NIST SP 800-171 Rev 3 (CUI; CMMC Level 2) OSCAL 1.1.0
All03.01 Access Control03.02 Awareness and Training03.03 Audit and Accountability03.04 Configuration Management03.05 Identification and Authentication03.06 Incident Response03.07 Maintenance03.08 Media Protection03.09 Personnel Security03.10 Physical Protection03.11 Risk Assessment03.12 Security Assessment and Monitoring03.13 System and Communications Protection03.14 System and Information Integrity03.15 Planning03.16 System and Services Acquisition03.17 Supply Chain Risk Management
| Ref | Title | Text | |
|---|---|---|---|
| 03.01.01 | Account Management | a. Define the types of system accounts allowed and prohibited. b. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria. c. Specify: c.01. Authorized users of the syst | |
| 03.01.02 | Access Enforcement | Enforce approved authorizations for logical access to CUI and system resources in accordance with applicable access control policies. | |
| 03.01.03 | Information Flow Enforcement | Enforce approved authorizations for controlling the flow of CUI within the system and between connected systems. | |
| 03.01.04 | Separation of Duties | a. Identify the duties of individuals requiring separation. b. Define system access authorizations to support separation of duties. | |
| 03.01.05 | Least Privilege | a. Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks. b. Authorize access to [Assignment: security functions] and [Assignment: security-relev | |
| 03.01.06 | Least Privilege – Privileged Accounts | a. Restrict privileged accounts on the system to [Assignment: personnel or roles].. b. Require that users (or roles) with privileged accounts use non-privileged accounts when accessing non-security functions or non-security information. | |
| 03.01.07 | Least Privilege – Privileged Functions | a. Prevent non-privileged users from executing privileged functions. b. Log the execution of privileged functions. | |
| 03.01.08 | Unsuccessful Logon Attempts | a. Enforce a limit of [Assignment: number] consecutive invalid logon attempts by a user during a [Assignment: time period]. b. Automatically [Selection (one or more): lock the account or node for an {{ insert: param, A.03.01.08.ODP.04 }}; l | |
| 03.01.09 | System Use Notification | Display a system use notification message with privacy and security notices consistent with applicable CUI rules before granting access to the system. | |
| 03.01.10 | Device Lock | a. Prevent access to the system by [Selection (one or more): initiating a device lock after {{ insert: param, A.03.01.10.ODP.02 }} of inactivity; requiring the user to initiate a device lock before leaving the system unattended]. b. Retain | |
| 03.01.11 | Session Termination | Terminate a user session automatically after [Assignment: conditions or trigger events]. | |
| 03.01.12 | Remote Access | a. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access. b. Authorize each type of remote system access prior to establishing such connections. c. Route remote | |
| 03.01.13 | 03.01.13 withdrawn | ||
| 03.01.14 | 03.01.14 withdrawn | ||
| 03.01.15 | 03.01.15 withdrawn | ||
| 03.01.16 | Wireless Access | a. Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system. b. Authorize each type of wireless access to the system prior to establishing such connections. c. Disa | |
| 03.01.17 | 03.01.17 withdrawn | ||
| 03.01.18 | Access Control for Mobile Devices | a. Establish usage restrictions, configuration requirements, and connection requirements for mobile devices. b. Authorize the connection of mobile devices to the system. c. Implement full-device or container-based encryption to protect the | |
| 03.01.19 | 03.01.19 withdrawn | ||
| 03.01.20 | Use of External Systems | a. Prohibit the use of external systems unless the systems are specifically authorized. b. Establish the following security requirements to be satisfied on external systems prior to allowing use of or access to those systems by authorized i | |
| 03.01.21 | 03.01.21 withdrawn | ||
| 03.01.22 | Publicly Accessible Content | a. Train authorized individuals to ensure that publicly accessible information does not contain CUI. b. Review the content on publicly accessible systems for CUI and remove such information, if discovered. | |
| 03.02.01 | Literacy Training and Awareness | a. Provide security literacy training to system users: a.01. As part of initial training for new users and [Assignment: frequency] thereafter, a.02. When required by system changes or following [Assignment: events], and a.03. On recognizing | |
| 03.02.02 | Role-Based Training | a. Provide role-based security training to organizational personnel: a.01. Before authorizing access to the system or CUI, before performing assigned duties, and [Assignment: frequency] thereafter a.02. When required by system changes or fo | |
| 03.02.03 | 03.02.03 withdrawn | ||
| 03.03.01 | Event Logging | a. Specify the following event types selected for logging within the system: [Assignment: event types]. b. Review and update the event types selected for logging [Assignment: frequency]. | |
| 03.03.02 | Audit Record Content | a. Include the following content in audit records: a.01. What type of event occurred a.02. When the event occurred a.03. Where the event occurred a.04. Source of the event a.05. Outcome of the event a.06. Identity of the individuals, subjec | |
| 03.03.03 | Audit Record Generation | a. Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02. b. Retain audit records for a time period consistent with the records retention policy. | |
