506333 Exhibit H Vendor Security Assessment Questionnaire.xlsx
XLSX spreadsheet 279 KB Posted
- Attached to
- Electronic Payment Processing Solution
- Solicitation number
- 506333
- Issued by
- Denver County, Denver City, Colorado
About this file
The file is a Vendor Security Assessment Questionnaire (HECVAT Lite) from Denver Water, designed to comprehensively evaluate a potential vendor's cybersecurity practices and information security controls. The document is a detailed Excel spreadsheet that covers multiple security domains including company overview, documentation, authentication, data protection, networking, incident response, and third-party management. While not directly related to a specific procurement, the questionnaire serves as a critical tool for assessing vendor security posture, with questions spanning areas such as access controls, encryption practices, incident response capabilities, physical security, and compliance with various security standards like NIST, HIPAA, and ISO 27002.
The questionnaire is structured to provide granular insights into a vendor's security program, with each section containing multiple questions that probe the depth and maturity of security practices. Vendors are expected to provide detailed responses about their systems' capabilities, including single sign-on support, data encryption methods, backup procedures, network segmentation, vulnerability scanning, and third-party risk management. The assessment appears to be part of a standardized approach used by higher education institutions and government entities to evaluate potential technology vendors, with scoring mechanisms that help organizations understand and quantify the security risks associated with adopting a particular solution or service.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 506333 Addendum No 2.docx | DOCX document | |
| 506333 Exhibit G Technology Accessibility Vendor Questionnaire.xlsx | XLSX spreadsheet | |
| 506333 Request for Proposal.docx | DOCX document | |
| 506333 Addendum No 3.docx | DOCX document | |
| 506333 Exhibit A - Sample Agreement.docx | DOCX document | |
| 506333 Exhibit B - Proposal Response.docx | DOCX document | |
| 506333 Exhibits CDEF.xlsx | XLSX spreadsheet | |
| 506333 Addendum No 1.docx | DOCX document | |
| 506333 Exhibits CDEF v.2 (Addendum #2).xlsx | XLSX spreadsheet | |
| 506333 Exhibits CDEF v.3 (Addendum #3).xlsx | XLSX spreadsheet | |
| August 2024 Monthly Volume Rpt.xlsx | XLSX spreadsheet | |
| September 2024 Monthly Volume Rpt.xlsx | XLSX spreadsheet |
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SOC2 Type 2 Report
| Exhibit H: Denver Water Vendor Security Questionnaire (SOC2/Type2) | ||||
| Instructions: Fill out all sections below and return the assessment form to the Procurement contact specified in the RFP. | ||||
| Date | mm/dd/yyyy | |||
| Vendor Information | ||||
| Vendor Name | Vendor Name | |||
| Product Name | Product Name and Version Information | |||
| Product Description | Brief Description of the Product | |||
| Web Link to Product Privacy Notice | https://www.vendor.domain/privacynotice | |||
| Vendor Contact Name | Vendor Contact Name | |||
| Vendor Contact Title | Vendor Contact Title | |||
| Vendor Contact Email | Vendor Contact E-mail Address | |||
| Vendor Contact Phone Number | 555-555-5555 | |||
| Vendor Accessibility Contact Name | Vendor Accessibility Contact Name | |||
| Vendor Accessibility Contact Title | Vendor Accessibility Contact Title | |||
| Vendor Accessibility Contact Email | Vendor Accessibility Contact Email | |||
| Vendor Accessibility Contact Phone Number | 555-555-5555 | |||
| Vendor Cloud Hosting Regions | e.g US-East, US-West | |||
| Vendor Work Locations | States or Countries | |||
| Fill out each section. | ||||
| Company Overview | Vendor Answers | Additional Information | ||
| Describe your company product or service. | ||||
| Have you experienced a Cybersecurity compromise or breach in the last year? Briefly describe the impact and lessons learned. | ||||
| Authentication, Authorization, and Accounting | Vendor Answers | Additional Information | ||
| Does your product support single sign-on (SSO) protocols for user and administrator authentication? | ||||
| Does your product support Azure Federation, OpenID, OAUTH, SAML2 or other Web SSO standard? | ||||
| Does your product or service support MFA? | ||||
| Does your product generate audit logs for all authentication and authorization events with a minimum of login, logout, actions performed, timestamp, user identifier and source IP address? | ||||
| Does your product or service automatically lock the session or logout an account after a period of inactivity? | ||||
| Systems Management | Vendor Answers | Additional Information | ||
| Do you have systems configuration hardening policies and procedures? | ||||
| Do you notify customers when you release changes to your product that could impact security? | ||||
| Do you promptly patch for security vulnerabilities based on established policy and procedures? | ||||
| Do you have vulnerability scanning and remediation policies and procedures with continuous improvement? | ||||
| Data | Vendor Answers | Additional Information | ||
| If you are a cloud provider, does you offer dedicated single-tenant instances? If not, describe how your product or environment separates data from different customers. | ||||
| Describe how your service or product encrypts data in transit. | ||||
| Describe how your service or product encrypts data at rest. | ||||
| Do you provide backup and restore documentation, methods, or strategies for your product or service? | ||||
| Do you have a written policy for data retention and destruction and can you provide a copy of it? | ||||
| Datacenter | Vendor Answers | Additional Information | ||
| Does your product or service store customer data in a datacenter that you manage yourself? | ||||
| Is the datacenter located in the United States? If no, list locations where you store customer data. | ||||
| Describe the physical security controls that you implement for the datacenter. | ||||
