Atch 7 - NIST.SP 800-171_POAM_Template.xlsx
XLSX spreadsheet 417 KB Posted
- Solicitation number
- HTC711-24-R-CC01
About this file
This document is an NIST 800-171 POAM (Plan of Action and Milestones) template for tracking compliance with NIST 800-171 security controls. The template provides instructions and a format for documenting the non-compliance detection date, scheduled and actual completion dates, supporting documentation, and status/comments for each NIST 800-171 control requirement. The template covers the 14 families of NIST 800-171 controls, such as access control, identification and authentication, and system and information integrity. It is designed to be used by organizations to assess their NIST 800-171 compliance posture and develop a plan to address any identified gaps.
This document describes a federal contract opportunity for International long-range and short-range passenger and/or cargo airlift services in support of the Civil Reserve Air Fleet (CRAF) program. The solicitation number is HTC711-24-R-CC01, and it is being issued by the Department of Defense United States Transportation Command. The contract will provide international charter airlift services. No other details about the specific products, services, pricing, set asides, or award dates are provided in this summary.
View the file
Other files
Show 40 more
50 files listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions for POAM
| USTRANSCOM NIST 800-171 POAM |
| INSTRUCTIONS |
Each tab across the bottom of this workbook contains a NIST 800-171 control family.
Note: Certain areas of each sheet are not editable. These include "control compliance", "control/objective number", "control family", "DIBCAC score", "control/objective text" and "control type" (columns A through F). These are all locked out.
Overarching control compliance status is controlled by the subobjectives under each control number. Example: 3.1.1 can only be compliant ("yes") if objectives 3.1.1[a] through [f] are all compliant ("yes"). A noncompliant ("no") in any subobjective will automatically render the objective as noncompliant ("no"). Thus, when all subobjectives are in compliance ("yes"), the objective automatically is compliant ("yes").
Noncompilance Detection Date: self explanatory
Scheduled Completion Date: please provide an estimated time the noncompliant control/objective will be corrected.
Actual Completion Date: please annotate the date the noncompliant control/objective was corrected.
Supporting Documentation/System Controls: briefly describe those technology controls and/or process documents that will be used to achieve compliance with the control/objective requirement. Include details of the implementation/deployment plans and associated milestones. Description should be complete enough so assessors can clearly see a pathway to compliance.
Status/Comments: additional amplifying information regarding the control, objective, documentation, and/or the POAM itself.
Dashboard
| Objective | 3.1.1 | 3.1.1 | 3.1.1 | 3.1.1 | 3.1.1 | 3.1.1 | 3.1.1 | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.4 | 3.1.4 | 3.1.4 | 3.1.4 | 3.1.5 | 3.1.5 | 3.1.5 | 3.1.5 | 3.1.5 | 3.1.6 | 3.1.6 | 3.1.6 | 3.1.7 | 3.1.7 | 3.1.7 | 3.1.7 | 3.1.7 | 3.1.8 | 3.1.8 | 3.1.8 | 3.1.9 | 3.1.9 | 3.1.9 | 3.1.10 | 3.1.10 | 3.1.10 | 3.1.10 | 3.1.11 | 3.1.11 | 3.1.11 | 3.1.12 | 3.1.12 | 3.1.12 |
| Procedure | 3.1.1 | 3.1.1[a] | 3.1.1[b] | 3.1.1[c] | 3.1.1[d] | 3.1.1[e] | 3.1.1[f] | 3.1.2 | 3.1.2[a] | 3.1.2[b] | 3.1.3 | 3.1.3[a] | 3.1.3[b] | 3.1.3[c] | 3.1.3[d] | 3.1.3[e] | 3.1.4 | 3.1.4[a] | 3.1.4[b] | 3.1.4[c] | 3.1.5 | 3.1.5[a] | 3.1.5[b] | 3.1.5[c] | 3.1.5[d] | 3.1.6 | 3.1.6[a] | 3.1.6[b] | 3.1.7 | 3.1.7[a] | 3.1.7[b] | 3.1.7[c] | 3.1.7[d] | 3.1.8 | 3.1.8[a] | 3.1.8[b] | 3.1.9 | 3.1.9[a] | 3.1.9[b] | 3.1.10 | 3.1.10[a] | 3.1.10[b] | 3.1.10[c] | 3.1.11 | 3.1.11[a] | 3.1.11[b] | 3.1.12 | 3.1.12[a] | 3.1.12[b] |
| response | NR | 0 | 0 | 0 | 0 | 0 | 0 | NR | 0 | 0 | NR | 0 | 0 | 0 | 0 | 0 | NR | 0 | 0 | 0 | NR | 0 | 0 | 0 | 0 | NR | 0 | 0 | NR | 0 | 0 | 0 | 0 | NR | 0 | 0 | NR | 0 | 0 | NR | 0 | 0 | 0 | NR | 0 | 0 | NR | 0 | 0 |
| 800-171 objectives | 800-171 Procedure | Basic FAR Objectives | Basic FAR Procedures | |||||||||||||||||||||||||||||||||||||||
| Objective | Procedure | response | Objective | Procedure | response | Objective | Procedure | response | Objective | Procedure | response | Objective | Procedure | response | Basic Safeguarding of Covered Contractor Information Systems | Compliant | ||||||||||||||||||||||||||
| (Yes/No) | NIST 800-171 | |||||||||||||||||||||||||||||||||||||||||
| Control/Objective Number | Control Family | DIBCAC Scoring | Control/Objective Text | Control Type | Non-Compliance Detection Date | Scheduled Completion Date | Actual Completion Date | Supporting Documentation / System Controls | Status / Comments | Access Control | Not Rated | Compliant | Non-Compliant | |||||||||||||||||||||||||||||
| 3.1.1 | 3.1.1 | NR | Access Control'!A2 | 3.1.1 | 3.1.1 | NR | 3.1.1 | 3.1.1 | NR | 1 | NR | 3.1.1 | Access Control | 5 | Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). | Basic | 0 | 0 | 0 | 0 | FARS 52.204-21 controls | 4 | 0 | 0 | ||||||||||||||||||
| 3.1.1 | 3.1.1[a] | 0 | Access Control'!A3 | 3.1.1 | 3.1.1[a] | 0 | 3.1.1 | 3.1.1[a] | 0 | 1 | 0 | 3.1.1[a] | Access Control | 0 | authorized users are identified. | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 Procedures | 23 | 0 | 0 | |||||||||||||||||
| 3.1.1 | 3.1.1[b] | 0 | Access Control'!A4 | 3.1.1 | 3.1.1[b] | 0 | 3.1.1 | 3.1.1[b] | 0 | 1 | 0 | 3.1.1[b] | Access Control | 0 | processes acting on behalf of authorized users are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ID and Authentication | Not Rated | Compliant | Non-Compliant | |||||||||||||||||
| 3.1.1 | 3.1.1[c] | 0 | Access Control'!A5 | 3.1.1 | 3.1.1[c] | 0 | 3.1.1 | 3.1.1[c] | 0 | 1 | 0 | 3.1.1[c] | Access Control | 0 | devices (and other systems) authorized to connect to the system are identified. | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 controls | 2 | 0 | 0 | |||||||||||||||||
| 3.1.1 | 3.1.1[d] | 0 | Access Control'!A6 | 3.1.1 | 3.1.1[d] | 0 | 3.1.1 | 3.1.1[d] | 0 | 1 | 0 | 3.1.1[d] | Access Control | 0 | system access is limited to authorized users. | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 Procedures | 8 | 0 | 0 | |||||||||||||||||
| 3.1.1 | 3.1.1[e] | 0 | Access Control'!A7 | 3.1.1 | 3.1.1[e] | 0 | 3.1.1 | 3.1.1[e] | 0 | 1 | 0 | 3.1.1[e] | Access Control | 0 | system access is limited to processes acting on behalf of authorized users. | 0 | 0 | 0 | 0 | 0 | 0 | Media Protection | Not Rated | Compliant | Non-Compliant | |||||||||||||||||
| 3.1.1 | 3.1.1[f] | 0 | Access Control'!A8 | 3.1.1 | 3.1.1[f] | 0 | 3.1.1 | 3.1.1[f] | 0 | 1 | 0 | 3.1.1[f] | Access Control | 0 | system access is limited to authorized devices (including other systems). | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 controls | 1 | 0 | 0 | |||||||||||||||||
