Professional Documents
Culture Documents
CNSSI-1253F Classified Information Overlay
CNSSI-1253F Classified Information Overlay
1. Identification
This overlay identifies security control specifications needed to safeguard classified information
stored, processed, or transmitted by national security systems (NSS).
Executive Order (EO) 13526, Classified National Security Information, January 2010.
EO 13587, Structural Reforms to Improve the Security of Classified Networks and the
Responsible Sharing and Safeguarding of Classified Information, October 2011.
National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53,
Revision 4, Security and Privacy Controls for Federal Information Systems and
Organizations, April 2013.1
Committee on National Security Systems (CNSS) Instruction (CNSSI) No. 1253,
Security Categorization and Control Selection for National Security Systems, March
2014.
CNSSI No. 1253 Appendix F Attachment 1, Security Control Overlays Template, August
2013.
CNSSI No. 1253 Appendix F Attachment 3, Cross Domain Solution (CDS) Overlay,
September 2013.
CNSSI No. 1001, National Instruction on Classified Information Spillage, February
2008.
CNSSI No. 4009, National Information Assurance (IA) Glossary, April 2010.
CNSSI No. 7000, TEMPEST Countermeasures for Facilities, May 2004.
National Security Telecommunications and Information Systems Security (NSTISS)
Instruction (NSTISSI) No. 7002, TEMPEST Glossary, March, 1995.
CNSS Policy (CNSSP) No. 15, National Information Assurance Policy on the Use of
Public Standards for the Secure Sharing of Information Among National Security
Systems, October 2012.
CNSSP No. 17, Policy on Wireless Systems, January 2014.
CNSSP No. 25, National Policy for Public Key Infrastructure in National Security
Systems, March 2009.
CNSSP No. 26, National Policy on Reducing the Risk of Removable Media for National
Security, July 2013.
CNSS Directive (CNSSD) No. 504, Directive on Protecting NSS from Insider Threat,
February 2014.
White House Memorandum, February 2014, Subject: Near-term Measures to Reduce the
Risk of High-Impact Unauthorized Disclosures.
White House Memorandum, November 2012, Subject: National Insider Threat Policy
and Minimum Standards for Executive Branch Insider Threat Programs.
1
Includes errata updates through January 2014.
This overlay applies to NSS that store, process, or transmit classified information. Information
may be considered for classification when there is a reasonable expectation that unauthorized
disclosure of the information could cause damage to national security2. There are three levels of
classification: Top Secret (exceptionally grave damage), Secret (serious damage), and
Confidential (damage).
Types of classified information include information that pertains to military plans, weapon
systems, or operations; intelligence activities; foreign relations and government information;
scientific, technological, or economic matters related to national security; safeguarding nuclear
materials or facilities; development and use of weapons of mass destruction; and vulnerabilities
and capabilities of NSS. Classified information on an information system requires protections
and handling methods that are in addition to those required to protect unclassified information,
because of the information’s nature and potential harm that would result from unauthorized
disclosure.
Impact values for confidentiality are not equivalent to classification levels. A loss of
confidentiality is different than an unauthorized disclosure of classified information.
Confidentiality impact values represent levels of impact on organizational operations and assets,
individuals, other organizations, and the Nation. In contrast, classification levels represent the
degrees of damage to national security. The categorization decision (i.e., the impact values for
confidentiality, integrity, and availability) is independent of the classification decision.
The assumptions that underlie the security control selections and serve as the basis to justify the
allocation of controls in the Classified Information Overlay include:
2
EO 13526 provides the complete definition of classified information in Section 6.1.
3
SAP is defined in EO 13526, Section 4.3. If the information system stores, processes or transmits classified
information that requires protection within a SAP established by the Director of National Intelligence, the
specifications in the Intelligence Overlay apply. If the information system stores, processes, or transmits classified
information that requires protection within a SAP established by another authority, consult that authority for
appropriate specifications.
3. Applicability
Use the following question to determine the applicability of the Classified Information Overlay:
Does the information system of interest by intent and design4 store, process, or transmit
classified information? If yes, this overlay does apply. If no, this overlay does not apply.
4. Overlay Summary
The table below contains a summary of the security control specifications as they apply in this
overlay. The symbols used in the table are as follows:
4
The specifications in this overlay do not apply to information systems that store, process, or transmit classified
information only for a limited time as a consequence of an information spill.
CLASSIFIED CLASSIFIED
CONTROL INFORMATION CONTROL INFORMATION
OVERLAY OVERLAY
PE-19(1) +R SC-8(3) +R
PS-3(1) +GR SC-8(4) +R
PS-4 +VR SC-12(2) +VR
PS-4(1) +R SC-12(3) +GVR
PS-6(2) +R SC-13 +VR
PS-6(3) +R SC-15(3) +GR
RA-6 +R SC-28 +GVR
SA-4(6) +R SC-28(1) +R
SA-15(9) +ER SC-42 +GR
SC-2 +R SC-42(3) +GVR
SC-3 +R SI-4(14) +R
SC-8 +VR SI-4(19) +R
SC-8(1) +R SI-4(21) +R
This section is a comprehensive view of the security control specifications as they apply to this
overlay. The guidance provided in this section elaborates on the guidance in NIST SP 800-53.
For controls that should either be selected or not selected, a justification is provided based on the
defined overlay characteristics. In addition to a justification, a security control may have other
specifications that include control extensions, supplemental guidance, parameter values, and
regulatory/statutory references. The specifications in this section are summarized in Section 4,
Table 1.
Per NIST SP 800-53, control enhancements are not intended to be selected independently (i.e., if
a control enhancement is selected, then the corresponding base security control must also be
selected). Security controls and enhancements are explicitly identified in an overlay only if they
directly support the overlay topic. Ensure that the base controls associated with the
enhancements in the overlay are tailored as appropriate in the final control set.
Control Enhancement: 2
Control Enhancement: 4
Control Enhancement: 7
Parameter Value: (a) The information system prevents further access to the system by
initiating a session lock after a period not to exceed 15 minutes of inactivity or upon
receiving a request from a user.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f); EO 13587, Sec 5.2,
para. (a).
Control Enhancement: 1
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f); EO 13587, Sec 5.2,
para. (a).
Regulatory/Statutory Reference(s): EO 13526, Sec 1.2, para. (a), Sec 1.6, para. (a), and
Sec 2.1, para. (a-b).
Control Enhancement: 5, 6, 7
Regulatory/Statutory Reference(s): EO 13526, Sec 1.6, para. (a) and Sec 2.1, para. (a-b).
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a).
Control Enhancement: 3, 4
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a); CNSSP No. 17.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a).
Control Enhancement: 1, 2, 4
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a).
Control Enhancement: 3
Parameter Value: (c) annually for as long as the user has access to the system.
Control Enhancement: 2
Regulatory/Statutory Reference(s): EO 13587, Sec 2.1(b) and Sec 5.2; White House
Memorandum, National Insider Threat Policy, Tab 1, Sec B.2(1) and Minimum
Standards for Executive Branch Insider Threat Programs, Tab 2, Sec H.
Control Enhancement: 4
Justification to Select: See justification for AU-6. The White House Memorandum,
Minimum Standards for Executive Branch Insider Threat Programs, requires the
organization to gather information for centralized analysis, reporting and response.
Control Enhancement: 5
Justification to Select: See justification for AU-6. The White House Memorandum,
Minimum Standards, requires the organization to build and maintain an insider threat
analytic and response capability to manually and/or electronically gather, integrate,
review, assess, and respond to information derived from counterintelligence, security,
information assurance, human resources, law enforcement, the monitoring of user
activity, and other sources as necessary and appropriate.
Parameter Value: The organization integrates analysis of audit records with the analysis
of counterintelligence, security, information assurance, human resources, law
enforcement, the monitoring of user activity, and other sources as necessary and
appropriate to further enhance the ability to identify inappropriate or unusual activity.
Control Enhancement: 8
Justification to Select: See justification for AU-6. Insider threat programs have
determined that full text analyses of all privileged user commands need to be performed
to effectively execute task C-5 of the White House Memorandum, Near-term Measures
to Reduce the Risk of High-Impact Unauthorized Disclosures.
Control Enhancement: 9
Regulatory/Statutory Reference(s): EO 13587, Sec 2.1(b) and Sec 5.2; White House
Memorandum, National Insider Threat Policy, Tab 1, Sec B.2(1) and Minimum
Standards for Executive Branch Insider Threat Programs, Tab 2, Sec H.1.
Justification to Select: The White House Memorandum, National Insider Threat Policy
and Minimum Standards for Executive Branch Insider Threat Programs, requires the
capability to capture audit information to detect and mitigate insider threat and requires
agencies to monitor and audit user activity on classified networks. This control directly
supports the capture of user activities during sessions. Having the capability to generate
audit records containing this content is considered a best practice for safeguarding
classified information against insider threat. Classified information is more likely to be
targeted for espionage than unclassified information.
