Attachment J.30 - NIST.SP.800-171A.PDF

NIST Special Publication 800-171A

Assessing Security Requirements for

Controlled Unclassified Information

RON ROSS

KELLEY DEMPSEY

VICTORIA PILLITTERI

NIST Special Publication 800-171A

Assessing Security Requirements for

Controlled Unclassified Information

RON ROSS

KELLEY DEMPSEY

VICTORIA PILLITTERI

Computer Security Division

National Institute of Standards and Technology

June 2018

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

PAGE i

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

P

.800-171A

Authority

This publication has been developed by the National Institute of Standards and Technology to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-171A Natl. Inst. Stand. Technol. Spec. Publ. 800-171A, 92 pages (June 2018)

CODEN: NSPUE2

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-171A

Comments on this publication may be submitted to:

Attn: Computer Security Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA).

Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

https://doi.org/10.6028/NIST.SP.800-171A mailto:sec-cert@nist.gov https://csrc.nist.gov/publications

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

PAGE ii

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

Reports on Computer Systems Technology

The NIST Information Technology Laboratory (ITL) promotes the United States economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology.

ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information and protection of individuals’ privacy in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information systems security and its collaborative activities with industry, government, and academic organizations.

Abstract

The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully conduct its assigned missions and business operations.

This publication provides federal and nonfederal organizations with assessment procedures and a methodology that can be employed to conduct assessments of the CUI security requirements in NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. The assessment procedures are flexible and can be customized to the needs of the organizations and the assessors conducting the assessments. Security assessments can be conducted as self-assessments; independent, third-party assessments; or government-sponsored assessments and can be applied with various degrees of rigor, based on customer-defined depth and coverage attributes. The findings and evidence produced during the security assessments can facilitate risk-based decisions by organizations related to the CUI requirements.

Keywords

Assessment; Assessment Method; Assessment Object; Assessment Procedure; Assurance; Basic Security Requirement; Controlled Unclassified Information; Coverage; CUI Registry; Depth;

Derived Security Requirement; Executive Order 13556; FISMA; NIST Special Publication 800- 53; NIST Special Publication 800-53A; Nonfederal Organization; Nonfederal System; Security Assessment; Security Control.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

PAGE iii

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

Acknowledgements

The authors gratefully acknowledge and appreciate the contributions from Jon Boyens, Devin Casey, Chris Enloe, Ned Goren, Gary Guissanie, Jody Jacobs, Jeff Marron, Vicki Michetti, Mark Riddle, Mary Thomas, Matt Scholl, Gary Stoneburner, Patricia Toth, and Patrick Viscuso whose thoughtful and constructive comments improved the quality, thoroughness, and usefulness of this publication. A special note of thanks goes to Jim Foti and Elizabeth Lennon for their superb administrative and technical editing support.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

PAGE iv

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

CAUTIONARY NOTE

The generalized assessment procedures described in this publication provide a framework and a starting point for developing specific procedures to assess the CUI security requirements in NIST Special Publication 800-171. The assessment procedures can be used to generate relevant evidence to determine if the security safeguards employed by organizations are implemented correctly, are operating as intended, and satisfy the CUI security requirements. Organizations have the flexibility to specialize the assessment procedures by selecting the specific assessment methods and the set of assessment objects to achieve the assessment objectives. There is no expectation that all assessment methods and all objects will be used for every assessment. There is also significant flexibility on the scope of the assessment and the degree of rigor applied during the assessment process. The assessment procedures and methods can be applied across a continuum of approaches—including self-assessments; independent, third-party assessments;

and assessments conducted by sponsoring organizations (e.g., government agencies). Such approaches may be specified in contracts or in agreements by participating parties.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

PAGE v

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

DEFINITION AND USAGE OF THE TERM INFORMATION SYSTEM

Unless otherwise specified by legislation, regulation, or governmentwide policy, the use of the term information system in this publication is replaced by the term system. This change reflects a more broad-based and holistic definition of information systems that includes, for example:

general purpose information systems; industrial and process control systems; cyber-physical systems; and individual devices that are part of the Internet of Things. As computing platforms and information technologies are increasingly deployed ubiquitously worldwide and systems and components are connected through wired and wireless networks, the susceptibility of Controlled Unclassified Information to loss or compromise grows—as does the potential for adverse consequences resulting from such occurrences.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

