The requirements are derived from the (NIST) 800-53 and related documents. Please also remember: This guide contains my comments that may differ from certain industry principles. If you are not sure ...