Regulatory/Statutory Reference(s): EO 13587, Sec 2.1(b) and Sec 5.2; White House
Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, Tab
2, Sec H.1.
Control Enhancement: 1
Justification to Select: See justification for AU-16. Preserving the identities of individuals
in cross-organization audit trails facilitates the detection of insider threats on all classified
networks.
Regulatory/Statutory Reference(s): EO 13587, Sec 2.1(b) and Sec 5.2; White House
Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, Tab
2, H.1.
Control Enhancement: 2
Regulatory/Statutory Reference(s): EO 13587, Sec 2.1(b) and Sec 5.2; White House
Memorandum, Minimum Standards for Executive Branch Insider Threat Programs, Tab
2, H.1.
Control Enhancement: 2
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2,
para. (a).
Control Enhancement: 6
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a).
Control Enhancement: 5
Parameter Value: (b) The organization reviews and reevaluates privileges at least
quarterly.
Control Enhancement: 1, 2
Justification to Select: CNSS Directive 504 Annex A requires that agencies implement
standardized access control methodologies, specifically multifactor authentication.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); CNSSI No. 1001.
Control Enhancement: 1, 2, 4
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); CNSSI No. 1001.
Control Enhancement: 3
Control Enhancement: 1
Justification to Select: EO 13526 states that classified information may not be removed
from official premises without proper authorization. Organizations that process classified
information must include appropriate content in their media protection policy and
procedures.
Justification to Select: Media devices are resources that can be used to exfiltrate
classified information and access to the devices should limited to authorized personnel.
EO 13526 states that classified information may not be removed from official premises
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (d); EO 13587, Sec 5.2 and
Sec 6.1.
Regulatory/Statutory Reference(s): EO 13526, Sec 1.6, para. (a) and Sec 2.1, para. (a)
and (b); CNSSP No. 26.
Parameter Value: Physically controls and securely stores digital and non-digital media
containing classified information within an area and/or container approved for
processing and storing media based on the classification of the information contained
within the media.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); CNSSP No. 26.
Justification to Select: EO 13526 states that classified information may not be removed
from official premises without proper authorization and that it must be stored under
conditions that provide adequate protection and prevent access by unauthorized persons.
Protection of classified information during transport, which includes maintaining
accountability, documenting transport activities, and employing cryptographic measures,
is essential to satisfy these requirements.
Parameter Value(s): The organization protects and controls digital media containing
classified information during transport outside controlled areas using [Assignment:
organization-defined security safeguards]. The organization protects and controls non-
digital media containing classified information during transport outside controlled areas
Regulatory/Statutory Reference(s): EO 13526, Sec. 4.1, para. (d) and (g); EO 13587, Sec
5.2, para. (a); CNSSP No. 26.
Control Enhancement: 3
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (d), (e), (f), and (g); EO
13587, Sec 5.2, para. (a); CNSSP No. 26.
Control Enhancement: 4
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (d), (e), (f), and (g); EO
13587, Sec 5.2, para. (a).
Justification to Select: EO 13526 states that all classified information must be destroyed
under conditions that provide adequate protection and prevent access by unauthorized
personnel. Sanitization and the verification of destruction of all types of media, physical
and digital, help to meet this requirement.
Parameter Value: (a) Sanitizes all digital and non-digital information system media
containing classified information prior to disposal, release out of organizational control,
or release for reuse using [Assignment: organization-defined sanitization techniques and
procedures] in accordance with applicable federal and organizational standards and
policies.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2,
para. (a).
Control Enhancement: 1, 2, 3
Regulatory/Statutory Reference(s): EO 13526, Sec. 4.1, para. (d); EO 13587, Sec 2.1(b)
and Sec 5.2.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2,
para. (a).
Control Enhancement: 1, 2, 4
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2,
para. (a).
Control Enhancement: 3
Parameter Value(s): The organization restricts unescorted access to the facility where the
information system resides to personnel with security clearances for all information
contained within the system.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2,
para. (a).
Control Enhancement: 2
Justification to Select: EO 13526 states that information may not be removed from
official premises without proper authorization. Conducting security checks at random or a
pre-defined frequency helps mitigate the risk of unauthorized removal of classified
materials.
