System and Information Integrity Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for system and information integrity in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers system and information integrity: flaw remediation, malicious code protection, monitoring, and integrity verification. New flaws and malicious code appear daily, so remediation speed and detection depth determine the Organization’s exposure. The Organization must remediate flaws within risk-based timelines. It must deploy endpoint detection and response (EDR) across the enterprise under OMB M-22-01 and give the Cybersecurity and Infrastructure Security Agency (CISA) access as directed. It must protect against malicious code enterprise-wide, monitor systems continuously with the Security Operations Center (SOC), handle security alerts including CISA advisories, and comply with directed actions. It must verify the integrity of software, firmware, and information.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• ID.IM — Improvements (Identify function)
• PR.PS — Platform Security (Protect function)
• PR.IR — Technology Infrastructure Resilience (Protect function)
• DE.CM — Continuous Monitoring (Detect function)
• DE.AE — Adverse Event Analysis (Detect function)
• RS.AN — Incident Analysis (Respond function)
• RS.MI — Incident Mitigation (Respond function)
• RC.RP — Recovery Plan Execution (Recover function)

These categories fall under the Detect, Identify, Protect, Recover, Respond function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every system and information integrity control in the low baseline of FIPS 200 and NIST SP 800-53B:

• SI-01 — Policy and Procedures
• SI-02 — Flaw Remediation
• SI-03 — Malicious Code Protection
• SI-04 — System Monitoring
• SI-05 — Security Alerts, Advisories, and Directives
• SI-12 — Information Management and Retention
• SI-12(1) — Limit Personally Identifiable Information Elements
• SI-12(2) — Minimize Personally Identifiable Information in Testing, Training, and Research
• SI-12(3) — Information Disposal
• SI-18 — Personally Identifiable Information Quality Operations
• SI-18(4) — Individual Requests
• SI-19 — De-identification

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA BOD 25-01: Implementing Secure Practices for Cloud Services, December 17, 2024.
• CISA BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy, September 2, 2020.
• OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (EDR), October 8, 2021.
• OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the SI control family. They add to the NIST SP 800-53 control requirements in the Policy section.

OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents through EDR

• The organization must ensure endpoint data is consolidated, retained, and archived to support analysis and insight as defined in CISA’s technical reference architecture. EDR solutions must be consistent with applicable privacy and statistical laws. (OMB M-22-01, §3)

CISA BOD 26-04: Prioritizing Security Updates Based on Risk

• The organization must follow CISA’s Internet Exposure Reduction Guidance to determine if vulnerable assets are publicly exposed, and must prioritize remediation of internet-exposed vulnerabilities over internal-only vulnerabilities. (CISA BOD 26-04, §2)
• The organization must track and report remediation status for all KEV catalog vulnerabilities, consolidating federal vulnerability remediation guidelines under a single directive. (CISA BOD 26-04, §3)

CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection

• The organization must conduct regular vulnerability detection across all assets and share results with CISA. Asset visibility is a prerequisite for effective patching, configuration management, and security lifecycle management. (CISA BOD 23-01, §2)

CISA BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy

• The organization must develop and publish a vulnerability disclosure policy (VDP) that authorizes good-faith security research on internet-facing systems and gives a clear process for receiving and responding to reports. (CISA BOD 20-01, §1)
• The organization must establish a vulnerability handling process that includes triage, remediation timelines, and communication with reporters. The VDP must include clear authorization language to protect good-faith researchers from legal action. (CISA BOD 20-01, §2)

OMB M-23-02: Migrating to Post-Quantum Cryptography

• The organization must conduct a prioritized inventory of all cryptographic systems, focusing first on systems that: use asymmetric encryption for logical access control, contain data expected to remain sensitive beyond 2035, or use algorithms vulnerable to quantum cryptanalysis. (OMB M-23-02, §II.A)

OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography

• The organization must establish or update an internal governance structure with defined roles to oversee PQC migration, integrate PQC readiness into existing governance, and submit a PQC Migration Plan to OMB and ONCD within 120 days of the memo, aligned to NIST IR 8547, containing a risk-based system prioritization strategy and timelines and milestones for all migration phases. Deadline: Plan due 2026-10-22. (OMB M-26-15, Action Two)

