Framework · ARC-AMPE
DE-Entity Mandatory Baseline
Volume II — SSPP DE-Entity Mandatory Baseline (v1.0) · NIST SP 800-53 Rev 5 tailoring (CMS ARC-AMPE) · supersedes MARS-E · compliance date 2026-03-04
The parsed catalog, as ingested from the CMS workbook. Evidence state against these controls is a tenant fact and is shown inside the workspace, not here.
Module page & standingVersion history & changes41 added · 26 removed · 76 renumbered or retitled since MARS-E 2.2BASELINE2550ba9a · 2025-04-10
308
Mandatory controls
175
Base controls
133
Enhancements
20
Families
Source
ARC-AMPE_Vol2_SSPP-DE-Entity_v1.0-508_07072025.xlsx, sheet “DEE Mandatory Baseline”
ACAccess Control18 base · 28 enh46 controls
| AC-01 | Policy and Procedures | Base |
| AC-02 | Account Management | Base |
| AC-02(01) | Automated System Account Management | Enh · AC-02 |
| AC-02(02) | Automated Temporary and Emergency Account Management | Enh · AC-02 |
| AC-02(03) | Disable Accounts | Enh · AC-02 |
| AC-02(04) | Automated Audit Actions | Enh · AC-02 |
| AC-02(05) | Inactivity Logout | Enh · AC-02 |
| AC-02(07) | Privileged User Accounts | Enh · AC-02 |
| AC-02(12) | Account Monitoring for Atypical Usage | Enh · AC-02 |
| AC-02(13) | Disable Accounts for High-Risk Individuals | Enh · AC-02 |
| AC-03 | Access Enforcement | Base |
| AC-03(14) | Individual Access | Enh · AC-03 |
| AC-04 | Information Flow Enforcement | Base |
| AC-05 | Separation of Duties | Base |
| AC-06 | Least Privilege | Base |
| AC-06(01) | Authorize Access to Security Functions | Enh · AC-06 |
| AC-06(02) | Non-privileged Access for Nonsecurity Functions | Enh · AC-06 |
| AC-06(05) | Privileged Accounts | Enh · AC-06 |
| AC-06(07) | Review of User Privileges | Enh · AC-06 |
| AC-06(09) | Log Use of Privileged Functions | Enh · AC-06 |
| AC-06(10) | Prohibit Non-privileged Users from Executing Privileged Functions | Enh · AC-06 |
| AC-07 | Unsuccessful Logon Attempts | Base |
| AC-08 | System Use Notification | Base |
| AC-10 | Concurrent Session Control | Base |
| AC-11 | Device Lock | Base |
| AC-12 | Session Termination | Base |
| AC-12(01) | User-Initiated Logouts | Enh · AC-12 |
| AC-12(02) | Termination Message | Enh · AC-12 |
| AC-12(03) | Timeout Warning Message | Enh · AC-12 |
| AC-14 | Permitted Actions Without Identification or Authentication | Base |
| AC-17 | Remote Access | Base |
| AC-17(01) | Monitoring and Control | Enh · AC-17 |
| AC-17(02) | Protection of Confidentiality and Integrity Using Encryption | Enh · AC-17 |
| AC-17(03) | Managed Access Control Points | Enh · AC-17 |
| AC-17(04) | Privileged Commands and Access | Enh · AC-17 |
| AC-17(09) | Disconnect or Disable Access | Enh · AC-17 |
| AC-18 | Wireless Access | Base |
| AC-18(01) | Authentication and Encryption | Enh · AC-18 |
| AC-18(03) | Disable Wireless Networking | Enh · AC-18 |
| AC-19 | Access Control for Mobile Devices | Base |
| AC-19(05) | Full Device and Container-based Encryption | Enh · AC-19 |
| AC-20 | Use of External Systems | Base |
| AC-20(01) | Limits on Authorized Use | Enh · AC-20 |
| AC-20(02) | Portable Storage Devices — Restricted Use | Enh · AC-20 |
| AC-21 | Information Sharing | Base |
| AC-22 | Publicly Accessible Content | Base |
ATAwareness and Training4 base · 5 enh9 controls
| AT-01 | Policy and Procedures | Base |
| AT-02 | Literacy Training and Awareness | Base |
| AT-02(02) | Insider Threat | Enh · AT-02 |
| AT-02(03) | Social Engineering and Mining | Enh · AT-02 |
| AT-02(04) | Suspicious Communications and Anomalous System Behavior | Enh · AT-02 |
| AT-02(05) | Advanced Persistent Threat | Enh · AT-02 |
| AT-03 | Role-Based Training | Base |