Control Enhancement: 3
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2,
para. (a).
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2,
para. (a).
Control Enhancement: 3
Parameter Value(s): The organization marks all output devices in facilities containing
information systems that that store, process, or transmit classified information indicating
the appropriate security marking of the information permitted to be output from the
device.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (g); EO 13587, Sec 5.2,
para. (a).
Regulatory/Statutory Reference(s): EO 13526, Sec. 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a).
Control Enhancement: 1
Justification to Select: CNSSI No. 7000 delineates the TEMPEST policies and
procedures for classified NSS.
Regulatory/Statutory Reference(s): CNSSI No. 7000; EO 13587, Sec 5.2, para. (a).
Control Enhancement: 1
Justification to Select: EO 13526 states that all personnel that have access to classified
information must be cleared through a determination of eligibility, NDA, and have the
appropriate need to know for the information.
Supplemental Guidance: The agency head or agency head's designee must make a
favorable determination that the person is eligible for access for information at
classification levels up to and including the level specified in the clearance.
Regulatory/Statutory Reference(s): EO 13526, Sec. 4.1, para. (a) and (b); EO 13587, Sec
5.2, para. (a).
Control Enhancement: 1
5
The intent of this specification is to ensure this information security topic is covered in the exit interview, not to
exclude other topics from also being covered.
Control Enhancement: 2
Justification to Select: EO 13526 states that all personnel that have access to classified
information must be cleared through a determination of eligibility, NDA, and have the
appropriate need-to-know for the information.
Control Enhancement: 3
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (a), (g), and (f).
Control Enhancement: 6
Regulatory/Statutory Reference(s): EO 13526, Sec. 4.1, para. (f) and (g); CNSSP No. 11.
Sec IV, 5 and 7.
Control Enhancement: 9
Control Extension: Classified information can only be used in test and simulation
environments that are at least at the same classification level as the live data.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a).
Parameter Value: The information system protects the confidentiality and integrity of
transmitted information.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (a), (f), and (g); EO 13587,
Sec 5.2, para. (a).
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (a), (f), and (g); EO 13587,
Sec 5.2, para. (a); CNSSP No. 15 Sec IV.4.
Control Enhancement: 2
Control Enhancement: 3
Supplemental Guidance: CNSSP No. 25 requires that NSS operating at the Secret level
obtain PKI support from the NSS-PKI.
Regulatory/Statutory Reference(s): CNSSP No. 15 Sec IV.4 and Sec 5.b.(3); CNSSP No.
25.
Regulatory/Statutory Reference(s): EO 13526, Sec. 4.1, para. (f) and (g); CNSSP No. 15
Sec IV.4.
Control Enhancement: 3
Parameter Value: The information system protects the confidentiality and integrity of
classified information at rest.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f); EO 13587, Sec 5.2,
para. (a).
Control Enhancement: 1
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a).
Control Enhancement: 3
Parameter Values: The organization prohibits the use of devices possessing sensors
capable of recording audio or imagery (still or video) or transmitting information (i.e.,
cell phones, two way radios) in all areas where classified information is stored,
processed, transmitted or discussed, except for [organization-defined areas or devices].
Control Enhancement: 14
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); CNSSP No. 17
Sec 5.b.iv; EO 13587, Sec 5.2, para. (a).
6. Tailoring Considerations
Organizations should consider the following specific control guidance when tailoring
information systems that are used to store, process, or transmit classified information in addition
to using the general tailoring guidance in CNSSI No. 1253.
Control Enhancement: 1, 5
Supplemental Guidance: If the organization intends to use wireless access for the
information system of interest, then these controls must be selected. If wireless
capabilities are enabled, there is a risk of unauthorized access to, and exfiltration of,
classified information.
Control Enhancement: 4
Supplemental Guidance: If the organization intends to allow mobile devices in the same
facility as the information system of interest, even if not part of the information system,
then this control must be selected.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g). EO 13587, Sec
5.2, para. (a); CNSSP No. 17.
Control Enhancement: 5
Supplemental Guidance: If the organization intends to allow mobile devices as part of the
information system of interest, then this control must be selected.
Regulatory/Statutory Reference(s): EO 13526, Sec 4.1, para. (f) and (g); EO 13587, Sec
5.2, para. (a); CNSSP No. 17.
7. Definitions
The terms used in this overlay are all defined in CNSSI No. 4009, National Information
Assurance (IA) Glossary, or one of the other references listed in section 1 of this document.