Framework · ARC-AMPE

DE-Entity Mandatory Baseline

Volume II — SSPP DE-Entity Mandatory Baseline (v1.0) · NIST SP 800-53 Rev 5 tailoring (CMS ARC-AMPE) · supersedes MARS-E ·  compliance date 2026-03-04

Every control below is bound to the shared evidence spine; state reflects the current demo tenant.

Version history & changes41 added · 26 removed · 76 renumbered or retitled since MARS-E 2.2
BASELINE2550ba9a · 2025-04-10
308
Mandatory controls
254
Evidenced
35
Scheduled
19
Gaps
Baseline evidenced
82%
ACAccess Control38/46
AC-01Policy and ProceduresBasegap
AC-02Account ManagementBaseevidenced
AC-02(01)Automated System Account ManagementEnh · AC-02scheduled
AC-02(02)Automated Temporary and Emergency Account ManagementEnh · AC-02gap
AC-02(03)Disable AccountsEnh · AC-02evidenced
AC-02(04)Automated Audit ActionsEnh · AC-02evidenced
AC-02(05)Inactivity LogoutEnh · AC-02evidenced
AC-02(07)Privileged User AccountsEnh · AC-02evidenced
AC-02(12)Account Monitoring for Atypical UsageEnh · AC-02evidenced
AC-02(13)Disable Accounts for High-Risk IndividualsEnh · AC-02evidenced
AC-03Access EnforcementBaseevidenced
AC-03(14)Individual AccessEnh · AC-03evidenced
AC-04Information Flow EnforcementBaseevidenced
AC-05Separation of DutiesBaseevidenced
AC-06Least PrivilegeBasegap
AC-06(01)Authorize Access to Security FunctionsEnh · AC-06evidenced
AC-06(02)Non-privileged Access for Nonsecurity FunctionsEnh · AC-06scheduled
AC-06(05)Privileged AccountsEnh · AC-06evidenced
AC-06(07)Review of User PrivilegesEnh · AC-06evidenced
AC-06(09)Log Use of Privileged FunctionsEnh · AC-06evidenced
AC-06(10)Prohibit Non-privileged Users from Executing Privileged FunctionsEnh · AC-06evidenced
AC-07Unsuccessful Logon AttemptsBaseevidenced
AC-08System Use NotificationBaseevidenced
AC-10Concurrent Session ControlBasescheduled
AC-11Device LockBaseevidenced
AC-12Session TerminationBaseevidenced
AC-12(01)User-Initiated LogoutsEnh · AC-12scheduled
AC-12(02)Termination MessageEnh · AC-12evidenced
AC-12(03)Timeout Warning MessageEnh · AC-12evidenced
AC-14Permitted Actions Without Identification or AuthenticationBaseevidenced
AC-17Remote AccessBaseevidenced
AC-17(01)Monitoring and ControlEnh · AC-17evidenced
AC-17(02)Protection of Confidentiality and Integrity Using EncryptionEnh · AC-17evidenced
AC-17(03)Managed Access Control PointsEnh · AC-17evidenced
AC-17(04)Privileged Commands and AccessEnh · AC-17evidenced
AC-17(09)Disconnect or Disable AccessEnh · AC-17evidenced
AC-18Wireless AccessBaseevidenced
AC-18(01)Authentication and EncryptionEnh · AC-18evidenced
AC-18(03)Disable Wireless NetworkingEnh · AC-18evidenced
AC-19Access Control for Mobile DevicesBaseevidenced
AC-19(05)Full Device and Container-based EncryptionEnh · AC-19evidenced
AC-20Use of External SystemsBaseevidenced
AC-20(01)Limits on Authorized UseEnh · AC-20evidenced
AC-20(02)Portable Storage Devices — Restricted UseEnh · AC-20evidenced
AC-21Information SharingBaseevidenced
AC-22Publicly Accessible ContentBasescheduled
ATAwareness and Training7/9
AT-01Policy and ProceduresBaseevidenced
AT-02Literacy Training and AwarenessBaseevidenced
AT-02(02)Insider ThreatEnh · AT-02evidenced
AT-02(03)Social Engineering and MiningEnh · AT-02evidenced
AT-02(04)Suspicious Communications and Anomalous System BehaviorEnh · AT-02evidenced
AT-02(05)Advanced Persistent ThreatEnh · AT-02evidenced
AT-03Role-Based TrainingBasescheduled
AT-03(05)Processing Personally Identifiable InformationEnh · AT-03evidenced
