3.1.1 Limit system access to authorized users3.1.2 Limit access to permitted transactions and functions3.1.3 Control the flow of CUI3.1.4 Separate duties to reduce malevolent activity3.1.5 Employ the principle of least privilege3.1.6 Use non-privileged accounts for nonsecurity functions3.1.7 Restrict and log privileged function execution3.1.8 Limit unsuccessful logon attempts3.1.9 Provide privacy and security notices3.1.10 Use session lock with pattern-hiding displays3.1.11 Automatically terminate sessions after defined conditions3.1.12 Monitor and control remote access sessions3.1.13 Encrypt remote access sessions3.1.14 Route remote access via managed control points3.1.15 Authorize remote privileged commands and security info3.1.16 Authorize wireless access before connection3.1.17 Protect wireless with authentication and encryption3.1.18 Control connection of mobile devices3.1.19 Encrypt CUI on mobile devices3.1.20 Verify and control external system connections3.1.21 Limit portable storage on external systems3.1.22 Control CUI on publicly accessible systems3.2.1 Make users aware of security risks3.2.2 Train personnel for their security duties3.2.3 Train staff to recognize insider threat3.3.1 Create and retain system audit logs3.3.2 Trace user actions to individual users3.3.3 Review and update logged events3.3.4 Alert on audit logging process failure3.3.5 Correlate audit review, analysis, and reporting3.3.6 Provide audit reduction and report generation3.3.7 Synchronize system clocks to authoritative source3.3.8 Protect audit information and logging tools3.3.9 Limit audit management to privileged subset3.4.1 Maintain baseline configurations and system inventories3.4.2 Enforce security configuration settings3.4.3 Track, review, approve, and log changes3.4.4 Analyze security impact of changes first3.4.5 Define and enforce change access restrictions3.4.6 Configure systems for least functionality3.4.7 Disable nonessential programs, ports, protocols, services3.4.8 Apply deny-by-exception or permit-by-exception software policy3.4.9 Control and monitor user-installed software3.5.1 Identify users, processes, and devices3.5.2 Authenticate users, processes, and devices3.5.3 Use MFA for privileged and network access3.5.4 Use replay-resistant authentication for network access3.5.5 Prevent identifier reuse for defined period3.5.6 Disable identifiers after inactivity3.5.7 Enforce password complexity and character change3.5.8 Prohibit password reuse for set generations3.5.9 Require immediate change of temporary passwords3.5.10 Store and transmit only cryptographically-protected passwords3.5.11 Obscure authentication feedback3.6.1 Establish operational incident-handling capability3.6.2 Track, document, and report incidents3.6.3 Test incident response capability3.7.1 Perform system maintenance3.7.2 Control maintenance tools, techniques, and personnel3.7.3 Sanitize equipment removed for off-site maintenance3.7.4 Scan diagnostic media for malicious code3.7.5 Require MFA for nonlocal maintenance sessions3.7.6 Supervise maintenance personnel lacking access authorization3.8.1 Protect system media containing CUI3.8.2 Limit access to CUI on media3.8.3 Sanitize or destroy media before disposal3.8.4 Mark media with CUI markings3.8.5 Control and account for media in transport3.8.6 Encrypt CUI on digital media in transport3.8.7 Control use of removable media3.8.8 Prohibit portable storage with no identifiable owner3.8.9 Protect confidentiality of backup CUI3.9.1 Screen individuals before granting access3.9.2 Protect systems during terminations and transfers3.10.1 Limit physical access to authorized individuals3.10.2 Protect and monitor the physical facility3.10.3 Escort visitors and monitor visitor activity3.10.4 Maintain audit logs of physical access3.10.5 Control and manage physical access devices3.10.6 Safeguard CUI at alternate work sites3.11.1 Periodically assess organizational risk3.11.2 Scan for vulnerabilities periodically3.11.3 Remediate vulnerabilities per risk assessments3.12.1 Periodically assess security control effectiveness3.12.2 Implement plans of action for deficiencies3.12.3 Monitor security controls on ongoing basis3.12.4 Develop and update system security plans3.13.1 Monitor and protect boundary communications3.13.2 Use secure architecture and engineering principles3.13.3 Separate user and system management functionality3.13.4 Prevent information transfer via shared resources3.13.5 Separate subnetworks for public-facing components3.13.6 Deny network traffic by default3.13.7 Prevent split tunneling for remote devices3.13.8 Encrypt CUI in transmission3.13.9 Terminate idle or ended network connections3.13.10 Establish and manage cryptographic keys3.13.11 Use FIPS-validated cryptography for CUI3.13.12 Block remote activation of collaborative devices3.13.13 Control and monitor mobile code3.13.14 Control and monitor VoIP technologies3.13.15 Protect authenticity of communications sessions3.13.16 Protect confidentiality of CUI at rest3.14.1 Identify, report, and correct system flaws3.14.2 Protect against malicious code3.14.3 Monitor and act on security alerts3.14.4 Update malicious code protection mechanisms3.14.5 Perform periodic and real-time file scans3.14.6 Monitor systems and traffic for attacks3.14.7 Identify unauthorized use of systems
