Showing 97 controls
Account Management
a. Define the types of system accounts allowed and prohibited. b. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria. c. Spe...
Access Enforcement
Enforce approved authorizations for logical access to CUI and system resources in accordance with applicable access control policies.
Information Flow Enforcement
Enforce approved authorizations for controlling the flow of CUI within the system and between connected systems.
Separation of Duties
a. Identify the duties of individuals requiring separation. b. Define system access authorizations to support separation of duties.
Least Privilege
a. Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks. b. Authorize access to [Assignment: organizatio...
Least Privilege – Privileged Accounts
a. Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles]. b. Require that users (or roles) with privileged accounts use non-privileged accounts when acces...
Least Privilege – Privileged Functions
a. Prevent non-privileged users from executing privileged functions. b. Log the execution of privileged functions.
Unsuccessful Logon Attempts
a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]. b. Automatically [Selection (one o...
System Use Notification
Display a system use notification message with privacy and security notices consistent with applicable CUI rules before granting access to the system.
Device Lock
a. Prevent access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock b...
Session Termination
Terminate a user session automatically after [Assignment: organization-defined conditions or trigger events requiring session disconnect].
Remote Access
a. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access. b. Authorize each type of remote system access prior to establ...
Wireless Access
a. Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system. b. Authorize each type of wireless access to the system prior t...
Access Control for Mobile Devices
a. Establish usage restrictions, configuration requirements, and connection requirements for mobile devices. b. Authorize the connection of mobile devices to the system. c. Implement full-device or co...
Use of External Systems
a. Prohibit the use of external systems unless the systems are specifically authorized. b. Establish the following security requirements to be satisfied on external systems prior to allowing use of or...
Publicly Accessible Content
a. Train authorized individuals to ensure that publicly accessible information does not contain CUI. b. Review the content on publicly accessible systems for CUI and remove such information, if discov...
Event Logging
a. Specify the following event types selected for logging within the system: [Assignment: organization-defined event types]. b. Review and update the event types selected for logging [Assignment: orga...
Audit Record Content
a. Include the following content in audit records: 1. What type of event occurred 2. When the event occurred 3. Where the event occurred 4. Source of the event 5. Outcome of the event 6. Identity of...
Audit Record Generation
a. Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02. b. Retain audit records for a time period consistent with the records retention poli...
Response to Audit Logging Process Failures
a. Alert organizational personnel or roles within [Assignment: organization-defined time period] in the event of an audit logging process failure. b. Take the following additional actions: [Assignment...
Audit Record Review, Analysis, and Reporting
a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications and the potential impact of inappropriate or unusual activity. b. Report findings to organizatio...
Audit Record Reduction and Report Generation
a. Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents. b. Preserve...
Time Stamps
a. Use internal system clocks to generate time stamps for audit records. b. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that u...
Protection of Audit Information
a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion. b. Authorize access to management of audit logging functionality to only a subset of privileg...
Literacy Training and Awareness
a. Provide security literacy training to system users: 1. As part of initial training for new users and [Assignment: organization-defined frequency] thereafter, 2. When required by system changes or f...
Role-Based Training
a. Provide role-based security training to organizational personnel: 1. Before authorizing access to the system or CUI, before performing assigned duties, and [Assignment: organization-defined frequen...
Baseline Configuration
a. Develop and maintain under configuration control, a current baseline configuration of the system. b. Review and update the baseline configuration of the system [Assignment: organization-defined fre...
Configuration Settings
a. Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: [Assignment: organization-def...
Configuration Change Control
a. Define the types of changes to the system that are configuration-controlled. b. Review proposed configuration-controlled changes to the system, and approve or disapprove such changes with explicit...
Impact Analyses
a. Analyze changes to the system to determine potential security impacts prior to change implementation. b. Verify that the security requirements for the system continue to be satisfied after the syst...
Access Restrictions for Change
Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.
Least Functionality
a. Configure the system to provide only mission-essential capabilities. b. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: [Assignment: organization-d...
Authorized Software – Allow by Exception
a. Identify software programs authorized to execute on the system. b. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system. c. Review and upd...
System Component Inventory
a. Develop and document an inventory of system components. b. Review and update the system component inventory [Assignment: organization-defined frequency]. c. Update the system component inventory as...
Information Location
a. Identify and document the location of CUI and the system components on which the information is processed and stored. b. Document changes to the system or system component location where CUI is pro...
System and Component Configuration for High-Risk Areas
a. Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [Assignment: organization-defined system configurations]. b. Apply the followin...
User Identification, Authentication, and Re-Authentication
a. Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users. b. Re-authenticate users when [Assignment: organization-def...
Device Identification and Authentication
Uniquely identify and authenticate [Assignment: organization-defined devices or types of devices] before establishing a system connection.
Multi-Factor Authentication
Implement multi-factor authentication for access to privileged and non-privileged accounts.
Replay-Resistant Authentication
Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.
Identifier Management
a. Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier. b. Select and assign an identifier that identifies an individual, g...
Password Management
a. Maintain a list of commonly-used, expected, or compromised passwords, and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been c...
Authentication Feedback
Obscure feedback of authentication information during the authentication process.
Authenticator Management
a. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution. b. Establish initial authenticator content for...
Incident Handling
Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.
Incident Monitoring, Reporting, and Response Assistance
a. Track and document system security incidents. b. Report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]. c. Report inci...
Incident Response Testing
Test the effectiveness of the incident response capability [Assignment: organization-defined frequency].
Incident Response Training
a. Provide incident response training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: organization-defined time period] of assuming an incident response rol...