AT-04Training RecordsBasegap
AUAudit and Accountability14/18
AU-01Policy and ProceduresBaseevidenced
AU-02Event LoggingBaseevidenced
AU-03Content of Audit RecordsBasescheduled
AU-03(01)Additional Audit InformationEnh · AU-03evidenced
AU-03(03)Limit Personally Identifiable Information ElementsEnh · AU-03gap
AU-04Audit Log Storage CapacityBaseevidenced
AU-05Response to Audit Logging Processing FailuresBaseevidenced
AU-06Audit Record Review, Analysis, and ReportingBasegap
AU-06(01)Automated Process IntegrationEnh · AU-06evidenced
AU-06(03)Correlate Audit Record RepositoriesEnh · AU-06evidenced
AU-07Audit Record Reduction and Report GenerationBaseevidenced
AU-07(01)Automatic ProcessingEnh · AU-07evidenced
AU-08Time StampsBaseevidenced
AU-09Protection of Audit InformationBaseevidenced
AU-09(04)Access by Subset of Privileged UsersEnh · AU-09evidenced
AU-10Non-RepudiationBaseevidenced
AU-11Audit Record RetentionBaseevidenced
AU-12Audit Record GenerationBasescheduled
CAAssessment, Authorization, and Monitoring11/12
CA-01Policies and ProceduresBaseevidenced
CA-02Control AssessmentsBaseevidenced
CA-02(01)Independent AssessorsEnh · CA-02gap
CA-03Information ExchangeBaseevidenced
CA-05Plan of Action and MilestonesBaseevidenced
CA-06AuthorizationBaseevidenced
CA-07Continuous MonitoringBaseevidenced
CA-07(01)Independent AssessmentEnh · CA-07evidenced
CA-07(04)Risk MonitoringEnh · CA-07evidenced
CA-08Penetration TestingBaseevidenced
CA-08(01)Independent Penetration Testing Agent or TeamEnh · CA-08evidenced
CA-09Internal System ConnectionsBaseevidenced
CMConfiguration Management20/25
CM-01Policy and ProceduresBaseevidenced
CM-02Baseline ConfigurationBasescheduled
CM-02(03)Retention of Previous ConfigurationsEnh · CM-02evidenced
CM-03Configuration Change ControlBaseevidenced
CM-03(02)Testing, Validation, and Documentation of ChangesEnh · CM-03evidenced
CM-04Impact AnalysesBaseevidenced
CM-04(01)Separate Test EnvironmentsEnh · CM-04evidenced
CM-04(02)Verification of ControlsEnh · CM-04evidenced
CM-05Access Restrictions for ChangeBaseevidenced
CM-05(01)Automated Access Enforcement and Audit RecordsEnh · CM-05evidenced
CM-05(05)Privilege Limitation for Production and OperationEnh · CM-05evidenced
CM-06Configuration SettingsBaseevidenced
CM-06(01)Automated Management, Application, and VerificationEnh · CM-06evidenced
CM-07Least FunctionalityBasescheduled
CM-07(01)Periodic ReviewEnh · CM-07evidenced
CM-07(02)Prevent Program ExecutionEnh · CM-07scheduled
CM-07(05)Authorized Software - Allow by ExceptionEnh · CM-07gap
CM-08System Component InventoryBaseevidenced
CM-08(01)Updates During Installation and RemovalEnh · CM-08scheduled
CM-08(03)Automated Unauthorized Component DetectionEnh · CM-08evidenced
CM-09Configuration Management PlanBaseevidenced
CM-10Software Usage RestrictionsBaseevidenced
CM-11User-Installed SoftwareBaseevidenced
CM-12Information LocationBaseevidenced
CM-13Data Action MappingBaseevidenced
CPContingency Planning15/16
CP-01Policy and ProceduresBaseevidenced
CP-02Contingency PlanBaseevidenced
CP-02(01)Coordinate with Related PlansEnh · CP-02scheduled
CP-02(03)Resume Missions and Business FunctionsEnh · CP-02evidenced
CP-02(08)Identify Critical AssetsEnh · CP-02evidenced
CP-03Contingency TrainingBaseevidenced
CP-04Contingency Plan TestingBaseevidenced
CP-04(01)Coordinate with Related PlansEnh · CP-04evidenced
CP-06Alternate Storage SiteBaseevidenced
CP-06(01)Separation from Primary SiteEnh · CP-06evidenced
