AC-16 Security and privacy attributes
What the standard requires
a. Provide the means to associate [organization-defined types of security and privacy attributes] with [organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission; b. Ensure that the attribute associations are made and retained with the information; c. Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for [organization-defined systems]: [organization-defined security and privacy attributes]; d. Determine the following permitted attribute values or ranges for each of the established attributes: [attribute values or ranges]; e. Audit changes to attributes; and f. Review [organization-defined security and privacy attributes] for applicability [organization-defined frequency].
Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.
Cross-framework mappings
No cross-framework mapping is seeded for this control. That is stated rather than filled in: a mapping nobody authored is worse than a gap you can see.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.