| Networking | Vendor Answers | Additional Information | ||
| Do you enforce network segmentation? | FIDP-02 | |||
| Do you use a stateful or nextgen firewall? | ||||
| Do you utilize a network intrusion detection system (IDS) or intrusion prevention system (IPS)? | ||||
| Do you always use encrypted access to your customer systems and data (e.g. VPN, SFTP, TLS, SSH)? |
000000 &P
CHANGELOG DEV
| questionID | changeDetails |
| GNRL-09 | Changed "Vendor Data Zone" to "Vendor Hosting Regions" |
| GNRL-10 | Removed |
| QUAL-01 through QUAL-07 | Added to HECVAT-Lite |
| COMP-01 | Separated C & D |
| COMP-02 | Separated C & D |
| COMP-07 | Updated guidance, Separated C & D |
| HLAP-01 | Updated guidance |
| HLAP-02 | Updated guidance |
| HLAP-03 | Updated guidance |
| HLAA-01 | Changed wording from "Can you enforce password/passphrase aging requirements?" to "Can the system enforce strong authentication for users accessing the system?" and updated guidance. |
| HLAA-02 | Updated question text from "Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. InCommon)" to "Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAML2, InCommon)" and updated guidance |
| HLAA-06 | New question, taken from AAAI-16 of Full, Separated C & D |
| HLAA-06 | UPDATED: Change question to "Does the system offer adequate logging functionality? At a minimum, describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c) information about SIEM/log collector usage d) a documented and implented process for log review." |
| HLAA-07 | New question, taken from AAAI-09 of Full |
| HLBC-02 | Updated guidance to have communication methods declared |
| HLBC-05 | New question, same as FULL BCPL-13 |
| Incident Response Section | New section in HECVAT Lite |
| HLIR-01 | New question, same as PPPR-10 Full |
| HLIR-02 | New question, same as HIPA-05 Full (question) but updated guidance |
| HLIR-03 | New question, same as DRPL-13 Full |
| GNRL-11 | Removed |
| GNRL-12 | Removed |
| HLAP-04 | Changed "Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?" To "Can you provide sanitized copies of system architecture diagrams and data flow diagrams as they pertain to the service being provided?" |
| HLAP-06 | Changed "Do you employ a single-tenant environment?" To "Does the environment provide for dedicated single-tenant capabilities?" |
| HLAP-06 | Guidance changed to "Describe how your product or environment separates data from different customers (logically, physically, single tenancy, multi-tenancy)." |
| HLDA-06 | Changed "Is any institution data visible in system administration modules/tools?" To "Does vendor staff have access to Institutional data (financial, PHI or other sensitive information) within the application/system?" |
| HLAP-03 | Changed "Can employees access customer data remotely?" to "Can vendor's employees access customer data remotely?". |
| HLDA-02 | Changed "Is sensitive data encrypted in transport? (e.g. system-to-client)" to "Is sensitive data encrypted, using secure protocols/algorithms, in transport? (e.g. system-to-client)". |
| HLDA-03 | Changed "Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?" to "Is sensitive data encrypted, using secure protocols/algorithms, in storage? (e.g. disk encryption, at-rest)". |
| HLDA-07 | New question, from DATA-15 in full (with new wording), "Are backup copies made according to pre-defined schedules and securely stored and protected according to policy and/or documented procedures?" |
| HLDA-08 | New question, from DATA-25 in full, "Do procedures exist to ensure that retention and destruction of data meets established business and regulatory requirements?" |
| HLTP-01 | New question, from THRD-01 in full, "Do you perform security assessments of third party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards regarding security, service recoverability, and confidentiality." |
| HLTP-01 | Changed for QUALITATIVE to QUANTITATIVE |
| HLTP-02 | New question, from THRD-04 in full, "Describe or provide references to your third party management strategy or provide additional information that may help analysts better understand your environment and how it relates to third-party solutions." |
| HLDC-01 | Changed from "Will any institution data leave the institution's Data Zone?" to "Will institutional data be stored in multiple regions?". |
| HLAP-03 | Change from "Can employees access customer data remotely?" to "Do you have a documented and currently implemented strategy for securing employee workstations when they work remotely? (i.e. not in a trusted computing environment)". |
| DOCU-01 | Change from "Have you undergone a SSAE 18 audit?" to "Have you undergone a SSAE 18 / SOC 2 audit?" |
| HLAP-01 | Changed "Do you support role-based access control (RBAC) for end-users?" to "Do you support role-based access control (RBAC) for institutional accounts? (This includes, end-users, administrator, service accounts, etc.)" |
| HLAP-02 | Changed "Do you support role-based access control (RBAC) for system administrators?" to "Do you support role-based access control (RBAC) for staff within the organization? (This includes system administrators and third party personell with access to the system?)" |
| HLAP-04 | Changed "Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?" to "" |
| HLAP-06 | Changed "Do you employ a single-tenant environment?" to "Does the environment provide for dedicated single-tenant capabilities? If not, describe how your product or environment separates data from different customers (logically, physically, single tenancy, multi-tenancy)." |
| HLDA-04 | Changed "Do backups containing institution data ever leave the institution's Data Zone, either physically or via network routing?" to "Are backup copies made according to pre-defined schedules and securely stored and protected?" |
| HLFI-05 | New question: "Do you enforce network segmentation between trusted and untrusted networks (i.e., Internet, DMZ, Extranet, etc.)?" |
| HLDA-09 | New question (DATA-10 in full), "Can the institution extract a full or partial backup of data?" |