| AT-03(05) | Processing Personally Identifiable Information | Enh · AT-03 |
| AT-04 | Training Records | Base |
AUAudit and Accountability12 base · 6 enh18 controls
| AU-01 | Policy and Procedures | Base |
| AU-02 | Event Logging | Base |
| AU-03 | Content of Audit Records | Base |
| AU-03(01) | Additional Audit Information | Enh · AU-03 |
| AU-03(03) | Limit Personally Identifiable Information Elements | Enh · AU-03 |
| AU-04 | Audit Log Storage Capacity | Base |
| AU-05 | Response to Audit Logging Processing Failures | Base |
| AU-06 | Audit Record Review, Analysis, and Reporting | Base |
| AU-06(01) | Automated Process Integration | Enh · AU-06 |
| AU-06(03) | Correlate Audit Record Repositories | Enh · AU-06 |
| AU-07 | Audit Record Reduction and Report Generation | Base |
| AU-07(01) | Automatic Processing | Enh · AU-07 |
| AU-08 | Time Stamps | Base |
| AU-09 | Protection of Audit Information | Base |
| AU-09(04) | Access by Subset of Privileged Users | Enh · AU-09 |
| AU-10 | Non-Repudiation | Base |
| AU-11 | Audit Record Retention | Base |
| AU-12 | Audit Record Generation | Base |
CAAssessment, Authorization, and Monitoring8 base · 4 enh12 controls
| CA-01 | Policies and Procedures | Base |
| CA-02 | Control Assessments | Base |
| CA-02(01) | Independent Assessors | Enh · CA-02 |
| CA-03 | Information Exchange | Base |
| CA-05 | Plan of Action and Milestones | Base |
| CA-06 | Authorization | Base |
| CA-07 | Continuous Monitoring | Base |
| CA-07(01) | Independent Assessment | Enh · CA-07 |
| CA-07(04) | Risk Monitoring | Enh · CA-07 |
| CA-08 | Penetration Testing | Base |
| CA-08(01) | Independent Penetration Testing Agent or Team | Enh · CA-08 |
| CA-09 | Internal System Connections | Base |
CMConfiguration Management13 base · 12 enh25 controls
| CM-01 | Policy and Procedures | Base |
| CM-02 | Baseline Configuration | Base |
| CM-02(03) | Retention of Previous Configurations | Enh · CM-02 |
| CM-03 | Configuration Change Control | Base |
| CM-03(02) | Testing, Validation, and Documentation of Changes | Enh · CM-03 |
| CM-04 | Impact Analyses | Base |
| CM-04(01) | Separate Test Environments | Enh · CM-04 |
| CM-04(02) | Verification of Controls | Enh · CM-04 |
| CM-05 | Access Restrictions for Change | Base |
| CM-05(01) | Automated Access Enforcement and Audit Records | Enh · CM-05 |
| CM-05(05) | Privilege Limitation for Production and Operation | Enh · CM-05 |
| CM-06 | Configuration Settings | Base |
| CM-06(01) | Automated Management, Application, and Verification | Enh · CM-06 |
| CM-07 | Least Functionality | Base |
| CM-07(01) | Periodic Review | Enh · CM-07 |
| CM-07(02) | Prevent Program Execution | Enh · CM-07 |
| CM-07(05) | Authorized Software - Allow by Exception | Enh · CM-07 |
| CM-08 | System Component Inventory | Base |
| CM-08(01) | Updates During Installation and Removal | Enh · CM-08 |
| CM-08(03) | Automated Unauthorized Component Detection | Enh · CM-08 |
| CM-09 | Configuration Management Plan | Base |
| CM-10 | Software Usage Restrictions | Base |
| CM-11 | User-Installed Software | Base |
| CM-12 | Information Location | Base |
| CM-13 | Data Action Mapping | Base |
CPContingency Planning7 base · 9 enh16 controls
| CP-01 | Policy and Procedures | Base |
| CP-02 | Contingency Plan | Base |
| CP-02(01) | Coordinate with Related Plans | Enh · CP-02 |
| CP-02(03) | Resume Missions and Business Functions | Enh · CP-02 |
| CP-02(08) | Identify Critical Assets | Enh · CP-02 |
| CP-03 | Contingency Training | Base |
| CP-04 | Contingency Plan Testing | Base |
| CP-04(01) | Coordinate with Related Plans | Enh · CP-04 |
