BaselineWatch
130 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST SP 800-171 Rev 3 (CUI; CMMC Level 2) OSCAL 1.1.0

130 requirements · published 2026-10-22
Changes in this version
All03.01 Access Control03.02 Awareness and Training03.03 Audit and Accountability03.04 Configuration Management03.05 Identification and Authentication03.06 Incident Response03.07 Maintenance03.08 Media Protection03.09 Personnel Security03.10 Physical Protection03.11 Risk Assessment03.12 Security Assessment and Monitoring03.13 System and Communications Protection03.14 System and Information Integrity03.15 Planning03.16 System and Services Acquisition03.17 Supply Chain Risk Management
RefTitleText
03.05.01 User Identification and Authentication a. Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users. b. Re-authenticate users when [Assignment: circumstances or situations] .
03.05.02 Device Identification and Authentication Uniquely identify and authenticate [Assignment: devices or types of devices] before establishing a system connection.
03.05.03 Multi-Factor Authentication Implement multi-factor authentication for access to privileged and non-privileged accounts.
03.05.04 Replay-Resistant Authentication Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.
03.05.05 Identifier Management a. Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier. b. Select and assign an identifier that identifies an individual, group, role, service, or device. c. Preve
03.05.06 03.05.06 withdrawn
03.05.07 Password Management a. Maintain a list of commonly-used, expected, or compromised passwords, and update the list [Assignment: frequency] and when organizational passwords are suspected to have been compromised. b. Verify that passwords are not found on the lis
03.05.08 03.05.08 withdrawn
03.05.09 03.05.09 withdrawn
03.05.10 03.05.10 withdrawn
03.05.11 Authentication Feedback Obscure feedback of authentication information during the authentication process.
03.05.12 Authenticator Management a. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution. b. Establish initial authenticator content for any authenticators issued by the organiz

12 of 130.