Atch 1g - PWS Appendix 3G Amend 0011.xlsx

XLSX spreadsheet 294 KB Posted

Attached to
International Charter Airlift Services in Support of the Civil Reserve Air Fleet (CRAF)
Solicitation number
HTC711-18-R-CC04
Issued by

About this file

Written by GovTribe AI ·

This is a presolicitation notice for an indefinite delivery indefinite quantity contract to provide international charter airlift services and aircraft commitment to the Civil Reserve Air Fleet program. The contractor shall provide passenger and cargo airlift utilizing Part 121 certified aircraft from October 2018 through March 2025, including any period of CRAF activation. The base period of performance is from October 2018 through September 2020, with two two-year option periods and an optional six-month extension. Multiple awards are anticipated. Questions shall be submitted to the identified contracting and contract specialist points of contact. The solicitation will be issued by the United States Transportation Command for these international charter airlift services in support of Department of Defense requirements.

View the file

Other files

File Type Posted
HTC711-18-R-CC04-0012_SF30.pdf PDF
Conformed Sections A-M Amend 0012.pdf PDF
HTC711-18-R-CC04-0011_SF30.pdf PDF
Atch 1 - PWS Amend 0011.pdf PDF
Atch 6 - WD 1996-0460 Rev 42 Amend 0011.pdf PDF
Conformed Sections A-M Amend 0011.pdf PDF
Atch 3 - iRAPT and Ferry_Amend 0011.docx DOCX document
Atch 6a - WD 2009-0027 Rev 23 Amend 0011.pdf PDF
Atch 1b - PWS Appendix 3B Amend 0011.XLSX XLSX spreadsheet
Atch 1e - PWS Appendix 3E Amend 0011.pdf PDF
Atch 11 - MOU Template Amend 0011.docx DOCX document
HTC711-18-R-CC04_Conformed_Sections_A_thru_M_Amend_0010.pdf PDF
HTC711-18-R-CC04-0010_SF30.pdf PDF
HTC711-18-R-CC04_Conformed_Sections_A_thru_M_Amend_0009.pdf PDF
HTC711-18-R-CC04-0009_SF30.pdf PDF
HTC711-18-R-CC04-0008_SF30.pdf PDF
HTC711-18-R-CC04_Conformed_Sections_A_thru_M_Amend_0008.pdf PDF
28_August_2019_Final_FY20_Uniform_Rates_&_Rules.pdf PDF
Proposed_FY20_Uniform_Rates_and_Rules.pdf PDF
10Apr19_FY18_-_FY22_Final_MOU_Letter.pdf PDF
Amended_FY18_-_FY22_Ratemaking_Memorandum_of_Understanding.pdf PDF
HTC711-18-R-CC04,_Conformed_Sections_A_thru_M,_Amend_0007.pdf PDF
HTC711-18-R-CC04-0007,_SF30.pdf PDF
20_December_2018_Final_FY19_Uniform_Rates_and_Rules_for_International_Service.pdf PDF
Atch_1_-_PWS,_Amend_0006.pdf PDF
Atch_4_-_Commitment,_Entitlement_&_Ordering_Procedures,_Amend_0006.pdf PDF
HTC711-18-R-CC04,_Conformed_Sections_A_thru_M,_Amend_0006.pdf PDF
Atch_6a_-_WD_2009-0027_rev_14,_Amend_0006.pdf PDF
HTC711-18-R-CC04-0006,_SF30.pdf PDF
CRAF_Other_than_F&O_Class_J&A,_redacted.pdf PDF
CRAF_Award_Details_-_FBO.xlsx XLSX spreadsheet
6_September_2018_Final_FY19_Uniform_Rates_and_Rules_for_International_Service.pdf PDF
Atch_4_-_Commitment,_Entitlement_&_Ordering_Procedures,_Amend_0005.pdf PDF
HTC711-18-R-CC04-0005.pdf PDF
Atch_9_-_FPA_Template,_Amend_0005.docx DOCX document
3._Atch_1_-_PWS,_Amend_0005.pdf PDF
16_August_2018_Final_FY19_Uniform_Rates_and_Rules_for_International_Service.pdf PDF
HTC711-18-R-CC04-0004.pdf PDF
Rd_4_CRAF_FY19_Questions_&_Answers,_14_Jun_2018_(FBO).pdf PDF
Rd_3_CRAF_FY19_Questions_&_Answers,_12_Jun_2018_(FBO).pdf PDF
HTC711-18-R-CC04-0003.pdf PDF
Rd_2CRAF_FY19_Questions_&_Answers,_7_Jun_2018_(FBO).pdf PDF
CRAF_FY19_Questions_&_Answers,_1_Jun_2018_(FBO).pdf PDF
HTC711-18-R-CC04-0002.pdf PDF
3._HTC71118RCC04_page_1_amended.pdf PDF
2._Atch_4_-_Commitment,_Entitlement_&_Ordering_Procedures,_Amend_0001.docx DOCX document
1._HTC711-18-R-CC04-0001.pdf PDF
3._Atch_1_-_PWS_FBO.DOCX DOCX document
2._RFP_18-R-CC04_FBO.docx DOCX document
Atch_4_-_Commitment,_Entitlement_&_Ordering_Procedures_FBO.docx DOCX document
Show 40 more

Latest 50 of 94 listed here. See the rest on GovTribe.

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Instructions for POAM

USTRANSCOM NIST 800-171 POAM
INSTRUCTIONS

Each tab across the bottom of this workbook contains a NIST 800-171 control family.

Note: Certain areas of each sheet are not editable. These include "control compliance", "control/objective number", "control family", "DIBCAC score", "control/objective text" and "control type" (columns A through F). These are all locked out.

Overarching control compliance status is controlled by the subobjectives under each control number. Example: 3.1.1 can only be compliant ("yes") if objectives 3.1.1[a] through [f] are all compliant ("yes"). A noncompliant ("no") in any subobjective will automatically render the objective as noncompliant ("no"). Thus, when all subobjectives are in compliance ("yes"), the objective automatically is compliant ("yes").

Noncompilance Detection Date: self explanatory

Scheduled Completion Date: please provide an estimated time the noncompliant control/objective will be corrected.

Actual Completion Date: please annotate the date the noncompliant control/objective was corrected.

Supporting Documentation/System Controls: briefly describe those technology controls and/or process documents that will be used to achieve compliance with the control/objective requirement. Include details of the implementation/deployment plans and associated milestones. Description should be complete enough so assessors can clearly see a pathway to compliance.

Status/Comments: additional amplifying information regarding the control, objective, documentation, and/or the POAM itself.