| CP-06 | Alternate Storage Site | Base |
| CP-06(01) | Separation from Primary Site | Enh · CP-06 |
| CP-06(03) | Accessibility | Enh · CP-06 |
| CP-09 | System Backup | Base |
| CP-09(01) | Testing for Reliability and Integrity | Enh · CP-09 |
| CP-09(08) | Cryptographic Protection | Enh · CP-09 |
| CP-10 | System Recovery and Reconstitution | Base |
| CP-10(02) | Transaction Recovery | Enh · CP-10 |
IAIdentification and Authentication10 base · 11 enh21 controls
| IA-01 | Policy and Procedures | Base |
| IA-02 | Identification and Authentication (Organizational Users) | Base |
| IA-02(01) | Multifactor Access to Privileged Accounts | Enh · IA-02 |
| IA-02(02) | Multifactor Access to Non-Privileged Accounts | Enh · IA-02 |
| IA-02(06) | Access to Accounts - Separate Device | Enh · IA-02 |
| IA-02(08) | Access to Accounts - Replay Resistant | Enh · IA-02 |
| IA-03 | Device Identification and Authentication | Base |
| IA-04 | Identifier Management | Base |
| IA-04(04) | Identify User Status | Enh · IA-04 |
| IA-05 | Authenticator Management | Base |
| IA-05(01) | Password-Based Authentication | Enh · IA-05 |
| IA-05(06) | Protection of Authenticators | Enh · IA-05 |
| IA-05(07) | Authenticator Management | No Embedded Unencrypted Static Authenticators | Enh · IA-05 |
| IA-06 | Authenticator Feedback | Base |
| IA-07 | Cryptographic Module Authentication | Base |
| IA-08 | Identification and Authentication (Non-Organizational Users) | Base |
| IA-08(02) | Identification and Authentication (Non-Organizational Users) |Acceptance of External Party Credentials | Enh · IA-08 |
| IA-11 | Re-Authentication | Base |
| IA-12 | Identity Proofing | Base |
| IA-12(01) | Supervisor Authorization | Enh · IA-12 |
| IA-12(03) | Identity Evidence Validation and Verification | Enh · IA-12 |
IRIncident Response8 base · 7 enh15 controls
| IR-01 | Policy and Procedures | Base |
| IR-02 | Incident Response Training | Base |
| IR-02(03) | Breach | Enh · IR-02 |
| IR-03 | Incident Response Testing | Base |
| IR-03(02) | Coordination with Related Plans | Enh · IR-03 |
| IR-04 | Incident Handling | Base |
| IR-04(03) | Continuity of Operations | Enh · IR-04 |
| IR-04(06) | Insider Threats – Specific Capabilities | Enh · IR-04 |
| IR-05 | Incident Monitoring | Base |
| IR-06 | Incident Reporting | Base |
| IR-06(01) | Automated Reporting | Enh · IR-06 |
| IR-07 | Incident Response Assistance | Base |
| IR-07(01) | Automation Support for Availability of Information and Support | Enh · IR-07 |
| IR-08 | Incident Response Plan | Base |
| IR-08(01) | Breaches | Enh · IR-08 |
MAMaintenance6 base · 6 enh12 controls
| MA-01 | Policy and Procedures | Base |
| MA-02 | Controlled Maintenance | Base |
| MA-03 | Maintenance Tools | Base |
| MA-03(01) | Inspect Tools | Enh · MA-03 |
| MA-03(02) | Inspect Media | Enh · MA-03 |
| MA-03(03) | Prevent Unauthorized Removal | Enh · MA-03 |
| MA-03(05) | Execution with Privilege | Enh · MA-03 |
| MA-03(06) | Software Updates and Patches | Enh · MA-03 |
| MA-04 | Nonlocal Maintenance | Base |
| MA-04(01) | Logging and Review | Enh · MA-04 |
| MA-05 | Maintenance Personnel | Base |
| MA-06 | Timely Maintenance | Base |
MPMedia Protection7 base · 1 enh8 controls
| MP-01 | Policy and Procedures | Base |
| MP-02 | Media Access | Base |
| MP-03 | Media Marking | Base |
| MP-04 | Media Storage | Base |
| MP-05 | Media Transport | Base |
| MP-06 | Media Sanitization | Base |
| MP-06(01) | Review, Approve, Track, Document, and Verify | Enh · MP-06 |
| MP-07 | Media Use | Base |
PEPhysical and Environmental Protection8 base · 1 enh9 controls
| PE-01 | Policy and Procedures | Base |