| DOCU-05 | |
| COMP-04 | Changed from 5year breach to 12-mo disruption |
| HLAA-05 | Updated to include "to the institution" |
| CHange management removal - added to docu-09 | |
| Rrevmoed CM section | |
| Adding supply chain to third party | |
| Remove line 44 and put in 65 |
Standards Crosswalk-Backup
| Higher Education Community Vendor Assessment Tool (HECVAT) - Lite - Standards Crosswalk |
| HEISC Shared Assessments Working Group |
| Documentation | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| DOCU-01 | ERROR:#N/A | 15.2.1 | SA-9 | |||||
| DOCU-02 | ERROR:#N/A | 15.2.1 | PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9 | |||||
| DOCU-03 | ERROR:#N/A | 15.2.1 | PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9 | |||||
| DOCU-04 | ERROR:#N/A | 18.1.1 | SA-9 | |||||
| DOCU-05 | ERROR:#N/A | 18.1.1 | SA-9 | |||||
| DOCU-06 | ERROR:#N/A | §164.308(a)(1)(i) | 18.1.4 | ID.GV-3 | ID.GV-3 | SA-9 | ||
| Company Overview | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| COMP-01 | ERROR:#N/A | |||||||
| COMP-02 | ERROR:#N/A | |||||||
| COMP-03 | ERROR:#N/A | 15.2.1 | ||||||
| COMP-04 | ERROR:#N/A | 15.2.2 | ||||||
| COMP-05 | ERROR:#N/A | 15.2.1 | ||||||
| COMP-06 | ERROR:#N/A | 14.2.1 | SA-3, SA-15, SC-2, PM-2, PM-10, SI-5,PM-3 | |||||
| COMP-07 | ERROR:#N/A | 15.2.1 | ||||||
| Application/Service Security | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLAP-01 | ERROR:#N/A | CSC 14 | 9.2.2 | PR.AC-4 | 3.1.1, 3.1.2, 3.1.7 | AC-2, AC-3, AC-6 | APPL-03 | |
| HLAP-02 | ERROR:#N/A | CSC 16 | 9.1.1 | PR.AC-4, PR.PT-3 | 3.4.9 | CM-11 | APPL-04 | |
| HLAP-03 | ERROR:#N/A | CSC 12 | 6.2 | PR.PT-3 | 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7 | AC-3, CM-7; NIST SP 800-46 | APPL-07 | |
| HLAP-04 | ERROR:#N/A | CSC 2 | 12.1.1 | ID.AM-1, ID.AM-2, ID.AM-4 | CA-9, SC-4 | APPL-11 | ||
| HLAP-05 | ERROR:#N/A | CSC 16 | 14.2.5 | PR.DS-6 | APPL-18 | |||
| HLAP-06 | ERROR:#N/A | CSC 12 | 14.2.5 | RA-2 | APPL-19 | |||
| Authentication, Authorization, and Accounting | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLAA-01 | ERROR:#N/A | CSC 16 | 9.2.3, 9.3.1, 9.4.3 | PR.AC-1 | 3.5.7 | IA-5(1) | AAAI-02 | |
| HLAA-02 | ERROR:#N/A | CSC 16 | 9.1.1, 9.2.3, 9.3.1, 9.4.3 | PR.AC-1 | 3.5.1 | IA-2, IA-5 | AAAI-05 | |
| HLAA-03 | ERROR:#N/A | CSC 16 | 9.4.3 | PR.AC-1, PR.AC-4 | AAAI-12 | |||
| HLAA-04 | ERROR:#N/A | CSC 16 | 9.4.3 | PR.AC-1, PR.AC-4 | AAAI-14 | |||
| HLAA-05 | ERROR:#N/A | CSC 6 | 12.4 | PR.PT-1 | 3.1.7, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.3, 3.7.1, 3.7.6, 3.10.4, 3.10.5 | AU-2(3), AU-6, AU-12, AC-6(9), CM-3, MA-2, MA-5, PE-3 | AAAI-18 | |
| Business Continuity Plan | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLBC-01 | ERROR:#N/A | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-01 | |
| HLBC-02 | ERROR:#N/A | CSC 10 | 17.1.2 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-05 | |
| HLBC-03 | ERROR:#N/A | CSC 10 | 17.1.2 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-06 | |
| HLBC-04 | ERROR:#N/A | CSC 10 | 17.1.3 | PR.IP-9 | AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-11 | ||
| Change Management | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLCH-01 | ERROR:#N/A | CSC 10 | 12.1.2 | PR.IP-3 | 3.4.3, 3.4.4 | CM-3, CM-4, CM-5 | CHNG-01 | |
| HLCH-02 | ERROR:#N/A | CSC 10 | 12.1.2 | CM-3, CM-4, CM-5 | CHNG-03 | |||
| HLCH-03 | ERROR:#N/A | CSC 13 | §164.308(a)(1)(ii)(B) | 12.6.1 | CM-3, CM-4, CM-5 | CHNG-13 | ||
| HLCH-04 | ERROR:#N/A | CSC 10 | 12.1.2 | PR.IP-3 | CM-3, CM-4, CM-5 | CHNG-15 | ||
| Data | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLDA-01 | ERROR:#N/A | CSC 12 | PR.AC-2, PR.IP-5 | 3.1.3, 3.8.1 | AC-4, MP-2, MP-4 | DATA-02 | ||
| HLDA-02 | ERROR:#N/A | CSC 13 | 8.2.3, 10.1.1 | PR.DS-1, PR.DS-2 | 3.1.19, 3.8.1 | MP-2, AC-19(5) | DATA-04 | |
| HLDA-03 | ERROR:#N/A | CSC 13 | 8.2.3, 10.1.1 | PR.DS-1 | 3.1.19, 3.8.1 | MP-2, AC-19(5) | ||
| HLDA-04 | ERROR:#N/A | CSC 13 | 12.3.1 | 3.8.9 | CP-9, MP-5 | DATA-25 | ||
| HLDA-05 | ERROR:#N/A | CSC 13 | 8.3.1 | PR.DS-3 | 3.7.1, 3.7.2, 3.8.3 | CP-9 MP-6, NIST SP 800-60, NIST SP 800-88, AC-2, AC-6, IA-4, PM-2, PM-10, SI-5, MA-2, MA-3, MP-6 | DATA-26 | |
| HLDA-06 | ERROR:#N/A | CSC 13, CSC 14 | 14.2.5 | PR.AC-4 | DATA-31 | |||
| Database | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLDB-01 | ERROR:#N/A | CSC 13 | 10.1.1 | PR.DS-1 | DBAS-01 | |||
| HLDB-02 | ERROR:#N/A | CSC 13 | 10.1.1 | PR.DS-1, PR.DS-2 | DBAS-02 | |||
| Datacenter | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLDC-01 | ERROR:#N/A | CSC 12 | 11.2.1 | DCTR-10 | ||||
| HLDC-02 | ERROR:#N/A | CSC 14 | 11.1.1 | PR.AC-2, PR.IP-5 | DCTR-01 | |||
| HLDC-03 | ERROR:#N/A | CSC 13 | 11.1.1 | DCTR-02 | ||||
| HLDC-04 | ERROR:#N/A | CSC 14 | 11.1.1, 11.1.2 | PR.AC-2 | 3.8.1, 3.8.2 | DCTR-06 | ||
| Disaster Recovery Plan | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLDR-01 | ERROR:#N/A | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AC-5, CP-4, CP-10, NIST SP 800-34 | DRPL-01 | |
| HLDR-02 | ERROR:#N/A | CSC 10, CSC 12 | 17.1.1 | PR.IP-9 | AC-5, CP-4, CP-10, NIST SP 800-34 | DRPL-04 | ||
| HLDR-03 | ERROR:#N/A | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AC-5, CP-4, CP-10, NIST SP 800-34 | DRPL-13 | |
| Firewalls, IDS, IPS, and Networking | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLFI-01 | ERROR:#N/A | CSC 9 | 13.1.1 | PR.DS-5 | FIDP-01 | |||
| HLFI-02 | ERROR:#N/A | CSC 9 | 12.1.2 | PR.AC-5 | FIDP-04 | |||
| HLFI-03 | ERROR:#N/A | CSC 19 | 12.4.1 | 3.6.1, 3.14.6, 3.14.7 | IR-2, IR-4, IR-9 | FIDP-09 | ||
| HLFI-04 | ERROR:#N/A | CSC 19 | 12.4.1 | DE.CM-1, DE.CM-2, DE.CM-7 | 3.6.1, 3.14.6, 3.14.7 | IR-2, IR-4, IR-10 | FIDP-10 | |
| Physical Security | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLPH-01 | ERROR:#N/A | CSC 3 | 11.1.1 | PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2 | 3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1 | MP-4, PE-2, PE-5, PE-6, PE-17 | PHYS-01 | |
| HLPH-02 | ERROR:#N/A | CSC 13 | 8.2.3 | PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5 | 3.8.1, 3.8.5, 3.8.7 | MP-2, MP-5, MP-7 | PHYS-02 | |