Dashboard

Objective3.1.13.1.13.1.13.1.13.1.13.1.13.1.13.1.23.1.23.1.23.1.33.1.33.1.33.1.33.1.33.1.33.1.43.1.43.1.43.1.43.1.53.1.53.1.53.1.53.1.53.1.63.1.63.1.63.1.73.1.73.1.73.1.73.1.73.1.83.1.83.1.83.1.93.1.93.1.93.1.103.1.103.1.103.1.103.1.113.1.113.1.113.1.123.1.123.1.12
Procedure3.1.13.1.1[a]3.1.1[b]3.1.1[c]3.1.1[d]3.1.1[e]3.1.1[f]3.1.23.1.2[a]3.1.2[b]3.1.33.1.3[a]3.1.3[b]3.1.3[c]3.1.3[d]3.1.3[e]3.1.43.1.4[a]3.1.4[b]3.1.4[c]3.1.53.1.5[a]3.1.5[b]3.1.5[c]3.1.5[d]3.1.63.1.6[a]3.1.6[b]3.1.73.1.7[a]3.1.7[b]3.1.7[c]3.1.7[d]3.1.83.1.8[a]3.1.8[b]3.1.93.1.9[a]3.1.9[b]3.1.103.1.10[a]3.1.10[b]3.1.10[c]3.1.113.1.11[a]3.1.11[b]3.1.123.1.12[a]3.1.12[b]
responseNR000000NR00NR00000NR000NR0000NR00NR0000NR00NR00NR000NR00NR00
800-171 objectives800-171 ProcedureBasic FAR ObjectivesBasic FAR Procedures
ObjectiveProcedureresponseObjectiveProcedureresponseObjectiveProcedureresponseObjectiveProcedureresponseObjectiveProcedureresponse
3.1.13.1.1NRAccess Control'!A23.1.13.1.1NR3.1.13.1.1NR
3.1.13.1.1[a]0Access Control'!A33.1.13.1.1[a]03.1.13.1.1[a]0
3.1.13.1.1[b]0Access Control'!A43.1.13.1.1[b]03.1.13.1.1[b]0
3.1.13.1.1[c]0Access Control'!A53.1.13.1.1[c]03.1.13.1.1[c]0
3.1.13.1.1[d]0Access Control'!A63.1.13.1.1[d]03.1.13.1.1[d]0
3.1.13.1.1[e]0Access Control'!A73.1.13.1.1[e]03.1.13.1.1[e]0
3.1.13.1.1[f]0Access Control'!A83.1.13.1.1[f]03.1.13.1.1[f]0
3.1.23.1.2NRAccess Control'!A93.1.23.1.2NR3.1.23.1.2NR
3.1.23.1.2[a]0Access Control'!A103.1.23.1.2[a]03.1.23.1.2[a]0
3.1.23.1.2[b]0Access Control'!A113.1.23.1.2[b]03.1.23.1.2[b]0
3.1.33.1.3NRAccess Control'!A123.1.33.1.3NR
3.1.33.1.3[a]0Access Control'!A133.1.33.1.3[a]0
3.1.33.1.3[b]0Access Control'!A143.1.33.1.3[b]0
3.1.33.1.3[c]0Access Control'!A153.1.33.1.3[c]0
3.1.33.1.3[d]0Access Control'!A163.1.33.1.3[d]0
3.1.33.1.3[e]0Access Control'!A173.1.33.1.3[e]0
3.1.43.1.4NRAccess Control'!A183.1.43.1.4NR
3.1.43.1.4[a]0Access Control'!A193.1.43.1.4[a]0
3.1.43.1.4[b]0Access Control'!A203.1.43.1.4[b]0
3.1.43.1.4[c]0Access Control'!A213.1.43.1.4[c]0
3.1.53.1.5NRAccess Control'!A223.1.53.1.5NR
3.1.53.1.5[a]0Access Control'!A233.1.53.1.5[a]0
3.1.53.1.5[b]0Access Control'!A243.1.53.1.5[b]0
3.1.53.1.5[c]0Access Control'!A253.1.53.1.5[c]0
3.1.53.1.5[d]0Access Control'!A263.1.53.1.5[d]0
3.1.63.1.6NRAccess Control'!A273.1.63.1.6NR
3.1.63.1.6[a]0Access Control'!A283.1.63.1.6[a]0
3.1.63.1.6[b]0Access Control'!A293.1.63.1.6[b]0
3.1.73.1.7NRAccess Control'!A303.1.73.1.7NR
3.1.73.1.7[a]0Access Control'!A313.1.73.1.7[a]0
3.1.73.1.7[b]0Access Control'!A323.1.73.1.7[b]0
3.1.73.1.7[c]0Access Control'!A333.1.73.1.7[c]0
3.1.73.1.7[d]0Access Control'!A343.1.73.1.7[d]0
3.1.83.1.8NRAccess Control'!A353.1.83.1.8NR
3.1.83.1.8[a]0Access Control'!A363.1.83.1.8[a]0
3.1.83.1.8[b]0Access Control'!A373.1.83.1.8[b]0
3.1.93.1.9NRAccess Control'!A383.1.93.1.9NR
3.1.93.1.9[a]0Access Control'!A393.1.93.1.9[a]0
3.1.93.1.9[b]0Access Control'!A403.1.93.1.9[b]0
3.1.103.1.10NRAccess Control'!A413.1.103.1.10NR
3.1.103.1.10[a]0Access Control'!A423.1.103.1.10[a]0
3.1.103.1.10[b]0Access Control'!A433.1.103.1.10[b]0
3.1.103.1.10[c]0Access Control'!A443.1.103.1.10[c]0
3.1.113.1.11NRAccess Control'!A453.1.113.1.11NR
3.1.113.1.11[a]0Access Control'!A463.1.113.1.11[a]0
3.1.113.1.11[b]0Access Control'!A473.1.113.1.11[b]0
3.1.123.1.12NRAccess Control'!A483.1.123.1.12NR
3.1.123.1.12[a]0Access Control'!A493.1.123.1.12[a]0
3.1.123.1.12[b]0Access Control'!A503.1.123.1.12[b]0
3.1.123.1.12[c]0Access Control'!A513.1.123.1.12[c]0
3.1.123.1.12[d]0Access Control'!A523.1.123.1.12[d]0
3.1.133.1.13NRAccess Control'!A533.1.133.1.13NR
3.1.133.1.13[a]0Access Control'!A543.1.133.1.13[a]0
3.1.133.1.13[b]0Access Control'!A553.1.133.1.13[b]0
3.1.143.1.14NRAccess Control'!A563.1.143.1.14NR
3.1.143.1.14[a]0Access Control'!A573.1.143.1.14[a]0
3.1.143.1.14[b]0Access Control'!A583.1.143.1.14[b]0
3.1.153.1.15NRAccess Control'!A593.1.153.1.15NR
3.1.153.1.15[a]0Access Control'!A603.1.153.1.15[a]0
3.1.153.1.15[b]0Access Control'!A613.1.153.1.15[b]0
3.1.153.1.15[c]0Access Control'!A623.1.153.1.15[c]0
3.1.153.1.15[d]0Access Control'!A633.1.153.1.15[d]0
3.1.163.1.16NRAccess Control'!A643.1.163.1.16NR
