | ✓ | Vulnerability Monitoring and Scanning |
+| RA-5(2) | — | ✓ | ✓ | Update Vulnerabilities to be Scanned |
+| RA-5(5) | — | ✓ | ✓ | Privileged Access |
+| RA-7 | ✓ | ✓ | ✓ | Risk Response |
+| RA-9 | — | ✓ | ✓ | Criticality Analysis |
+| RA-10 | — | — | ✓ | Threat Hunting |
+
+**Vulnerability scanning cadence (RA-5):** CISA BOD 19-02 — Critical vulnerabilities patch within 15 days, High within 30 days. FedRAMP: monthly OS/web app scans; weekly database scans.
+
+---
+
+## SA — System and Services Acquisition (23 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| SA-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| SA-2 | ✓ | ✓ | ✓ | Allocation of Resources |
+| SA-3 | ✓ | ✓ | ✓ | System Development Life Cycle (SDLC security integration) |
+| SA-4 | ✓ | ✓ | ✓ | Acquisition Process (security requirements in contracts) |
+| SA-4(1) | — | ✓ | ✓ | Functional Properties of Controls |
+| SA-4(2) | — | ✓ | ✓ | Design and Implementation Information |
+| SA-4(9) | — | ✓ | ✓ | Functions, Ports, Protocols, and Services in Use |
+| SA-5 | ✓ | ✓ | ✓ | System Documentation |
+| SA-8 | — | ✓ | ✓ | Security and Privacy Engineering Principles |
+| SA-9 | ✓ | ✓ | ✓ | External System Services |
+| SA-10 | — | ✓ | ✓ | Developer Configuration Management |
+| SA-11 | — | ✓ | ✓ | Developer Testing and Evaluation |
+| SA-15 | — | ✓ | ✓ | Development Process, Standards, and Tools |
+| SA-17 | — | — | ✓ | Developer Architecture and Design |
+| SA-22 | ✓ | ✓ | ✓ | Unsupported System Components |
+
+---
+
+## SC — System and Communications Protection (51 controls)
+
+**Purpose:** Protect communications and system boundaries.
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| SC-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| SC-5 | ✓ | ✓ | ✓ | Denial of Service Protection |
+| SC-7 | ✓ | ✓ | ✓ | Boundary Protection (firewalls, DMZ, NGFW) |
+| SC-7(3) | — | ✓ | ✓ | Access Points |
+| SC-7(4) | — | ✓ | ✓ | External Telecommunications Services |
+| SC-7(5) | — | ✓ | ✓ | Deny by Default / Allow by Exception |
+| SC-7(7) | — | ✓ | ✓ | Split Tunneling for Remote Devices |
+| SC-7(8) | — | ✓ | ✓ | Route Traffic to Authenticated Proxy Servers |
+| SC-8 | — | ✓ | ✓ | Transmission Confidentiality and Integrity |
+| SC-8(1) | — | ✓ | ✓ | Cryptographic Protection (TLS 1.2+ or TLS 1.3) |
+| SC-10 | — | ✓ | ✓ | Network Disconnect |
+| SC-12 | ✓ | ✓ | ✓ | Cryptographic Key Establishment and Management |
+| SC-13 | ✓ | ✓ | ✓ | Cryptographic Protection (FIPS 140-2/3 validated modules) |
+| SC-15 | ✓ | ✓ | ✓ | Collaborative Computing Devices and Applications |
+| SC-17 | — | ✓ | ✓ | Public Key Infrastructure Certificates (PKI) |
+| SC-18 | — | ✓ | ✓ | Mobile Code |
+| SC-20 | ✓ | ✓ | ✓ | Secure Name/Address Resolution Service |
+| SC-21 | ✓ | ✓ | ✓ | Secure Name/Address Resolution Service (Recursive) |
+| SC-22 | ✓ | ✓ | ✓ | Architecture and Provisioning for Name/Address Resolution Service |
+| SC-23 | — | ✓ | ✓ | Session Authenticity |
+| SC-28 | ✓ | ✓ | ✓ | Protection of Information at Rest |
+| SC-28(1) | — | ✓ | ✓ | Cryptographic Protection (AES-256 for data at rest) |
+| SC-39 | ✓ | ✓ | ✓ | Process Isolation |
+
+**Cryptography requirements:** SC-13 mandates FIPS 140-2 (or FIPS 140-3) validated cryptographic modules. SC-8(1) requires cryptographic protection in transit; SC-28(1) requires encryption at rest.