CP-06(03)AccessibilityEnh · CP-06evidenced
CP-09System BackupBaseevidenced
CP-09(01)Testing for Reliability and IntegrityEnh · CP-09evidenced
CP-09(08)Cryptographic ProtectionEnh · CP-09evidenced
CP-10System Recovery and ReconstitutionBaseevidenced
CP-10(02)Transaction RecoveryEnh · CP-10evidenced
IAIdentification and Authentication17/21
IA-01Policy and ProceduresBaseevidenced
IA-02Identification and Authentication (Organizational Users)Baseevidenced
IA-02(01)Multifactor Access to Privileged AccountsEnh · IA-02evidenced
IA-02(02)Multifactor Access to Non-Privileged AccountsEnh · IA-02evidenced
IA-02(06)Access to Accounts - Separate DeviceEnh · IA-02scheduled
IA-02(08)Access to Accounts - Replay ResistantEnh · IA-02evidenced
IA-03Device Identification and AuthenticationBaseevidenced
IA-04Identifier ManagementBaseevidenced
IA-04(04)Identify User StatusEnh · IA-04evidenced
IA-05Authenticator ManagementBasescheduled
IA-05(01)Password-Based AuthenticationEnh · IA-05evidenced
IA-05(06)Protection of AuthenticatorsEnh · IA-05evidenced
IA-05(07)Authenticator Management | No Embedded Unencrypted Static AuthenticatorsEnh · IA-05evidenced
IA-06Authenticator FeedbackBaseevidenced
IA-07Cryptographic Module AuthenticationBaseevidenced
IA-08Identification and Authentication (Non-Organizational Users)Baseevidenced
IA-08(02)Identification and Authentication (Non-Organizational Users) |Acceptance of External Party CredentialsEnh · IA-08scheduled
IA-11Re-AuthenticationBasescheduled
IA-12Identity ProofingBaseevidenced
IA-12(01)Supervisor AuthorizationEnh · IA-12evidenced
IA-12(03)Identity Evidence Validation and VerificationEnh · IA-12evidenced
IRIncident Response12/15
IR-01Policy and ProceduresBasescheduled
IR-02Incident Response TrainingBaseevidenced
IR-02(03)BreachEnh · IR-02evidenced
IR-03Incident Response TestingBaseevidenced
IR-03(02)Coordination with Related PlansEnh · IR-03evidenced
IR-04Incident HandlingBaseevidenced
IR-04(03)Continuity of OperationsEnh · IR-04evidenced
IR-04(06)Insider Threats – Specific CapabilitiesEnh · IR-04evidenced
IR-05Incident MonitoringBaseevidenced
IR-06Incident ReportingBasescheduled
IR-06(01)Automated ReportingEnh · IR-06evidenced
IR-07Incident Response AssistanceBaseevidenced
IR-07(01)Automation Support for Availability of Information and SupportEnh · IR-07evidenced
IR-08Incident Response PlanBaseevidenced
IR-08(01)BreachesEnh · IR-08scheduled
MAMaintenance11/12
MA-01Policy and ProceduresBaseevidenced
MA-02Controlled MaintenanceBaseevidenced
MA-03Maintenance ToolsBasegap
MA-03(01)Inspect ToolsEnh · MA-03evidenced
MA-03(02)Inspect MediaEnh · MA-03evidenced
MA-03(03)Prevent Unauthorized RemovalEnh · MA-03evidenced
MA-03(05)Execution with PrivilegeEnh · MA-03evidenced
MA-03(06)Software Updates and PatchesEnh · MA-03evidenced
MA-04Nonlocal MaintenanceBaseevidenced
MA-04(01)Logging and ReviewEnh · MA-04evidenced
MA-05Maintenance PersonnelBaseevidenced
MA-06Timely MaintenanceBaseevidenced
MPMedia Protection7/8
MP-01Policy and ProceduresBaseevidenced
MP-02Media AccessBaseevidenced
MP-03Media MarkingBaseevidenced
MP-04Media StorageBaseevidenced
MP-05Media TransportBasescheduled
MP-06Media SanitizationBaseevidenced
MP-06(01)Review, Approve, Track, Document, and VerifyEnh · MP-06evidenced
MP-07Media UseBaseevidenced
PEPhysical and Environmental Protection8/9
PE-01Policy and ProceduresBaseevidenced
PE-02Physical Access AuthorizationsBaseevidenced
PE-03Physical Access ControlBaseevidenced