PAGE vi

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

OTHER RESOURCES TO SUPPORT ASSESSMENTS

NIST Special Publication 800-171A is a companion publication developed to support assessments of the CUI security requirements in NIST Special Publication 800-171. As such, it is the primary and authoritative source of guidance for organizations conducting such assessments. However, since it is recognized that the communities of interest affected by the CUI security requirements are broad and diverse, other supporting assessment guidance may be developed for those communities. For example, the NIST Manufacturing Extension Partnership (MEP) developed Handbook 162, NIST MEP Cybersecurity Self-Assessment Handbook for Assessing NIST SP 800- 171 Security Requirements in Response to DFARS Cybersecurity Requirements. This resource, along with other assessment resources that may be developed in the future, can complement the assessment procedures in NIST Special Publication 800-171A, thus helping sector-specific organizations generate the evidence needed to determine if the CUI security requirements have been satisfied.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

PAGE vii

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

Table of Contents

CHAPTER ONE INTRODUCTION

1.1 PURPOSE AND APPLICABILITY

1.2 TARGET AUDIENCE

1.3 ORGANIZATION OF THIS SPECIAL PUBLICATION

CHAPTER TWO THE FUNDAMENTALS

2.1 ASSESSMENT PROCEDURES

2.2 ASSURANCE CASES

CHAPTER THREE THE PROCEDURES

3.1 ACCESS CONTROL

3.2 AWARENESS AND TRAINING

3.3 AUDIT AND ACCOUNTABILITY

3.4 CONFIGURATION MANAGEMENT

3.5 IDENTIFICATION AND AUTHENTICATION

3.6 INCIDENT RESPONSE

3.7 MAINTENANCE

3.8 MEDIA PROTECTION

3.9 PERSONNEL SECURITY

3.10 PHYSICAL PROTECTION

3.11 RISK ASSESSMENT

3.12 SECURITY ASSESSMENT

3.13 SYSTEM AND COMMUNICATIONS PROTECTION

3.14 SYSTEM AND INFORMATION INTEGRITY

APPENDIX A REFERENCES

APPENDIX B GLOSSARY

APPENDIX C ACRONYMS

APPENDIX D ASSESSMENT METHODS

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

PAGE viii

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

Errata

This table contains changes that have been incorporated into Special Publication 800-171A.

Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature.

DATE TYPE REVISION PAGE

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER ONE PAGE 1

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

CHAPTER ONE

INTRODUCTION

THE NEED TO ASSESS CUI SECURITY REQUIREMENTS

he protection of unclassified federal information in nonfederal systems and organizations is dependent on the federal government providing a process for identifying the different types of information that are used by federal agencies. Executive Order 13556 established a governmentwide Controlled Unclassified Information (CUI) 1 Program to standardize the way the executive branch handles unclassified information that requires protection. The implementing regulation for the CUI Program is 32 CFR part 2002, Controlled Unclassified Information. Only federal information that requires safeguarding or dissemination controls pursuant to federal law, regulation, or governmentwide policy may be designated as CUI.2 NIST Special Publication 800- 171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, specifies the security requirements to ensure the confidentiality of CUI.

1.1 PURPOSE AND APPLICABILITY

The purpose of this publication is to provide procedures for assessing the CUI requirements in NIST Special Publication 800-171. Compliance with the security requirements is addressed in CUI guidance and the CUI Federal Acquisition Regulation (FAR)3 or as supplemented by federal agencies (e.g., Department of Defense Federal Acquisition Regulation). Organizations can use the assessment procedures to generate evidence to support the assertion that the security requirements have been satisfied.

The assessment process is an information-gathering and evidence-producing activity to determine the effectiveness of the safeguards intended to meet the set of security requirements specified in NIST Special Publication 800-171. In this context, the information gathered and the evidence produced can be used by an organization to:

• Identify potential problems or shortfalls in the organization’s security and risk management programs;

• Identify security weaknesses and deficiencies in its systems and in the environments in which those systems operate;

• Prioritize risk mitigation decisions and activities;

• Confirm that identified security weaknesses and deficiencies in the system and in the environment of operation have been addressed; and

• Support continuous monitoring activities and provide information security situational awareness.