+
+---
+
+## SI — System and Information Integrity (23 controls)
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| SI-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| SI-2 | ✓ | ✓ | ✓ | Flaw Remediation (patch management) |
+| SI-2(2) | — | ✓ | ✓ | Automated Flaw Remediation Status |
+| SI-3 | ✓ | ✓ | ✓ | Malicious Code Protection (AV/EDR) |
+| SI-3(2) | — | ✓ | ✓ | Automatic Updates |
+| SI-4 | ✓ | ✓ | ✓ | System Monitoring (IDS/IPS, SIEM) |
+| SI-4(2) | — | ✓ | ✓ | Automated Tools and Mechanisms for Real-Time Analysis |
+| SI-4(4) | — | ✓ | ✓ | Inbound and Outbound Communications Traffic |
+| SI-4(5) | — | ✓ | ✓ | System-Generated Alerts |
+| SI-5 | ✓ | ✓ | ✓ | Security Alerts, Advisories, and Directives |
+| SI-6 | — | — | ✓ | Security and Privacy Function Verification |
+| SI-7 | — | ✓ | ✓ | Software, Firmware, and Information Integrity |
+| SI-7(1) | — | ✓ | ✓ | Integrity Checks |
+| SI-7(7) | — | ✓ | ✓ | Integration of Detection and Response |
+| SI-8 | — | ✓ | ✓ | Spam Protection |
+| SI-10 | — | ✓ | ✓ | Information Input Validation |
+| SI-12 | ✓ | ✓ | ✓ | Information Management and Retention |
+| SI-16 | — | ✓ | ✓ | Memory Protection |
+
+---
+
+## SR — Supply Chain Risk Management (12 controls)
+
+**Purpose:** Identify, assess, and mitigate risks from the supply chain (new family in Rev 5).
+
+| Control | L | M | H | Description |
+|---------|---|---|---|-------------|
+| SR-1 | ✓ | ✓ | ✓ | Policy and Procedures |
+| SR-2 | — | ✓ | ✓ | Supply Chain Risk Management Plan (SCRM Plan) |
+| SR-2(1) | — | — | ✓ | Establish SCRM Team |
+| SR-3 | — | ✓ | ✓ | Supply Chain Controls and Processes |
+| SR-4 | — | ✓ | ✓ | Provenance |
+| SR-5 | — | ✓ | ✓ | Acquisition Strategies, Tools, and Methods |
+| SR-6 | — | ✓ | ✓ | Supplier Assessments and Reviews |
+| SR-6(1) | — | — | ✓ | Testing and Analysis |
+| SR-7 | — | ✓ | ✓ | Supply Chain Operations Security |
+| SR-8 | — | ✓ | ✓ | Notification Agreements |
+| SR-9 | — | — | ✓ | Tamper Resistance and Detection |
+| SR-10 | — | — | ✓ | Inspection of Systems or Components |
+| SR-11 | — | ✓ | ✓ | Component Authenticity |
+| SR-11(1) | — | — | ✓ | Anti-Counterfeit Training |
+| SR-12 | — | ✓ | ✓ | Component Disposal |
+
+**EO 14028 connection:** SR family implements software supply chain security requirements. SBOMs (Software Bill of Materials) support SR-3, SR-4, and SR-11.
+
+---
+
+## PM — Program Management (32 controls)
+
+**Applies at the organizational level — not specific to any system baseline.**
+
+| Control | Description |
+|---------|-------------|
+| PM-1 | Information Security Program Plan |
+| PM-2 | Information Security Program Leadership Roles (CISO) |
+| PM-5 | System Inventory |
+| PM-7 | Enterprise Architecture |
+| PM-8 | Critical Infrastructure Plan |
+| PM-9 | Risk Management Strategy |
+| PM-10 | Authorization Process |
+| PM-11 | Mission and Business Process Definition |
+| PM-12 | Insider Threat Program |
+| PM-13 | Security Workforce |
+| PM-14 | Testing, Training, and Monitoring |
+| PM-15 | Security and Privacy Groups and Associations |
+| PM-16 | Threat Awareness Program |
+| PM-17 | Protecting Controlled Unclassified Information |
+| PM-18 | Privacy Program Plan |
+| PM-19 | Privacy Program Leadership Roles (CPO) |
+| PM-20 | Dissemination of Privacy Program Information |
+| PM-21 | Accounting for PII |
+| PM-22 | Personally Identifiable Information Quality Management |
+| PM-23 | Data Governance Body |
+| PM-24 | Data Integrity Board |
+| PM-25 | Minimization of PII Used in Testing, Training, and Research |
+| PM-26 | Complaint Management |
+| PM-27 | Privacy Reporting |
+| PM-28 | Risk Framing |
+| PM-29 | Risk Management Program Leadership Roles |
+| PM-30 | Supply Chain Risk Management Strategy |
+| PM-31 | Continuous Monitoring Strategy |
+| PM-32 | Purposing |