| PE-02 | Physical Access Authorizations | Base |
| PE-03 | Physical Access Control | Base |
| PE-04 | Access Control for Transmission | Base |
| PE-05 | Access Control for Output Devices | Base |
| PE-06 | Monitoring Physical Access | Base |
| PE-06(01) | Intrusion Alarms and Surveillance Equipment | Enh · PE-06 |
| PE-08 | Visitor Access Records | Base |
| PE-16 | Delivery and Removal | Base |
PLPlanning5 base · 1 enh6 controls
| PL-01 | Policy and Procedures | Base |
| PL-02 | System Security and Privacy Plan | Base |
| PL-04 | Rules of Behavior | Base |
| PL-04(01) | Social Media and External Site / Application Usage Restrictions | Enh · PL-04 |
| PL-08 | Security and Privacy Architectures | Base |
| PL-11 | Baseline Tailoring | Base |
PMProgram Management4 base · 1 enh5 controls
| PM-04 | Plan of Action and Milestones Process | Base |
| PM-05 | System Inventory | Base |
| PM-05(01) | Inventory of Personally Identifiable Information | Enh · PM-05 |
| PM-21 | Accounting of Disclosures | Base |
| PM-25 | Minimization of PII Used in Testing, Training, and Research | Base |
PSPersonnel Security8 base · 0 enh8 controls
| PS-01 | Policy and Procedures | Base |
| PS-02 | Position Risk Designation | Base |
| PS-03 | Personnel Screening | Base |
| PS-04 | Personnel Termination | Base |
| PS-05 | Personnel Transfer | Base |
| PS-06 | Access Agreements | Base |
| PS-07 | External Personnel Security | Base |
| PS-08 | Personnel Sanctions | Base |
PTPersonally Identifiable Information Processing and Transparency6 base · 4 enh10 controls
| PT-01 | Policy and Procedures | Base |
| PT-02 | Authority to Process Personally Identifiable Information | Base |
| PT-03 | Personally Identifiable Information Processing Purposes | Base |
| PT-04 | Consent | Base |
| PT-04(03) | Revocation | Enh · PT-04 |
| PT-05 | Privacy Notice | Base |
| PT-05(01) | Just-in-time Notice | Enh · PT-05 |
| PT-05(02) | Privacy Act Statements | Enh · PT-05 |
| PT-07 | Specific Categories of Personally Identifiable Information | Base |
| PT-07(01) | Social Security Numbers | Enh · PT-07 |
RARisk Assessment6 base · 2 enh8 controls
| RA-01 | Policy and Procedures | Base |
| RA-02 | Security Categorization | Base |
| RA-03 | Risk Assessment | Base |
| RA-05 | Vulnerability Monitoring and Scanning | Base |
| RA-05(02) | Update Vulnerabilities to be Scanned | Enh · RA-05 |
| RA-05(05) | Privileged Access | Enh · RA-05 |
| RA-07 | Risk Response | Base |
| RA-08 | Privacy Impact Assessments | Base |
SASystem and Services Acquisition12 base · 6 enh18 controls
| SA-01 | Policy and Procedures | Base |
| SA-02 | Allocation of Resources | Base |
| SA-03 | System Development Life Cycle | Base |
| SA-04 | Acquisition Process | Base |
| SA-04(01) | Functional Properties of Controls | Enh · SA-04 |
| SA-04(02) | Design and Implementation Information for Security Controls | Enh · SA-04 |
| SA-04(09) | Functions, Ports, Protocols, and Services in Use | Enh · SA-04 |
| SA-05 | System Documentation | Base |
| SA-08 | Security and Privacy Engineering Principles | Base |
| SA-09 | External System Services | Base |
| SA-09(05) | Processing, Storage, and Service Location | Enh · SA-09 |
| SA-09(08) | Processing and Storage Location - U.S. Jurisdiction | Enh · SA-09 |
| SA-10 | Developer Configuration Management | Base |
| SA-11 | Developer Testing and Evaluation | Base |
| SA-15 | Development Process, Standards, and Tools | Base |
| SA-15(12) | Minimize Personally Identifiable Information | Enh · SA-15 |
| SA-17 | Developer Security Architecture and Design | Base |
| SA-22 | Unsupported System Components | Base |
SCSystem and Communications Protection16 base · 12 enh28 controls