| 3.1.2 | 3.1.2 | NR | Access Control'!A9 | 3.1.2 | 3.1.2 | NR | 3.1.2 | 3.1.2 | NR | 1 | NR | 3.1.2 | Access Control | 5 | Limit information system access to the types of transactions and functions that authorized users are permitted to execute. | Derived | 0 | 0 | 0 | 0 | FARS 52.204-21 Procedures | 3 | 0 | 0 | ||||||||||||||||||
| 3.1.2 | 3.1.2[a] | 0 | Access Control'!A10 | 3.1.2 | 3.1.2[a] | 0 | 3.1.2 | 3.1.2[a] | 0 | 1 | 0 | 3.1.2[a] | Access Control | 0 | the types of transactions and functions that authorized users are permitted to execute are defined. | 0 | 0 | 0 | 0 | 0 | 0 | Physical Protection | Not Rated | Compliant | Non-Compliant | |||||||||||||||||
| 3.1.2 | 3.1.2[b] | 0 | Access Control'!A11 | 3.1.2 | 3.1.2[b] | 0 | 3.1.2 | 3.1.2[b] | 0 | 1 | 0 | 3.1.2[b] | Access Control | 0 | system access is limited to the defined types of transactions and functions for authorized users. | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 controls | 4 | 0 | 0 | |||||||||||||||||
| 3.1.3 | 3.1.3 | NR | Access Control'!A12 | 3.1.3 | 3.1.3 | NR | 2 | NR | 3.1.3 | Access Control | 1 | Limit the flow of DoD information to organizations or individuals necessary for the performance of the operationally critical requirements of this contract. | Derived | 0 | 0 | 0 | 0 | FARS 52.204-21 Procedures | 13 | |||||||||||||||||||||||
| 3.1.3 | 3.1.3[a] | 0 | Access Control'!A13 | 3.1.3 | 3.1.3[a] | 0 | 2 | 0 | 3.1.3[a] | Access Control | 0 | information flow control policies are defined. | 0 | 0 | 0 | 0 | 0 | 0 | Compliant | |||||||||||||||||||||||
| 3.1.3 | 3.1.3[b] | 0 | Access Control'!A14 | 3.1.3 | 3.1.3[b] | 0 | 2 | 0 | 3.1.3[b] | Access Control | 0 | methods and enforcement mechanisms for controlling the flow of CUI are defined. | 0 | 0 | 0 | 0 | 0 | 0 | 2 | |||||||||||||||||||||||
| 3.1.3 | 3.1.3[c] | 0 | Access Control'!A15 | 3.1.3 | 3.1.3[c] | 0 | 2 | 0 | 3.1.3[c] | Access Control | 0 | designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified. | 0 | 0 | 0 | 0 | 0 | 0 | 12 | |||||||||||||||||||||||
| 3.1.3 | 3.1.3[d] | 0 | Access Control'!A16 | 3.1.3 | 3.1.3[d] | 0 | 2 | 0 | 3.1.3[d] | Access Control | 0 | authorizations for controlling the flow of CUI are defined. | 0 | 0 | 0 | 0 | 0 | 0 | Compliant | |||||||||||||||||||||||
| 3.1.3 | 3.1.3[e] | 0 | Access Control'!A17 | 3.1.3 | 3.1.3[e] | 0 | 2 | 0 | 3.1.3[e] | Access Control | 0 | approved authorizations for controlling the flow of CUI are enforced. | 0 | 0 | 0 | 0 | 0 | 0 | 4 | |||||||||||||||||||||||
| 3.1.4 | 3.1.4 | NR | Access Control'!A18 | 3.1.4 | 3.1.4 | NR | 2 | NR | 3.1.4 | Access Control | 1 | Separate the duties of individuals to reduce the risk of malevolent activity without collusion. | Derived | 0 | 0 | 0 | 0 | 15 | ||||||||||||||||||||||||
| 3.1.4 | 3.1.4[a] | 0 | Access Control'!A19 | 3.1.4 | 3.1.4[a] | 0 | 2 | 0 | 3.1.4[a] | Access Control | 0 | the duties of individuals requiring separation are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.4 | 3.1.4[b] | 0 | Access Control'!A20 | 3.1.4 | 3.1.4[b] | 0 | 2 | 0 | 3.1.4[b] | Access Control | 0 | responsibilities for duties that require separation are assigned to separate individuals. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.4 | 3.1.4[c] | 0 | Access Control'!A21 | 3.1.4 | 3.1.4[c] | 0 | 2 | 0 | 3.1.4[c] | Access Control | 0 | access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.5 | 3.1.5 | NR | Access Control'!A22 | 3.1.5 | 3.1.5 | NR | 2 | NR | 3.1.5 | Access Control | 3 | Employ the principle of least privilege, including for specific security functions and privileged accounts. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.5 | 3.1.5[a] | 0 | Access Control'!A23 | 3.1.5 | 3.1.5[a] | 0 | 2 | 0 | 3.1.5[a] | Access Control | 0 | privileged accounts are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.5 | 3.1.5[b] | 0 | Access Control'!A24 | 3.1.5 | 3.1.5[b] | 0 | 2 | 0 | 3.1.5[b] | Access Control | 0 | access to privileged accounts is authorized in accordance with the principle of least privilege. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.5 | 3.1.5[c] | 0 | Access Control'!A25 | 3.1.5 | 3.1.5[c] | 0 | 2 | 0 | 3.1.5[c] | Access Control | 0 | security functions are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.5 | 3.1.5[d] | 0 | Access Control'!A26 | 3.1.5 | 3.1.5[d] | 0 | 2 | 0 | 3.1.5[d] | Access Control | 0 | access to security functions is authorized in accordance with the principle of least privilege. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.6 | 3.1.6 | NR | Access Control'!A27 | 3.1.6 | 3.1.6 | NR | 2 | NR | 3.1.6 | Access Control | 1 | Use non-privileged accounts or roles when accessing nonsecurity functions. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.6 | 3.1.6[a] | 0 | Access Control'!A28 | 3.1.6 | 3.1.6[a] | 0 | 2 | 0 | 3.1.6[a] | Access Control | 0 | nonsecurity functions are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.6 | 3.1.6[b] | 0 | Access Control'!A29 | 3.1.6 | 3.1.6[b] | 0 | 2 | 0 | 3.1.6[b] | Access Control | 0 | users are required to use non-privileged accounts or roles when accessing nonsecurity functions. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.7 | 3.1.7 | NR | Access Control'!A30 | 3.1.7 | 3.1.7 | NR | 2 | NR | 3.1.7 | Access Control | 1 | Prevent non-privileged users from executing privileged functions and audit the execution of such functions. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.7 | 3.1.7[a] | 0 | Access Control'!A31 | 3.1.7 | 3.1.7[a] | 0 | 2 | 0 | 3.1.7[a] | Access Control | 0 | privileged functions are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.7 | 3.1.7[b] | 0 | Access Control'!A32 | 3.1.7 | 3.1.7[b] | 0 | 2 | 0 | 3.1.7[b] | Access Control | 0 | non-privileged users are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.7 | 3.1.7[c] | 0 | Access Control'!A33 | 3.1.7 | 3.1.7[c] | 0 | 2 | 0 | 3.1.7[c] | Access Control | 0 | non-privileged users are prevented from executing privileged functions. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.7 | 3.1.7[d] | 0 | Access Control'!A34 | 3.1.7 | 3.1.7[d] | 0 | 2 | 0 | 3.1.7[d] | Access Control | 0 | the execution of privileged functions is captured in audit logs. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.8 | 3.1.8 | NR | Access Control'!A35 | 3.1.8 | 3.1.8 | NR | 2 | NR | 3.1.8 | Access Control | 1 | Limit unsuccessful logon attempts. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.8 | 3.1.8[a] | 0 | Access Control'!A36 | 3.1.8 | 3.1.8[a] | 0 | 2 | 0 | 3.1.8[a] | Access Control | 0 | the means of limiting unsuccessful logon attempts is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.8 | 3.1.8[b] | 0 | Access Control'!A37 | 3.1.8 | 3.1.8[b] | 0 | 2 | 0 | 3.1.8[b] | Access Control | 0 | the defined means of limiting unsuccessful logon attempts is implemented. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.9 | 3.1.9 | NR | Access Control'!A38 | 3.1.9 | 3.1.9 | NR | 2 | NR | 3.1.9 | Access Control | 1 | Provide privacy and security notices consistent with U.S. Government and/or local governmental regulations. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.9 | 3.1.9[a] | 0 | Access Control'!A39 | 3.1.9 | 3.1.9[a] | 0 | 2 | 0 | 3.1.9[a] | Access Control | 0 | privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.9 | 3.1.9[b] | 0 | Access Control'!A40 | 3.1.9 | 3.1.9[b] | 0 | 2 | 0 | 3.1.9[b] | Access Control | 0 | privacy and security notices are displayed. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.10 | 3.1.10 | NR | Access Control'!A41 | 3.1.10 | 3.1.10 | NR | 2 | NR | 3.1.10 | Access Control | 1 | Use session lock with pattern-hiding displays to prevent access/viewing of data after period of inactivity. | Basic | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.10 | 3.1.10[a] | 0 | Access Control'!A42 | 3.1.10 | 3.1.10[a] | 0 | 2 | 0 | 3.1.10[a] | Access Control | 0 | the period of inactivity after which the system initiates a session lock is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.10 | 3.1.10[b] | 0 | Access Control'!A43 | 3.1.10 | 3.1.10[b] | 0 | 2 | 0 | 3.1.10[b] | Access Control | 0 | access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.10 | 3.1.10[c] | 0 | Access Control'!A44 | 3.1.10 | 3.1.10[c] | 0 | 2 | 0 | 3.1.10[c] | Access Control | 0 | previously visible information is concealed via a pattern-hiding display after the defined period of inactivity. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.11 | 3.1.11 | NR | Access Control'!A45 | 3.1.11 | 3.1.11 | NR | 2 | NR | 3.1.11 | Access Control | 1 | Terminate (automatically) a user session after a defined condition. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.11 | 3.1.11[a] | 0 | Access Control'!A46 | 3.1.11 | 3.1.11[a] | 0 | 2 | 0 | 3.1.11[a] | Access Control | 0 | conditions requiring a user session to terminate are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.11 | 3.1.11[b] | 0 | Access Control'!A47 | 3.1.11 | 3.1.11[b] | 0 | 2 | 0 | 3.1.11[b] | Access Control | 0 | a user session is automatically terminated after any of the defined conditions occur. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.12 | 3.1.12 | NR | Access Control'!A48 | 3.1.12 | 3.1.12 | NR | 2 | NR | 3.1.12 | Access Control | 5 | Monitor and control remote access sessions. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.12 | 3.1.12[a] | 0 | Access Control'!A49 | 3.1.12 | 3.1.12[a] | 0 | 2 | 0 | 3.1.12[a] | Access Control | 0 | remote access sessions are permitted. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.12 | 3.1.12[b] | 0 | Access Control'!A50 | 3.1.12 | 3.1.12[b] | 0 | 2 | 0 | 3.1.12[b] | Access Control | 0 | the types of permitted remote access are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.12 | 3.1.12[c] | NR | Access Control'!A51 | 3.1.12 | 3.1.12[c] | NR | 2 | NR | 3.1.12[c] | Access Control | 0 | remote access sessions are controlled. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.12 | 3.1.12[d] | 0 | Access Control'!A52 | 3.1.12 | 3.1.12[d] | 0 | 2 | 0 | 3.1.12[d] | Access Control | 0 | remote access sessions are monitored. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.13 | 3.1.13 | NR | Access Control'!A53 | 3.1.13 | 3.1.13 | NR | 2 | NR | 3.1.13 | Access Control | 5 | Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.13 | 3.1.13[a] | 0 | Access Control'!A54 | 3.1.13 | 3.1.13[a] | 0 | 2 | 0 | 3.1.13[a] | Access Control | 0 | cryptographic mechanisms to protect the confidentiality of remote access sessions are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.13 | 3.1.13[b] | 0 | Access Control'!A55 | 3.1.13 | 3.1.13[b] | 0 | 2 | 0 | 3.1.13[b] | Access Control | 0 | cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.14 | 3.1.14 | NR | Access Control'!A56 | 3.1.14 | 3.1.14 | NR | 2 | NR | 3.1.14 | Access Control | 1 | Route remote access via managed access control points. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.14 | 3.1.14[a] | 0 | Access Control'!A57 | 3.1.14 | 3.1.14[a] | 0 | 2 | 0 | 3.1.14[a] | Access Control | 0 | managed access control points are identified and implemented. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.14 | 3.1.14[b] | 0 | Access Control'!A58 | 3.1.14 | 3.1.14[b] | 0 | 2 | 0 | 3.1.14[b] | Access Control | 0 | remote access is routed through managed network access control points. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.15 | 3.1.15 | NR | Access Control'!A59 | 3.1.15 | 3.1.15 | NR | 2 | NR | 3.1.15 | Access Control | 1 | Authorize remote execution of privileged commands and remote access to security-relevant information. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.15 | 3.1.15[a] | 0 | Access Control'!A60 | 3.1.15 | 3.1.15[a] | 0 | 2 | 0 | 3.1.15[a] | Access Control | 0 | privileged commands authorized for remote execution are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.15 | 3.1.15[b] | 0 | Access Control'!A61 | 3.1.15 | 3.1.15[b] | 0 | 2 | 0 | 3.1.15[b] | Access Control | 0 | security-relevant information authorized to be accessed remotely is identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.15 | 3.1.15[c] | 0 | Access Control'!A62 | 3.1.15 | 3.1.15[c] | 0 | 2 | 0 | 3.1.15[c] | Access Control | 0 | the execution of the identified privileged commands via remote access is authorized. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.15 | 3.1.15[d] | 0 | Access Control'!A63 | 3.1.15 | 3.1.15[d] | 0 | 2 | 0 | 3.1.15[d] | Access Control | 0 | access to the identified security-relevant information via remote access is authorized. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.16 | 3.1.16 | NR | Access Control'!A64 | 3.1.16 | 3.1.16 | NR | 2 | NR | 3.1.16 | Access Control | 5 | Authorize wireless access prior to allowing such connections. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.16 | 3.1.16[a] | 0 | Access Control'!A65 | 3.1.16 | 3.1.16[a] | 0 | 2 | 0 | 3.1.16[a] | Access Control | 0 | wireless access points are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.16 | 3.1.16[b] | 0 | Access Control'!A66 | 3.1.16 | 3.1.16[b] | 0 | 2 | 0 | 3.1.16[b] | Access Control | 0 | wireless access is authorized prior to allowing such connections. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.17 | 3.1.17 | NR | Access Control'!A67 | 3.1.17 | 3.1.17 | NR | 2 | NR | 3.1.17 | Access Control | 5 | Protect wireless access using authentication and encryption. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.17 | 3.1.17[a] | NR | Access Control'!A68 | 3.1.17 | 3.1.17[a] | NR | 2 | NR | 3.1.17[a] | Access Control | 0 | wireless access to the system is protected using authentication. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.17 | 3.1.17[b] | 0 | Access Control'!A69 | 3.1.17 | 3.1.17[b] | 0 | 2 | 0 | 3.1.17[b] | Access Control | 0 | wireless access to the system is protected using encryption. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.18 | 3.1.18 | NR | Access Control'!A70 | 3.1.18 | 3.1.18 | NR | 2 | NR | 3.1.18 | Access Control | 5 | Control connection of mobile devices. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.18 | 3.1.18[a] | 0 | Access Control'!A71 | 3.1.18 | 3.1.18[a] | 0 | 2 | 0 | 3.1.18[a] | Access Control | 0 | mobile devices that process, store, or transmit CUI are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.18 | 3.1.18[b] | 0 | Access Control'!A72 | 3.1.18 | 3.1.18[b] | 0 | 2 | 0 | 3.1.18[b] | Access Control | 0 | mobile device connections are authorized. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.18 | 3.1.18[c] | 0 | Access Control'!A73 | 3.1.18 | 3.1.18[c] | 0 | 2 | 0 | 3.1.18[c] | Access Control | 0 | mobile device connections are monitored and logged. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.19 | 3.1.19 | NR | Access Control'!A74 | 3.1.19 | 3.1.19 | NR | 2 | NR | 3.1.19 | Access Control | 3 | Provide adequate technical protections on mobile devices and computing platforms that process and/or store contractual information. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.19 | 3.1.19[a] | 0 | Access Control'!A75 | 3.1.19 | 3.1.19[a] | 0 | 2 | 0 | 3.1.19[a] | Access Control | 0 | mobile devices and mobile computing platforms that process, store, or transmit CUI are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.19 | 3.1.19[b] | 0 | Access Control'!A76 | 3.1.19 | 3.1.19[b] | 0 | 2 | 0 | 3.1.19[b] | Access Control | 0 | encryption is employed to protect CUI on identified mobile devices and mobile computing platforms. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.20 | 3.1.20 | NR | Access Control'!A77 | 3.1.20 | 3.1.20 | NR | 3.1.20 | 3.1.20 | NR | 1 | NR | 3.1.20 | Access Control | 1 | Verify and control/limit connections to and use of external information systems. | Derived | 0 | 0 | 0 | 0 | FARS 52.204-21 Procedures | 13 | 0 | 0 | ||||||||||||||||||
| 3.1.20 | 3.1.20[a] | 0 | Access Control'!A78 | 3.1.20 | 3.1.20[a] | 0 | 3.1.20 | 3.1.20[a] | 0 | 1 | 0 | 3.1.20[a] | Access Control | 0 | connections to external systems are identified. | 0 | 0 | 0 | 0 | 0 | 0 | Sys and Comm Protection | Not Rated | Compliant | Non-Compliant | |||||||||||||||||
| 3.1.20 | 3.1.20[b] | 0 | Access Control'!A79 | 3.1.20 | 3.1.20[b] | 0 | 3.1.20 | 3.1.20[b] | 0 | 1 | 0 | 3.1.20[b] | Access Control | 0 | the use of external systems is identified. | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 controls | 2 | 0 | 0 | |||||||||||||||||
| 3.1.20 | 3.1.20[c] | 0 | Access Control'!A80 | 3.1.20 | 3.1.20[c] | 0 | 3.1.20 | 3.1.20[c] | 0 | 1 | 0 | 3.1.20[c] | Access Control | 0 | connections to external systems are verified. | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 Procedures | 12 | 0 | 0 | |||||||||||||||||
| 3.1.20 | 3.1.20[d] | 0 | Access Control'!A81 | 3.1.20 | 3.1.20[d] | 0 | 3.1.20 | 3.1.20[d] | 0 | 1 | 0 | 3.1.20[d] | Access Control | 0 | the use of external systems is verified. | 0 | 0 | 0 | 0 | 0 | 0 | System and Info Integrity | Not Rated | Compliant | Non-Compliant | |||||||||||||||||
| 3.1.20 | 3.1.20[e] | 0 | Access Control'!A82 | 3.1.20 | 3.1.20[e] | 0 | 3.1.20 | 3.1.20[e] | 0 | 1 | 0 | 3.1.20[e] | Access Control | 0 | connections to external systems are controlled/limited. | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 controls | 4 | 0 | 0 | |||||||||||||||||
| 3.1.20 | 3.1.20[f] | 0 | Access Control'!A83 | 3.1.20 | 3.1.20[f] | 0 | 3.1.20 | 3.1.20[f] | 0 | 1 | 0 | 3.1.20[f] | Access Control | 0 | the use of external systems is controlled/limited. | 0 | 0 | 0 | 0 | 0 | 0 | FARS 52.204-21 Procedures | 15 | 0 | 0 | |||||||||||||||||
| 3.1.21 | 3.1.21 | NR | Access Control'!A84 | 3.1.21 | 3.1.21 | NR | 2 | NR | 3.1.21 | Access Control | 1 | Limit use of organizational portable storage devices on external information systems. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.1.21 | 3.1.21[a] | 0 | Access Control'!A85 | 3.1.21 | 3.1.21[a] | 0 | 2 | 0 | 3.1.21[a] | Access Control | 0 | the use of portable storage devices containing CUI on external systems is identified and documented. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.21 | 3.1.21[b] | 0 | Access Control'!A86 | 3.1.21 | 3.1.21[b] | 0 | 2 | 0 | 3.1.21[b] | Access Control | 0 | limits on the use of portable storage devices containing CUI on external systems are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.21 | 3.1.21[c] | 0 | Access Control'!A87 | 3.1.21 | 3.1.21[c] | 0 | 2 | 0 | 3.1.21[c] | Access Control | 0 | the use of portable storage devices containing CUI on external systems is limited as defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.1.22 | 3.1.22 | NR | Access Control'!A88 | 3.1.22 | 3.1.22 | NR | 3.1.22 | 3.1.22 | NR | 1 | NR | 3.1.22 | Access Control | 1 | Control DoD information posted or processed on publically accessible systems. | Derived | 0 | 0 | 0 | 0 | ||||||||||||||||||||||
| 3.1.22 | 3.1.22[a] | 0 | Access Control'!A89 | 3.1.22 | 3.1.22[a] | 0 | 3.1.22 | 3.1.22[a] | 0 | 1 | 0 | 3.1.22[a] | Access Control | 0 | individuals authorized to post or process information on publicly accessible systems are identified. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.1.22 | 3.1.22[b] | 0 | Access Control'!A90 | 3.1.22 | 3.1.22[b] | 0 | 3.1.22 | 3.1.22[b] | 0 | 1 | 0 | 3.1.22[b] | Access Control | 0 | procedures to ensure CUI is not posted or processed on publicly accessible systems are identified. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.1.22 | 3.1.22[c] | 0 | Access Control'!A91 | 3.1.22 | 3.1.22[c] | 0 | 3.1.22 | 3.1.22[c] | 0 | 1 | 0 | 3.1.22[c] | Access Control | 0 | a review process is in place prior to posting of any content to publicly accessible systems. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.1.22 | 3.1.22[d] | 0 | Access Control'!A92 | 3.1.22 | 3.1.22[d] | 0 | 3.1.22 | 3.1.22[d] | 0 | 1 | 0 | 3.1.22[d] | Access Control | 0 | content on publicly accessible systems is reviewed to ensure that it does not include CUI. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.1.22 | 3.1.22[e] | 0 | Access Control'!A93 | 3.1.22 | 3.1.22[e] | 0 | 3.1.22 | 3.1.22[e] | 0 | 1 | 0 | 3.1.22[e] | Access Control | 0 | mechanisms are in place to remove and address improper posting of CUI. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.2.1 | 3.2.1 | NR | Awareness and Training'!A2 | 3.2.1 | 3.2.1 | NR | 2 | NR | 3.2.1 | Awareness and Training | 5 | Ensure that managers, systems administrators, and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of organizational information systems. | Basic | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.2.1 | 3.2.1[a] | 0 | Awareness and Training'!A3 | 3.2.1 | 3.2.1[a] | 0 | 2 | 0 | 3.2.1[a] | Awareness and Training | 0 | security risks associated with organizational activities involving CUI are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.2.1 | 3.2.1[b] | 0 | Awareness and Training'!A4 | 3.2.1 | 3.2.1[b] | 0 | 2 | 0 | 3.2.1[b] | Awareness and Training | 0 | policies, standards, and procedures related to the security of the system are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.2.1 | 3.2.1[c] | 0 | Awareness and Training'!A5 | 3.2.1 | 3.2.1[c] | 0 | 2 | 0 | 3.2.1[c] | Awareness and Training | 0 | managers, systems administrators, and users of the system are made aware of the security risks associated with their activities. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.2.1 | 3.2.1[d] | 0 | Awareness and Training'!A6 | 3.2.1 | 3.2.1[d] | 0 | 2 | 0 | 3.2.1[d] | Awareness and Training | 0 | managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.2.2 | 3.2.2 | NR | Awareness and Training'!A7 | 3.2.2 | 3.2.2 | NR | 2 | NR | 3.2.2 | Awareness and Training | 5 | Ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities. | Basic | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.2.2 | 3.2.2[a] | 0 | Awareness and Training'!A8 | 3.2.2 | 3.2.2[a] | 0 | 2 | 0 | 3.2.2[a] | Awareness and Training | 0 | information security-related duties, roles, and responsibilities are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.2.2 | 3.2.2[b] | 0 | Awareness and Training'!A9 | 3.2.2 | 3.2.2[b] | 0 | 2 | 0 | 3.2.2[b] | Awareness and Training | 0 | information security-related duties, roles, and responsibilities are assigned to designated personnel. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.2.2 | 3.2.2[c] | 0 | Awareness and Training'!A10 | 3.2.2 | 3.2.2[c] | 0 | 2 | 0 | 3.2.2[c] | Awareness and Training | 0 | personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.2.3 | 3.2.3 | NR | Awareness and Training'!A11 | 3.2.3 | 3.2.3 | NR | 2 | NR | 3.2.3 | Awareness and Training | 1 | Provide security awareness training on recognizing and reporting potential indicators of insider threat. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.2.3 | 3.2.3[a] | 0 | Awareness and Training'!A12 | 3.2.3 | 3.2.3[a] | 0 | 2 | 0 | 3.2.3[a] | Awareness and Training | 0 | potential indicators associated with insider threats are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.2.3 | 3.2.3[b] | 0 | Awareness and Training'!A13 | 3.2.3 | 3.2.3[b] | 0 | 2 | 0 | 3.2.3[b] | Awareness and Training | 0 | security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.1 | 3.3.1 | NR | Audit and Accountability'!A2 | 3.3.1 | 3.3.1 | NR | 2 | NR | 3.3.1 | Audit and Accountability | 5 | Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity. | Basic | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.1 | 3.3.1[a] | 0 | Audit and Accountability'!A3 | 3.3.1 | 3.3.1[a] | 0 | 2 | 0 | 3.3.1[a] | Audit and Accountability | 0 | audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.1 | 3.3.1[b] | 0 | Audit and Accountability'!A4 | 3.3.1 | 3.3.1[b] | 0 | 2 | 0 | 3.3.1[b] | Audit and Accountability | 0 | the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.1 | 3.3.1[c] | 0 | Audit and Accountability'!A5 | 3.3.1 | 3.3.1[c] | 0 | 2 | 0 | 3.3.1[c] | Audit and Accountability | 0 | audit records are created (generated). | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.1 | 3.3.1[d] | 0 | Audit and Accountability'!A6 | 3.3.1 | 3.3.1[d] | 0 | 2 | 0 | 3.3.1[d] | Audit and Accountability | 0 | audit records, once created, contain the defined content. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.1 | 3.3.1[e] | 0 | Audit and Accountability'!A7 | 3.3.1 | 3.3.1[e] | 0 | 2 | 0 | 3.3.1[e] | Audit and Accountability | 0 | retention requirements for audit records are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.1 | 3.3.1[f] | 0 | Audit and Accountability'!A8 | 3.3.1 | 3.3.1[f] | 0 | 2 | 0 | 3.3.1[f] | Audit and Accountability | 0 | audit records are retained as defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.2 | 3.3.2 | NR | Audit and Accountability'!A9 | 3.3.2 | 3.3.2 | NR | 2 | NR | 3.3.2 | Audit and Accountability | 3 | Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions. | Basic | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.2 | 3.3.2[a] | 0 | Audit and Accountability'!A10 | 3.3.2 | 3.3.2[a] | 0 | 2 | 0 | 3.3.2[a] | Audit and Accountability | 0 | the content of the audit records needed to support the ability to uniquely trace users to their actions is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.2 | 3.3.2[b] | 0 | Audit and Accountability'!A11 | 3.3.2 | 3.3.2[b] | 0 | 2 | 0 | 3.3.2[b] | Audit and Accountability | 0 | audit records, once created, contain the defined content. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.3 | 3.3.3 | NR | Audit and Accountability'!A12 | 3.3.3 | 3.3.3 | NR | 2 | NR | 3.3.3 | Audit and Accountability | 1 | Review and update audited events. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.3 | 3.3.3[a] | 0 | Audit and Accountability'!A13 | 3.3.3 | 3.3.3[a] | 0 | 2 | 0 | 3.3.3[a] | Audit and Accountability | 0 | a process for determining when to review logged events is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.3 | 3.3.3[b] | 0 | Audit and Accountability'!A14 | 3.3.3 | 3.3.3[b] | 0 | 2 | 0 | 3.3.3[b] | Audit and Accountability | 0 | event types being logged are reviewed in accordance with the defined review process. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.3 | 3.3.3[c] | 0 | Audit and Accountability'!A15 | 3.3.3 | 3.3.3[c] | 0 | 2 | 0 | 3.3.3[c] | Audit and Accountability | 0 | event types being logged are updated based on the review. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.4 | 3.3.4 | NR | Audit and Accountability'!A16 | 3.3.4 | 3.3.4 | NR | 2 | NR | 3.3.4 | Audit and Accountability | 1 | Alert in the event of an audit process failure. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.4 | 3.3.4[a] | 0 | Audit and Accountability'!A17 | 3.3.4 | 3.3.4[a] | 0 | 2 | 0 | 3.3.4[a] | Audit and Accountability | 0 | personnel or roles to be alerted in the event of an audit logging process failure are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.4 | 3.3.4[b] | 0 | Audit and Accountability'!A18 | 3.3.4 | 3.3.4[b] | 0 | 2 | 0 | 3.3.4[b] | Audit and Accountability | 0 | types of audit logging process failures for which alert will be generated are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.4 | 3.3.4[c] | 0 | Audit and Accountability'!A19 | 3.3.4 | 3.3.4[c] | 0 | 2 | 0 | 3.3.4[c] | Audit and Accountability | 0 | identified personnel or roles are alerted in the event of an audit logging process failure. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.5 | 3.3.5 | NR | Audit and Accountability'!A20 | 3.3.5 | 3.3.5 | NR | 2 | NR | 3.3.5 | Audit and Accountability | 5 | Use automated mechanisms to integrate and correlate audit review, analysis, and reporting processes for investigation and response to indications of inappropriate, suspicious, or unusual activity. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.5 | 3.3.5[a] | 0 | Audit and Accountability'!A21 | 3.3.5 | 3.3.5[a] | 0 | 2 | 0 | 3.3.5[a] | Audit and Accountability | 0 | audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.5 | 3.3.5[b] | 0 | Audit and Accountability'!A22 | 3.3.5 | 3.3.5[b] | 0 | 2 | 0 | 3.3.5[b] | Audit and Accountability | 0 | defined audit record review, analysis, and reporting processes are correlated. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.6 | 3.3.6 | NR | Audit and Accountability'!A23 | 3.3.6 | 3.3.6 | NR | 2 | NR | 3.3.6 | Audit and Accountability | 1 | Provide audit reduction and report generation to support on-demand analysis and reporting. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.6 | 3.3.6[a] | 0 | Audit and Accountability'!A24 | 3.3.6 | 3.3.6[a] | 0 | 2 | 0 | 3.3.6[a] | Audit and Accountability | 0 | an audit record reduction capability that supports on-demand analysis is provided. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.6 | 3.3.6[b] | 0 | Audit and Accountability'!A25 | 3.3.6 | 3.3.6[b] | 0 | 2 | 0 | 3.3.6[b] | Audit and Accountability | 0 | a report generation capability that supports on-demand reporting is provided. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.7 | 3.3.7 | NR | Audit and Accountability'!A26 | 3.3.7 | 3.3.7 | NR | 2 | NR | 3.3.7 | Audit and Accountability | 1 | Provide an information system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.7 | 3.3.7[a] | 0 | Audit and Accountability'!A27 | 3.3.7 | 3.3.7[a] | 0 | 2 | 0 | 3.3.7[a] | Audit and Accountability | 0 | internal system clocks are used to generate time stamps for audit records. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.7 | 3.3.7[b] | 0 | Audit and Accountability'!A28 | 3.3.7 | 3.3.7[b] | 0 | 2 | 0 | 3.3.7[b] | Audit and Accountability | 0 | an authoritative source with which to compare and synchronize internal system clocks is specified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.7 | 3.3.7[c] | 0 | Audit and Accountability'!A29 | 3.3.7 | 3.3.7[c] | 0 | 2 | 0 | 3.3.7[c] | Audit and Accountability | 0 | internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.8 | 3.3.8 | NR | Audit and Accountability'!A30 | 3.3.8 | 3.3.8 | NR | 2 | NR | 3.3.8 | Audit and Accountability | 1 | Protect audit information and audit tools from unauthorized access, modification, and deletion. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.8 | 3.3.8[a] | 0 | Audit and Accountability'!A31 | 3.3.8 | 3.3.8[a] | 0 | 2 | 0 | 3.3.8[a] | Audit and Accountability | 0 | audit information is protected from unauthorized access. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.8 | 3.3.8[b] | 0 | Audit and Accountability'!A32 | 3.3.8 | 3.3.8[b] | 0 | 2 | 0 | 3.3.8[b] | Audit and Accountability | 0 | audit information is protected from unauthorized modification. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.8 | 3.3.8[c] | 0 | Audit and Accountability'!A33 | 3.3.8 | 3.3.8[c] | 0 | 2 | 0 | 3.3.8[c] | Audit and Accountability | 0 | audit information is protected from unauthorized deletion. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.8 | 3.3.8[d] | 0 | Audit and Accountability'!A34 | 3.3.8 | 3.3.8[d] | 0 | 2 | 0 | 3.3.8[d] | Audit and Accountability | 0 | audit logging tools are protected from unauthorized access. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.8 | 3.3.8[e] | 0 | Audit and Accountability'!A35 | 3.3.8 | 3.3.8[e] | 0 | 2 | 0 | 3.3.8[e] | Audit and Accountability | 0 | audit logging tools are protected from unauthorized modification. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.8 | 3.3.8[f] | 0 | Audit and Accountability'!A36 | 3.3.8 | 3.3.8[f] | 0 | 2 | 0 | 3.3.8[f] | Audit and Accountability | 0 | audit logging tools are protected from unauthorized deletion. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.9 | 3.3.9 | NR | Audit and Accountability'!A37 | 3.3.9 | 3.3.9 | NR | 2 | NR | 3.3.9 | Audit and Accountability | 1 | Limit management of audit functionality to a subset of privileged users. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.3.9 | 3.3.9[a] | 0 | Audit and Accountability'!A38 | 3.3.9 | 3.3.9[a] | 0 | 2 | 0 | 3.3.9[a] | Audit and Accountability | 0 | a subset of privileged users granted access to manage audit logging functionality is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.3.9 | 3.3.9[b] | 0 | Audit and Accountability'!A39 | 3.3.9 | 3.3.9[b] | 0 | 2 | 0 | 3.3.9[b] | Audit and Accountability | 0 | management of audit logging functionality is limited to the defined subset of privileged users. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.1 | 3.4.1 | NR | Configuration Management'!A2 | 3.4.1 | 3.4.1 | NR | 2 | NR | 3.4.1 | Configuration Management | 5 | Establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. | Basic | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.4.1 | 3.4.1[a] | 0 | Configuration Management'!A3 | 3.4.1 | 3.4.1[a] | 0 | 2 | 0 | 3.4.1[a] | Configuration Management | 0 | a baseline configuration is established. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.1 | 3.4.1[b] | 0 | Configuration Management'!A4 | 3.4.1 | 3.4.1[b] | 0 | 2 | 0 | 3.4.1[b] | Configuration Management | 0 | the baseline configuration includes hardware, software, firmware, and documentation. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.1 | 3.4.1[c] | 0 | Configuration Management'!A5 | 3.4.1 | 3.4.1[c] | 0 | 2 | 0 | 3.4.1[c] | Configuration Management | 0 | the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.1 | 3.4.1[d] | 0 | Configuration Management'!A6 | 3.4.1 | 3.4.1[d] | 0 | 2 | 0 | 3.4.1[d] | Configuration Management | 0 | a system inventory is established. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.1 | 3.4.1[e] | 0 | Configuration Management'!A7 | 3.4.1 | 3.4.1[e] | 0 | 2 | 0 | 3.4.1[e] | Configuration Management | 0 | the system inventory includes hardware, software, firmware, and documentation. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.1 | 3.4.1[f] | 0 | Configuration Management'!A8 | 3.4.1 | 3.4.1[f] | 0 | 2 | 0 | 3.4.1[f] | Configuration Management | 0 | the inventory is maintained (reviewed and updated) throughout the system development life cycle. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.2 | 3.4.2 | NR | Configuration Management'!A9 | 3.4.2 | 3.4.2 | NR | 2 | NR | 3.4.2 | Configuration Management | 5 | Establish and enforce security configuration settings for information technology products employed in organizational information systems. | Basic | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.4.2 | 3.4.2[a] | 0 | Configuration Management'!A10 | 3.4.2 | 3.4.2[a] | 0 | 2 | 0 | 3.4.2[a] | Configuration Management | 0 | security configuration settings for information technology products employed in the system are established and included in the baseline configuration. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.2 | 3.4.2[b] | 0 | Configuration Management'!A11 | 3.4.2 | 3.4.2[b] | 0 | 2 | 0 | 3.4.2[b] | Configuration Management | 0 | security configuration settings for information technology products employed in the system are enforced. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.3 | 3.4.3 | NR | Configuration Management'!A12 | 3.4.3 | 3.4.3 | NR | 2 | NR | 3.4.3 | Configuration Management | 1 | Track, review, approve/disapprove, and audit changes to information systems. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.4.3 | 3.4.3[a] | 0 | Configuration Management'!A13 | 3.4.3 | 3.4.3[a] | 0 | 2 | 0 | 3.4.3[a] | Configuration Management | 0 | changes to the system are tracked. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.3 | 3.4.3[b] | 0 | Configuration Management'!A14 | 3.4.3 | 3.4.3[b] | 0 | 2 | 0 | 3.4.3[b] | Configuration Management | 0 | changes to the system are reviewed. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.3 | 3.4.3[c] | 0 | Configuration Management'!A15 | 3.4.3 | 3.4.3[c] | 0 | 2 | 0 | 3.4.3[c] | Configuration Management | 0 | changes to the system are approved or disapproved. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.3 | 3.4.3[d] | 0 | Configuration Management'!A16 | 3.4.3 | 3.4.3[d] | 0 | 2 | 0 | 3.4.3[d] | Configuration Management | 0 | changes to the system are logged. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.4 | 3.4.4 | NR | Configuration Management'!A17 | 3.4.4 | 3.4.4 | NR | 3.4.4 | 3.4.4 | NR | 2 | NR | 3.4.4 | Configuration Management | 1 | Analyze the security impact of changes prior to implementation. | Derived | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.4.5 | 3.4.5 | NR | Configuration Management'!A18 | 3.4.5 | 3.4.5 | NR | 2 | NR | 3.4.5 | Configuration Management | 5 | Define, document, approve, and enforce physical and logical access restrictions associated with changes to the information system. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.4.5 | 3.4.5[a] | 0 | Configuration Management'!A19 | 3.4.5 | 3.4.5[a] | 0 | 2 | 0 | 3.4.5[a] | Configuration Management | 0 | physical access restrictions associated with changes to the system are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.5 | 3.4.5[b] | 0 | Configuration Management'!A20 | 3.4.5 | 3.4.5[b] | 0 | 2 | 0 | 3.4.5[b] | Configuration Management | 0 | physical access restrictions associated with changes to the system are documented. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.5 | 3.4.5[c] | 0 | Configuration Management'!A21 | 3.4.5 | 3.4.5[c] | 0 | 2 | 0 | 3.4.5[c] | Configuration Management | 0 | physical access restrictions associated with changes to the system are approved. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.5 | 3.4.5[d] | 0 | Configuration Management'!A22 | 3.4.5 | 3.4.5[d] | 0 | 2 | 0 | 3.4.5[d] | Configuration Management | 0 | physical access restrictions associated with changes to the system are enforced. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.5 | 3.4.5[e] | 0 | Configuration Management'!A23 | 3.4.5 | 3.4.5[e] | 0 | 2 | 0 | 3.4.5[e] | Configuration Management | 0 | logical access restrictions associated with changes to the system are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.5 | 3.4.5[f] | 0 | Configuration Management'!A24 | 3.4.5 | 3.4.5[f] | 0 | 2 | 0 | 3.4.5[f] | Configuration Management | 0 | logical access restrictions associated with changes to the system are documented. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.5 | 3.4.5[g] | 0 | Configuration Management'!A25 | 3.4.5 | 3.4.5[g] | 0 | 2 | 0 | 3.4.5[g] | Configuration Management | 0 | logical access restrictions associated with changes to the system are approved. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.5 | 3.4.5[h] | 0 | Configuration Management'!A26 | 3.4.5 | 3.4.5[h] | 0 | 2 | 0 | 3.4.5[h] | Configuration Management | 0 | logical access restrictions associated with changes to the system are enforced. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.6 | 3.4.6 | NR | Configuration Management'!A27 | 3.4.6 | 3.4.6 | NR | 2 | NR | 3.4.6 | Configuration Management | 5 | Employ the principle of least functionality by configuring the information system to provide only essential capabilities. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.4.6 | 3.4.6[a] | 0 | Configuration Management'!A28 | 3.4.6 | 3.4.6[a] | 0 | 2 | 0 | 3.4.6[a] | Configuration Management | 0 | essential system capabilities are defined based on the principle of least functionality. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.6 | 3.4.6[b] | 0 | Configuration Management'!A29 | 3.4.6 | 3.4.6[b] | 0 | 2 | 0 | 3.4.6[b] | Configuration Management | 0 | the system is configured to provide only the defined essential capabilities. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7 | NR | Configuration Management'!A30 | 3.4.7 | 3.4.7 | NR | 2 | NR | 3.4.7 | Configuration Management | 5 | Restrict, disable, and prevent the use of nonessential programs, functions, ports, protocols, and services. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.4.7 | 3.4.7[a] | 0 | Configuration Management'!A31 | 3.4.7 | 3.4.7[a] | 0 | 2 | 0 | 3.4.7[a] | Configuration Management | 0 | essential programs are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[b] | 0 | Configuration Management'!A32 | 3.4.7 | 3.4.7[b] | 0 | 2 | 0 | 3.4.7[b] | Configuration Management | 0 | the use of nonessential programs is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[c] | 0 | Configuration Management'!A33 | 3.4.7 | 3.4.7[c] | 0 | 2 | 0 | 3.4.7[c] | Configuration Management | 0 | the use of nonessential programs is restricted, disabled, or prevented as defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[d] | 0 | Configuration Management'!A34 | 3.4.7 | 3.4.7[d] | 0 | 2 | 0 | 3.4.7[d] | Configuration Management | 0 | essential functions are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[e] | 0 | Configuration Management'!A35 | 3.4.7 | 3.4.7[e] | 0 | 2 | 0 | 3.4.7[e] | Configuration Management | 0 | the use of nonessential functions is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[f] | 0 | Configuration Management'!A36 | 3.4.7 | 3.4.7[f] | 0 | 2 | 0 | 3.4.7[f] | Configuration Management | 0 | the use of nonessential functions is restricted, disabled, or prevented as defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[g] | 0 | Configuration Management'!A37 | 3.4.7 | 3.4.7[g] | 0 | 2 | 0 | 3.4.7[g] | Configuration Management | 0 | essential ports are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[h] | 0 | Configuration Management'!A38 | 3.4.7 | 3.4.7[h] | 0 | 2 | 0 | 3.4.7[h] | Configuration Management | 0 | the use of nonessential ports is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[i] | 0 | Configuration Management'!A39 | 3.4.7 | 3.4.7[i] | 0 | 2 | 0 | 3.4.7[i] | Configuration Management | 0 | the use of nonessential ports is restricted, disabled, or prevented as defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[j] | NR | Configuration Management'!A40 | 3.4.7 | 3.4.7[j] | NR | 2 | NR | 3.4.7[j] | Configuration Management | 0 | essential protocols are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[k] | 0 | Configuration Management'!A41 | 3.4.7 | 3.4.7[k] | 0 | 2 | 0 | 3.4.7[k] | Configuration Management | 0 | the use of nonessential protocols is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[l] | 0 | Configuration Management'!A42 | 3.4.7 | 3.4.7[l] | 0 | 2 | 0 | 3.4.7[l] | Configuration Management | 0 | the use of nonessential protocols is restricted, disabled, or prevented as defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[m] | 0 | Configuration Management'!A43 | 3.4.7 | 