1 Controlled Unclassified Information is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended.

2 The CUI Registry is the online repository for information, guidance, policy, and requirements on handling CUI.

3 The CUI Executive Agent is actively engaged in the process of developing a FAR clause that will apply the requirements of the federal CUI regulation and NIST Special Publication 800-171 to contractors.

T

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER ONE PAGE 2

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

The assessment procedures in this publication offer the flexibility to customize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk.4

1.2 TARGET AUDIENCE

This publication serves system, information security, and privacy5 professionals including individuals with:

• System development responsibilities (e.g., program managers, system developers, system owners, systems integrators, system security engineers);

• Information security assessment and monitoring responsibilities (e.g., system evaluators, assessors, independent verifiers/validators, auditors, analysts, system owners);

• Information security, privacy, risk management, governance, and oversight responsibilities (e.g., authorizing officials, chief information officers, chief privacy officers, chief information security officers, system managers, information security managers); and

• Information security implementation and operational responsibilities (e.g., system owners, information owners/stewards, mission and business owners, systems administrators, system security officers).

1.3 ORGANIZATION OF THIS SPECIAL PUBLICATION

The remainder of this special publication is organized as follows:

• Chapter Two describes the fundamental concepts associated with assessments of CUI security requirements including assessment procedures, methods, objects, and assurance cases that can be created using evidence produced during assessments.

4 The term risk is used to mean risk to organizational operations (i.e., mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation. See NIST Special Publication 800-39 for additional information on organizational risk management and risk tolerance.

5 References to privacy in this publication are made only in the context of where security and privacy considerations overlap—that is, in the security objective of confidentiality, which generally supports privacy and the protection of personally identifiable information from unauthorized disclosure. NIST Internal Report 8062 provides additional information on the overlapping and complementary nature of security and privacy disciplines.

THE SCOPE OF CUI SECURITY REQUIREMENT ASSESSMENTS

For the CUI security requirements in NIST Special Publication 800-171, nonfederal organizations describe in a system security plan, how the specified requirements are met or how organizations plan to meet the requirements. The plan describes the system boundary; the environment in which the system operates; how the requirements are implemented; and the relationships with or connections to other systems. The scope of the assessments conducted using the procedures described in this publication are guided and informed by the individual system security plans for the organizational systems processing, storing, or transmitting CUI. The assessments focus on the implementation and effectiveness of the safeguards intended to meet a fixed set of security requirements as defined in NIST Special Publication 800-171.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER ONE PAGE 3

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

• Chapter Three provides a catalog of assessment procedures for the fourteen families of CUI security requirements in NIST Special Publication 800-171, including assessment objectives and potential assessment methods and objects for each procedure.

• Supporting appendices provide additional assessment-related information including general references; definitions and terms; acronyms; and a description of the assessment methods used in assessment procedures.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER TWO PAGE 4

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

CHAPTER TWO

THE FUNDAMENTALS

BASIC CONCEPTS FOR ASSESSMENTS OF CUI SECURITY REQUIREMENTS

he CUI security requirements in NIST Special Publication 800-171 are organized into fourteen families. Each family contains the requirements related to the general security topic of the family. Table 1 lists the CUI security requirement families addressed in this publication. The assessment procedures in Chapter Three are grouped by family designations to help ensure completeness and consistency of assessments.

TABLE 1: CUI SECURITY REQUIREMENT FAMILIES

FAMILY FAMILY

Access Control Media Protection Awareness and Training Personnel Security Audit and Accountability Physical Protection Configuration Management Risk Assessment Identification and Authentication Security Assessment Incident Response System and Communications Protection Maintenance System and Information Integrity

2.1 ASSESSMENT PROCEDURES

An assessment procedure consists of an assessment objective and a set of potential assessment methods and assessment objects that can be used to conduct the assessment. Each assessment objective includes a determination statement related to the CUI security requirement that is the subject of the assessment. The determination statements are linked to the content of the CUI security requirements to ensure traceability of the assessment results to the requirements. The application of an assessment procedure to a security requirement produces assessment findings.

These findings reflect, or are subsequently used, to help determine if the security requirement has been satisfied.