PE-04Access Control for TransmissionBaseevidenced
PE-05Access Control for Output DevicesBaseevidenced
PE-06Monitoring Physical AccessBasegap
PE-06(01)Intrusion Alarms and Surveillance EquipmentEnh · PE-06evidenced
PE-08Visitor Access RecordsBaseevidenced
PE-16Delivery and RemovalBaseevidenced
PLPlanning5/6
PL-01Policy and ProceduresBaseevidenced
PL-02System Security and Privacy PlanBasescheduled
PL-04Rules of BehaviorBaseevidenced
PL-04(01)Social Media and External Site / Application Usage RestrictionsEnh · PL-04evidenced
PL-08Security and Privacy ArchitecturesBaseevidenced
PL-11Baseline TailoringBaseevidenced
PMProgram Management4/5
PM-04Plan of Action and Milestones ProcessBaseevidenced
PM-05System InventoryBaseevidenced
PM-05(01)Inventory of Personally Identifiable InformationEnh · PM-05evidenced
PM-21Accounting of DisclosuresBaseevidenced
PM-25Minimization of PII Used in Testing, Training, and ResearchBasescheduled
PSPersonnel Security6/8
PS-01Policy and ProceduresBaseevidenced
PS-02Position Risk DesignationBaseevidenced
PS-03Personnel ScreeningBaseevidenced
PS-04Personnel TerminationBaseevidenced
PS-05Personnel TransferBasegap
PS-06Access AgreementsBaseevidenced
PS-07External Personnel SecurityBaseevidenced
PS-08Personnel SanctionsBasescheduled
PTPersonally Identifiable Information Processing and Transparency6/10
PT-01Policy and ProceduresBaseevidenced
PT-02Authority to Process Personally Identifiable InformationBasescheduled
PT-03Personally Identifiable Information Processing PurposesBaseevidenced
PT-04ConsentBaseevidenced
PT-04(03)RevocationEnh · PT-04evidenced
PT-05Privacy NoticeBasegap
PT-05(01)Just-in-time NoticeEnh · PT-05evidenced
PT-05(02)Privacy Act StatementsEnh · PT-05gap
PT-07Specific Categories of Personally Identifiable InformationBaseevidenced
PT-07(01)Social Security NumbersEnh · PT-07gap
RARisk Assessment7/8
RA-01Policy and ProceduresBasescheduled
RA-02Security CategorizationBaseevidenced
RA-03Risk AssessmentBaseevidenced
RA-05Vulnerability Monitoring and ScanningBaseevidenced
RA-05(02)Update Vulnerabilities to be ScannedEnh · RA-05evidenced
RA-05(05)Privileged AccessEnh · RA-05evidenced
RA-07Risk ResponseBaseevidenced
RA-08Privacy Impact AssessmentsBaseevidenced
SASystem and Services Acquisition16/18
SA-01Policy and ProceduresBaseevidenced
SA-02Allocation of ResourcesBaseevidenced
SA-03System Development Life CycleBasescheduled
SA-04Acquisition ProcessBaseevidenced
SA-04(01)Functional Properties of ControlsEnh · SA-04evidenced
SA-04(02)Design and Implementation Information for Security ControlsEnh · SA-04evidenced
SA-04(09)Functions, Ports, Protocols, and Services in UseEnh · SA-04evidenced
SA-05System DocumentationBaseevidenced
SA-08Security and Privacy Engineering PrinciplesBasescheduled
SA-09External System ServicesBaseevidenced
SA-09(05)Processing, Storage, and Service LocationEnh · SA-09evidenced
SA-09(08)Processing and Storage Location - U.S. JurisdictionEnh · SA-09evidenced
SA-10Developer Configuration ManagementBaseevidenced
SA-11Developer Testing and EvaluationBaseevidenced
SA-15Development Process, Standards, and ToolsBaseevidenced
SA-15(12)Minimize Personally Identifiable InformationEnh · SA-15evidenced
SA-17Developer Security Architecture and DesignBaseevidenced
SA-22Unsupported System ComponentsBaseevidenced
SCSystem and Communications Protection23/28
SC-01Policy and ProceduresBaseevidenced
SC-02Separation of System and User FunctionalityBaseevidenced