3.1.163.1.16[a]0Access Control'!A653.1.163.1.16[a]0
3.1.163.1.16[b]0Access Control'!A663.1.163.1.16[b]0
3.1.173.1.17NRAccess Control'!A673.1.173.1.17NR
3.1.173.1.17[a]0Access Control'!A683.1.173.1.17[a]0
3.1.173.1.17[b]0Access Control'!A693.1.173.1.17[b]0
3.1.183.1.18NRAccess Control'!A703.1.183.1.18NR
3.1.183.1.18[a]0Access Control'!A713.1.183.1.18[a]0
3.1.183.1.18[b]0Access Control'!A723.1.183.1.18[b]0
3.1.183.1.18[c]0Access Control'!A733.1.183.1.18[c]0
3.1.193.1.19NRAccess Control'!A743.1.193.1.19NR
3.1.193.1.19[a]0Access Control'!A753.1.193.1.19[a]0
3.1.193.1.19[b]0Access Control'!A763.1.193.1.19[b]0
3.1.203.1.20NRAccess Control'!A773.1.203.1.20NR3.1.203.1.20NR
3.1.203.1.20[a]0Access Control'!A783.1.203.1.20[a]03.1.203.1.20[a]0
3.1.203.1.20[b]0Access Control'!A793.1.203.1.20[b]03.1.203.1.20[b]0
3.1.203.1.20[c]0Access Control'!A803.1.203.1.20[c]03.1.203.1.20[c]0
3.1.203.1.20[d]0Access Control'!A813.1.203.1.20[d]03.1.203.1.20[d]0
3.1.203.1.20[e]0Access Control'!A823.1.203.1.20[e]03.1.203.1.20[e]0
3.1.203.1.20[f]0Access Control'!A833.1.203.1.20[f]03.1.203.1.20[f]0
3.1.213.1.21NRAccess Control'!A843.1.213.1.21NR
3.1.213.1.21[a]0Access Control'!A853.1.213.1.21[a]0
3.1.213.1.21[b]0Access Control'!A863.1.213.1.21[b]0
3.1.213.1.21[c]0Access Control'!A873.1.213.1.21[c]0
3.1.223.1.22NRAccess Control'!A883.1.223.1.22NR3.1.223.1.22NR
3.1.223.1.22[a]0Access Control'!A893.1.223.1.22[a]03.1.223.1.22[a]0
3.1.223.1.22[b]0Access Control'!A903.1.223.1.22[b]03.1.223.1.22[b]0
3.1.223.1.22[c]0Access Control'!A913.1.223.1.22[c]03.1.223.1.22[c]0
3.1.223.1.22[d]0Access Control'!A923.1.223.1.22[d]03.1.223.1.22[d]0
3.1.223.1.22[e]0Access Control'!A933.1.223.1.22[e]03.1.223.1.22[e]0
3.2.13.2.1NRAwareness and Training'!A23.2.13.2.1NR
3.2.13.2.1[a]0Awareness and Training'!A33.2.13.2.1[a]0
3.2.13.2.1[b]0Awareness and Training'!A43.2.13.2.1[b]0
3.2.13.2.1[c]0Awareness and Training'!A53.2.13.2.1[c]0
3.2.13.2.1[d]0Awareness and Training'!A63.2.13.2.1[d]0
3.2.23.2.2NRAwareness and Training'!A73.2.23.2.2NR
3.2.23.2.2[a]0Awareness and Training'!A83.2.23.2.2[a]0
3.2.23.2.2[b]0Awareness and Training'!A93.2.23.2.2[b]0
3.2.23.2.2[c]0Awareness and Training'!A103.2.23.2.2[c]0
3.2.33.2.3NRAwareness and Training'!A113.2.33.2.3NR
3.2.33.2.3[a]0Awareness and Training'!A123.2.33.2.3[a]0
3.2.33.2.3[b]0Awareness and Training'!A133.2.33.2.3[b]0
3.3.13.3.1NRAudit and Accountability'!A23.3.13.3.1NR
3.3.13.3.1[a]0Audit and Accountability'!A33.3.13.3.1[a]0
3.3.13.3.1[b]0Audit and Accountability'!A43.3.13.3.1[b]0
3.3.13.3.1[c]0Audit and Accountability'!A53.3.13.3.1[c]0
3.3.13.3.1[d]0Audit and Accountability'!A63.3.13.3.1[d]0
3.3.13.3.1[e]0Audit and Accountability'!A73.3.13.3.1[e]0
3.3.13.3.1[f]0Audit and Accountability'!A83.3.13.3.1[f]0
3.3.23.3.2NRAudit and Accountability'!A93.3.23.3.2NR
3.3.23.3.2[a]0Audit and Accountability'!A103.3.23.3.2[a]0
3.3.23.3.2[b]0Audit and Accountability'!A113.3.23.3.2[b]0
3.3.33.3.3NRAudit and Accountability'!A123.3.33.3.3NR
3.3.33.3.3[a]0Audit and Accountability'!A133.3.33.3.3[a]0
3.3.33.3.3[b]0Audit and Accountability'!A143.3.33.3.3[b]0
3.3.33.3.3[c]0Audit and Accountability'!A153.3.33.3.3[c]0
3.3.43.3.4NRAudit and Accountability'!A163.3.43.3.4NR
3.3.43.3.4[a]0Audit and Accountability'!A173.3.43.3.4[a]0
3.3.43.3.4[b]0Audit and Accountability'!A183.3.43.3.4[b]0
3.3.43.3.4[c]0Audit and Accountability'!A193.3.43.3.4[c]0
3.3.53.3.5NRAudit and Accountability'!A203.3.53.3.5NR
3.3.53.3.5[a]0Audit and Accountability'!A213.3.53.3.5[a]0
3.3.53.3.5[b]0Audit and Accountability'!A223.3.53.3.5[b]0
3.3.63.3.6NRAudit and Accountability'!A233.3.63.3.6NR
3.3.63.3.6[a]0Audit and Accountability'!A243.3.63.3.6[a]0
3.3.63.3.6[b]0Audit and Accountability'!A253.3.63.3.6[b]0
3.3.73.3.7NRAudit and Accountability'!A263.3.73.3.7NR
3.3.73.3.7[a]0Audit and Accountability'!A273.3.73.3.7[a]0
3.3.73.3.7[b]0Audit and Accountability'!A283.3.73.3.7[b]0
3.3.73.3.7[c]0Audit and Accountability'!A293.3.73.3.7[c]0
3.3.83.3.8NRAudit and Accountability'!A303.3.83.3.8NR
3.3.83.3.8[a]0Audit and Accountability'!A313.3.83.3.8[a]0
3.3.83.3.8[b]0Audit and Accountability'!A323.3.83.3.8[b]0