| Policies, Procedures, and Processes | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLPP-01 | ERROR:#N/A | 5.1.1 | ID.GV-2 | 3.9.1, 3.9.2 | PM-2, PM-10, SI-5, CA-5, PM-1 | PPPR-01 | ||
| HLPP-02 | ERROR:#N/A | CSC 4 | 14.2.1 | PR.IP-2 | 3.13.2 | CA-5, CM-3, PM-1, SA-15, SA-3, SA-8, SC-2 | PPPR-08 | |
| HLPP-03 | ERROR:#N/A | CSC 19 | 16.1.5 | PR.IP-9 | 3.6.1, 3.12.2 | CA-5, PM-1, IR-4, IR-5, IR-7, IR-8 | PPPR-11 | |
| HLPP-04 | ERROR:#N/A | CSC 17 | §164.308(a)(1)(i) | 5.1.1 | ID.GV-3 | CA-5, PM-1 | PPPR-18 | |
| Systems Management & Configuration | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLSY-01 | ERROR:#N/A | CSC 12 | 13.1.1 | PR.PT-4 | 3.1.3 | AC-4 | SYST-01 | |
| HLSY-02 | ERROR:#N/A | CSC 3 | 12.1.1 | PR.IP-1, PR.IP-2 | 3.1.18, 3.7.1, 3.13.13 | CM-2, CM-6, CM-3, AC-19, MA-2 | SYST-04 | |
| Vulnerability Scanning | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLVU-01 | ERROR:#N/A | CSC 4 | 12.6.1 | DE.CM-8 | 3.11.1, 3.11.2, 3.11.3 | SI-2 | VULN-02 | |
| HLVU-02 | ERROR:#N/A | CSC 4 | DE.CM-8 | 3.11.1, 3.11.2, 3.11.3 | SI-2 | VULN-03 |
| CIS Critical Security Controls v6.1 | 4 |
| HIPAA | 5 |
| ISO 27002:2013 | 6 |
| NIST Cybersecurity Framework | 7 |
| NIST SP 800-171r1 | 8 |
| NIST SP 800-53r4 | 9 |
000000 &P
Crosswalk Detail
| 5.1.1 | Policies for information security |
| 5.1.2 | Review of the policies for information security |
| 6.1.1 | Information security roles and responsibilities |
| 6.1.2 | Segregation of duties |
| 6.1.3 | Contact with authorities |
| 6.1.4 | Contact with special interest groups |
| 6.1.5 | Information security in project management |
| 6.2.1 | Mobile device policy |
| 6.2.2 | Teleworking |
| 7.1.1 | Screening |
| 7.1.2 | Terms and conditions of employment |
| 7.2.1 | Management responsibilities |
| 7.2.2 | Information security awareness, education and training |
| 7.2.3 | Disciplinary process |
| 7.3.1 | Termination or change of employment responsibilities |
| 8.1.1 | Inventory of assets |
| 8.1.2 | Ownership of assets |
| 8.1.3 | Acceptable use of assets |
| 8.1.4 | Return of assets |
| 8.2.1 | Classification of information |
| 8.2.2 | Labelling of information |
| 8.2.3 | Handling of assets |
| 8.3.1 | Management of removable media |
| 8.3.2 | Disposal of media |
| 8.3.3 | Physical media transfer |
| 9.1.1 | Access control policy |
| 9.1.2 | Access to networks and network services |
| 9.2.1 | User registration and de-registration |
| 9.2.2 | User access provisioning |
| 9.2.3 | Management of privileged access rights |
| 9.2.4 | Management of secret authentication information of users |
| 9.2.5 | Review of user access rights |
| 9.2.6 | Removal or adjustment of access rights |
| 9.3.1 | Use of secret authentication information |
| 9.4.1 | Information access restriction |
| 9.4.2 | Secure log-on procedures |
| 9.4.3 | Password management system |
| 9.4.4 | Use of privileged utility programs |
| 9.4.5 | Access control to program source code |
| 10.1.1 | Policy on the use of cryptographic controls |
| 10.1.2 | Key management |
| 11.1.1 | Physical security perimeter |
| 11.1.2 | Physical entry controls |
| 11.1.3 | Securing offices, rooms and facilities |
| 11.1.4 | Protecting against external and environmental threats |
| 11.1.5 | Working in secure areas |
| 11.1.6 | Delivery and loading areas |
| 11.2.1 | Equipment siting and protection |
| 11.2.2 | Supporting utilities |
| 11.2.3 | Cabling security |
| 11.2.4 | Equipment maintenance |
| 11.2.5 | Removal of assets |
| 11.2.6 | Security of equipment and assets off-premises |
| 11.2.7 | Secure disposal or re-use of equipment |
| 11.2.8 | Unattended user equipment |
| 11.2.9 | Clear desk and clear screen policy |
| 12.1.1 | Documented operating procedures |
| 12.1.2 | Change management |
| 12.1.3 | Capacity management |
| 12.1.4 | Separation of development, testing and operational environments |
| 12.2.1 | Controls against malware |
| 12.3.1 | Information backup |
| 12.4.1 | Event logging |
| 12.4.2 | Protection of log information |
| 12.4.3 | Administrator and operator logs |
| 12.4.4 | Clock synchronisation |
| 12.5.1 | Installation of software on operational systems |
| 12.6.1 | Management of technical vulnerabilities |
| 12.6.2 | Restrictions on software installation |
| 12.7.1 | Information systems audit controls |
| 13.1.1 | Network controls |
| 13.1.2 | Security of network services |
| 13.1.3 | Segregation in networks |
| 13.2.1 | Information transfer policies and procedures |
| 13.2.2 | Agreements on information transfer |
| 13.2.3 | Electronic messaging |
| 13.2.4 | Confidentiality or non-disclosure agreements |
| 14.1.1 | Information Security requirements analysis and specification |
| 14.1.2 | Securing application services on public networks |
| 14.1.3 | Protecting application services transactions |
| 14.2.1 | Secure development policy |
| 14.2.2 | System change control procedures |
| 14.2.3 | Technical review of applications after operating platform changes |
| 14.2.4 | Restrictions on changes to software packages |
| 14.2.5 | Secure system engineering principles |
| 14.2.6 | Secure development environment |
| 14.2.7 | Outsourced development |
| 14.2.8 | System security testing |
| 14.2.9 | System acceptance testing |
| 14.3.1 | Protection of test data |
| 15.1.1 | Information security policy for supplier relationships |
| 15.1.2 | Addressing security within supplier agreements |
| 15.1.3 | Information and communication technology supply chain |
| 15.2.1 | Monitoring and review of supplier services |
| 15.2.2 | Managing changes to supplier services |
| 16.1.1 | Responsibilities and procedures |
| 16.1.2 | Reporting information security events |
| 16.1.3 | Reporting information security weaknesses |
| 16.1.4 | Assessment of and decision on information security events |
| 16.1.5 | Response to information security incidents |
| 16.1.6 | Learning from information security incidents |
| 16.1.7 | Collection of evidence |
| 17.1.1 | Planning information security continuity |
| 17.1.2 | Implementing information security continuity |