SC-04Information in Shared System ResourcesBaseevidenced
SC-05Denial-of-Service ProtectionBaseevidenced
SC-07Boundary ProtectionBaseevidenced
SC-07(03)Access PointsEnh · SC-07evidenced
SC-07(04)External Telecommunications ServicesEnh · SC-07evidenced
SC-07(05)Deny By Default — Allow By ExceptionEnh · SC-07evidenced
SC-07(07)Split Tunneling for Remote DevicesEnh · SC-07gap
SC-07(08)Route Traffic to Authenticated Proxy ServersEnh · SC-07evidenced
SC-07(12)Host-Based ProtectionEnh · SC-07gap
SC-07(18)Fail SecureEnh · SC-07evidenced
SC-7(24)Boundary Protection | Personally Identifiable InformationEnh · SC-7evidenced
SC-7(29)Boundary Protection | Separate Subnets to Isolate FunctionsEnh · SC-7gap
SC-08Transmission Confidentiality and IntegrityBaseevidenced
SC-08(01)Cryptographic ProtectionEnh · SC-08evidenced
SC-08(02)Pre- and Post-Transmission HandlingEnh · SC-08evidenced
SC-10Network DisconnectBaseevidenced
SC-12Cryptographic Key Establishment and ManagementBaseevidenced
SC-13Cryptographic ProtectionBaseevidenced
SC-17Public Key Infrastructure CertificatesBaseevidenced
SC-18Mobile CodeBasegap
SC-20Secure Name/Address Resolution Service (Authoritative Source)Basescheduled
SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)Baseevidenced
SC-22Architecture and Provisioning for Name/Address Resolution ServiceBaseevidenced
SC-23Session AuthenticityBaseevidenced
SC-28Protection of Information At RestBaseevidenced
SC-28(01)Cryptographic ProtectionEnh · SC-28evidenced
SISystem and Information Integrity23/30
SI-01Policy and ProceduresBaseevidenced
SI-02Flaw RemediationBasescheduled
SI-02(02)Automated Flaw Remediation StatusEnh · SI-02evidenced
SI-02(06)Removal of Previous Versions of Software and FirmwareEnh · SI-02scheduled
SI-03Malicious Code ProtectionBaseevidenced
SI-04System MonitoringBaseevidenced
SI-04(01)System-Wide Intrusion Detection SystemEnh · SI-04evidenced
SI-04(04)Inbound and Outbound Communications TrafficEnh · SI-04evidenced
SI-04(05)System-Generated AlertsEnh · SI-04evidenced
SI-04(23)Host-Based DevicesEnh · SI-04evidenced
SI-05Security Alerts, Advisories, and DirectivesBasescheduled
SI-06Security and Privacy Function VerificationBaseevidenced
SI-07Software, Firmware, and Information IntegrityBaseevidenced
SI-07(01)Integrity ChecksEnh · SI-07scheduled
SI-07(07)Integration of Detection and ResponseEnh · SI-07scheduled
SI-08Spam ProtectionBasegap
SI-08(02)Automatic UpdatesEnh · SI-08evidenced
SI-10Information Input ValidationBaseevidenced
SI-11Error HandlingBaseevidenced
SI-12Information Management and RetentionBaseevidenced
SI-12(01)Limit Personally Identifiable Information ElementsEnh · SI-12evidenced
SI-12(02)Minimize Personally Identifiable Information in Testing, Training, and ResearchEnh · SI-12evidenced
SI-12(03)Information DisposalEnh · SI-12evidenced
SI-16Memory ProtectionBaseevidenced
SI-18Personally Identifiable Information Quality OperationsBaseevidenced
SI-18(04)Individual RequestsEnh · SI-18evidenced
SI-18(05)Notice of Collection or DeletionEnh · SI-18evidenced
SI-19De-IdentificationBasescheduled
SI-19(03)ReleaseEnh · SI-19evidenced
SI-19(04)Removal, Masking, Encryption, Hashing, or Replacement of Direct IdentifiersEnh · SI-19evidenced
SRSupply Chain Risk Management4/4
SR-01Policy and ProceduresBaseevidenced
SR-02Supply Chain Risk Management PlanBaseevidenced
SR-02(01)Establish SCRM TeamEnh · SR-02evidenced
SR-03Supply Chain Controls and ProcessesBaseevidenced