3.3.83.3.8[c]0Audit and Accountability'!A333.3.83.3.8[c]0
3.3.83.3.8[d]0Audit and Accountability'!A343.3.83.3.8[d]0
3.3.83.3.8[e]0Audit and Accountability'!A353.3.83.3.8[e]0
3.3.83.3.8[f]0Audit and Accountability'!A363.3.83.3.8[f]0
3.3.93.3.9NRAudit and Accountability'!A373.3.93.3.9NR
3.3.93.3.9[a]0Audit and Accountability'!A383.3.93.3.9[a]0
3.3.93.3.9[b]0Audit and Accountability'!A393.3.93.3.9[b]0
3.4.13.4.1NRConfiguration Management'!A23.4.13.4.1NR
3.4.13.4.1[a]0Configuration Management'!A33.4.13.4.1[a]0
3.4.13.4.1[b]0Configuration Management'!A43.4.13.4.1[b]0
3.4.13.4.1[c]0Configuration Management'!A53.4.13.4.1[c]0
3.4.13.4.1[d]0Configuration Management'!A63.4.13.4.1[d]0
3.4.13.4.1[e]0Configuration Management'!A73.4.13.4.1[e]0
3.4.13.4.1[f]0Configuration Management'!A83.4.13.4.1[f]0
3.4.23.4.2NRConfiguration Management'!A93.4.23.4.2NR
3.4.23.4.2[a]0Configuration Management'!A103.4.23.4.2[a]0
3.4.23.4.2[b]0Configuration Management'!A113.4.23.4.2[b]0
3.4.33.4.3NRConfiguration Management'!A123.4.33.4.3NR
3.4.33.4.3[a]0Configuration Management'!A133.4.33.4.3[a]0
3.4.33.4.3[b]0Configuration Management'!A143.4.33.4.3[b]0
3.4.33.4.3[c]0Configuration Management'!A153.4.33.4.3[c]0
3.4.33.4.3[d]0Configuration Management'!A163.4.33.4.3[d]0
3.4.43.4.4NRConfiguration Management'!A173.4.43.4.4NR3.4.43.4.4NR
3.4.53.4.5NRConfiguration Management'!A183.4.53.4.5NR
3.4.53.4.5[a]0Configuration Management'!A193.4.53.4.5[a]0
3.4.53.4.5[b]0Configuration Management'!A203.4.53.4.5[b]0
3.4.53.4.5[c]0Configuration Management'!A213.4.53.4.5[c]0
3.4.53.4.5[d]0Configuration Management'!A223.4.53.4.5[d]0
3.4.53.4.5[e]0Configuration Management'!A233.4.53.4.5[e]0
3.4.53.4.5[f]0Configuration Management'!A243.4.53.4.5[f]0
3.4.53.4.5[g]0Configuration Management'!A253.4.53.4.5[g]0
3.4.53.4.5[h]0Configuration Management'!A263.4.53.4.5[h]0
3.4.63.4.6NRConfiguration Management'!A273.4.63.4.6NR
3.4.63.4.6[a]0Configuration Management'!A283.4.63.4.6[a]0
3.4.63.4.6[b]0Configuration Management'!A293.4.63.4.6[b]0
3.4.73.4.7NRConfiguration Management'!A303.4.73.4.7NR
3.4.73.4.7[a]0Configuration Management'!A313.4.73.4.7[a]0
3.4.73.4.7[b]0Configuration Management'!A323.4.73.4.7[b]0
3.4.73.4.7[c]0Configuration Management'!A333.4.73.4.7[c]0
3.4.73.4.7[d]0Configuration Management'!A343.4.73.4.7[d]0
3.4.73.4.7[e]0Configuration Management'!A353.4.73.4.7[e]0
3.4.73.4.7[f]0Configuration Management'!A363.4.73.4.7[f]0
3.4.73.4.7[g]0Configuration Management'!A373.4.73.4.7[g]0
3.4.73.4.7[h]0Configuration Management'!A383.4.73.4.7[h]0
3.4.73.4.7[i]0Configuration Management'!A393.4.73.4.7[i]0
3.4.73.4.7[j]0Configuration Management'!A403.4.73.4.7[j]0
3.4.73.4.7[k]0Configuration Management'!A413.4.73.4.7[k]0
3.4.73.4.7[l]0Configuration Management'!A423.4.73.4.7[l]0
3.4.73.4.7[m]0Configuration Management'!A433.4.73.4.7[m]0
3.4.73.4.7[n]0Configuration Management'!A443.4.73.4.7[n]0
3.4.73.4.7[o]0Configuration Management'!A453.4.73.4.7[o]0
3.4.83.4.8NRConfiguration Management'!A463.4.83.4.8NR
3.4.83.4.8[a]0Configuration Management'!A473.4.83.4.8[a]0
3.4.83.4.8[b]0Configuration Management'!A483.4.83.4.8[b]0
3.4.83.4.8[c]0Configuration Management'!A493.4.83.4.8[c]0
3.4.93.4.9NRConfiguration Management'!A503.4.93.4.9NR
3.4.93.4.9[a]0Configuration Management'!A513.4.93.4.9[a]0
3.4.93.4.9[b]0Configuration Management'!A523.4.93.4.9[b]0
3.4.93.4.9[c]0Configuration Management'!A533.4.93.4.9[c]0
3.5.13.5.1NRID and Authentication '!A23.5.13.5.1NR3.5.13.5.1NR
3.5.13.5.1[a]0ID and Authentication '!A33.5.13.5.1[a]03.5.13.5.1[a]0
3.5.13.5.1[b]0ID and Authentication '!A43.5.13.5.1[b]03.5.13.5.1[b]0
3.5.13.5.1[c]0ID and Authentication '!A53.5.13.5.1[c]03.5.13.5.1[c]0
3.5.23.5.2NRID and Authentication '!A63.5.23.5.2NR3.5.23.5.2NR
3.5.23.5.2[a]0ID and Authentication '!A73.5.23.5.2[a]03.5.23.5.2[a]0
3.5.23.5.2[b]0ID and Authentication '!A83.5.23.5.2[b]03.5.23.5.2[b]0
3.5.23.5.2[c]0ID and Authentication '!A93.5.23.5.2[c]03.5.23.5.2[c]0
3.5.33.5.3NRID and Authentication '!A103.5.33.5.3NR
3.5.33.5.3[a]0ID and Authentication '!A113.5.33.5.3[a]0
3.5.33.5.3[b]0ID and Authentication '!A123.5.33.5.3[b]0
