Appendix E - CUI Requirements Table.pdf

DRAFT

Appendix E

E-1

Appendix E: CUI Requirements Table

Modified NIST SP 800-171 Requirements Req # NIST SP 800-171 Requirement USTRANSCOM Modified Requirement

3.1.3 Control the flow of CUI in accordance with

approved authorizations.

Limit the flow of DoD information to organizations or individuals necessary for the performance of the operationally critical requirements of this contract.

3.1.9 Provide privacy and security notices

consistent with applicable CUI rules.

Provide privacy and security notices consistent with U.S. Government and/or local governmental regulations.

3.1.19 Encrypt CUI on mobile devices and mobile

computing platforms.

Provide adequate technical protections on mobile devices and computing platforms that process and/or store contractual information.

3.1.22 Control CUI posted or processed on publicly

accessible systems.

Control DoD information posted or processed on publically accessible systems.

3.7.3 Ensure equipment removed for off-site

maintenance is sanitized of any CUI.

Ensure equipment removed for off-site maintenance is sanitized of DoD information.

3.8.1 Protect (i.e., physically control and securely

store) system media containing CUI, both paper and digital.

Protect (i.e., physically control and securely store) system media containing DoD information, both paper and digital.

3.8.2 Limit access to CUI on system media to

authorized users.

Limit access to DoD information on system media to authorized users.

3.8.3 Sanitize or destroy system media containing

CUI before disposal or release for reuse.

Sanitize or destroy system media containing DoD information before disposal or release for reuse.

3.8.4 Mark media with necessary CUI markings

and distribution limitations.

Mark media with privacy and security notices consistent with U.S. Government and/or local government regulations.

3.8.5 Control access to media containing CUI and

maintain accountability for media during transport outside of controlled areas.

Control access to and maintain accountability for media containing DoD information.

3.8.9 Protect the confidentiality of backup CUI at

storage locations.

Provide information backup procedures (frequency, timeframe for storage, etc.) for DoD data located on contractor systems. Protect the confidentiality of backup materials containing DoD information.

3.9.1 Screen individuals prior to authorizing access

to organizational systems containing CUI.

Screen individuals prior to authorizing access to organizational systems containing DoD information.

3.9.2 Ensure that CUI and organizational systems

containing CUI are protected during and after personnel actions such as terminations and transfers.

Ensure that DoD information and organizational systems containing DoD information are protected during and after personnel actions such as terminations and transfers.

3.10.6 Enforce safeguarding measures for CUI at

alternate work sites (e.g., telework sites).

Enforce safeguarding measures for DoD Information at alternate work sites (e.g., telework sites).

3.11.1 Periodically assess the risk to organizational

operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of DoD information.

DRAFT

Appendix E

E-2

3.13.8 Implement cryptographic mechanisms to

prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Implement cryptographic mechanisms to prevent unauthorized disclosure of DoD information during transmission when possible unless otherwise protected by alternate physical safeguards.

3.13.11 Employ FIPS-validated cryptography when

used to protect the confidentiality of CUI.

Employ FIPS-validated cryptography when used to protect the confidentiality of DoD information within the organization’s systems and when possible when transmitting to external entities.

3.13.16 Protect the confidentiality of CUI at rest. Protect the confidentiality of DoD information at rest.