A SP 800-53 control (also referred to as a base control) is a security and/or privacy outcome involving policy, oversight, supervision, processes to be implemented by systems or individuals. Examples of base controls include AC-2 Account Management, IA-5 Authenticator Management, PL-4 Rules of Behavior, and SR-2 Supply Chain Risk Management Plan.
Step 1: Navigate to New: Suggest a New Control
From the SP 800-53 Public Comments: Submit and View page, suggest a new control or control enhancement by, clicking “New,” indicated by the red box shown in Figure 5.
A new control proposal can either be for a new base control or a new control enhancement (Also see Suggest a New Control Enhancement).
Step 2: Select a New Base Control
Select the radio button for “New Base Control,” indicated by the red box, as shown in Figure 6.
For step-by-step instructions on how to propose a new control enhancement, see Suggest a New Control Enhancement.
The website automatically populates a blank form that contains the following fields for user input (indicated by the red boxes), as shown below in Figure 7:
- Control Family (required)
- Control Name (required)
- Control Statement (required)
- Discussion
- Related Controls
- References
- Security Control Baseline
- Privacy Control Baseline
- Justification/Rationale (required)
Step 3: Select a Control Family and Enter New Control Name
Figure 8 below illustrates how to select a Control Family (required) from the existing SP 800-53 control families using the drop-down menu (marked with the red arrow). Additionally, the red box identifies where to enter text for the proposed Control Name (required).
Step 4: Add a New Control Statement
Figure 9 below shows how to add a New Control Statement (required) by clicking on the green “New Statement Required” button.
Upon clicking the green “New Statement Required” button, a pop-up window prompts the user to provide a control statement that can be entered in paragraph form or hierarchical, numbered list. To provide a control statement in paragraph form, enter the proposed control statement in the text box, as shown in Figure 10.
- OPTIONAL: To add “Sub Text” to the control statement (i.e., to add another item to the list), click on the green “Sub Text” button, indicated by the red arrow shown below in Figure 11.
- The new list item “(a)” appears under the “Statement:” text box, indicated by the red arrow in Figure 12.
- To add “Sub Text” to list item "(a)" of the control statement, click on the green “Sub Text” button, indicated by the red arrow, as shown in Figure 13 below.
- A new text box “(1)” displays as a sub-section of sub text “(a)”, indicated by the red arrow, as shown below in Figure 14.
To delete a section (sub text or sub-section) of a control statement, click on the red “Delete” button, indicated by the red arrow shown in Figure 15 below.
Once all changes to the Control Statement are entered, click the blue “Save” button, as shown below in Figure 16.
The pop-up window closes, and the new text input displays in the Control Statement text box as shown below in Figure 17.
OPTIONAL Step 5: Provide Discussion
Figure 18 displays the text box to provide Discussion on the new base control. The information in the Discussion section assists organizations, as needed, when developing, tailoring, implementing, assessing, or monitoring controls, but does not extend the control. The information provides important considerations for implementing controls based on mission or business requirements, operational environments, or assessments of risk. The additional information can also explain the purpose of controls and often includes examples. This field can be left blank.
Note that if an invalid character is input or the minimum length requirement is not met, an error message (in red) appears under the text box requiring an update before allowing submission. The Discussion text box can also be resized by clicking and dragging on the lower right-hand corner.
OPTIONAL Step 6: Add and Remove Related Controls
To assist with control implementation and assessment, users can add related controls. Related controls are other SP 800-53 controls that impact or support the implementation, address a related outcome, or are referenced in the Discussion section (if applicable). This field can be left blank.
To add a related control:
- On the right-hand side of the screen, under “Related Controls,” select from the drop-down menu of existing SP 800-53 control families, indicated by the red box in Figure 19 below. Once an SP 800-53 control family is selected, the list of existing controls in that family populates in the field underneath. Highlight the control to select as a “Related Control,” as indicated by the red arrow shown in Figure 19 below. Note that only base controls are listed.
- After a related control is selected, click the left facing chevron button highlighted by the red box shown in Figure 20 below. The selected control then appears in the box on the left, as indicated by the red arrow.