3.5.33.5.3[c]0ID and Authentication '!A133.5.33.5.3[c]0
3.5.33.5.3[d]0ID and Authentication '!A143.5.33.5.3[d]0
3.5.43.5.4NRID and Authentication '!A153.5.43.5.4NR3.5.43.5.4NR
3.5.53.5.5NRID and Authentication '!A163.5.53.5.5NR
3.5.53.5.5[a]0ID and Authentication '!A173.5.53.5.5[a]0
3.5.53.5.5[b]0ID and Authentication '!A183.5.53.5.5[b]0
3.5.63.5.6NRID and Authentication '!A193.5.63.5.6NR
3.5.63.5.6[a]0ID and Authentication '!A203.5.63.5.6[a]0
3.5.63.5.6[b]0ID and Authentication '!A213.5.63.5.6[b]0
3.5.73.5.7NRID and Authentication '!A223.5.73.5.7NR
3.5.73.5.7[a]0ID and Authentication '!A233.5.73.5.7[a]0
3.5.73.5.7[b]0ID and Authentication '!A243.5.73.5.7[b]0
3.5.73.5.7[c]0ID and Authentication '!A253.5.73.5.7[c]0
3.5.73.5.7[d]0ID and Authentication '!A263.5.73.5.7[d]0
3.5.83.5.8NRID and Authentication '!A273.5.83.5.8NR
3.5.83.5.8[a]0ID and Authentication '!A283.5.83.5.8[a]0
3.5.83.5.8[b]0ID and Authentication '!A293.5.83.5.8[b]0
3.5.93.5.9NRID and Authentication '!A303.5.93.5.9NR3.5.93.5.9NR
3.5.103.5.10NRID and Authentication '!A313.5.103.5.10NR
3.5.103.5.10[a]0ID and Authentication '!A323.5.103.5.10[a]0
3.5.103.5.10[b]0ID and Authentication '!A333.5.103.5.10[b]0
3.5.113.5.11NRID and Authentication '!A343.5.113.5.11NR3.5.113.5.11NR
3.6.13.6.1NRIncident Response'!A23.6.13.6.1NR
3.6.13.6.1[a]0Incident Response'!A33.6.13.6.1[a]0
3.6.13.6.1[b]0Incident Response'!A43.6.13.6.1[b]0
3.6.13.6.1[c]0Incident Response'!A53.6.13.6.1[c]0
3.6.13.6.1[d]0Incident Response'!A63.6.13.6.1[d]0
3.6.13.6.1[e]0Incident Response'!A73.6.13.6.1[e]0
3.6.13.6.1[f]0Incident Response'!A83.6.13.6.1[f]0
3.6.13.6.1[g]0Incident Response'!A93.6.13.6.1[g]0
3.6.23.6.2NRIncident Response'!A103.6.23.6.2NR
3.6.23.6.2[a]0Incident Response'!A113.6.23.6.2[a]0
3.6.23.6.2[b]0Incident Response'!A123.6.23.6.2[b]0
3.6.23.6.2[c]0Incident Response'!A133.6.23.6.2[c]0
3.6.23.6.2[d]0Incident Response'!A143.6.23.6.2[d]0
3.6.23.6.2[e]0Incident Response'!A153.6.23.6.2[e]0
3.6.23.6.2[f]0Incident Response'!A163.6.23.6.2[f]0
3.6.33.6.3NRIncident Response'!A173.6.33.6.3NR3.6.33.6.3NR
3.7.13.7.1NRMaintenance!A23.7.13.7.1NR3.7.13.7.1NR
3.7.23.7.2NRMaintenance!A33.7.23.7.2NR
3.7.23.7.2[a]0Maintenance!A43.7.23.7.2[a]0
3.7.23.7.2[b]0Maintenance!A53.7.23.7.2[b]0
3.7.23.7.2[c]0Maintenance!A63.7.23.7.2[c]0
3.7.23.7.2[d]0Maintenance!A73.7.23.7.2[d]0
3.7.33.7.3NRMaintenance!A83.7.33.7.3NR3.7.33.7.3NR
3.7.43.7.4NRMaintenance!A93.7.43.7.4NR3.7.43.7.4NR
3.7.53.7.5NRMaintenance!A103.7.53.7.5NR
3.7.53.7.5[a]0Maintenance!A113.7.53.7.5[a]0
3.7.53.7.5[b]0Maintenance!A123.7.53.7.5[b]0
3.7.63.7.6NRMaintenance!A133.7.63.7.6NR3.7.63.7.6NR
3.8.13.8.1NRMedia Protection'!A23.8.13.8.1NR
3.8.13.8.1[a]0Media Protection'!A33.8.13.8.1[a]0
3.8.13.8.1[b]0Media Protection'!A43.8.13.8.1[b]0
3.8.13.8.1[c]0Media Protection'!A53.8.13.8.1[c]0
3.8.13.8.1[d]0Media Protection'!A63.8.13.8.1[d]0
3.8.23.8.2NRMedia Protection'!A73.8.23.8.2NR3.8.23.8.2NR
3.8.33.8.3NRMedia Protection'!A83.8.33.8.3NR3.8.33.8.3NR
3.8.33.8.3[a]0Media Protection'!A93.8.33.8.3[a]03.8.33.8.3[a]0
3.8.33.8.3[b]0Media Protection'!A103.8.33.8.3[b]03.8.33.8.3[b]0
3.8.43.8.4NRMedia Protection'!A113.8.43.8.4NR
3.8.43.8.4[a]0Media Protection'!A123.8.43.8.4[a]0
3.8.43.8.4[b]0Media Protection'!A133.8.43.8.4[b]0
3.8.53.8.5NRMedia Protection'!A143.8.53.8.5NR
3.8.53.8.5[a]0Media Protection'!A153.8.53.8.5[a]0
3.8.53.8.5[b]0Media Protection'!A163.8.53.8.5[b]0
3.8.63.8.6NRMedia Protection'!A173.8.63.8.6NR3.8.63.8.6NR
3.8.73.8.7NRMedia Protection'!A183.8.73.8.7NR3.8.73.8.7NR
3.8.83.8.8NRMedia Protection'!A193.8.83.8.8NR3.8.83.8.8NR
3.8.93.8.9NRMedia Protection'!A203.8.93.8.9NR3.8.93.8.9NR
3.9.13.9.1NRPersonnel Security'!A23.9.13.9.1NR3.9.13.9.1NR
3.9.23.9.2NRPersonnel Security'!A33.9.23.9.2NR
3.9.23.9.2[a]0Personnel Security'!A43.9.23.9.2[a]0
3.9.23.9.2[b]0Personnel Security'!A53.9.23.9.2[b]0
3.9.23.9.2[c]0Personnel Security'!A63.9.23.9.2[c]0
3.10.13.10.1NRPhysical Protection'!A23.10.13.10.1NR3.10.13.10.1NR
3.10.13.10.1[a]0Physical Protection'!A33.10.13.10.1[a]03.10.13.10.1[a]0
3.10.13.10.1[b]0Physical Protection'!A43.10.13.10.1[b]03.10.13.10.1[b]0
3.10.13.10.1[c]0Physical Protection'!A53.10.13.10.1[c]03.10.13.10.1[c]0
3.10.13.10.1[d]0Physical Protection'!A63.10.13.10.1[d]03.10.13.10.1[d]0
3.10.23.10.2NRPhysical Protection'!A73.10.23.10.2NR
3.10.23.10.2[a]0Physical Protection'!A83.10.23.10.2[a]0
3.10.23.10.2[b]0Physical Protection'!A93.10.23.10.2[b]0
3.10.23.10.2[c]0Physical Protection'!A103.10.23.10.2[c]0
3.10.23.10.2[d]0Physical Protection'!A113.10.23.10.2[d]0
3.10.33.10.3NRPhysical Protection'!A123.10.33.10.3NR3.10.33.10.3NR
3.10.33.10.3[a]0Physical Protection'!A133.10.33.10.3[a]03.10.33.10.3[a]0
3.10.33.10.3[b]0Physical Protection'!A143.10.33.10.3[b]03.10.33.10.3[b]0
3.10.43.10.4NRPhysical Protection'!A153.10.43.10.4NR3.10.43.10.4NR3.10.43.10.4NR3.10.43.10.4NR
3.10.53.10.5NRPhysical Protection'!A163.10.53.10.5NR3.10.53.10.5NR
3.10.53.10.5[a]0Physical Protection'!A173.10.53.10.5[a]03.10.53.10.5[a]0
3.10.53.10.5[b]0Physical Protection'!A183.10.53.10.5[b]03.10.53.10.5[b]0
3.10.53.10.5[c]0Physical Protection'!A193.10.53.10.5[c]03.10.53.10.5[c]0
3.10.63.10.6NRPhysical Protection'!A203.10.63.10.6NR
3.10.63.10.6[a]0Physical Protection'!A213.10.63.10.6[a]0
3.10.63.10.6[b]0Physical Protection'!A223.10.63.10.6[b]0
3.11.13.11.1NRRisk Assessment'!A23.11.13.11.1NR
3.11.13.11.1[a]0Risk Assessment'!A33.11.13.11.1[a]0
3.11.13.11.1[b]0Risk Assessment'!A43.11.13.11.1[b]0
3.11.23.11.2NRRisk Assessment'!A53.11.23.11.2NR
3.11.23.11.2[a]0Risk Assessment'!A63.11.23.11.2[a]0
3.11.23.11.2[b]0Risk Assessment'!A73.11.23.11.2[b]0
3.11.23.11.2[c]0Risk Assessment'!A83.11.23.11.2[c]0
3.11.23.11.2[d]0Risk Assessment'!A93.11.23.11.2[d]0
3.11.23.11.2[e]0Risk Assessment'!A103.11.23.11.2[e]0
3.11.33.11.3NRRisk Assessment'!A113.11.33.11.3NR
3.11.33.11.3[a]0Risk Assessment'!A123.11.33.11.3[a]0
3.11.33.11.3[b]0Risk Assessment'!A133.11.33.11.3[b]0
3.12.13.12.1NRSecurity Assessment'!A23.12.13.12.1NR
3.12.13.12.1[a]0Security Assessment'!A33.12.13.12.1[a]0
3.12.13.12.1[b]0Security Assessment'!A43.12.13.12.1[b]0
3.12.23.12.2NRSecurity Assessment'!A53.12.23.12.2NR
3.12.23.12.2[a]0Security Assessment'!A63.12.23.12.2[a]0
3.12.23.12.2[b]0Security Assessment'!A73.12.23.12.2[b]0
3.12.23.12.2[c]0Security Assessment'!A83.12.23.12.2[c]0
3.12.33.12.30Security Assessment'!A93.12.33.12.303.12.33.12.30
3.12.43.12.4NRSecurity Assessment'!A103.12.43.12.4NR
3.12.43.12.4[a]0Security Assessment'!A113.12.43.12.4[a]0
3.12.43.12.4[b]0Security Assessment'!A123.12.43.12.4[b]0
3.12.43.12.4[c]0Security Assessment'!A133.12.43.12.4[c]0
3.12.43.12.4[d]0Security Assessment'!A143.12.43.12.4[d]0
3.12.43.12.4[e]0Security Assessment'!A153.12.43.12.4[e]0
3.12.43.12.4[f]0Security Assessment'!A163.12.43.12.4[f]0
3.12.43.12.4[g]0Security Assessment'!A173.12.43.12.4[g]0
3.12.43.12.4[h]0Security Assessment'!A183.12.43.12.4[h]0
3.13.13.13.1NRSys and Comm Protection'!A23.13.13.13.1NR3.13.13.13.1NR
3.13.13.13.1[a]0Sys and Comm Protection'!A33.13.13.13.1[a]03.13.13.13.1[a]0
3.13.13.13.1[b]0Sys and Comm Protection'!A43.13.13.13.1[b]03.13.13.13.1[b]0
3.13.13.13.1[c]0Sys and Comm Protection'!A53.13.13.13.1[c]03.13.13.13.1[c]0
3.13.13.13.1[d]0Sys and Comm Protection'!A63.13.13.13.1[d]03.13.13.13.1[d]0
3.13.13.13.1[e]0Sys and Comm Protection'!A73.13.13.13.1[e]03.13.13.13.1[e]0
3.13.13.13.1[f]0Sys and Comm Protection'!A83.13.13.13.1[f]03.13.13.13.1[f]0
3.13.13.13.1[g]0Sys and Comm Protection'!A93.13.13.13.1[g]03.13.13.13.1[g]0
3.13.13.13.1[h]0Sys and Comm Protection'!A103.13.13.13.1[h]03.13.13.13.1[h]0
3.13.23.13.2NRSys and Comm Protection'!A113.13.23.13.2NR
3.13.23.13.2[a]0Sys and Comm Protection'!A123.13.23.13.2[a]0
3.13.23.13.2[b]0Sys and Comm Protection'!A133.13.23.13.2[b]0
3.13.23.13.2[c]0Sys and Comm Protection'!A143.13.23.13.2[c]0
3.13.23.13.2[d]0Sys and Comm Protection'!A153.13.23.13.2[d]0
3.13.23.13.2[e]0Sys and Comm Protection'!A163.13.23.13.2[e]0
3.13.23.13.2[f]0Sys and Comm Protection'!A173.13.23.13.2[f]0
3.13.33.13.3NRSys and Comm Protection'!A183.13.33.13.3NR
3.13.33.13.3[a]0Sys and Comm Protection'!A193.13.33.13.3[a]0
3.13.33.13.3[b]0Sys and Comm Protection'!A203.13.33.13.3[b]0
3.13.33.13.3[c]0Sys and Comm Protection'!A213.13.33.13.3[c]0
3.13.43.13.40Sys and Comm Protection'!A223.13.43.13.403.13.43.13.40
