| Access Control (AC) Policy | Access Control (AC) Plan | Account Management Plan | |
| Awareness and Training (AT) Policy | Awareness and Training (AT) Plan | | |
| Audit and Accountability (AU) Policy | Audit and Accountability (AU) Plan | | |
| Assessment, Authorization, and Monitoring (CA) Policy | Assessment, Authorization, and Monitoring (CA) Plan | | |
| Configuration Management (CM) Policy | Configuration Management (CM) Plan | | |
| Contingency Planning (CP) Policy | Contingency Planning (CP) Plan | | |
| Identification and Authentication (IA) Policy | Identification and Authentication (IA) Plan | | |
| Incident Response (IR) Policy | Incident Response (IR) Plan | | |
| Maintenance (MA) Policy | Maintenance (MA) Plan | | |
| Media Protection (MP) Policy | Media Protection (MP) Plan | | |
| Physical and Environmental Protection (PE) Policy | Physical and Environmental Protection (PE) Plan | | |
| Planning (PL) Policy | Planning (PL) Plan | | |
| Program Management (PM) Policy | Program Management (PM) Plan | | |
| Personnel Security (PS) Policy | Personnel Security (PS) Plan | | |
| PII Processing and Transparency (PT) Policy | PII Processing and Transparency (PT) Plan | | |
| Risk Assessment (RA) Policy | Risk Assessment (RA) Plan | | |
| System and Services Acquisition (SA) Policy | System and Services Acquisition (SA) Plan | | |
| System and Communications Protection (SC) Policy | System and Communications Protection (SC) Plan | | |
| System and Information Integrity (SI) Policy | System and Information Integrity (SI) Plan | | |
| Supply Chain Risk Management (SR) Policy | Supply Chain Risk Management (SR) Plan | | |