| 17.1.3 | Verify, review and evaluate information security continuity |
| 17.2.1 | Availability of information processing facilities |
| 18.1.1 | Identification of applicable legislation and contractual requirements |
| 18.1.2 | Intellectual property rights |
| 18.1.3 | Protection of records |
| 18.1.4 | Privacy and protection of personally identifiable information |
| 18.1.5 | Regulation of cryptographic controls |
| 18.2.1 | Independent review of information security |
| 18.2.2 | Compliance with security policies and standards |
| 18.2.3 | Technical compliance review |
| 8.2.3, 10.1.1 | Handling of assets; Policy on the use of cryptographic controls |
| 11.1.1,11.1.2 | Physical security perimeter; Physical entry controls |
| 11.1.1, 11.1.2 | Physical security perimeter; Physical entry controls |
| 9.2.3, 9.3.1, 9.4.3 | Management of privileged access rights; Use of secret authentication information; Password management system |
| 9.1.1, 9.2.3, 9.3.1, 9.4.3 | Access control policy; Management of privileged access rights; Use of secret authentication information; Password management system |
| CSC 1 | Inventory of Authorized and Unauthorized Devices |
| CSC 2 | Inventory of Authorized and Unauthorized Software |
| CSC 3 | Secure Configurations for Hardware and Software |
| CSC 4 | Continuous Vulnerability Assessment and Remediation |
| CSC 5 | Malware Defenses |
| CSC 6 | Application Software Security |
| CSC 7 | Wireless Access Control |
| CSC 8 | Data Recovery Capability |
| CSC 9 | Security Skills Assessment and Appropriate Training to Fill Gaps |
| CSC 10 | Secure Configurations for Network Devices |
| CSC 11 | Limitation and Control of Network Ports |
| CSC 12 | Controlled Use of Administrative Privileges |
| CSC 13 | Boundary Defense |
| CSC 14 | Maintenance, Monitoring, and Analysis of Audit Logs |
| CSC 15 | Controlled Access Based on the Need to Know |
| CSC 16 | Account Monitoring and Control |
| CSC 17 | Data Protection |
| CSC 18 | Incident Response and Management |
| CSC 19 | Secure Network Engineering |
| CSC 20 | Penetration Tests and Red Team Exercises |
| CSC 13, CSC 14 | Boundary Defense; Maintenance, Monitoring, and Analysis of Audit Logs |
| CSC 10, CSC 12 | Secure Configurations for Network Devices; Controlled Use of Administrative Privileges |
| ID.AM-1 | Physical devices and systems within the organization are inventoried |
| ID.AM-2 | Software platforms and applications within the organization are inventoried |
| ID.AM-3 | Organizational communication and data flows are mapped |
| ID.AM-4 | External information systems are catalogued |
| ID.AM-5 | Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value |
| ID.AM-6 | Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established |
| ID.BE-1 | The organization’s role in the supply chain is identified and communicated |
| ID.BE-2 | The organization’s place in critical infrastructure and its industry sector is identified and communicated |
| ID.BE-3 | Priorities for organizational mission, objectives, and activities are established and communicated |
| ID.BE-4 | Dependencies and critical functions for delivery of critical services are established |
| ID.BE-5 | Resilience requirements to support delivery of critical services are established |
| ID.GV-1 | Organizational information security policy is established |
| ID.GV-2 | Information security roles & responsibilities are coordinated and aligned with internal roles and external partners |
| ID.GV-3 | Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed |
| ID.GV-4 | Governance and risk management processes address cybersecurity risks |
| ID.RA-1 | Asset vulnerabilities are identified and documented |
| ID.RA-2 | Threat and vulnerability information is received from information sharing forums and sources |
| ID.RA-3 | Threats, both internal and external, are identified and documented |
| ID.RA-4 | Potential business impacts and likelihoods are identified |
| ID.RA-5 | Threats, vulnerabilities, likelihoods, and impacts are used to determine risk |
| ID.RA-6 | Risk responses are identified and prioritized |
| ID.RM-1 | Risk management processes are established, managed, and agreed to by organizational stakeholders |
| ID.RM-2 | Organizational risk tolerance is determined and clearly expressed |
| ID.RM-3 | The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis |
| PR.AC-1 | Identities and credentials are managed for authorized devices and users |
| PR.AC-2 | Physical access to assets is managed and protected |
| PR.AC-3 | Remote access is managed |
| PR.AC-4 | Access permissions are managed, incorporating the principles of least privilege and separation of duties |
| PR.AC-5 | Network integrity is protected, incorporating network segregation where appropriate |
| PR.AT-1 | All users are informed and trained |
| PR.AT-2 | Privileged users understand roles & responsibilities |
| PR.AT-3 | Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities |
| PR.AT-4 | Senior executives understand roles & responsibilities |
| PR.AT-5 | Physical and information security personnel understand roles & responsibilities |
| PR.DS-1 | Data-at-rest is protected |
| PR.DS-2 | Data-in-transit is protected |
| PR.DS-3 | Assets are formally managed throughout removal, transfers, and disposition |
| PR.DS-4 | Adequate capacity to ensure availability is maintained |
| PR.DS-5 | Protections against data leaks are implemented |
| PR.DS-6 | Integrity checking mechanisms are used to verify software, firmware, and information integrity |
| PR.DS-7 | The development and testing environment(s) are separate from the production environment |
| PR.IP-1 | A baseline configuration of information technology/industrial control systems is created and maintained |
| PR.IP-2 | A System Development Life Cycle to manage systems is implemented |
| PR.IP-3 | Configuration change control processes are in place |
| PR.IP-4 | Backups of information are conducted, maintained, and tested periodically |
| PR.IP-5 | Policy and regulations regarding the physical operating environment for organizational assets are met |