| SC-01 | Policy and Procedures | Base |
| SC-02 | Separation of System and User Functionality | Base |
| SC-04 | Information in Shared System Resources | Base |
| SC-05 | Denial-of-Service Protection | Base |
| SC-07 | Boundary Protection | Base |
| SC-07(03) | Access Points | Enh · SC-07 |
| SC-07(04) | External Telecommunications Services | Enh · SC-07 |
| SC-07(05) | Deny By Default — Allow By Exception | Enh · SC-07 |
| SC-07(07) | Split Tunneling for Remote Devices | Enh · SC-07 |
| SC-07(08) | Route Traffic to Authenticated Proxy Servers | Enh · SC-07 |
| SC-07(12) | Host-Based Protection | Enh · SC-07 |
| SC-07(18) | Fail Secure | Enh · SC-07 |
| SC-07(24) | Boundary Protection | Personally Identifiable Information | Enh · SC-07 |
| SC-07(29) | Boundary Protection | Separate Subnets to Isolate Functions | Enh · SC-07 |
| SC-08 | Transmission Confidentiality and Integrity | Base |
| SC-08(01) | Cryptographic Protection | Enh · SC-08 |
| SC-08(02) | Pre- and Post-Transmission Handling | Enh · SC-08 |
| SC-10 | Network Disconnect | Base |
| SC-12 | Cryptographic Key Establishment and Management | Base |
| SC-13 | Cryptographic Protection | Base |
| SC-17 | Public Key Infrastructure Certificates | Base |
| SC-18 | Mobile Code | Base |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | Base |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | Base |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | Base |
| SC-23 | Session Authenticity | Base |
| SC-28 | Protection of Information At Rest | Base |
| SC-28(01) | Cryptographic Protection | Enh · SC-28 |
SISystem and Information Integrity14 base · 16 enh30 controls
| SI-01 | Policy and Procedures | Base |
| SI-02 | Flaw Remediation | Base |
| SI-02(02) | Automated Flaw Remediation Status | Enh · SI-02 |
| SI-02(06) | Removal of Previous Versions of Software and Firmware | Enh · SI-02 |
| SI-03 | Malicious Code Protection | Base |
| SI-04 | System Monitoring | Base |
| SI-04(01) | System-Wide Intrusion Detection System | Enh · SI-04 |
| SI-04(04) | Inbound and Outbound Communications Traffic | Enh · SI-04 |
| SI-04(05) | System-Generated Alerts | Enh · SI-04 |
| SI-04(23) | Host-Based Devices | Enh · SI-04 |
| SI-05 | Security Alerts, Advisories, and Directives | Base |
| SI-06 | Security and Privacy Function Verification | Base |
| SI-07 | Software, Firmware, and Information Integrity | Base |
| SI-07(01) | Integrity Checks | Enh · SI-07 |
| SI-07(07) | Integration of Detection and Response | Enh · SI-07 |
| SI-08 | Spam Protection | Base |
| SI-08(02) | Automatic Updates | Enh · SI-08 |
| SI-10 | Information Input Validation | Base |
| SI-11 | Error Handling | Base |
| SI-12 | Information Management and Retention | Base |
| SI-12(01) | Limit Personally Identifiable Information Elements | Enh · SI-12 |
| SI-12(02) | Minimize Personally Identifiable Information in Testing, Training, and Research | Enh · SI-12 |
| SI-12(03) | Information Disposal | Enh · SI-12 |
| SI-16 | Memory Protection | Base |
| SI-18 | Personally Identifiable Information Quality Operations | Base |
| SI-18(04) | Individual Requests | Enh · SI-18 |
| SI-18(05) | Notice of Collection or Deletion | Enh · SI-18 |
| SI-19 | De-Identification | Base |
| SI-19(03) | Release | Enh · SI-19 |
| SI-19(04) | Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers | Enh · SI-19 |
SRSupply Chain Risk Management3 base · 1 enh4 controls
| SR-01 | Policy and Procedures | Base |
| SR-02 | Supply Chain Risk Management Plan | Base |
| SR-02(01) | Establish SCRM Team | Enh · SR-02 |
| SR-03 | Supply Chain Controls and Processes | Base |