Assessment objects identify the specific items being assessed and can include specifications, mechanisms, activities, and individuals. Specifications are the document-based artifacts (e.g., policies, procedures, security plans, security requirements, functional specifications, architectural designs) associated with a system. Mechanisms are the specific hardware, software, or firmware safeguards employed within a system. Activities are the protection-related actions supporting a system that involve people (e.g., conducting system backup operations, exercising a contingency plan, and monitoring network traffic). Individuals, or groups of individuals, are people applying the specifications, mechanisms, or activities described above.

The assessment methods define the nature and the extent of the assessor’s actions. The methods include examine, interview, and test. The examine method is the process of reviewing, inspecting, observing, studying, or analyzing assessment objects (i.e., specifications, mechanisms, activities).

The purpose of the examine method is to facilitate understanding, achieve clarification, or obtain evidence. The interview method is the process of holding discussions with individuals or groups

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER TWO PAGE 5

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

of individuals to facilitate understanding, achieve clarification, or obtain evidence. And finally, the test method is the process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior. In all three assessment methods, the results are used in making specific determinations called for in the determination statements and thereby achieving the objectives for the assessment procedure.

The assessment methods described above have associated attributes of depth and coverage, which define the level of effort for the assessment. These attributes provide a means to define the rigor and scope of the assessment for the increased assurance of security requirements. A description of assessment methods and objects is provided in Appendix D.6 Figure 1 illustrates an example of an assessment procedure for CUI security requirement 3.1.3 from NIST Special Publication 800- 171.

FIGURE 1: ASSESSMENT PROCEDURE FOR CUI SECURITY REQUIREMENT

Organizations are not expected to employ all assessment methods and objects contained within the assessment procedures identified in this publication. Rather, organizations have the flexibility to determine the level of effort needed and the assurance required for an assessment (e.g., which assessment methods and assessment objects are deemed to be the most useful in obtaining the desired results). This determination is made based on how the organization can accomplish the assessment objectives in the most cost-effective manner and with sufficient confidence to support the determination that the CUI requirements have been satisfied.

6 Additional information on assessment methods and objects and the attributes of depth and coverage is provided in NIST Special Publication 800-53A.

3.1.3 SECURITY REQUIREMENT

Control the flow of CUI in accordance with approved authorizations.

ASSESSMENT OBJECTIVE

Determine if:

3.1.3[a] information flow control policies are defined.

3.1.3[b] methods and enforcement mechanisms for controlling the flow of CUI are defined.

3.1.3[c] designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified.

3.1.3[d] authorizations for controlling the flow of CUI are defined.

3.1.3[e] approved authorizations for controlling the flow of CUI are enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system security plan; system design documentation; system configuration settings and associated documentation; list of information flow authorizations; system baseline configuration; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; system developers].

Test: [SELECT FROM: Mechanisms implementing information flow enforcement policy].

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER TWO PAGE 6

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

2.2 ASSURANCE CASES

Building an effective assurance case for determining compliance to CUI security requirements is a process that involves compiling evidence from a variety of sources and conducting different types of activities during an assessment. An assurance case is a body of evidence organized into an argument demonstrating that some claim about a system is true. For assessments conducted using the procedures in this publication, that claim is compliance with the security requirements specified in NIST Special Publication 800-171. Assessors gather evidence during the assessment process to allow designated officials7 to make objective determinations about compliance to the CUI security requirements. The evidence needed to make such determinations can be obtained from various sources including self-assessments, independent third-party assessments, or other types of assessments, depending on the needs of the organization establishing the requirements and the organization conducting the assessments.

For example, many technical security requirements are satisfied by security capabilities that are built in to commercial information technology products and systems. Product assessments are typically conducted by independent, third-party testing organizations.8 These assessments examine the security functions of products and established configuration settings. Assessments can also be conducted to demonstrate compliance to industry, national, or international security standards as well as developer and vendor claims. Since many information technology products are assessed by commercial testing organizations and then subsequently deployed in hundreds of thousands of systems, these types of assessments can be carried out at a greater level of depth and provide deeper insights into the security capabilities of the products.

Ultimately, evidence needed to determine compliance comes from the implementation of the selected safeguards to satisfy the CUI security requirements and from the assessments of that implementation. Assessors can build on previously developed materials that started with the specification of the organization’s information security needs and is further developed during the design, development, and implementation of the system and system components. These materials, developed while implementing security throughout the life cycle of the system, provide the initial evidence for an assurance case.