3.1.1 Limit system access to authorized users3.1.2 Limit access to permitted transactions and functions3.1.3 Control the flow of CUI3.1.4 Separate duties to reduce malevolent activity3.1.5 Employ the principle of least privilege3.1.6 Use non-privileged accounts for nonsecurity functions3.1.7 Restrict and log privileged function execution3.1.8 Limit unsuccessful logon attempts3.1.9 Provide privacy and security notices3.1.10 Use session lock with pattern-hiding displays3.1.11 Automatically terminate sessions after defined conditions3.1.12 Monitor and control remote access sessions3.1.13 Encrypt remote access sessions3.1.14 Route remote access via managed control points3.1.15 Authorize remote privileged commands and security info3.1.16 Authorize wireless access before connection3.1.17 Protect wireless with authentication and encryption3.1.18 Control connection of mobile devices3.1.19 Encrypt CUI on mobile devices3.1.20 Verify and control external system connections3.1.21 Limit portable storage on external systems3.1.22 Control CUI on publicly accessible systems3.2.1 Make users aware of security risks3.2.2 Train personnel for their security duties3.2.3 Train staff to recognize insider threat3.3.1 Create and retain system audit logs3.3.2 Trace user actions to individual users3.3.3 Review and update logged events3.3.4 Alert on audit logging process failure3.3.5 Correlate audit review, analysis, and reporting3.3.6 Provide audit reduction and report generation3.3.7 Synchronize system clocks to authoritative source3.3.8 Protect audit information and logging tools3.3.9 Limit audit management to privileged subset3.4.1 Maintain baseline configurations and system inventories3.4.2 Enforce security configuration settings3.4.3 Track, review, approve, and log changes3.4.4 Analyze security impact of changes first3.4.5 Define and enforce change access restrictions3.4.6 Configure systems for least functionality3.4.7 Disable nonessential programs, ports, protocols, services3.4.8 Apply deny-by-exception or permit-by-exception software policy3.4.9 Control and monitor user-installed software3.5.1 Identify users, processes, and devices3.5.2 Authenticate users, processes, and devices3.5.3 Use MFA for privileged and network access3.5.4 Use replay-resistant authentication for network access3.5.5 Prevent identifier reuse for defined period3.5.6 Disable identifiers after inactivity3.5.7 Enforce password complexity and character change3.5.8 Prohibit password reuse for set generations3.5.9 Require immediate change of temporary passwords3.5.10 Store and transmit only cryptographically-protected passwords3.5.11 Obscure authentication feedback3.6.1 Establish operational incident-handling capability3.6.2 Track, document, and report incidents3.6.3 Test incident response capability3.7.1 Perform system maintenance3.7.2 Control maintenance tools, techniques, and personnel3.7.3 Sanitize equipment removed for off-site maintenance3.7.4 Scan diagnostic media for malicious code3.7.5 Require MFA for nonlocal maintenance sessions3.7.6 Supervise maintenance personnel lacking access authorization3.8.1 Protect system media containing CUI3.8.2 Limit access to CUI on media3.8.3 Sanitize or destroy media before disposal3.8.4 Mark media with CUI markings3.8.5 Control and account for media in transport3.8.6 Encrypt CUI on digital media in transport3.8.7 Control use of removable media3.8.8 Prohibit portable storage with no identifiable owner3.8.9 Protect confidentiality of backup CUI3.9.1 Screen individuals before granting access3.9.2 Protect systems during terminations and transfers3.10.1 Limit physical access to authorized individuals3.10.2 Protect and monitor the physical facility3.10.3 Escort visitors and monitor visitor activity3.10.4 Maintain audit logs of physical access3.10.5 Control and manage physical access devices3.10.6 Safeguard CUI at alternate work sites3.11.1 Periodically assess organizational risk3.11.2 Scan for vulnerabilities periodically3.11.3 Remediate vulnerabilities per risk assessments3.12.1 Periodically assess security control effectiveness3.12.2 Implement plans of action for deficiencies3.12.3 Monitor security controls on ongoing basis3.12.4 Develop and update system security plans3.13.1 Monitor and protect boundary communications3.13.2 Use secure architecture and engineering principles3.13.3 Separate user and system management functionality3.13.4 Prevent information transfer via shared resources3.13.5 Separate subnetworks for public-facing components3.13.6 Deny network traffic by default3.13.7 Prevent split tunneling for remote devices3.13.8 Encrypt CUI in transmission3.13.9 Terminate idle or ended network connections3.13.10 Establish and manage cryptographic keys3.13.11 Use FIPS-validated cryptography for CUI3.13.12 Block remote activation of collaborative devices3.13.13 Control and monitor mobile code3.13.14 Control and monitor VoIP technologies3.13.15 Protect authenticity of communications sessions3.13.16 Protect confidentiality of CUI at rest3.14.1 Identify, report, and correct system flaws3.14.2 Protect against malicious code3.14.3 Monitor and act on security alerts3.14.4 Update malicious code protection mechanisms3.14.5 Perform periodic and real-time file scans3.14.6 Monitor systems and traffic for attacks3.14.7 Identify unauthorized use of systems