44 U.S.C. 2911: Disclosure requirement for official business conducted using non-official electronic messaging accounts

• The organization must make sure that staff who create or send a record from a non-official messaging account copy an official account, or forward a complete copy to it within 20 days. Deadline: 20 days after the message is created or sent. (44 U.S.C. 2911)

NARA Bulletin 2023-02: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages

• The organization must manage text, chat, and instant messages about agency business as federal records, and do not let messaging tools delete them before the records schedule allows. (NARA Bulletin 2023-02)

3. Policy #

The Organization must implement and maintain its system and information integrity controls to meet the following requirements:

SI-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: DE.CM (Continuous Monitoring)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] system and information integrity policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and
3. Review and update the current system and information integrity:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep a system and information integrity policy at the organization level and at the system level, with procedures that put each requirement into practice. The CISO manages the development, documentation, and distribution of both documents. The CISO delivers them to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders when they are issued and after every revision. The policy and procedures must stay consistent with the laws, directives, and standards that apply to the Organization. These include the endpoint detection requirements in OMB M-22-01 and the CISA vulnerability directives that apply to this family. The CISO must review and update both documents every two years, and sooner when the Organization’s technology, enterprise architecture, or data types change.

SI-02 — Flaw Remediation #

Baselines: Low / Moderate / High / High Value Asset (HVA) overlay CSF 2.0: ID.IM (Improvements), PR.PS (Platform Security), PR.IR (Technology Infrastructure Resilience), DE.CM (Continuous Monitoring)

Requirement:

1. Identify, report, and correct system flaws;
2. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
3. Install security-relevant software and firmware updates within thirty (30) days of release of updates of the release of the updates; and
4. Incorporate flaw remediation into the organizational configuration management process.

Implementation guidance:

System Owners must identify, report, and correct flaws in their systems. Administrators must test security-relevant software and firmware updates for effectiveness and side effects before they install them. System Owners must install each update by the finding’s due date: the earliest of the CISA Binding Operational Directive (BOD) 26-04 Table 1 timeline and the RA-05 timeframe for its severity. Under CISA BOD 26-04, the Organization tracks each vulnerability listed in the CISA Known Exploited Vulnerabilities (KEV) catalog until it is fixed and reports its status. Vulnerabilities on internet-exposed systems take priority over vulnerabilities on internal-only systems. System Owners must remediate flaws through the configuration management process, so that each fix is a tracked and verifiable change. System Owners own remediation for their systems, and the ISSO reports remediation status. Administrators must accept updates only from authorized sources.

SI-03 — Malicious Code Protection #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: PR.PS (Platform Security), DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis)

Requirement:

1. Implement signature based and non-signature based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
2. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
3. Configure malicious code protection mechanisms to:

1. Perform periodic scans of the system at least weekly and real-time scans of files from external sources at to include endpoints and network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy; and
2. to include blocking and quarantining malicious code; and send alert to administrator or defined security personnel near-realtime in response to malicious code detection; and

4. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.

Implementation guidance:

The Organization must run signature-based and behavior-based malicious code protection at system entry and exit points and on every endpoint. The EDR tools detect and remove malicious code on hosts, and the secure web gateway inspects web traffic at the network edge. Administrators must keep the protection content updating automatically as vendors release it, under the configuration management process. Administrators must configure the tools to scan each system at least every week. The tools must also scan files from external sources in real time, at endpoints and at network entry and exit points, as users download, open, or run them. When a tool detects malicious code, it blocks and quarantines the code and alerts the SOC, the incident response team, the System Owner, the ISSO, and the system administrators. The SOC must assess each suspected false positive and tune the tools, so that the protection does not disrupt availability.