To remove a related control:
- On the left-hand side of the screen, under the “Currently Assigned Related Controls” box, select the existing SP 800-53 control, as indicated by the red arrow in Figure 21 below. The selected control will display in grey. Click on the right facing chevron button, highlighted by the red box, in Figure 21 below. The control then no longer displays as a “Currently Assigned Related Controls” box on the left.
Repeat OPTIONAL Step 6 as necessary to add and/or remove all relevant related controls.
OPTIONAL Step 7: Add and Remove References
Add References to new or existing applicable laws, policies, standards, guidelines, websites, and other useful resources for the control. This field can be left blank.
To add a reference using an existing reference in SP 800-53:
- As shown in Figure 22 below, select the drop-down menu of “Select Existing Reference,” indicated by the red box.
- A drop-down menu of existing references used in the published version of SP 800-53 appears, as shown in Figure 23. Select the appropriate reference.
- Complete the selection by clicking the green “Add Existing Reference” button, indicated by the red arrow in Figure 24 below.
- The newly added reference appears underneath the green “Add Existing Reference” button, as indicated by the red box in Figure 25.
To add a new reference that is not used in SP 800-53:
- Click on the green “New Reference” button, highlighted by the red box shown in Figure 26 below.
- A new row displays in the Reference Table. The new row includes space for the Reference Title, URL, and option to delete the new reference. Click on “Edit” button next to the Reference Title and URL fields to update, as shown by the red arrow in Figure 27 below.
To remove a new reference (newly added or existing in SP 800-53), click “Delete” under “Action” on the right side of the row, as shown in Figure 28.
Repeat OPTIONAL Step 7 as necessary to include and/or remove new and existing references for the control.
OPTIONAL Step 8: Suggest Applicable Security Control Baseline(s)
Suggest Security Control Baseline(s) by clicking the corresponding check box(es) with Low, Moderate, and/or High security control baseline(s), or Not Selected, as shown below in Figure 29. Refer to SP 800-53B for additional guidance on the security control baselines. This field can be left blank. Note that the Security Control baselines are additive. Any control selected in the Low-Impact Baseline is also selected at Moderate and High.
OPTIONAL Step 9: Suggest Inclusion in Privacy Control Baseline
Suggest if the new control is included in the Privacy Control Baseline by selecting the radio button for “Yes” or “No,” as shown in Figure 30. Controls are selected in the Privacy Control Baseline if the proposed control addresses privacy requirements based on privacy program responsibilities under OMB Circular A-130. Refer to SP 800-53B for additional guidance on the privacy control baseline. This field can be left blank.
Step 10: Provide the Justification/Rationale for the Proposal
Include the gap(s) and/or threats addressed, risks that are managed, the rationale for inclusion in control baseline(s), and any additional information about the proposed new control. Figure 31 shows the text box to provide the Justification/Rationale.
OPTIONAL Step 11: Include a New Control Enhancement with the Base Control
To create a new control enhancement for the new base control, select the box to the right of the blue “Submit” button highlighted in Figure 32 below.
- If proposing a new control enhancement, after clicking the blue “Submit” button, a pop-up message notifies that the user will automatically be directed to a new form to enter a new control enhancement (see Figure 33 below). Upon clicking “Ok,” a new form for a new control enhancement will display. Suggest a New Control Enhancement for additional guidance on how to propose a new control enhancement.
Step 12: Review and Submit Proposal Submission
To submit, all required fields in the form must be completed. Any incomplete fields are highlighted in red, and the proposal cannot be submitted until completed. A warning message in red appears below the “Submit” button stating all the required fields were not completed, indicated by the red arrow shown in Figure 34 below.
Once all the required fields are completed, the warning message disappears, and a summary of the proposal appears, as indicated by the red arrow in Figure 35 below. After reviewing the summary, click on the “Submit” button to complete your submission.
Step 13: Provide Confirmation Email Address
Upon clicking the blue “Submit” button, a pop-up window appears requesting the submitter’s email address, as shown in Figure 36 below.
Step 14: Success Message: Check Email for Confirmation Instructions
A pop-up message indicating the submission was successful, as shown in Figure 37. However, the submission is not yet confirmed; please check the email address provided and refer to Confirm a Proposal Submission.
.svg)
.svg)