Assessments can be conducted by systems developers, systems integrators, auditors, system owners, or the security staffs of organizations. The assessors or assessment teams bring together available information about the system such as the results from individual component product assessments. The assessors can conduct additional system-level assessments using the procedures and methods contained in this publication and based on the implementation information provided by the nonfederal organization in its system security plan. System assessments can be used to compile and evaluate the evidence needed by organizations to help determine the effectiveness of the safeguards implemented to protect CUI; the actions needed to mitigate security-related risks to the organization; and compliance to the CUI security requirements.

7 A designated official is an official, either internal or external to the nonfederal organization, with the responsibility to determine organizational compliance to CUI security requirements.

8 Examples include Common Criteria Testing Laboratories evaluating commercial IT products in accordance with ISO/IEC 15408 and Cryptographic Module Validation Program Testing Laboratories evaluating cryptographic modules in accordance with Federal Information Processing Standard (FIPS) 140.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER TWO PAGE 7

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

APPLICABLE CUI SECURITY REQUIREMENTS

The system security plan is used to describe how the organization meets or plans to meet the CUI security requirements. Any security requirements that are deemed non-applicable by the organization (e.g., no wireless capability in the system or the system component processing, storing, or transmitting CUI), are documented as such in the system security plan. Once the system security plan is completed, a security assessment plan can be developed using the assessment procedures described in Chapter Three and tailoring those procedures as needed.

An assessment procedure is developed for every CUI security requirement that is applicable to the system, system component, or the organization. Conversely, security requirements that are deemed non-applicable in the system security plan are not assessed.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER THREE PAGE 8

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

CHAPTER THREE

THE PROCEDURES

ASSESSMENT PROCEDURES, METHODS, AND OBJECTS FOR CUI SECURITY REQUIREMENTS

his chapter provides assessment procedures for all CUI security requirements defined in NIST Special Publication 800-171. The assessment procedures are organized into fourteen families. Organizations conducting CUI security requirement assessments can build their assessment plans using the information provided in the generic assessment procedures—selecting the specific assessment methods and objects that meet the organization’s needs. Organizations also have flexibility in defining the level of rigor and detail associated with the assessment based on the assurance requirements of the organization. Appendix D provides additional information on the different levels of rigor and detail for assessments.

The assessment objective defined for each assessment procedure is achieved by applying the designated assessment methods to the selected assessment objects and compiling/producing the evidence necessary to make the determination associated with each assessment objective. Each determination statement contained within an assessment procedure produces one of the following findings: satisfied or other than satisfied. A finding of “satisfied” indicates that for the security requirement addressed by the determination statement, the assessment information obtained (i.e., the evidence collected) indicates that the assessment objective has been met producing a fully acceptable result. A finding of “other than satisfied” indicates that for the security requirement addressed by the determination statement, the assessment findings obtained indicate potential anomalies that may need to be addressed by the organization. A finding of “other than satisfied” may also indicate that for reasons specified in the assessment report, the assessor was unable to obtain sufficient information to make the determination called for in the determination statement.

For assessment findings that are other than satisfied, organizations may define subcategories of findings indicating the severity or criticality of the weaknesses or deficiencies discovered and the potential adverse effects of those weaknesses or deficiencies on organizational missions and/or business functions. Defining such subcategories can help to establish priorities for needed risk mitigation actions.

CAUTIONARY NOTE

The content in this publication can be used for many different assessment-related purposes in determining organizational compliance to the CUI security requirements. The broad range of potential assessment methods and objects listed in this publication do not necessarily reflect, and should not be directly associated with, actual compliance or noncompliance. Rather, the selection of specific assessment methods and objects from the list provided, can help generate a picture of overall compliance with the CUI security requirements. There is no expectation about the number of methods or objects needed to determine compliance to the CUI security requirements. Moreover, the entire list of potential assessment objects should not be viewed as required artifacts needed to determine compliance to the requirements. Organizations have the flexibility to determine the specific methods and objects sufficient to obtain the needed evidence to support claims of compliance.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r1.pdf

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER THREE PAGE 9

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

3.1 ACCESS CONTROL

3.1.1 SECURITY REQUIREMENT

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

ASSESSMENT OBJECTIVE

Determine if:

3.1.1[a] authorized users are identified.

3.1.1[b] processes acting on behalf of authorized users are identified.

3.1.1[c] devices (and other systems) authorized to connect to the system are identified.

3.1.1[d] system access is limited to authorized users.

3.1.1[e] system access is limited to processes acting on behalf of authorized users.

3.1.1[f] system access is limited to authorized devices (including other systems).

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing account management;

system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; notifications or records of recently transferred, separated, or terminated employees; list of conditions for group and role membership; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews;

system monitoring records; system audit logs and records; list of devices and systems authorized to connect to organizational systems; other relevant documents or records].

Interview: [SELECT FROM: Personnel with account management responsibilities; system or network administrators; personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes for managing system accounts; mechanisms for implementing account management].

3.1.2 SECURITY REQUIREMENT

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

ASSESSMENT OBJECTIVE

Determine if:

3.1.2[a] the types of transactions and functions that authorized users are permitted to execute are defined.

3.1.2[b] system access is limited to the defined types of transactions and functions for authorized users.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing access enforcement; system security plan; system design documentation; list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records].

Interview: [SELECT FROM: Personnel with access enforcement responsibilities; system or network administrators; personnel with information security responsibilities; system developers].

Test: [SELECT FROM: Mechanisms implementing access control policy].

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER THREE PAGE 10

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

3.1.3 SECURITY REQUIREMENT

Control the flow of CUI in accordance with approved authorizations.

ASSESSMENT OBJECTIVE

Determine if:

3.1.3[a] information flow control policies are defined.

3.1.3[b] methods and enforcement mechanisms for controlling the flow of CUI are defined.

3.1.3[c] designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified.

3.1.3[d] authorizations for controlling the flow of CUI are defined.

3.1.3[e] approved authorizations for controlling the flow of CUI are enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system security plan; system design documentation; system configuration settings and associated documentation; list of information flow authorizations; system baseline configuration; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; system developers].

Test: [SELECT FROM: Mechanisms implementing information flow enforcement policy].

3.1.4 SECURITY REQUIREMENT

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

ASSESSMENT OBJECTIVE

Determine if:

3.1.4[a] the duties of individuals requiring separation are defined.

3.1.4[b] responsibilities for duties that require separation are assigned to separate individuals.

3.1.4[c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing divisions of responsibility and separation of duties; system security plan; system configuration settings and associated documentation; list of divisions of responsibility and separation of duties;

system access authorizations; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with responsibilities for defining divisions of responsibility and separation of duties; personnel with information security responsibilities; system or network administrators].

Test: [SELECT FROM: Mechanisms implementing separation of duties policy].

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER THREE PAGE 11

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

3.1.5 SECURITY REQUIREMENT

Employ the principle of least privilege, including for specific security functions and privileged accounts.

ASSESSMENT OBJECTIVE

Determine if:

3.1.5[a] privileged accounts are identified.

3.1.5[b] access to privileged accounts is authorized in accordance with the principle of least privilege.

3.1.5[c] security functions are identified.

3.1.5[d] access to security functions is authorized in accordance with the principle of least privilege.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing account management;

system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; list of conditions for group and role membership;

notifications or records of recently transferred, separated, or terminated employees; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring/audit records; procedures addressing least privilege; list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access is to be explicitly authorized; list of system-generated privileged accounts; list of system administration personnel; other relevant documents or records].

Interview: [SELECT FROM: Personnel with account management responsibilities; system or network administrators; personnel with information security responsibilities; personnel with responsibilities for defining least privileges necessary to accomplish specified tasks].

Test: [SELECT FROM: Organizational processes for managing system accounts; mechanisms for implementing account management; mechanisms implementing least privilege functions;

mechanisms prohibiting privileged access to the system].

3.1.6 SECURITY REQUIREMENT

Use non-privileged accounts or roles when accessing nonsecurity functions.

ASSESSMENT OBJECTIVE

Determine if:

3.1.6[a] nonsecurity functions are identified.

3.1.6[b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; system security plan; list of system-generated security functions assigned to system accounts or roles; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with responsibilities for defining least privileges necessary to accomplish specified organizational tasks; personnel with information security responsibilities; system or network administrators].

Test: [SELECT FROM: Mechanisms implementing least privilege functions].

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER THREE PAGE 12

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

3.1.7 SECURITY REQUIREMENT

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

ASSESSMENT OBJECTIVE

Determine if:

3.1.7[a] privileged functions are defined.

3.1.7[b] non-privileged users are defined.

3.1.7[c] non-privileged users are prevented from executing privileged functions.

3.1.7[d] the execution of privileged functions is captured in audit logs.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; system security plan; system design documentation; list of privileged functions and associated user account assignments; system configuration settings and associated documentation;

system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with responsibilities for defining least privileges necessary to accomplish specified tasks; personnel with information security responsibilities; system developers].

Test: [SELECT FROM: Mechanisms implementing least privilege functions for non-privileged users;

mechanisms auditing the execution of privileged functions].

3.1.8 SECURITY REQUIREMENT

Limit unsuccessful logon attempts.

ASSESSMENT OBJECTIVE

Determine if:

3.1.8[a] the means of limiting unsuccessful logon attempts is defined.

3.1.8[b] the defined means of limiting unsuccessful logon attempts is implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing unsuccessful logon attempts;

system security plan; system design documentation; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with information security responsibilities; system developers;

system or network administrators].

Test: [SELECT FROM: Mechanisms implementing access control policy for unsuccessful logon attempts].

3.1.9 SECURITY REQUIREMENT

Provide privacy and security notices consistent with applicable CUI rules.

ASSESSMENT OBJECTIVE

Determine if:

3.1.9[a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category.

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER THREE PAGE 13

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

3.1.9[b] privacy and security notices are displayed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Privacy and security policies, procedures addressing system use notification; documented approval of system use notification messages or banners;

system audit logs and records; system design documentation; user acknowledgements of notification message or banner; system security plan; system use notification messages;

system configuration settings and associated documentation; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; personnel with responsibility for providing legal advice; system developers].

Test: [SELECT FROM: Mechanisms implementing system use notification].

3.1.10 SECURITY REQUIREMENT

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

ASSESSMENT OBJECTIVE

Determine if:

3.1.10[a] the period of inactivity after which the system initiates a session lock is defined.

3.1.10[b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity.

3.1.10[c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing session lock; procedures addressing identification and authentication; system design documentation; system configuration settings and associated documentation; system security plan; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; system developers].

Test: [SELECT FROM: Mechanisms implementing access control policy for session lock].

3.1.11 SECURITY REQUIREMENT

Terminate (automatically) a user session after a defined condition.

ASSESSMENT OBJECTIVE

Determine if:

3.1.11[a] conditions requiring a user session to terminate are defined.

3.1.11[b] a user session is automatically terminated after any of the defined conditions occur.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing session termination; system design documentation; system security plan; system configuration settings and associated documentation; list of conditions or trigger events requiring session disconnect; system audit logs and records; other relevant documents or records].

NIST SP 800-171A ASSESSING SECURITY REQUIREMENTS FOR CONTROLLED UNCLASSIFIED INFORMATION

CHAPTER THREE PAGE 14

This publication is available free of charge from : https://doi.org/10.6028/N

IST.S

Interview: [SELECT FROM: System or network administrators; personnel with information security

Test: [SELECT FROM: Mechanisms implementing user session termination].

3.1.12 SECURITY REQUIREMENT

Monitor and control remote access sessions.

ASSESSMENT OBJECTIVE

Determine if:

3.1.12[a] remote access sessions are permitted.

3.1.12[b] the types of permitted remote access are identified.

3.1.12[c] remote access sessions are controlled.

3.1.12[d] remote access sessions are monitored.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing remote access implementation and usage (including restrictions); configuration management plan;

system security plan; system design documentation; system configuration settings and associated documentation; remote access authorizations; system audit logs and records;

other relevant documents or records].

Interview: [SELECT FROM: Personnel with responsibilities for managing remote access connections;

system or network administrators; personnel with information security responsibilities].

Test: [SELECT FROM: Remote access management capability for the system].

3.1.13 SECURITY REQUIREMENT

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

ASSESSMENT OBJECTIVE

Determine if:

3.1.13[a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified.

3.1.13[b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the system; system security plan; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; system audit logs and records; other relevant documents or records].

Interview: [SELECT…