SI-04 — System Monitoring #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: ID.IM (Improvements), PR.PS (Platform Security), PR.IR (Technology Infrastructure Resilience), DE.CM (Continuous Monitoring)

Requirement:

1. Monitor the system to detect:

1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives — to be defined]; and
2. Unauthorized local, network, and remote connections;

2. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods — to be defined];
3. Invoke internal monitoring capabilities or deploy monitoring devices:

1. Strategically within the system to collect organization-determined essential information; and
2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;

4. Analyze detected events and anomalies;
5. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
6. Obtain legal opinion regarding system monitoring activities; and
7. Provide [Assignment: organization-defined system monitoring information — to be defined] to [Assignment: organization-defined personnel or roles — to be defined] [Selection (one or more): as needed; [organization-defined] — to be defined].

Implementation guidance:

The Organization must monitor its systems to detect attacks and signs of attack. Monitoring follows the objectives in the Incident Response Plan and the Continuous Monitoring Plan. The SOC must monitor for the irregularities and anomalies that signal a malfunction or a compromise, and for unauthorized local, network, and remote connections. The secure web gateway monitors the boundary, the EDR tools collect endpoint telemetry, and the security information and event management (SIEM) system correlates all of it. The SOC must analyze the events these tools detect. The CISO must raise the level of monitoring when the risk to operations, assets, or individuals rises. The Organization must have a legal opinion that covers the scope of its monitoring. The SOC must send alerts, log entries, and artifacts of potential or actual cybersecurity events to the SOC Manager, the incident response team, the System Owner, the ISSO, and the CISO. The SOC must send them [SI-04 parameter 5 — to be defined], after a significant change in the threat environment, and as events require.

SI-05 — Security Alerts, Advisories, and Directives #

Baselines: Low / Moderate / High CSF 2.0: ID.IM (Improvements), DE.CM (Continuous Monitoring), DE.AE (Adverse Event Analysis), RS.AN (Incident Analysis)

Requirement:

1. Receive system security alerts, advisories, and directives from CISA on an ongoing basis;
2. Generate internal security alerts, advisories, and directives as deemed necessary;
3. Disseminate security alerts, advisories, and directives to: to include system security personnel and administrators with configuration/patch-management responsibilities; and
4. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.

Implementation guidance:

The Organization must receive security alerts, advisories, and directives on an ongoing basis from at least the Enterprise Security Operations Center, the agency incident response team, CISA, OMB, and product vendors. The SOC must issue internal alerts and advisories when conditions call for them. The SOC must send alerts, advisories, and directives to the System Owners, ISSOs, and system administrators who must act on them. When the scope requires, the SOC must also send them to the IT office, the wider workforce, contract vendors, and the Organization’s Federal Risk and Authorization Management Program (FedRAMP) cloud service providers. The owner of each security directive must implement it within the timeframe the directive sets. When the Organization cannot comply in time, the CISO must notify the issuing organization of the degree of noncompliance. Every directive must have an owner, a deadline, and a tracked status.

SI-12 — Information Management and Retention #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.PS (Platform Security)

Requirement:

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

Implementation guidance:

System Owners must manage and retain the information in their systems and the information those systems produce. They must follow the laws, executive orders, directives, regulations, standards, guidelines, and operational requirements that apply, and the National Archives and Records Administration (NARA)-approved records schedules. System Owners must apply the retention period each information type requires and coordinate with records management personnel. Security records follow the same rules. The SIEM system keeps audit logs for twelve months in active storage and eighteen months in cold storage, under the logging requirements. When the retention period ends, System Owners must dispose of the information deliberately and document the disposal. They must never leave disposal to storage defaults.

SI-12(1) — Limit Personally Identifiable Information Elements #

Baselines: Privacy

Requirement:

Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [Assignment: organization-defined elements of personally identifiable information — to be defined].

Implementation guidance:

Systems must process only these elements of personally identifiable information (PII): [SI-12(1) parameter 1 — to be defined]. The System Owner must make sure the system collects, uses, stores, shares, and disposes of no other PII elements. Before adding a new PII element, the System Owner must update the privacy impact assessment and get approval from the Senior Agency Official for Privacy (SAOP). The Privacy Officer must review each system’s PII elements during every privacy impact assessment update.

SI-12(2) — Minimize Personally Identifiable Information in Testing, Training, and Research #

Baselines: Privacy

Requirement:

Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: [Assignment: organization-defined techniques — to be defined].

Implementation guidance:

Staff must minimize the use of personally identifiable information (PII) outside production systems. For research, they must apply this technique: [SI-12(2) parameter 1 — to be defined]. For testing, they must apply this technique: [SI-12(2) parameter 2 — to be defined]. For training, they must apply this technique: [SI-12(2) parameter 3 — to be defined]. The System Owner must approve each test, research, or training data set before staff use it. Any exception requires written approval from the Senior Agency Official for Privacy (SAOP).

SI-12(3) — Information Disposal #

Baselines: Privacy

Requirement:

Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques — to be defined].

Implementation guidance:

When the retention period in the approved records schedule ends, staff must dispose of information that contains personally identifiable information (PII). To dispose of information, they must use [SI-12(3) parameter 1 — to be defined]. To destroy media, they must use [SI-12(3) parameter 2 — to be defined]. To erase data, they must use [SI-12(3) parameter 3 — to be defined]. These rules cover originals, copies, backups, archives, and system logs that contain PII. The System Owner must make sure staff record each disposal.

SI-18 — Personally Identifiable Information Quality Operations #

Baselines: Privacy

Requirement:

1. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignment: organization-defined frequency — to be defined]; and
2. Correct or delete inaccurate or outdated personally identifiable information.

Implementation guidance:

System Owners must check the personally identifiable information (PII) in their systems for accuracy [SI-18 parameter 1 — to be defined], for relevance [SI-18 parameter 2 — to be defined], for timeliness [SI-18 parameter 3 — to be defined], and for completeness [SI-18 parameter 4 — to be defined]. The check covers PII at each stage, from collection to disposal. System Owners must correct or delete any PII they find to be wrong or out of date. They must keep a record of each change. Systems that support decisions about a person’s rights, benefits, or privileges must receive the most thorough checks. The Privacy Officer must review the results and report problems to the Senior Agency Official for Privacy (SAOP).

SI-18(4) — Individual Requests #

Baselines: Privacy

Requirement:

Correct or delete personally identifiable information upon request by individuals or their designated representatives.

Implementation guidance:

The Organization must correct or delete personally identifiable information (PII) when the individual or the individual’s designated representative asks, unless the law requires the Organization to keep it. The Privacy Officer must track each request. The Privacy Officer must consult the Senior Agency Official for Privacy (SAOP) and General Counsel before denying a request in whole or in part. The Privacy Officer must tell the requester the decision and, for a denial, the reason and how to appeal.

SI-19 — De-identification #

Baselines: Privacy

Requirement:

1. Remove the following elements of personally identifiable information from datasets: [Assignment: organization-defined elements — to be defined]; and
2. Evaluate [Assignment: organization-defined frequency — to be defined] for effectiveness of de-identification.

Implementation guidance:

Before staff share or reuse a data set for a purpose that does not need identities, they must remove these elements: [SI-19 parameter 1 — to be defined]. Only staff trained in de-identification may do this work. The System Owner must approve each de-identified data set before its release. The Privacy Officer must test the effectiveness of de-identification [SI-19 parameter 2 — to be defined]. The test must consider new data sets and new analysis methods that could let someone link records back to a person. If a test shows that people can be identified, the System Owner must withdraw the data set and fix the method. The Senior Agency Official for Privacy (SAOP) must approve any change to the de-identification method.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of system and information integrity controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves system and information integrity through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Automate patch deployment rings with health-gated promotion, measuring reduction in mean time to remediate.
6. Tune detection content continuously using purple-team results and measure detection-gap closure.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• CISA BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy, September 2, 2020.
• CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
• CISA BOD 25-01: Implementing Secure Practices for Cloud Services, December 17, 2024.
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA Known Exploited Vulnerabilities Catalog, updated continuously.
• Disclosure requirement for official business conducted using non-official electronic messaging accounts (44 U.S.C. § 2911).
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NARA Bulletin 2023-02: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages, January 5, 2023.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST IR 8547: Transition to Post-Quantum Cryptography Standards, November 12, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response (EDR), October 8, 2021.
• OMB M-23-02: Migrating to Post-Quantum Cryptography, November 18, 2022.
• OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.