Incident Response Plan
a. Develop an incident response plan that: 1. Provides the organization with a roadmap for implementing its incident response capability, 2. Describes the structure and organization of the incident re...
Maintenance Tools
a. Approve, control, and monitor the use of system maintenance tools. b. Check media with diagnostic and test programs for malicious code before it is used in the system. c. Prevent the removal of sys...
Nonlocal Maintenance
a. Approve and monitor nonlocal maintenance and diagnostic activities. b. Implement multi-factor authentication and replay resistance in the establishment of nonlocal maintenance and diagnostic sessio...
Maintenance Personnel
a. Establish a process for maintenance personnel authorization. b. Maintain a list of authorized maintenance organizations or personnel. c. Verify that non-escorted personnel who perform maintenance o...
Media Storage
Physically control and securely store system media that contain CUI.
Media Access
Restrict access to CUI on system media to authorized personnel or roles.
Media Sanitization
Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse.
Media Marking
Mark system media that contain CUI to indicate distribution limitations, handling caveats, and applicable CUI markings.
Media Transport
a. Protect and control system media that contain CUI during transport outside of controlled areas. b. Maintain accountability of system media that contain CUI during transport outside of controlled ar...
Media Use
a. Restrict or prohibit the use of [Assignment: organization-defined types of system media]. b. Prohibit the use of removable system media without an identifiable owner.
System Backup – Cryptographic Protection
a. Protect the confidentiality of backup information. b. Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI at backup storage locations.
Personnel Screening
a. Screen individuals prior to authorizing access to the system. b. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening].
Personnel Termination and Transfer
a. When individual employment is terminated: 1. Disable system access within [Assignment: organization-defined time period], 2. Terminate or revoke authenticators and credentials associated with the i...
Physical Access Authorizations
a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides. b. Issue authorization credentials for facility access. c. Review the facility...
Monitoring Physical Access
a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. b. Review physical access logs [Assignment: organization-defined frequency] an...
Alternate Work Site
a. Determine alternate work sites allowed for use by employees. b. Employ the following security requirements at alternate work sites: [Assignment: organization-defined security requirements].
Physical Access Control
a. Enforce physical access authorizations at entry and exit points to the facility where the system resides by: 1. Verifying individual physical access authorizations before granting access to the fac...
Access Control for Transmission
Control physical access to system distribution and transmission lines within organizational facilities.
Policy and Procedures
a. Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for the protection of CUI. b. Review and update polic...
System Security Plan
a. Develop a system security plan that: 1. Defines the constituent system components; 2. Identifies the information types processed, stored, and transmitted by the system; 3. Describes specific threat...
Rules of Behavior
a. Establish rules that describe the responsibilities and expected behavior for system usage and protecting CUI. b. Provide rules to individuals who require access to the system. c. Receive a document...
Risk Assessment
a. Assess the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI. b. Update risk assessments [Assignment: organization-define...
Vulnerability Monitoring and Scanning
a. Monitor and scan the system for vulnerabilities [Assignment: organization-defined frequency] and when new vulnerabilities affecting the system are identified. b. Remediate system vulnerabilities wi...
Risk Response
Respond to findings from security assessments, monitoring, and audits.
Security Assessment
Assess the security requirements for the system and its environment of operation [Assignment: organization-defined frequency] to determine if the requirements have been satisfied.
Plan of Action and Milestones
a. Develop a plan of action and milestones for the system: 1. To document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments and 2. To reduce or el...
Continuous Monitoring
Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.
Information Exchange
a. Approve and manage the exchange of CUI between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda...
Supply Chain Risk Management Plan
a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of the...
Acquisition Strategies, Tools, and Methods
Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks.
Supply Chain Requirements and Processes
a. Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes. b. Enforce the following security requirements to protect against supply ch...
Boundary Protection
a. Monitor and control communications at external managed interfaces to the system and key internal managed interfaces within the system. b. Implement subnetworks for publicly accessible system compon...
Information in Shared System Resources
Prevent unauthorized and unintended information transfer via shared system resources.
Network Communications – Deny by Default – Allow by Exception
Deny network communications traffic by default, and allow network communications traffic by exception.
Transmission and Storage Confidentiality
Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI during transmission and while in storage.
Network Disconnect
Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity.
Cryptographic Key Establishment and Management
Establish and manage cryptographic keys in the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, sto...
Cryptographic Protection
Implement the following types of cryptography to protect the confidentiality of CUI: [Assignment: organization-defined types of cryptography].
Collaborative Computing Devices and Applications
a. Prohibit the remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allow...
Mobile Code
a. Define acceptable mobile code and mobile code technologies. b. Authorize, monitor, and control the use of mobile code.
Session Authenticity
Protect the authenticity of communications sessions.
Flaw Remediation
a. Identify, report, and correct system flaws. b. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates.
Malicious Code Protection
a. Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. b. Update malicious code protection mechanisms as new releases are available i...
Security Alerts, Advisories, and Directives
a. Receive system security alerts, advisories, and directives from external organizations on an ongoing basis. b. Generate and disseminate internal system security alerts, advisories, and directives,...
System Monitoring
a. Monitor the system to detect: 1. Attacks and indicators of potential attacks and 2. Unauthorized connections. b. Identify unauthorized use of the system. c. Monitor inbound and outbound communicati...
Information Management and Retention
Manage and retain CUI within the system and CUI output from the system in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational r...
Security Engineering Principles
Apply the following systems security engineering principles to the development or modification of the system and system components: [Assignment: organization-defined systems security engineering princ...
Unsupported System Components
a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. b. Provide options for risk mitigation or alternative sources for conti...
External System Services
a. Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security requirements: [Assignment: organization-defined secu...