| PR.IP-6 | Data is destroyed according to policy |
| PR.IP-7 | Protection processes are continuously improved |
| PR.IP-8 | Effectiveness of protection technologies is shared with appropriate parties |
| PR.IP-9 | Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed |
| PR.IP-10 | Response and recovery plans are tested |
| PR.IP-11 | Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening) |
| PR.IP-12 | A vulnerability management plan is developed and implemented |
| PR.MA-1 | Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools |
| PR.MA-2 | Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access |
| PR.PT-1 | Audit/log records are determined, documented, implemented, and reviewed in accordance with policy |
| PR.PT-2 | Removable media is protected and its use restricted according to policy |
| PR.PT-3 | Access to systems and assets is controlled, incorporating the principle of least functionality |
| PR.PT-4 | Communications and control networks are protected |
| DE.AE-1 | A baseline of network operations and expected data flows for users and systems is established and managed |
| DE.AE-2 | Detected events are analyzed to understand attack targets and methods |
| DE.AE-3 | Event data are aggregated and correlated from multiple sources and sensors |
| DE.AE-4 | Impact of events is determined |
| DE.AE-5 | Incident alert thresholds are established |
| DE.CM-1 | The network is monitored to detect potential cybersecurity events |
| DE.CM-2 | The physical environment is monitored to detect potential cybersecurity events |
| DE.CM-3 | Personnel activity is monitored to detect potential cybersecurity events |
| DE.CM-4 | Malicious code is detected |
| DE.CM-5 | Unauthorized mobile code is detected |
| DE.CM-6 | External service provider activity is monitored to detect potential cybersecurity events |
| DE.CM-7 | Monitoring for unauthorized personnel, connections, devices, and software is performed |
| DE.CM-8 | Vulnerability scans are performed |
| DE.DP-1 | Roles and responsibilities for detection are well defined to ensure accountability |
| DE.DP-2 | Detection activities comply with all applicable requirements |
| DE.DP-3 | Detection processes are tested |
| DE.DP-4 | Event detection information is communicated to appropriate parties |
| DE.DP-5 | Detection processes are continuously improved |
| RS.RP-1 | Response plan is executed during or after an event |
| RS.CO-1 | Personnel know their roles and order of operations when a response is needed |
| RS.CO-2 | Events are reported consistent with established criteria |
| RS.CO-3 | Information is shared consistent with response plans |
| RS.CO-4 | Coordination with stakeholders occurs consistent with response plans |
| RS.CO-5 | Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness |
| RS.AN-1 | Notifications from detection systems are investigated |
| RS.AN-2 | The impact of the incident is understood |
| RS.AN-3 | Forensics are performed |
| RS.AN-4 | Incidents are categorized consistent with response plans |
| RS.MI-1 | Incidents are contained |
| RS.MI-2 | Incidents are mitigated |
| RS.MI-3 | Newly identified vulnerabilities are mitigated or documented as accepted risks |
| RS.IM-1 | Response plans incorporate lessons learned |
| RS.IM-2 | Response strategies are updated |
| RC.RP-1 | Recovery plan is executed during or after an event |
| RC.IM-1 | Recovery plans incorporate lessons learned |
| RC.IM-2 | Recovery strategies are updated |
| RC.CO-1 | Public relations are managed |
| RC.CO-2 | Reputation after an event is repaired |
| RC.CO-3 | Recovery activities are communicated to internal stakeholders and executive and management teams |
| PR.AC-4, PR.PT-3 | Access permissions are managed, incorporating the principles of least privilege and separation of duties; Access to systems and assets is controlled, incorporating the principle of least functionality |
| ID.AM-1, ID.AM-2, ID.AM-4 | Physical devices and systems within the organization are inventoried; Software platforms and applications within the organization are inventoried; Organizational communication and data flows are mapped |
| PR.AC-1, PR.AC-4 | Identities and credentials are managed for authorized devices and users; Access permissions are managed, incorporating the principles of least privilege and separation of duties |
| PR.AC-2, PR.IP-5 | Physical access to assets is managed and protected; Policy and regulations regarding the physical operating environment for organizational assets are met |
| PR.DS-1, PR.DS-2 | Data-at-rest is protected; Data-in-transit is protected |
| DE.CM-1, DE.CM-2, DE.CM-7 | The network is monitored to detect potential cybersecurity events; The physical environment is monitored to detect potential cybersecurity events; Monitoring for unauthorized personnel, connections, devices, and software is performed |
| PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2 | Physical access to assets is managed and protected; Physical and information security personnel understand roles & responsibilities ; Policy and regulations regarding the physical operating environment for organizational assets are met; The physical environment is monitored to detect potential cybersecurity events |
| PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5 | Physical access to assets is managed and protected, Access permissions are managed, incorporating the principles of least privilege and separation of duties; Data-at-rest is protected; Assets are formally managed throughout removal, transfers, and disposition; Protections against data leaks are implemented |
| PR.IP-1, PR.IP-2 | A baseline configuration of information technology/industrial control systems is created and maintained; A System Development Life Cycle to manage systems is implemented |
| 3.1.1 | Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). |
| 3.1.2 | Limit system access to the types of transactions and functions that authorized users are permitted to execute. |
| 3.1.3 | Control the flow of CUI in accordance with approved authorizations. |
| 3.1.4 | Separate the duties of individuals to reduce the risk of malevolent activity without collusion. |
| 3.1.5 | Employ the principle of least privilege, including for specific security functions and privileged accounts. |
| 3.1.6 | Use non-privileged accounts or roles when accessing nonsecurity functions. |
| 3.1.7 | Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. |
| 3.1.8 | Limit unsuccessful logon attempts. |
| 3.1.9 | Provide privacy and security notices consistent with applicable CUI rules. |
| 3.1.10 | Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. |
| 3.1.11 | Terminate (automatically) a user session after a defined condition. |
| 3.1.12 | Monitor and control remote access sessions. |
| 3.1.13 | Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. |
| 3.1.14 | Route remote access via managed access control points. |
| 3.1.15 | Authorize remote execution of privileged commands and remote access to security-relevant information |
| 3.1.16 | Authorize wireless access prior to allowing such connections. |
| 3.1.17 | Protect wireless access using authentication and encryption. |
| 3.1.18 | Control connection of mobile devices. |
| 3.1.19 | Encrypt CUI on mobile devices and mobile computing platforms.21 |
| 3.1.20 | Verify and control/limit connections to and use of external systems. |
| 3.1.21 | Limit use of portable storage devices on external systems. |
| 3.1.22 | Control CUI posted or processed on publicly accessible systems. |
| 3.2.1 | Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. |
| 3.2.2 | Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. |
| 3.2.3 | Provide security awareness training on recognizing and reporting potential indicators of insider reat. |
| 3.3.1 | Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. |
| 3.3.2 | Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. |
| 3.3.3 | Review and update logged events. |
| 3.3.4 | Alert in the event of an audit logging process failure. |
| 3.3.5 | Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. |
| 3.3.6 | Provide audit record reduction and report generation to support on-demand analysis and reporting. |
| 3.3.7 | Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. |
| 3.3.8 | Protect audit information and audit logging tools from unauthorized access, modification, and deletion. |
| 3.3.9 | Limit management of audit logging functionality to a subset of privileged users. |
| 3.4.1 | Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. |
| 3.4.2 | Establish and enforce security configuration settings for information technology products employed in organizational systems. |
| 3.4.3 | Track, review, approve or disapprove, and log changes to organizational systems. |
| 3.4.4 | Analyze the security impact of changes prior to implementation. |
| 3.4.5 | Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. |
| 3.4.6 | Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. |
| 3.4.7 | Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. |
| 3.4.8 | Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. |
| 3.4.9 | Control and monitor user-installed software. |
| 3.5.1 | Identify system users, processes acting on behalf of users, and devices. |
| 3.5.2 | Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. |
| 3.5.3 | Use multifactor authentication 22 for local and network access 23 to privileged accounts and for network access to non-privileged accounts. |
| 3.5.4 | Employ replay-resistant authentication mechanisms for network access to privileged and non- privileged accounts. |
| 3.5.5 | Prevent reuse of identifiers for a defined period. |
| 3.5.6 | Disable identifiers after a defined period of inactivity. |
| 3.5.7 | Enforce a minimum password complexity and change of characters when new passwords are created. |
| 3.5.8 | Prohibit password reuse for a specified number of generations. |
| 3.5.9 | Allow temporary password use for system logons with an immediate change to a permanent password. |
| 3.5.10 | Store and transmit only cryptographically-protected passwords. |
| 3.5.11 | Obscure feedback of authentication information. |
| 3.6.1 | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. |
| 3.6.2 | Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. |
| 3.6.3 | Test the organizational incident response capability. |
| 3.7.1 | Perform maintenance on organizational systems. |
| 3.7.2 | Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. |
| 3.7.3 | Ensure equipment removed for off-site maintenance is sanitized of any CUI. |
| 3.7.4 | Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. |
| 3.7.5 | Require multifactor authentication to establish nonlocal maintenance sessions via external netw connections and terminate such connections when nonlocal maintenance is complete. |
| 3.7.6 | Supervise the maintenance activities of maintenance personnel without required access authorization. |
| 3.8.1 | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. |
| 3.8.2 | Limit access to CUI on system media to authorized users. |
| 3.8.3 | Sanitize or destroy system media containing CUI before disposal or release for reuse. |
| 3.8.4 | Mark media with necessary CUI markings and distribution limitations. |
| 3.8.5 | Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. |
| 3.8.6 | Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. |
| 3.8.7 | Control the use of removable media on system components. |
| 3.8.8 | Prohibit the use of portable storage devices when such devices have no identifiable owner. |
| 3.8.9 | Protect the confidentiality of backup CUI at storage locations. |
| 3.9.1 | Screen individuals prior to authorizing access to organizational systems containing CUI. |
| 3.9.2 | Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. |
| 3.10.1 | Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. |
| 3.10.2 | Protect and monitor the physical facility and support infrastructure for organizational systems. |
| 3.10.3 | Escort visitors and monitor visitor activity. |
| 3.10.4 | Maintain audit logs of physical access. |
| 3.10.5 | Control and manage physical access devices. |
| 3.10.6 | Enforce safeguarding measures for CUI at alternate work sites. |
| 3.11.1 | Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. |
| 3.11.2 | Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. |
| 3.11.3 | Remediate vulnerabilities in accordance with risk assessments. |
| 3.12.1 | Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. |
| 3.12.2 | Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. |
| 3.12.3 | Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. |
| 3.12.4 | Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. |
| 3.13.1 | Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. |
| 3.13.2 | Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. |
| 3.13.3 | Separate user functionality from system management functionality. |
| 3.13.4 | Prevent unauthorized and unintended information transfer via shared system resources. |
| 3.13.5 | Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. |
| 3.13.6 | Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). |
| 3.13.7 | Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). |
| 3.13.8 | Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. |
| 3.13.9 | Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. |
| 3.13.10 | Establish and manage cryptographic keys for cryptography employed in organizational systems. |
| 3.13.11 | Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. |
| 3.13.12 | Prohibit remote activation 27 of collaborative computing devices and provide indication of devices in use to users present at the device. |
| 3.13.13 | Control and monitor the use of mobile code. |
| 3.13.14 | Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. |
| 3.13.15 | Protect the authenticity of communications sessions. |
| 3.13.16 | Protect the confidentiality of CUI at rest. |
| 3.14.1 | Identify, report, and correct system flaws in a timely manner. |
| 3.14.2 | Provide protection from malicious code at designated locations within organizational systems. |
| 3.14.3 | Monitor system security alerts and advisories and take action in response. |
| 3.14.4 | Update malicious code protection mechanisms when new releases are available. |
| 3.14.5 | Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. |
| 3.14.6 | Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. |
| 3.14.7 | Identify unauthorized use of organizational systems. |
| 3.1.1, 3.1.2, 3.1.7 | Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).; Limit system access to the types of transactions and functions that authorized users are permitted to execute.; Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. |
| 3.1.12, 3.1.13, 3.1.14, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7 | Monitor and control remote access sessions.; Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.; Route remote access via managed access control points.; Authorize remote execution of privileged commands and remote access to security-relevant information; Limit unsuccessful logon attempts.; Require multifactor authentication to establish nonlocal maintenance sessions via external netw connections and terminate such connections when nonlocal maintenance is complete.; Limit access to CUI on system media to authorized users.; Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). |
| 3.1.7, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.3, 3.7.1, 3.7.6, 3.10.4, 3.10.5 | Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.; Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.; Review and update logged events.; Alert in the event of an audit logging process failure.; Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.; Track, review, approve or disapprove, and log changes to organizational systems.; Perform maintenance on organizational systems.; Supervise the maintenance activities of maintenance personnel without required access authorization.;Maintain audit logs of physical access.;Control and manage physical access devices. |
| 3.4.3, 3.4.4 | Track, review, approve or disapprove, and log changes to organizational systems.; Analyze the security impact of changes prior to implementation. |
| 3.1.3, 3.8.1 | Control the flow of CUI in accordance with approved authorizations.;Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. |
| 3.1.19, 3.8.1 | Encrypt CUI on mobile devices and mobile computing platforms.21;Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. |
| 3.7.1, 3.7.2, 3.8.3 | Perform maintenance on organizational systems.;Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.;Sanitize or destroy system media containing CUI before disposal or release for reuse. |
| 3.8.1, 3.8.2 | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.;Limit access to CUI on system media to authorized users. |
| 3.6.1, 3.14.6, 3.14.7 | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.;Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.;Identify unauthorized use of organizational systems. |
| 3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1 | Limit access to CUI on system media to authorized users.; Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.; Protect and monitor the physical facility and support infrastructure for organizational systems.; Control and manage physical access devices.; Enforce safeguarding measures for CUI at alternate work sites.; Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. |
| 3.8.1, 3.8.5, 3.8.7 | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.;Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.;Control the use of removable media on system components. |
| 3.9.1, 3.9.2 | Screen individuals prior to authorizing access to organizational systems containing CUI.;Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. |
| 3.6.1, 3.12.2 | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.;Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. |
| 3.1.18, 3.7.1, 3.13.13 | Control connection of mobile devices.;Perform maintenance on organizational systems.;Separate user functionality from system management functionality. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .