mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 14:03:24 +00:00
198 lines
8.1 KiB
YAML
198 lines
8.1 KiB
YAML
id: supplemental_controls
|
|
title: "Out of Scope Supplemental"
|
|
discussion: |
|
|
There are several requirements defined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Information Systems and Organizations, Revision 5 that can be met by making configuration changes to the operating system. However, NIST SP 800-53 (Rev. 5) contains a broad set of guidelines that attempt to address all aspects of an information system or systems within an organization. Because the macOS Security Compliance Project is tailored specifically to macOS, some requirements defined in NIST SP 800-53 (Rev. 5) are not applicable.
|
|
|
|
This supplemental contains those controls that are assigned to a baseline in NIST SP 800-53 (Rev. 5) which cannot be addressed with a technical configuration for macOS. These controls can be accomplished though administrative or procedural processes within an organization or via integration of the macOS system into enterprise information systems which are configured to protect the systems within.
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Access Control (AC)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/AC-1[AC-1], link:https://nvd.nist.gov/800-53/Rev4/control/AC-2[AC-2], link:https://nvd.nist.gov/800-53/Rev4/control/AC-14[AC-14], link:https://nvd.nist.gov/800-53/Rev4/control/AC-17?#enhancement-4[AC-17(4)], link:https://nvd.nist.gov/800-53/Rev4/control/AC-22[AC-22]
|
|
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Awareness and Training (AT)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/AT-1[AT-1], link:https://nvd.nist.gov/800-53/Rev4/control/AT-2[AT-2], link:https://nvd.nist.gov/800-53/Rev4/control/AT-3[AT-3], link:https://nvd.nist.gov/800-53/Rev4/control/AT-4[AT-4]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Audit and Accountability (AU)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/AU-1[AU-1], link:https://nvd.nist.gov/800-53/Rev4/control/AU-6[AU-6]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Security Assessment and Authorization (CA)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/CA-1[CA-1], link:https://nvd.nist.gov/800-53/Rev4/control/CA-2[CA-2], link:https://nvd.nist.gov/800-53/Rev4/control/CA-3[CA-3], link:https://nvd.nist.gov/800-53/Rev4/control/CA-5[CA-5], link:https://nvd.nist.gov/800-53/Rev4/control/CA-6[CA-6], link:https://nvd.nist.gov/800-53/Rev4/control/CA-7[CA-7], link:https://nvd.nist.gov/800-53/Rev4/control/CA-9[CA-9]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Configuration Management (CM)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/CM-1[CM-1], link:https://nvd.nist.gov/800-53/Rev4/control/CM-4[CM-4], link:https://nvd.nist.gov/800-53/Rev4/control/CM-8[CM-8], link:https://nvd.nist.gov/800-53/Rev4/control/CM-10[CM-10], link:https://nvd.nist.gov/800-53/Rev4/control/CM-11[CM-11]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Contingency Planning (CP)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/CP-1[CP-1], link:https://nvd.nist.gov/800-53/Rev4/control/CP-2[CP-2], link:https://nvd.nist.gov/800-53/Rev4/control/CP-3[CP-3], link:https://nvd.nist.gov/800-53/Rev4/control/CP-4[CP-4], link:https://nvd.nist.gov/800-53/Rev4/control/CP-9[CP-9], link:https://nvd.nist.gov/800-53/Rev4/control/CP-10[CP-10]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Identification and Authentication (IA)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/IA-1[IA-1], link:https://nvd.nist.gov/800-53/Rev4/control/IA-8?#enhancement-1[IA-8(1)], link:https://nvd.nist.gov/800-53/Rev4/control/IA-8?#enhancement-2[IA-8(2)], link:https://nvd.nist.gov/800-53/Rev4/control/IA-8?#enhancement-3[IA-8(3)], link:https://nvd.nist.gov/800-53/Rev4/control/IA-8?#enhancement-4[IA-8(4)]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Incident Response (IR)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/IR-1[IR-1], link:https://nvd.nist.gov/800-53/Rev4/control/IR-2[IR-2], link:https://nvd.nist.gov/800-53/Rev4/control/IR-4[IR-4], link:https://nvd.nist.gov/800-53/Rev4/control/IR-5[IR-5], link:https://nvd.nist.gov/800-53/Rev4/control/IR-6[IR-6], link:https://nvd.nist.gov/800-53/Rev4/control/IR-7[IR-7], link:https://nvd.nist.gov/800-53/Rev4/control/IR-8[IR-8],