3.4.7[m] | 0 | 2 | 0 | 3.4.7[m] | Configuration Management | 0 | essential services are defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[n] | 0 | Configuration Management'!A44 | 3.4.7 | 3.4.7[n] | 0 | 2 | 0 | 3.4.7[n] | Configuration Management | 0 | the use of nonessential services is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.7 | 3.4.7[o] | 0 | Configuration Management'!A45 | 3.4.7 | 3.4.7[o] | 0 | 2 | 0 | 3.4.7[o] | Configuration Management | 0 | the use of nonessential services is restricted, disabled, or prevented as defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.8 | 3.4.8 | NR | Configuration Management'!A46 | 3.4.8 | 3.4.8 | NR | 2 | NR | 3.4.8 | Configuration Management | 5 | Apply deny-by-exception (blacklist) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.4.8 | 3.4.8[a] | 0 | Configuration Management'!A47 | 3.4.8 | 3.4.8[a] | 0 | 2 | 0 | 3.4.8[a] | Configuration Management | 0 | a policy specifying whether whitelisting or blacklisting is to be implemented is specified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.8 | 3.4.8[b] | 0 | Configuration Management'!A48 | 3.4.8 | 3.4.8[b] | 0 | 2 | 0 | 3.4.8[b] | Configuration Management | 0 | the software allowed to execute under whitelisting or denied use under blacklisting is specified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.8 | 3.4.8[c] | 0 | Configuration Management'!A49 | 3.4.8 | 3.4.8[c] | 0 | 2 | 0 | 3.4.8[c] | Configuration Management | 0 | whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.9 | 3.4.9 | NR | Configuration Management'!A50 | 3.4.9 | 3.4.9 | NR | 2 | NR | 3.4.9 | Configuration Management | 1 | Control and monitor user-installed software. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.4.9 | 3.4.9[a] | 0 | Configuration Management'!A51 | 3.4.9 | 3.4.9[a] | 0 | 2 | 0 | 3.4.9[a] | Configuration Management | 0 | a policy for controlling the installation of software by users is established. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.9 | 3.4.9[b] | 0 | Configuration Management'!A52 | 3.4.9 | 3.4.9[b] | 0 | 2 | 0 | 3.4.9[b] | Configuration Management | 0 | installation of software by users is controlled based on the established policy. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.4.9 | 3.4.9[c] | 0 | Configuration Management'!A53 | 3.4.9 | 3.4.9[c] | 0 | 2 | 0 | 3.4.9[c] | Configuration Management | 0 | installation of software by users is monitored. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.5.1 | 3.5.1 | NR | ID and Authentication '!A2 | 3.5.1 | 3.5.1 | NR | 3.5.1 | 3.5.1 | NR | 1 | NR | 3.5.1 | Identification and Authentication | 5 | Identify information system users, processes acting on behalf of users, or devices. | Basic | 0 | 0 | 0 | 0 | ||||||||||||||||||||||
| 3.5.1 | 3.5.1[a] | 0 | ID and Authentication '!A3 | 3.5.1 | 3.5.1[a] | 0 | 3.5.1 | 3.5.1[a] | 0 | 1 | 0 | 3.5.1[a] | Identification and Authentication | 0 | system users are identified. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.5.1 | 3.5.1[b] | 0 | ID and Authentication '!A4 | 3.5.1 | 3.5.1[b] | 0 | 3.5.1 | 3.5.1[b] | 0 | 1 | 0 | 3.5.1[b] | Identification and Authentication | 0 | processes acting on behalf of users are identified. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.5.1 | 3.5.1[c] | 0 | ID and Authentication '!A5 | 3.5.1 | 3.5.1[c] | 0 | 3.5.1 | 3.5.1[c] | 0 | 1 | 0 | 3.5.1[c] | Identification and Authentication | 0 | devices accessing the system are identified. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.5.2 | 3.5.2 | NR | ID and Authentication '!A6 | 3.5.2 | 3.5.2 | NR | 3.5.2 | 3.5.2 | NR | 1 | NR | 3.5.2 | Identification and Authentication | 5 | Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. | Basic | 0 | 0 | 0 | 0 | ||||||||||||||||||||||
| 3.5.2 | 3.5.2[a] | 0 | ID and Authentication '!A7 | 3.5.2 | 3.5.2[a] | 0 | 3.5.2 | 3.5.2[a] | 0 | 1 | 0 | 3.5.2[a] | Identification and Authentication | 0 | the identity of each user is authenticated or verified as a prerequisite to system access. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.5.2 | 3.5.2[b] | 0 | ID and Authentication '!A8 | 3.5.2 | 3.5.2[b] | 0 | 3.5.2 | 3.5.2[b] | 0 | 1 | 0 | 3.5.2[b] | Identification and Authentication | 0 | the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.5.2 | 3.5.2[c] | 0 | ID and Authentication '!A9 | 3.5.2 | 3.5.2[c] | 0 | 3.5.2 | 3.5.2[c] | 0 | 1 | 0 | 3.5.2[c] | Identification and Authentication | 0 | the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access. | 0 | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.5.3 | 3.5.3 | NR | ID and Authentication '!A10 | 3.5.3 | 3.5.3 | NR | 2 | NR | 3.5.3 | Identification and Authentication | 5 | Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.5.3 | 3.5.3[a] | 0 | ID and Authentication '!A11 | 3.5.3 | 3.5.3[a] | 0 | 2 | 0 | 3.5.3[a] | Identification and Authentication | 0 | privileged accounts are identified. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.5.3 | 3.5.3[b] | 0 | ID and Authentication '!A12 | 3.5.3 | 3.5.3[b] | 0 | 2 | 0 | 3.5.3[b] | Identification and Authentication | 0 | multifactor authentication is implemented for local access to privileged accounts. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.5.3 | 3.5.3[c] | 0 | ID and Authentication '!A13 | 3.5.3 | 3.5.3[c] | 0 | 2 | 0 | 3.5.3[c] | Identification and Authentication | 0 | multifactor authentication is implemented for network access to privileged accounts. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.5.3 | 3.5.3[d] | 0 | ID and Authentication '!A14 | 3.5.3 | 3.5.3[d] | 0 | 2 | 0 | 3.5.3[d] | Identification and Authentication | 0 | multifactor authentication is implemented for network access to non-privileged accounts. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.5.4 | 3.5.4 | 0 | ID and Authentication '!A15 | 3.5.4 | 3.5.4 | 0 | 3.5.4 | 3.5.4 | 0 | 2 | 0 | 3.5.4 | Identification and Authentication | 1 | Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. | Derived | 0 | 0 | 0 | 0 | 0 | |||||||||||||||||||||
| 3.5.5 | 3.5.5 | NR | ID and Authentication '!A16 | 3.5.5 | 3.5.5 | NR | 2 | NR | 3.5.5 | Identification and Authentication | 1 | Prevent reuse of identifiers for a defined period. | Derived | 0 | 0 | 0 | 0 | |||||||||||||||||||||||||
| 3.5.5 | 3.5.5[a] | 0 | ID and Authentication '!A17 | 3.5.5 | 3.5.5[a] | 0 | 2 | 0 | 3.5.5[a] | Identification and Authentication | 0 | a period within which identifiers cannot be reused is defined. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.5.5 | 3.5.5[b] | 0 | ID and Authentication '!A18 | 3.5.5 | 3.5.5[b] | 0 | 2 | 0 | 3.5.5[b] | Identification and Authentication | 0 | reuse of identifiers is prevented within the defined period. | 0 | 0 | 0 | 0 | 0 | 0 | ||||||||||||||||||||||||
| 3.5.6 | 3.5.6 | NR | ID and Authentication '!A19 | 3.5.6 | 3.5.6 | NR | 2 | NR | 3.5.6 | Identification and Authentication | 1 | Disable identifiers after a defined period of inactivity. | Derived | 0 | 0 | 0 | 0 |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .