Source catalog · ARC-AMPE

The mandatory
DE-Entity baseline.

Explore the controls and enhancements parsed from the CMS Volume II — SSPP DE-Entity Mandatory Baseline workbook, organized by the source’s control families.

Controls and enhancements: 308
Base controls: 175
Enhancements: 133
Control families: 20

Read the catalog in context.

This source workbook is Volume II — SSPP DE-Entity Mandatory Baseline, v1.0, with NIST SP 800-53 Rev 5 tailoring (CMS ARC-AMPE) lineage. The baseline records a compliance date of 2026-03-04.

Evidence state belongs to each assessment and is shown inside the authenticated workspace. These source entries describe requirements; they do not establish an organization’s compliance.

CMS authority source

Workbook provenance

Workbook: ARC-AMPE_Vol2_SSPP-DE-Entity_v1.0-508_07072025.xlsx. Source sheet: DEE Mandatory Baseline.

Framework edition on record: v1.02. Source verification: 2026-08-30.

Explore the requirements

The complete parsed baseline.

Expand a family to read its controls and enhancements. Identifiers and titles follow the source workbook.

ACAccess Control46 entries

Access Control: 18 base controls and 28 enhancements
Source identifier	Requirement title	Type
`AC-01`	Policy and Procedures	Base control
`AC-02`	Account Management	Base control
`AC-02(01)`	Automated System Account Management	Enhancement of `AC-02`
`AC-02(02)`	Automated Temporary and Emergency Account Management	Enhancement of `AC-02`
`AC-02(03)`	Disable Accounts	Enhancement of `AC-02`
`AC-02(04)`	Automated Audit Actions	Enhancement of `AC-02`
`AC-02(05)`	Inactivity Logout	Enhancement of `AC-02`
`AC-02(07)`	Privileged User Accounts	Enhancement of `AC-02`
`AC-02(12)`	Account Monitoring for Atypical Usage	Enhancement of `AC-02`
`AC-02(13)`	Disable Accounts for High-Risk Individuals	Enhancement of `AC-02`
`AC-03`	Access Enforcement	Base control
`AC-03(14)`	Individual Access	Enhancement of `AC-03`
`AC-04`	Information Flow Enforcement	Base control
`AC-05`	Separation of Duties	Base control
`AC-06`	Least Privilege	Base control
`AC-06(01)`	Authorize Access to Security Functions	Enhancement of `AC-06`
`AC-06(02)`	Non-privileged Access for Nonsecurity Functions	Enhancement of `AC-06`
`AC-06(05)`	Privileged Accounts	Enhancement of `AC-06`
`AC-06(07)`	Review of User Privileges	Enhancement of `AC-06`
`AC-06(09)`	Log Use of Privileged Functions	Enhancement of `AC-06`
`AC-06(10)`	Prohibit Non-privileged Users from Executing Privileged Functions	Enhancement of `AC-06`
`AC-07`	Unsuccessful Logon Attempts	Base control
`AC-08`	System Use Notification	Base control
`AC-10`	Concurrent Session Control	Base control
`AC-11`	Device Lock	Base control
`AC-12`	Session Termination	Base control
`AC-12(01)`	User-Initiated Logouts	Enhancement of `AC-12`
`AC-12(02)`	Termination Message	Enhancement of `AC-12`
`AC-12(03)`	Timeout Warning Message	Enhancement of `AC-12`
`AC-14`	Permitted Actions Without Identification or Authentication	Base control
`AC-17`	Remote Access	Base control
`AC-17(01)`	Monitoring and Control	Enhancement of `AC-17`
`AC-17(02)`	Protection of Confidentiality and Integrity Using Encryption	Enhancement of `AC-17`
`AC-17(03)`	Managed Access Control Points	Enhancement of `AC-17`
`AC-17(04)`	Privileged Commands and Access	Enhancement of `AC-17`
`AC-17(09)`	Disconnect or Disable Access	Enhancement of `AC-17`
`AC-18`	Wireless Access	Base control
`AC-18(01)`	Authentication and Encryption	Enhancement of `AC-18`
`AC-18(03)`	Disable Wireless Networking	Enhancement of `AC-18`
`AC-19`	Access Control for Mobile Devices	Base control
`AC-19(05)`	Full Device and Container-based Encryption	Enhancement of `AC-19`
`AC-20`	Use of External Systems	Base control
`AC-20(01)`	Limits on Authorized Use	Enhancement of `AC-20`
`AC-20(02)`	Portable Storage Devices — Restricted Use	Enhancement of `AC-20`
`AC-21`	Information Sharing	Base control
`AC-22`	Publicly Accessible Content	Base control

ATAwareness and Training9 entries

Awareness and Training: 4 base controls and 5 enhancements
Source identifier	Requirement title	Type
`AT-01`	Policy and Procedures	Base control
`AT-02`	Literacy Training and Awareness	Base control
`AT-02(02)`	Insider Threat	Enhancement of `AT-02`
`AT-02(03)`	Social Engineering and Mining	Enhancement of `AT-02`
`AT-02(04)`	Suspicious Communications and Anomalous System Behavior	Enhancement of `AT-02`
`AT-02(05)`	Advanced Persistent Threat	Enhancement of `AT-02`
`AT-03`	Role-Based Training	Base control
`AT-03(05)`	Processing Personally Identifiable Information	Enhancement of `AT-03`
`AT-04`	Training Records	Base control

AUAudit and Accountability18 entries

Audit and Accountability: 12 base controls and 6 enhancements
Source identifier	Requirement title	Type
`AU-01`	Policy and Procedures	Base control
`AU-02`	Event Logging	Base control
`AU-03`	Content of Audit Records	Base control
`AU-03(01)`	Additional Audit Information	Enhancement of `AU-03`
`AU-03(03)`	Limit Personally Identifiable Information Elements	Enhancement of `AU-03`
`AU-04`	Audit Log Storage Capacity	Base control
`AU-05`	Response to Audit Logging Processing Failures	Base control
`AU-06`	Audit Record Review, Analysis, and Reporting	Base control
`AU-06(01)`	Automated Process Integration	Enhancement of `AU-06`
`AU-06(03)`	Correlate Audit Record Repositories	Enhancement of `AU-06`
`AU-07`	Audit Record Reduction and Report Generation	Base control
`AU-07(01)`	Automatic Processing	Enhancement of `AU-07`
`AU-08`	Time Stamps	Base control
`AU-09`	Protection of Audit Information	Base control
`AU-09(04)`	Access by Subset of Privileged Users	Enhancement of `AU-09`
`AU-10`	Non-Repudiation	Base control
`AU-11`	Audit Record Retention	Base control
`AU-12`	Audit Record Generation	Base control

CAAssessment, Authorization, and Monitoring12 entries

Assessment, Authorization, and Monitoring: 8 base controls and 4 enhancements
Source identifier	Requirement title	Type
`CA-01`	Policies and Procedures	Base control
`CA-02`	Control Assessments	Base control
`CA-02(01)`	Independent Assessors	Enhancement of `CA-02`
`CA-03`	Information Exchange	Base control
`CA-05`	Plan of Action and Milestones	Base control
`CA-06`	Authorization	Base control
`CA-07`	Continuous Monitoring	Base control
`CA-07(01)`	Independent Assessment	Enhancement of `CA-07`
`CA-07(04)`	Risk Monitoring	Enhancement of `CA-07`
`CA-08`	Penetration Testing	Base control
`CA-08(01)`	Independent Penetration Testing Agent or Team	Enhancement of `CA-08`
`CA-09`	Internal System Connections	Base control

CMConfiguration Management25 entries

Configuration Management: 13 base controls and 12 enhancements
Source identifier	Requirement title	Type
`CM-01`	Policy and Procedures	Base control
`CM-02`	Baseline Configuration	Base control
`CM-02(03)`	Retention of Previous Configurations	Enhancement of `CM-02`
`CM-03`	Configuration Change Control	Base control
`CM-03(02)`	Testing, Validation, and Documentation of Changes	Enhancement of `CM-03`
`CM-04`	Impact Analyses	Base control
`CM-04(01)`	Separate Test Environments	Enhancement of `CM-04`
`CM-04(02)`	Verification of Controls	Enhancement of `CM-04`
`CM-05`	Access Restrictions for Change	Base control
`CM-05(01)`	Automated Access Enforcement and Audit Records	Enhancement of `CM-05`
`CM-05(05)`	Privilege Limitation for Production and Operation	Enhancement of `CM-05`
`CM-06`	Configuration Settings	Base control
`CM-06(01)`	Automated Management, Application, and Verification	Enhancement of `CM-06`
`CM-07`	Least Functionality	Base control
`CM-07(01)`	Periodic Review	Enhancement of `CM-07`
`CM-07(02)`	Prevent Program Execution	Enhancement of `CM-07`
`CM-07(05)`	Authorized Software - Allow by Exception	Enhancement of `CM-07`
`CM-08`	System Component Inventory	Base control
`CM-08(01)`	Updates During Installation and Removal	Enhancement of `CM-08`
`CM-08(03)`	Automated Unauthorized Component Detection	Enhancement of `CM-08`
`CM-09`	Configuration Management Plan	Base control
`CM-10`	Software Usage Restrictions	Base control
`CM-11`	User-Installed Software	Base control
`CM-12`	Information Location	Base control
`CM-13`	Data Action Mapping	Base control

CPContingency Planning16 entries

Contingency Planning: 7 base controls and 9 enhancements
Source identifier	Requirement title	Type
`CP-01`	Policy and Procedures	Base control
`CP-02`	Contingency Plan	Base control
`CP-02(01)`	Coordinate with Related Plans	Enhancement of `CP-02`
`CP-02(03)`	Resume Missions and Business Functions	Enhancement of `CP-02`
`CP-02(08)`	Identify Critical Assets	Enhancement of `CP-02`
`CP-03`	Contingency Training	Base control
`CP-04`	Contingency Plan Testing	Base control
`CP-04(01)`	Coordinate with Related Plans	Enhancement of `CP-04`
`CP-06`	Alternate Storage Site	Base control
`CP-06(01)`	Separation from Primary Site	Enhancement of `CP-06`
`CP-06(03)`	Accessibility	Enhancement of `CP-06`
`CP-09`	System Backup	Base control
`CP-09(01)`	Testing for Reliability and Integrity	Enhancement of `CP-09`
`CP-09(08)`	Cryptographic Protection	Enhancement of `CP-09`
`CP-10`	System Recovery and Reconstitution	Base control
`CP-10(02)`	Transaction Recovery	Enhancement of `CP-10`

IAIdentification and Authentication21 entries

Identification and Authentication: 10 base controls and 11 enhancements
Source identifier	Requirement title	Type
`IA-01`	Policy and Procedures	Base control
`IA-02`	Identification and Authentication (Organizational Users)	Base control
`IA-02(01)`	Multifactor Access to Privileged Accounts	Enhancement of `IA-02`
`IA-02(02)`	Multifactor Access to Non-Privileged Accounts	Enhancement of `IA-02`
`IA-02(06)`	Access to Accounts - Separate Device	Enhancement of `IA-02`
`IA-02(08)`	Access to Accounts - Replay Resistant	Enhancement of `IA-02`
`IA-03`	Device Identification and Authentication	Base control
`IA-04`	Identifier Management	Base control
`IA-04(04)`	Identify User Status	Enhancement of `IA-04`
`IA-05`	Authenticator Management	Base control
`IA-05(01)`	Password-Based Authentication	Enhancement of `IA-05`
`IA-05(06)`	Protection of Authenticators	Enhancement of `IA-05`
`IA-05(07)`	Authenticator Management \| No Embedded Unencrypted Static Authenticators	Enhancement of `IA-05`
`IA-06`	Authenticator Feedback	Base control
`IA-07`	Cryptographic Module Authentication	Base control
`IA-08`	Identification and Authentication (Non-Organizational Users)	Base control
`IA-08(02)`	Identification and Authentication (Non-Organizational Users) \|Acceptance of External Party Credentials	Enhancement of `IA-08`
`IA-11`	Re-Authentication	Base control
`IA-12`	Identity Proofing	Base control
`IA-12(01)`	Supervisor Authorization	Enhancement of `IA-12`
`IA-12(03)`	Identity Evidence Validation and Verification	Enhancement of `IA-12`

IRIncident Response15 entries

Incident Response: 8 base controls and 7 enhancements
Source identifier	Requirement title	Type
`IR-01`	Policy and Procedures	Base control
`IR-02`	Incident Response Training	Base control
`IR-02(03)`	Breach	Enhancement of `IR-02`
`IR-03`	Incident Response Testing	Base control
`IR-03(02)`	Coordination with Related Plans	Enhancement of `IR-03`
`IR-04`	Incident Handling	Base control
`IR-04(03)`	Continuity of Operations	Enhancement of `IR-04`
`IR-04(06)`	Insider Threats – Specific Capabilities	Enhancement of `IR-04`
`IR-05`	Incident Monitoring	Base control
`IR-06`	Incident Reporting	Base control
`IR-06(01)`	Automated Reporting	Enhancement of `IR-06`
`IR-07`	Incident Response Assistance	Base control
`IR-07(01)`	Automation Support for Availability of Information and Support	Enhancement of `IR-07`
`IR-08`	Incident Response Plan	Base control
`IR-08(01)`	Breaches	Enhancement of `IR-08`

MAMaintenance12 entries

Maintenance: 6 base controls and 6 enhancements
Source identifier	Requirement title	Type
`MA-01`	Policy and Procedures	Base control
`MA-02`	Controlled Maintenance	Base control
`MA-03`	Maintenance Tools	Base control
`MA-03(01)`	Inspect Tools	Enhancement of `MA-03`
`MA-03(02)`	Inspect Media	Enhancement of `MA-03`
`MA-03(03)`	Prevent Unauthorized Removal	Enhancement of `MA-03`
`MA-03(05)`	Execution with Privilege	Enhancement of `MA-03`
`MA-03(06)`	Software Updates and Patches	Enhancement of `MA-03`
`MA-04`	Nonlocal Maintenance	Base control
`MA-04(01)`	Logging and Review	Enhancement of `MA-04`
`MA-05`	Maintenance Personnel	Base control
`MA-06`	Timely Maintenance	Base control

MPMedia Protection8 entries

Media Protection: 7 base controls and 1 enhancements
Source identifier	Requirement title	Type
`MP-01`	Policy and Procedures	Base control
`MP-02`	Media Access	Base control
`MP-03`	Media Marking	Base control
`MP-04`	Media Storage	Base control
`MP-05`	Media Transport	Base control
`MP-06`	Media Sanitization	Base control
`MP-06(01)`	Review, Approve, Track, Document, and Verify	Enhancement of `MP-06`
`MP-07`	Media Use	Base control

PEPhysical and Environmental Protection9 entries

Physical and Environmental Protection: 8 base controls and 1 enhancements
Source identifier	Requirement title	Type
`PE-01`	Policy and Procedures	Base control
`PE-02`	Physical Access Authorizations	Base control
`PE-03`	Physical Access Control	Base control
`PE-04`	Access Control for Transmission	Base control
`PE-05`	Access Control for Output Devices	Base control
`PE-06`	Monitoring Physical Access	Base control
`PE-06(01)`	Intrusion Alarms and Surveillance Equipment	Enhancement of `PE-06`
`PE-08`	Visitor Access Records	Base control
`PE-16`	Delivery and Removal	Base control

PLPlanning6 entries

Planning: 5 base controls and 1 enhancements
Source identifier	Requirement title	Type
`PL-01`	Policy and Procedures	Base control
`PL-02`	System Security and Privacy Plan	Base control
`PL-04`	Rules of Behavior	Base control
`PL-04(01)`	Social Media and External Site / Application Usage Restrictions	Enhancement of `PL-04`
`PL-08`	Security and Privacy Architectures	Base control
`PL-11`	Baseline Tailoring	Base control

PMProgram Management5 entries

Program Management: 4 base controls and 1 enhancements
Source identifier	Requirement title	Type
`PM-04`	Plan of Action and Milestones Process	Base control
`PM-05`	System Inventory	Base control
`PM-05(01)`	Inventory of Personally Identifiable Information	Enhancement of `PM-05`
`PM-21`	Accounting of Disclosures	Base control
`PM-25`	Minimization of PII Used in Testing, Training, and Research	Base control

PSPersonnel Security8 entries

Personnel Security: 8 base controls and 0 enhancements
Source identifier	Requirement title	Type
`PS-01`	Policy and Procedures	Base control
`PS-02`	Position Risk Designation	Base control
`PS-03`	Personnel Screening	Base control
`PS-04`	Personnel Termination	Base control
`PS-05`	Personnel Transfer	Base control
`PS-06`	Access Agreements	Base control
`PS-07`	External Personnel Security	Base control
`PS-08`	Personnel Sanctions	Base control

PTPersonally Identifiable Information Processing and Transparency10 entries

Personally Identifiable Information Processing and Transparency: 6 base controls and 4 enhancements
Source identifier	Requirement title	Type
`PT-01`	Policy and Procedures	Base control
`PT-02`	Authority to Process Personally Identifiable Information	Base control
`PT-03`	Personally Identifiable Information Processing Purposes	Base control
`PT-04`	Consent	Base control
`PT-04(03)`	Revocation	Enhancement of `PT-04`
`PT-05`	Privacy Notice	Base control
`PT-05(01)`	Just-in-time Notice	Enhancement of `PT-05`
`PT-05(02)`	Privacy Act Statements	Enhancement of `PT-05`
`PT-07`	Specific Categories of Personally Identifiable Information	Base control
`PT-07(01)`	Social Security Numbers	Enhancement of `PT-07`

RARisk Assessment8 entries

Risk Assessment: 6 base controls and 2 enhancements
Source identifier	Requirement title	Type
`RA-01`	Policy and Procedures	Base control
`RA-02`	Security Categorization	Base control
`RA-03`	Risk Assessment	Base control
`RA-05`	Vulnerability Monitoring and Scanning	Base control
`RA-05(02)`	Update Vulnerabilities to be Scanned	Enhancement of `RA-05`
`RA-05(05)`	Privileged Access	Enhancement of `RA-05`
`RA-07`	Risk Response	Base control
`RA-08`	Privacy Impact Assessments	Base control

SASystem and Services Acquisition18 entries

System and Services Acquisition: 12 base controls and 6 enhancements
Source identifier	Requirement title	Type
`SA-01`	Policy and Procedures	Base control
`SA-02`	Allocation of Resources	Base control
`SA-03`	System Development Life Cycle	Base control
`SA-04`	Acquisition Process	Base control
`SA-04(01)`	Functional Properties of Controls	Enhancement of `SA-04`
`SA-04(02)`	Design and Implementation Information for Security Controls	Enhancement of `SA-04`
`SA-04(09)`	Functions, Ports, Protocols, and Services in Use	Enhancement of `SA-04`
`SA-05`	System Documentation	Base control
`SA-08`	Security and Privacy Engineering Principles	Base control
`SA-09`	External System Services	Base control
`SA-09(05)`	Processing, Storage, and Service Location	Enhancement of `SA-09`
`SA-09(08)`	Processing and Storage Location - U.S. Jurisdiction	Enhancement of `SA-09`
`SA-10`	Developer Configuration Management	Base control
`SA-11`	Developer Testing and Evaluation	Base control
`SA-15`	Development Process, Standards, and Tools	Base control
`SA-15(12)`	Minimize Personally Identifiable Information	Enhancement of `SA-15`
`SA-17`	Developer Security Architecture and Design	Base control
`SA-22`	Unsupported System Components	Base control

SCSystem and Communications Protection28 entries

System and Communications Protection: 16 base controls and 12 enhancements
Source identifier	Requirement title	Type
`SC-01`	Policy and Procedures	Base control
`SC-02`	Separation of System and User Functionality	Base control
`SC-04`	Information in Shared System Resources	Base control
`SC-05`	Denial-of-Service Protection	Base control
`SC-07`	Boundary Protection	Base control
`SC-07(03)`	Access Points	Enhancement of `SC-07`
`SC-07(04)`	External Telecommunications Services	Enhancement of `SC-07`
`SC-07(05)`	Deny By Default — Allow By Exception	Enhancement of `SC-07`
`SC-07(07)`	Split Tunneling for Remote Devices	Enhancement of `SC-07`
`SC-07(08)`	Route Traffic to Authenticated Proxy Servers	Enhancement of `SC-07`
`SC-07(12)`	Host-Based Protection	Enhancement of `SC-07`
`SC-07(18)`	Fail Secure	Enhancement of `SC-07`
`SC-07(24)`	Boundary Protection \| Personally Identifiable Information	Enhancement of `SC-07`
`SC-07(29)`	Boundary Protection \| Separate Subnets to Isolate Functions	Enhancement of `SC-07`
`SC-08`	Transmission Confidentiality and Integrity	Base control
`SC-08(01)`	Cryptographic Protection	Enhancement of `SC-08`
`SC-08(02)`	Pre- and Post-Transmission Handling	Enhancement of `SC-08`
`SC-10`	Network Disconnect	Base control
`SC-12`	Cryptographic Key Establishment and Management	Base control
`SC-13`	Cryptographic Protection	Base control
`SC-17`	Public Key Infrastructure Certificates	Base control
`SC-18`	Mobile Code	Base control
`SC-20`	Secure Name/Address Resolution Service (Authoritative Source)	Base control
`SC-21`	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Base control
`SC-22`	Architecture and Provisioning for Name/Address Resolution Service	Base control
`SC-23`	Session Authenticity	Base control
`SC-28`	Protection of Information At Rest	Base control
`SC-28(01)`	Cryptographic Protection	Enhancement of `SC-28`

SISystem and Information Integrity30 entries

System and Information Integrity: 14 base controls and 16 enhancements
Source identifier	Requirement title	Type
`SI-01`	Policy and Procedures	Base control
`SI-02`	Flaw Remediation	Base control
`SI-02(02)`	Automated Flaw Remediation Status	Enhancement of `SI-02`
`SI-02(06)`	Removal of Previous Versions of Software and Firmware	Enhancement of `SI-02`
`SI-03`	Malicious Code Protection	Base control
`SI-04`	System Monitoring	Base control
`SI-04(01)`	System-Wide Intrusion Detection System	Enhancement of `SI-04`
`SI-04(04)`	Inbound and Outbound Communications Traffic	Enhancement of `SI-04`
`SI-04(05)`	System-Generated Alerts	Enhancement of `SI-04`
`SI-04(23)`	Host-Based Devices	Enhancement of `SI-04`
`SI-05`	Security Alerts, Advisories, and Directives	Base control
`SI-06`	Security and Privacy Function Verification	Base control
`SI-07`	Software, Firmware, and Information Integrity	Base control
`SI-07(01)`	Integrity Checks	Enhancement of `SI-07`
`SI-07(07)`	Integration of Detection and Response	Enhancement of `SI-07`
`SI-08`	Spam Protection	Base control
`SI-08(02)`	Automatic Updates	Enhancement of `SI-08`
`SI-10`	Information Input Validation	Base control
`SI-11`	Error Handling	Base control
`SI-12`	Information Management and Retention	Base control
`SI-12(01)`	Limit Personally Identifiable Information Elements	Enhancement of `SI-12`
`SI-12(02)`	Minimize Personally Identifiable Information in Testing, Training, and Research	Enhancement of `SI-12`
`SI-12(03)`	Information Disposal	Enhancement of `SI-12`
`SI-16`	Memory Protection	Base control
`SI-18`	Personally Identifiable Information Quality Operations	Base control
`SI-18(04)`	Individual Requests	Enhancement of `SI-18`
`SI-18(05)`	Notice of Collection or Deletion	Enhancement of `SI-18`
`SI-19`	De-Identification	Base control
`SI-19(03)`	Release	Enhancement of `SI-19`
`SI-19(04)`	Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers	Enhancement of `SI-19`

SRSupply Chain Risk Management4 entries

Supply Chain Risk Management: 3 base controls and 1 enhancements
Source identifier	Requirement title	Type
`SR-01`	Policy and Procedures	Base control
`SR-02`	Supply Chain Risk Management Plan	Base control
`SR-02(01)`	Establish SCRM Team	Enhancement of `SR-02`
`SR-03`	Supply Chain Controls and Processes	Base control

Put the baseline
into practice.

Explore source requirements, evidence collection, and review for an ARC-AMPE assessment.

Request a walkthrough

Read the catalog in context.

The complete parsed baseline.

Put the baselineinto practice.

Put the baseline
into practice.