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Maintenance (MA)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/MA-1[MA-1], link:https://nvd.nist.gov/800-53/Rev4/control/MA-2[MA-2], link:https://nvd.nist.gov/800-53/Rev4/control/MA-5[MA-5]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Media Protection (MP)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/MP-1[MP-1], link:https://nvd.nist.gov/800-53/Rev4/control/MP-2[MP-2], link:https://nvd.nist.gov/800-53/Rev4/control/MP-6[MP-6], link:https://nvd.nist.gov/800-53/Rev4/control/MP-7[MP-7]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Physical and Environmental Protection (PE)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/PE-1[PE-1], link:https://nvd.nist.gov/800-53/Rev4/control/PE-2[PE-2], link:https://nvd.nist.gov/800-53/Rev4/control/PE-3[PE-3], link:https://nvd.nist.gov/800-53/Rev4/control/PE-6[PE-6], link:https://nvd.nist.gov/800-53/Rev4/control/PE-8[PE-8], link:https://nvd.nist.gov/800-53/Rev4/control/PE-12[PE-12], link:https://nvd.nist.gov/800-53/Rev4/control/PE-13[PE-13], link:https://nvd.nist.gov/800-53/Rev4/control/PE-14[PE-14], link:https://nvd.nist.gov/800-53/Rev4/control/PE-15[PE-15], link:https://nvd.nist.gov/800-53/Rev4/control/PE-16[PE-16]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Planning (PL)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/PL-1[PL-1], link:https://nvd.nist.gov/800-53/Rev4/control/PL-2[PL-2], link:https://nvd.nist.gov/800-53/Rev4/control/PL-4[PL-4]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Personnel Security (PS)
|
|
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/PS-1[PS-1], link:https://nvd.nist.gov/800-53/Rev4/control/PS-2[PS-2], link:https://nvd.nist.gov/800-53/Rev4/control/PS-3[PS-3], link:https://nvd.nist.gov/800-53/Rev4/control/PS-4[PS-4], link:https://nvd.nist.gov/800-53/Rev4/control/PS-5[PS-5], link:https://nvd.nist.gov/800-53/Rev4/control/PS-6[PS-6], link:https://nvd.nist.gov/800-53/Rev4/control/PS-7[PS-7], link:https://nvd.nist.gov/800-53/Rev4/control/PS-8[PS-8]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|Risk Assessment (RA)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/RA-1[RA-1], link:https://nvd.nist.gov/800-53/Rev4/control/RA-2[RA-2], link:https://nvd.nist.gov/800-53/Rev4/control/RA-3[RA-3], link:https://nvd.nist.gov/800-53/Rev4/control/RA-5[RA-5]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|System and Services Acquisition (SA)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/SA-1[SA-1], link:https://nvd.nist.gov/800-53/Rev4/control/SA-2[SA-2], link:https://nvd.nist.gov/800-53/Rev4/control/SA-3[SA-3], link:https://nvd.nist.gov/800-53/Rev4/control/SA-4[SA-4], link:https://controlfreak.risk-redux.io/controls/SA-4%20(10)[SA-4(10)], link:https://nvd.nist.gov/800-53/Rev4/control/SA-5[SA-5], link:https://nvd.nist.gov/800-53/Rev4/control/SA-9[SA-9]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|System and Communications Protection (SC)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/SC-1[SC-1], link:https://nvd.nist.gov/800-53/Rev4/control/SC-12[SC-12], link:https://nvd.nist.gov/800-53/Rev4/control/SC-15[SC-15], link:https://nvd.nist.gov/800-53/Rev4/control/SC-20[SC-20], link:https://nvd.nist.gov/800-53/Rev4/control/SC-22[SC-22], link:https://nvd.nist.gov/800-53/Rev4/control/SC-39[SC-39]
|
|
|===
|
|
|
|
[cols="15%h, 85%a"]
|
|
|===
|
|
|
|
|Family
|
|
|System and Information Integrity (SI)
|
|
|
|
|Controls
|
|
|link:https://nvd.nist.gov/800-53/Rev4/control/SI-1[SI-1], link:https://nvd.nist.gov/800-53/Rev4/control/SI-4[SI-4], link:https://nvd.nist.gov/800-53/Rev4/control/SI-5[SI-5], link:https://nvd.nist.gov/800-53/Rev4/control/SI-12[SI-12]
|
|
|===
|
|
check: |
|
|
fix: |
|
|
references:
|
|
cci:
|
|
- N/A
|
|
800-53r5:
|
|
- N/A
|
|
800-53r4:
|
|
- N/A
|
|
srg:
|
|
- N/A
|
|
disa_stig:
|
|
- N/A
|
|
macOS:
|
|
- "11.0"
|
|
tags:
|
|
- supplemental
|
|
mobileconfig: false
|
|
mobileconfig_info:
|