3.13.53.13.5NRSys and Comm Protection'!A233.13.53.13.5NR3.13.53.13.5NR
3.13.53.13.5[a]0Sys and Comm Protection'!A243.13.53.13.5[a]03.13.53.13.5[a]0
3.13.53.13.5[b]0Sys and Comm Protection'!A253.13.53.13.5[b]03.13.53.13.5[b]0
3.13.63.13.6NRSys and Comm Protection'!A263.13.63.13.6NR
3.13.63.13.6[a]0Sys and Comm Protection'!A273.13.63.13.6[a]0
3.13.63.13.6[b]0Sys and Comm Protection'!A283.13.63.13.6[b]0
3.13.73.13.70Sys and Comm Protection'!A293.13.73.13.703.13.73.13.70
3.13.83.13.8NRSys and Comm Protection'!A303.13.83.13.8NR
3.13.83.13.8[a]0Sys and Comm Protection'!A313.13.83.13.8[a]0
3.13.83.13.8[b]0Sys and Comm Protection'!A323.13.83.13.8[b]0
3.13.83.13.8[c]0Sys and Comm Protection'!A333.13.83.13.8[c]0
3.13.93.13.9NRSys and Comm Protection'!A343.13.93.13.9NR
3.13.93.13.9[a]0Sys and Comm Protection'!A353.13.93.13.9[a]0
3.13.93.13.9[b]0Sys and Comm Protection'!A363.13.93.13.9[b]0
3.13.93.13.9[c]0Sys and Comm Protection'!A373.13.93.13.9[c]0
3.13.103.13.10NRSys and Comm Protection'!A383.13.103.13.10NR
3.13.103.13.10[a]0Sys and Comm Protection'!A393.13.103.13.10[a]0
3.13.103.13.10[b]0Sys and Comm Protection'!A403.13.103.13.10[b]0
3.13.113.13.110Sys and Comm Protection'!A413.13.113.13.1103.13.113.13.110
3.13.123.13.12NRSys and Comm Protection'!A423.13.123.13.12NR
3.13.123.13.12[a]0Sys and Comm Protection'!A433.13.123.13.12[a]0
3.13.123.13.12[b]0Sys and Comm Protection'!A443.13.123.13.12[b]0
3.13.123.13.12[c]0Sys and Comm Protection'!A453.13.123.13.12[c]0
3.13.133.13.13NRSys and Comm Protection'!A463.13.133.13.13NR
3.13.133.13.13[a]0Sys and Comm Protection'!A473.13.133.13.13[a]0
3.13.133.13.13[b]0Sys and Comm Protection'!A483.13.133.13.13[b]0
3.13.143.13.14NRSys and Comm Protection'!A493.13.143.13.14NR
3.13.143.13.14[a]0Sys and Comm Protection'!A503.13.143.13.14[a]0
3.13.143.13.14[b]0Sys and Comm Protection'!A513.13.143.13.14[b]0
3.13.153.13.150Sys and Comm Protection'!A523.13.153.13.1503.13.153.13.150
3.13.163.13.160Sys and Comm Protection'!A533.13.163.13.1603.13.163.13.160
3.14.13.14.1NRSystem and Info Integrity'!A23.14.13.14.1NR3.14.13.14.1NR
3.14.13.14.1[a]0System and Info Integrity'!A33.14.13.14.1[a]03.14.13.14.1[a]0
3.14.13.14.1[b]0System and Info Integrity'!A43.14.13.14.1[b]03.14.13.14.1[b]0
3.14.13.14.1[c]0System and Info Integrity'!A53.14.13.14.1[c]03.14.13.14.1[c]0
3.14.13.14.1[d]0System and Info Integrity'!A63.14.13.14.1[d]03.14.13.14.1[d]0
3.14.13.14.1[e]0System and Info Integrity'!A73.14.13.14.1[e]03.14.13.14.1[e]0
3.14.13.14.1[f]0System and Info Integrity'!A83.14.13.14.1[f]03.14.13.14.1[f]0
3.14.23.14.2NRSystem and Info Integrity'!A93.14.23.14.2NR3.14.23.14.2NR
3.14.23.14.2[a]0System and Info Integrity'!A103.14.23.14.2[a]03.14.23.14.2[a]0
3.14.23.14.2[b]0System and Info Integrity'!A113.14.23.14.2[b]03.14.23.14.2[b]0
3.14.33.14.3NRSystem and Info Integrity'!A123.14.33.14.3NR
3.14.33.14.3[a]0System and Info Integrity'!A133.14.33.14.3[a]0
3.14.33.14.3[b]0System and Info Integrity'!A143.14.33.14.3[b]0
3.14.33.14.3[c]0System and Info Integrity'!A153.14.33.14.3[c]0
3.14.43.14.40System and Info Integrity'!A163.14.43.14.403.14.43.14.403.14.43.14.403.14.43.14.40
3.14.53.14.5NRSystem and Info Integrity'!A173.14.53.14.5NR3.14.53.14.5NR
3.14.53.14.5[a]0System and Info Integrity'!A183.14.53.14.5[a]03.14.53.14.5[a]0
3.14.53.14.5[b]0System and Info Integrity'!A193.14.53.14.5[b]03.14.53.14.5[b]0
3.14.53.14.5[c]0System and Info Integrity'!A203.14.53.14.5[c]03.14.53.14.5[c]0
3.14.63.14.6NRSystem and Info Integrity'!A213.14.63.14.6NR
3.14.63.14.6[a]0System and Info Integrity'!A223.14.63.14.6[a]0
3.14.63.14.6[b]0System and Info Integrity'!A233.14.63.14.6[b]0
3.14.63.14.6[c]0System and Info Integrity'!A243.14.63.14.6[c]0
3.14.73.14.7NRSystem and Info Integrity'!A253.14.73.14.7NR
3.14.73.14.7[a]0System and Info Integrity'!A263.14.73.14.7[a]0
3.14.73.14.7[b]0System and Info Integrity'!A273.14.73.14.7[b]0
407407103040711011011000320320320001717170059595900
Not RatedCompliantNon-CompliantNot RatedCompliantNon-CompliantNot RatedCompliantNon-CompliantNot RatedCompliantNon-CompliantNot RatedCompliantNon-Compliant

Carrier Info

Company name:
Contract number:
Cage code:
Date completed:
Submission Type (Annual contract requirement or interim update?)
Point of contact (POC):
POC phone number:
POC e-mail address:

800-171 Controls

Not Rated Compliant Non-Compliant 110 0 0

800-171 Procedures

Not Rated Compliant Non-Compliant 320 0 0

FAR 52.204-21

Controls

Not Rated Compliant Non-Compliant 17 0 0

FAR 52.204-21

Procedures

Not Rated Compliant Non-Compliant 59 0 0

Access Control

Compliant
(Yes/No)NIST 800-171
Control/Objective NumberControl FamilyDIBCAC ScoringControl/Objective TextControl TypeNon-Compliance Detection DateScheduled Completion DateActual Completion DateSupporting Documentation / System ControlsStatus / CommentsResponsible Party: IT Operations, Security Office, and/or Data CustodianISO 27002:2013 Mapping
NR3.1.1Access Control5Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).Basic
3.1.1[a]Access Controlauthorized users are identified.
3.1.1[b]Access Controlprocesses acting on behalf of authorized users are identified.
3.1.1[c]Access Controldevices (and other systems) authorized to connect to the system are identified.
3.1.1[d]Access Controlsystem access is limited to authorized users.
3.1.1[e]Access Controlsystem access is limited to processes acting on behalf of authorized users.
3.1.1[f]Access Controlsystem access is limited to authorized devices (including other systems).
NR3.1.2Access Control5Limit information system access to the types of transactions and functions that authorized users are permitted to execute.Derived
3.1.2[a]Access Controlthe types of transactions and functions that authorized users are permitted to execute are defined.
3.1.2[b]Access Controlsystem access is limited to the defined types of transactions and functions for authorized users.
NR3.1.3Access Control1Limit the flow of DoD information to organizations or individuals necessary for the performance of the operationally critical requirements of this contract.Derived
3.1.3[a]Access Controlinformation flow control policies are defined.
3.1.3[b]Access Controlmethods and enforcement mechanisms for controlling the flow of CUI are defined.
3.1.3[c]Access Controldesignated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified.
3.1.3[d]Access Controlauthorizations for controlling the flow of CUI are defined.
3.1.3[e]Access Controlapproved authorizations for controlling the flow of CUI are enforced.
NR3.1.4Access Control1Separate the duties of individuals to reduce the risk of malevolent activity without collusion.Derived
3.1.4[a]Access Controlthe duties of individuals requiring separation are defined.
3.1.4[b]Access Controlresponsibilities for duties that require separation are assigned to separate individuals.
3.1.4[c]Access Controlaccess privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.
NR3.1.5Access Control3Employ the principle of least privilege, including for specific security functions and privileged accounts.Derived
3.1.5[a]Access Controlprivileged accounts are identified.
3.1.5[b]Access Controlaccess to privileged accounts is authorized in accordance with the principle of least privilege.
3.1.5[c]Access Controlsecurity functions are identified.
3.1.5[d]Access Controlaccess to security functions is authorized in accordance with the principle of least privilege.
NR3.1.6Access Control1Use non-privileged accounts or roles when accessing nonsecurity functions.Derived
3.1.6[a]Access Controlnonsecurity functions are identified.
3.1.6[b]Access Controlusers are required to use non-privileged accounts or roles when accessing nonsecurity functions.
NR3.1.7Access Control1Prevent non-privileged users from executing privileged functions and audit the execution of such functions.Derived
3.1.7[a]Access Controlprivileged functions are defined.
3.1.7[b]Access Controlnon-privileged users are defined.
3.1.7[c]Access Controlnon-privileged users are prevented from executing privileged functions.
3.1.7[d]Access Controlthe execution of privileged functions is captured in audit logs.
NR3.1.8Access Control1Limit unsuccessful logon attempts.Derived
3.1.8[a]Access Controlthe means of limiting unsuccessful logon attempts is defined.
3.1.8[b]Access Controlthe defined means of limiting unsuccessful logon attempts is implemented.
NR3.1.9Access Control1Provide privacy and security notices consistent with U.S. Government and/or local governmental regulations.Derived
3.1.9[a]Access Controlprivacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category.
3.1.9[b]Access Controlprivacy and security notices are displayed.
NR3.1.10Access Control1Use session lock with pattern-hiding displays to prevent access/viewing of data after period of inactivity.Basic
3.1.10[a]Access Controlthe period of inactivity after which the system initiates a session lock is defined.
3.1.10[b]Access Controlaccess to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity.
3.1.10[c]Access Controlpreviously visible information is concealed via a pattern-hiding display after the defined period of inactivity.
NR3.1.11Access Control1Terminate (automatically) a user session after a defined condition.Derived
3.1.11[a]Access Controlconditions requiring a user session to terminate are defined.
3.1.11[b]Access Controla user session is automatically terminated after any of the defined conditions occur.
NR3.1.12Access Control5Monitor and control remote access sessions.Derived
3.1.12[a]Access Controlremote access sessions are permitted.
3.1.12[b]Access Controlthe types of permitted remote access are identified.
3.1.12[c]Access Controlremote access sessions are controlled.
3.1.12[d]Access Controlremote access sessions are monitored.
NR3.1.13Access Control5Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.Derived
3.1.13[a]Access Controlcryptographic mechanisms to protect the confidentiality of remote access sessions are identified.
3.1.13[b]Access Controlcryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.
NR3.1.14Access Control1Route remote access via managed access control points.Derived
3.1.14[a]Access Controlmanaged access control points are identified and implemented.
3.1.14[b]Access Controlremote access is routed through managed network access control points.
NR3.1.15Access Control1Authorize remote execution of privileged commands and remote access to security-relevant information.Derived
3.1.15[a]Access Controlprivileged commands authorized for remote execution are identified.
3.1.15[b]Access Controlsecurity-relevant information authorized to be accessed remotely is identified.
3.1.15[c]Access Controlthe execution of the identified privileged commands via remote access is authorized.
3.1.15[d]Access Controlaccess to the identified security-relevant information via remote access is authorized.
NR3.1.16Access Control5Authorize wireless access prior to allowing such connections.Derived
3.1.16[a]Access Controlwireless access points are identified.
3.1.16[b]Access Controlwireless access is authorized prior to allowing such connections.
NR3.1.17Access Control5Protect wireless access using authentication and encryption.Derived
3.1.17[a]Access Controlwireless access to the system is protected using authentication.
3.1.17[b]Access Controlwireless access to the system is protected using encryption.
NR3.1.18Access Control5Control connection of mobile devices.Derived
3.1.18[a]Access Controlmobile devices that process, store, or transmit CUI are identified.
3.1.18[b]Access Controlmobile device connections are authorized.
3.1.18[c]Access Controlmobile device connections are monitored and logged.
NR3.1.19Access Control3Provide adequate technical protections on mobile devices and computing platforms that process and/or store contractual information.Derived
3.1.19[a]Access Controlmobile devices and mobile computing platforms that process, store, or transmit CUI are identified.
3.1.19[b]Access Controlencryption is employed to protect CUI on identified mobile devices and mobile computing platforms.
NR3.1.20Access Control1Verify and control/limit connections to and use of external information systems.Derived
3.1.20[a]Access Controlconnections to external systems are identified.
3.1.20[b]Access Controlthe use of external systems is identified.
3.1.20[c]Access Controlconnections to external systems are verified.
3.1.20[d]Access Controlthe use of external systems is verified.
3.1.20[e]Access Controlconnections to external systems are controlled/limited.
3.1.20[f]Access Controlthe use of external systems is controlled/limited.
NR3.1.21Access Control1Limit use of organizational portable storage devices on external information systems.Derived
3.1.21[a]Access Controlthe use of portable storage devices containing CUI on external systems is identified and documented.
3.1.21[b]Access Controllimits on the use of portable storage devices containing CUI on external systems are defined.
3.1.21[c]Access Controlthe use of portable storage devices containing CUI on external systems is limited as defined.
NR3.1.22Access Control1Control DoD information posted or processed on publically accessible systems.Derived
3.1.22[a]Access Controlindividuals authorized to post or process information on publicly accessible systems are identified.
3.1.22[b]Access Controlprocedures to ensure CUI is not posted or processed on publicly accessible systems are identified.
3.1.22[c]Access Controla review process is in place prior to posting of any content to publicly accessible systems.
3.1.22[d]Access Controlcontent on publicly accessible systems is reviewed to ensure that it does not include CUI.
3.1.22[e]Access Controlmechanisms are in place to remove and address improper posting of CUI.

Awareness and Training

Compliant
(Yes/No)NIST 800-171
Control/Objective NumberControl FamilyDIBCAC ScoringControl/Objective TextControl TypeNon-Compliance Detection DateScheduled Completion DateActual Completion DateSupporting Documentation / System ControlsStatus / Comments
NR3.2.1Awareness and Training5Ensure that managers, systems administrators, and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of organizational information systems.Basic
3.2.1[a]Awareness and Trainingsecurity risks associated with organizational activities involving CUI are identified.
3.2.1[b]Awareness and Trainingpolicies, standards, and procedures related to the security of the system are identified.
3.2.1[c]Awareness and Trainingmanagers, systems administrators, and users of the system are made aware of the security risks associated with their activities.
3.2.1[d]Awareness and Trainingmanagers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.
NR3.2.2Awareness and Training5Ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.Basic
3.2.2[a]Awareness and Traininginformation security-related duties, roles, and responsibilities are defined.
3.2.2[b]Awareness and Traininginformation security-related duties, roles, and responsibilities are assigned to designated personnel.
3.2.2[c]Awareness and Trainingpersonnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities.
NR3.2.3Awareness and Training1Provide security awareness training on recognizing and reporting potential indicators of insider threat.Derived
3.2.3[a]Awareness and Trainingpotential indicators associated with insider threats are identified.
3.2.3[b]Awareness and Trainingsecurity awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.

Audit and Accountability

Compliant
(Yes/No)NIST 800-171
Control/Objective NumberControl FamilyDIBCAC ScoringControl/Objective TextControl TypeNon-Compliance Detection DateScheduled Completion DateActual Completion DateSupporting Documentation / System ControlsStatus / Comments
NR3.3.1Audit and Accountability5Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity.Basic
3.3.1[a]Audit and Accountabilityaudit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified.

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .