NIST SP 800-171 Rev 3 (CUI; CMMC Level 2) OSCAL 1.1.0
All03.01 Access Control03.02 Awareness and Training03.03 Audit and Accountability03.04 Configuration Management03.05 Identification and Authentication03.06 Incident Response03.07 Maintenance03.08 Media Protection03.09 Personnel Security03.10 Physical Protection03.11 Risk Assessment03.12 Security Assessment and Monitoring03.13 System and Communications Protection03.14 System and Information Integrity03.15 Planning03.16 System and Services Acquisition03.17 Supply Chain Risk Management
| Ref | Title | Text | |
|---|---|---|---|
| 03.12.01 | Security Assessment | Assess the security requirements for the system and its environment of operation [Assignment: frequency] to determine if the requirements have been satisfied. | |
| 03.12.02 | Plan of Action and Milestones | a. Develop a plan of action and milestones for the system: a.01. To document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments and a.02. To reduce or eliminate known system vulnerabiliti | |
| 03.12.03 | Continuous Monitoring | Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments. | |
| 03.12.04 | 03.12.04 withdrawn | ||
| 03.12.05 | Information Exchange | a. Approve and manage the exchange of CUI between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service-l |
5 of 130.