BaselineWatch
130 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST SP 800-171 Rev 3 (CUI; CMMC Level 2) OSCAL 1.1.0

130 requirements · published 2026-10-22
Changes in this version
All03.01 Access Control03.02 Awareness and Training03.03 Audit and Accountability03.04 Configuration Management03.05 Identification and Authentication03.06 Incident Response03.07 Maintenance03.08 Media Protection03.09 Personnel Security03.10 Physical Protection03.11 Risk Assessment03.12 Security Assessment and Monitoring03.13 System and Communications Protection03.14 System and Information Integrity03.15 Planning03.16 System and Services Acquisition03.17 Supply Chain Risk Management
RefTitleText
03.04.01 Baseline Configuration a. Develop and maintain under configuration control, a current baseline configuration of the system. b. Review and update the baseline configuration of the system [Assignment: frequency] and when system components are installed or modified.
03.04.02 Configuration Settings a. Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: [Assignment: configuration settings] . b. Identify, document, and app
03.04.03 Configuration Change Control a. Define the types of changes to the system that are configuration-controlled. b. Review proposed configuration-controlled changes to the system, and approve or disapprove such changes with explicit consideration for security impacts. c. I
03.04.04 Impact Analyses a. Analyze changes to the system to determine potential security impacts prior to change implementation. b. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented.
03.04.05 Access Restrictions for Change Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.
03.04.06 Least Functionality a. Configure the system to provide only mission-essential capabilities. b. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: [Assignment: functions] . c. Review the system [Assignment: frequen
03.04.07 03.04.07 withdrawn
03.04.08 Authorized Software – Allow by Exception a. Identify software programs authorized to execute on the system. b. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system. c. Review and update the list of authorized software prog
03.04.09 03.04.09 withdrawn
03.04.10 System Component Inventory a. Develop and document an inventory of system components. b. Review and update the system component inventory [Assignment: frequency]. c. Update the system component inventory as part of installations, removals, and system updates.
03.04.11 Information Location a. Identify and document the location of CUI and the system components on which the information is processed and stored. b. Document changes to the system or system component location where CUI is processed and stored.
03.04.12 System and Component Configuration for High-Risk Areas a. Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [Assignment: configurations]. b. Apply the following security requirements to the systems or components when the indivi

12 of 130.