| 03.03.04 | Response to Audit Logging Process Failures | a. Alert organizational personnel or roles within [Assignment: time period] in the event of an audit logging process failure. b. Take the following additional actions: [Assignment: additional actions]. | |
| 03.03.05 | Audit Record Review, Analysis, and Reporting | a. Review and analyze system audit records [Assignment: frequency] for indications and the potential impact of inappropriate or unusual activity. b. Report findings to organizational personnel or roles. c. Analyze and correlate audit record | |
| 03.03.06 | Audit Record Reduction and Report Generation | a. Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents. b. Preserve the original content and time ordering | |
| 03.03.07 | Time Stamps | a. Use internal system clocks to generate time stamps for audit records. b. Record time stamps for audit records that meet [Assignment: granularity of time measurement] and that use Coordinated Universal Time (UTC), have a fixed local time | |
| 03.03.08 | Protection of Audit Information | a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion. b. Authorize access to management of audit logging functionality to only a subset of privileged users or roles. | |
| 03.03.09 | 03.03.09 withdrawn | ||
| 03.04.01 | Baseline Configuration | a. Develop and maintain under configuration control, a current baseline configuration of the system. b. Review and update the baseline configuration of the system [Assignment: frequency] and when system components are installed or modified. | |
| 03.04.02 | Configuration Settings | a. Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: [Assignment: configuration settings] . b. Identify, document, and app | |
| 03.04.03 | Configuration Change Control | a. Define the types of changes to the system that are configuration-controlled. b. Review proposed configuration-controlled changes to the system, and approve or disapprove such changes with explicit consideration for security impacts. c. I | |
| 03.04.04 | Impact Analyses | a. Analyze changes to the system to determine potential security impacts prior to change implementation. b. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented. | |
| 03.04.05 | Access Restrictions for Change | Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system. | |
| 03.04.06 | Least Functionality | a. Configure the system to provide only mission-essential capabilities. b. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: [Assignment: functions] . c. Review the system [Assignment: frequen | |
| 03.04.07 | 03.04.07 withdrawn | ||
| 03.04.08 | Authorized Software – Allow by Exception | a. Identify software programs authorized to execute on the system. b. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system. c. Review and update the list of authorized software prog | |
| 03.04.09 | 03.04.09 withdrawn | ||
| 03.04.10 | System Component Inventory | a. Develop and document an inventory of system components. b. Review and update the system component inventory [Assignment: frequency]. c. Update the system component inventory as part of installations, removals, and system updates. | |
| 03.04.11 | Information Location | a. Identify and document the location of CUI and the system components on which the information is processed and stored. b. Document changes to the system or system component location where CUI is processed and stored. | |
| 03.04.12 | System and Component Configuration for High-Risk Areas | a. Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [Assignment: configurations]. b. Apply the following security requirements to the systems or components when the indivi | |
| 03.05.01 | User Identification and Authentication | a. Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users. b. Re-authenticate users when [Assignment: circumstances or situations] . | |
| 03.05.02 | Device Identification and Authentication | Uniquely identify and authenticate [Assignment: devices or types of devices] before establishing a system connection. | |
| 03.05.03 | Multi-Factor Authentication | Implement multi-factor authentication for access to privileged and non-privileged accounts. | |
| 03.05.04 | Replay-Resistant Authentication | Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts. | |
| 03.05.05 | Identifier Management | a. Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier. b. Select and assign an identifier that identifies an individual, group, role, service, or device. c. Preve | |
| 03.05.06 | 03.05.06 withdrawn | ||
| 03.05.07 | Password Management | a. Maintain a list of commonly-used, expected, or compromised passwords, and update the list [Assignment: frequency] and when organizational passwords are suspected to have been compromised. b. Verify that passwords are not found on the lis | |
| 03.05.08 | 03.05.08 withdrawn | ||
| 03.05.09 | 03.05.09 withdrawn | ||
| 03.05.10 | 03.05.10 withdrawn | ||
| 03.05.11 | Authentication Feedback | Obscure feedback of authentication information during the authentication process. | |
| 03.05.12 | Authenticator Management | a. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution. b. Establish initial authenticator content for any authenticators issued by the organiz | |
| 03.06.01 | Incident Handling | Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery. | |
| 03.06.02 | Incident Monitoring, Reporting, and Response Assistance | a. Track and document system security incidents. b. Report suspected incidents to the organizational incident response capability within [Assignment: time period]. c. Report incident information to [Assignment: authorities]. d. Provide an i | |
| 03.06.03 | Incident Response Testing | Test the effectiveness of the incident response capability [Assignment: frequency]. | |
| 03.06.04 | Incident Response Training | a. Provide incident response training to system users consistent with assigned roles and responsibilities: a.01. Within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access, a.02. When | |
| 03.06.05 | Incident Response Plan | a. Develop an incident response plan that: a.01. Provides the organization with a roadmap for implementing its incident response capability, a.02. Describes the structure and organization of the incident response capability, a.03. Provides | |
| 03.07.01 | 03.07.01 withdrawn | ||
| 03.07.02 | 03.07.02 withdrawn | ||
| 03.07.03 | 03.07.03 withdrawn | ||
| 03.07.04 | Maintenance Tools | a. Approve, control, and monitor the use of system maintenance tools. b. Check media with diagnostic and test programs for malicious code before it is used in the system. c. Prevent the removal of system maintenance equipment containing CUI | |
| 03.07.05 | Nonlocal Maintenance | a. Approve and monitor nonlocal maintenance and diagnostic activities. b. Implement multi-factor authentication and replay resistance in the establishment of nonlocal maintenance and diagnostic sessions. c. Terminate session and network con | |
| 03.07.06 | Maintenance Personnel | a. Establish a process for maintenance personnel authorization. b. Maintain a list of authorized maintenance organizations or personnel. c. Verify that non-escorted personnel who perform maintenance on the system possess the required access | |
| 03.08.01 | Media Storage | Physically control and securely store system media that contain CUI. | |
| 03.08.02 | Media Access | Restrict access to CUI on system media to authorized personnel or roles. | |
| 03.08.03 | Media Sanitization | Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse. | |
| 03.08.04 | Media Marking | Mark system media that contain CUI to indicate distribution limitations, handling caveats, and applicable CUI markings. | |
| 03.08.05 | Media Transport | a. Protect and control system media that contain CUI during transport outside of controlled areas. b. Maintain accountability of system media that contain CUI during transport outside of controlled areas. c. Document activities associated w | |
| 03.08.06 | 03.08.06 withdrawn | ||
| 03.08.07 | Media Use | a. Restrict or prohibit the use of [Assignment: types of system media]. b. Prohibit the use of removable system media without an identifiable owner. | |
| 03.08.08 | 03.08.08 withdrawn | ||
| 03.08.09 | System Backup – Cryptographic Protection | a. Protect the confidentiality of backup information. b. Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI at backup storage locations. | |
| 03.09.01 | Personnel Screening | a. Screen individuals prior to authorizing access to the system. b. Rescreen individuals in accordance with [Assignment: conditions]. | |
| 03.09.02 | Personnel Termination and Transfer | a. When individual employment is terminated: a.01. Disable system access within [Assignment: time period], a.02. Terminate or revoke authenticators and credentials associated with the individual, and a.03. Retrieve security-related system p | |
| 03.10.01 | Physical Access Authorizations | a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides. b. Issue authorization credentials for facility access. c. Review the facility access list [Assignment: frequency]. d. | |
| 03.10.02 | Monitoring Physical Access | a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. b. Review physical access logs [Assignment: frequency] and upon occurrence of [Assignment: events or potential indicat | |
| 03.10.03 | 03.10.03 withdrawn | ||
| 03.10.04 | 03.10.04 withdrawn | ||
| 03.10.05 | 03.10.05 withdrawn | ||
| 03.10.06 | Alternate Work Site | a. Determine alternate work sites allowed for use by employees. b. Employ the following security requirements at alternate work sites: [Assignment: security requirements]. | |
| 03.10.07 | Physical Access Control | a. Enforce physical access authorizations at entry and exit points to the facility where the system resides by: a.01. Verifying individual physical access authorizations before granting access to the facility and a.02. Controlling ingress a | |
| 03.10.08 | Access Control for Transmission | Control physical access to system distribution and transmission lines within organizational facilities. | |
| 03.11.01 | Risk Assessment | a. Assess the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI. b. Update risk assessments [Assignment: frequency]. | |
| 03.11.02 | Vulnerability Monitoring and Scanning | a. Monitor and scan the system for vulnerabilities [Assignment: frequency] and when new vulnerabilities affecting the system are identified. b. Remediate system vulnerabilities within [Assignment: response times]. c. Update system vulnerabi | |
| 03.11.03 | 03.11.03 withdrawn | ||
| 03.11.04 | Risk Response | Respond to findings from security assessments, monitoring, and audits. | |
| 03.12.01 | Security Assessment | Assess the security requirements for the system and its environment of operation [Assignment: frequency] to determine if the requirements have been satisfied. | |
| 03.12.02 | Plan of Action and Milestones | a. Develop a plan of action and milestones for the system: a.01. To document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments and a.02. To reduce or eliminate known system vulnerabiliti | |
| 03.12.03 | Continuous Monitoring | Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments. | |
| 03.12.04 | 03.12.04 withdrawn | ||
| 03.12.05 | Information Exchange | a. Approve and manage the exchange of CUI between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service-l | |
| 03.13.01 | Boundary Protection | a. Monitor and control communications at external managed interfaces to the system and key internal managed interfaces within the system. b. Implement subnetworks for publicly accessible system components that are physically or logically se | |
| 03.13.02 | 03.13.02 withdrawn | ||
| 03.13.03 | 03.13.03 withdrawn | ||
| 03.13.04 | Information in Shared System Resources | Prevent unauthorized and unintended information transfer via shared system resources. | |
| 03.13.05 | 03.13.05 withdrawn | ||
| 03.13.06 | Network Communications – Deny by Default – Allow by Exception | Deny network communications traffic by default, and allow network communications traffic by exception. | |
| 03.13.07 | 03.13.07 withdrawn | ||
| 03.13.08 | Transmission and Storage Confidentiality | Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI during transmission and while in storage. | |
| 03.13.09 | Network Disconnect | Terminate the network connection associated with a communications session at the end of the session or after [Assignment: time period] of inactivity. | |
| 03.13.10 | Cryptographic Key Establishment and Management | Establish and manage cryptographic keys in the system in accordance with the following key management requirements: [Assignment: requirements]. | |
| 03.13.11 | Cryptographic Protection | Implement the following types of cryptography to protect the confidentiality of CUI: [Assignment: types of cryptography]. | |
| 03.13.12 | Collaborative Computing Devices and Applications | a. Prohibit the remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: exceptions]. b. Provide an explicit indication of use to users physically present at the devices. | |
| 03.13.13 | Mobile Code | a. Define acceptable mobile code and mobile code technologies. b. Authorize, monitor, and control the use of mobile code. | |
| 03.13.14 | 03.13.14 withdrawn | ||
| 03.13.15 | Session Authenticity | Protect the authenticity of communications sessions. | |
| 03.13.16 | 03.13.16 withdrawn | ||
| 03.14.01 | Flaw Remediation | a. Identify, report, and correct system flaws. b. Install security-relevant software and firmware updates within [Assignment: time period] of the release of the updates. | |
| 03.14.02 | Malicious Code Protection | a. Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. b. Update malicious code protection mechanisms as new releases are available in accordance with configuration manageme | |
| 03.14.03 | Security Alerts, Advisories, and Directives | a. Receive system security alerts, advisories, and directives from external organizations on an ongoing basis. b. Generate and disseminate internal system security alerts, advisories, and directives, as necessary. | |
| 03.14.04 | 03.14.04 withdrawn | ||
| 03.14.05 | 03.14.05 withdrawn | ||
| 03.14.06 | System Monitoring | a. Monitor the system to detect: a.01. Attacks and indicators of potential attacks and a.02. Unauthorized connections. b. Identify unauthorized use of the system. c. Monitor inbound and outbound communications traffic to detect unusual or u | |
| 03.14.07 | 03.14.07 withdrawn | ||
| 03.14.08 | Information Management and Retention | Manage and retain CUI within the system and CUI output from the system in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. | |
| 03.15.01 | Policy and Procedures | a. Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for the protection of CUI. b. Review and update policies and procedures [Assignment: frequenc | |
| 03.15.02 | System Security Plan | a. Develop a system security plan that: a.01. Defines the constituent system components; a.02. Identifies the information types processed, stored, and transmitted by the system; a.03. Describes specific threats to the system that are of con | |
| 03.15.03 | Rules of Behavior | a. Establish rules that describe the responsibilities and expected behavior for system usage and protecting CUI. b. Provide rules to individuals who require access to the system. c. Receive a documented acknowledgement from individuals indi | |
| 03.16.01 | Security Engineering Principles | Apply the following systems security engineering principles to the development or modification of the system and system components: [Assignment: systems security engineering principles]. | |
| 03.16.02 | Unsupported System Components | a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. b. Provide options for risk mitigation or alternative sources for continued support for unsupported components | |
| 03.16.03 | External System Services | a. Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security requirements: [Assignment: security requirements]. b. Define and document user roles and res | |
| 03.17.01 | Supply Chain Risk Management Plan | a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of the system, system components, or system ser | |
| 03.17.02 | Acquisition Strategies, Tools, and Methods | Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks. | |
| 03.17.03 | Supply Chain Requirements and Processes | a. Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes. b. Enforce the following security requirements to protect against supply chain risks to the system, system componen |
130 of 130.