NIST SP 800-171 Rev 3

Define the types of system accounts allowed and prohibited. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria. Specify: Authorized users of the system, Group and role membership, and Access authorizations (i.e., privileges) for each account. Authorize access to the system based on: A valid access authorization and Intended system usage. Monitor the use of system accounts. Disable system accounts when: The accounts have expired, The accounts have been inactive for [Assignment: organization-defined], The accounts are no longer associated with a user or individual, The accounts are in violation of organizational policy, or Significant risks associated with individuals are discovered. Notify account managers and designated personnel or roles within: [Assignment: organization-defined] when accounts are no longer required. [Assignment: organization-defined] when users are terminated or transferred. [Assignment: organization-defined] when system usage or the need-to-know changes for an individual. Require that users log out of the system after [Assignment: organization-defined] of expected inactivity or when [Assignment: organization-defined].

Enforce approved authorizations for logical access to CUI and system resources in accordance with applicable access control policies.

Enforce approved authorizations for controlling the flow of CUI within the system and between connected systems.

Identify the duties of individuals requiring separation. Define system access authorizations to support separation of duties.

Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks. Authorize access to [Assignment: organization-defined] and [Assignment: organization-defined]. Review the privileges assigned to roles or classes of users [Assignment: organization-defined] to validate the need for such privileges. Reassign or remove privileges, as necessary.

Restrict privileged accounts on the system to [Assignment: organization-defined].. Require that users (or roles) with privileged accounts use non-privileged accounts when accessing non-security functions or non-security information.

Prevent non-privileged users from executing privileged functions. Log the execution of privileged functions.

Enforce a limit of [Assignment: organization-defined] consecutive invalid logon attempts by a user during a [Assignment: organization-defined]. Automatically [Assignment: organization-defined] when the maximum number of unsuccessful attempts is exceeded.

Display a system use notification message with privacy and security notices consistent with applicable CUI rules before granting access to the system.

Prevent access to the system by [Assignment: organization-defined]. Retain the device lock until the user reestablishes access using established identification and authentication procedures. Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Terminate a user session automatically after [Assignment: organization-defined].

Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access. Authorize each type of remote system access prior to establishing such connections. Route remote access to the system through authorized and managed access control points. Authorize the remote execution of privileged commands and remote access to security-relevant information.

Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system. Authorize each type of wireless access to the system prior to establishing such connections. Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment. Protect wireless access to the system using authentication and encryption.

Establish usage restrictions, configuration requirements, and connection requirements for mobile devices. Authorize the connection of mobile devices to the system. Implement full-device or container-based encryption to protect the confidentiality of CUI on mobile devices.

Prohibit the use of external systems unless the systems are specifically authorized. Establish the following security requirements to be satisfied on external systems prior to allowing use of or access to those systems by authorized individuals: [Assignment: organization-defined]. Permit authorized individuals to use external systems to access the organizational system or to process, store, or transmit CUI only after: Verifying that the security requirements on the external systems as specified in the organization’s system security plans have been satisfied and Retaining approved system connection or processing agreements with the organizational entities hosting the external systems. Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems.

Train authorized individuals to ensure that publicly accessible information does not contain CUI. Review the content on publicly accessible systems for CUI and remove such information, if discovered.

Provide security literacy training to system users: As part of initial training for new users and [Assignment: organization-defined] thereafter, When required by system changes or following [Assignment: organization-defined], and On recognizing and reporting indicators of insider threat, social engineering, and social mining. Update security literacy training content [Assignment: organization-defined] and following [Assignment: organization-defined].

Provide role-based security training to organizational personnel: Before authorizing access to the system or CUI, before performing assigned duties, and [Assignment: organization-defined] thereafter When required by system changes or following [Assignment: organization-defined]. Update role-based training content [Assignment: organization-defined] and following [Assignment: organization-defined].

Specify the following event types selected for logging within the system: [Assignment: organization-defined]. Review and update the event types selected for logging [Assignment: organization-defined].

Include the following content in audit records: What type of event occurred When the event occurred Where the event occurred Source of the event Outcome of the event Identity of the individuals, subjects, objects, or entities associated with the event Provide additional information for audit records as needed.

Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02. Retain audit records for a time period consistent with the records retention policy.

Alert organizational personnel or roles within [Assignment: organization-defined] in the event of an audit logging process failure. Take the following additional actions: [Assignment: organization-defined].

Review and analyze system audit records [Assignment: organization-defined] for indications and the potential impact of inappropriate or unusual activity. Report findings to organizational personnel or roles. Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents. Preserve the original content and time ordering of audit records.

Use internal system clocks to generate time stamps for audit records. Record time stamps for audit records that meet [Assignment: organization-defined] and that use Coordinated Universal Time (UTC), have a fixed local time offset from UTC, or include the local time offset as part of the time stamp.

Protect audit information and audit logging tools from unauthorized access, modification, and deletion. Authorize access to management of audit logging functionality to only a subset of privileged users or roles.

Develop and maintain under configuration control, a current baseline configuration of the system. Review and update the baseline configuration of the system [Assignment: organization-defined] and when system components are installed or modified.

Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: [Assignment: organization-defined] . Identify, document, and approve any deviations from established configuration settings.

Define the types of changes to the system that are configuration-controlled. Review proposed configuration-controlled changes to the system, and approve or disapprove such changes with explicit consideration for security impacts. Implement and document approved configuration-controlled changes to the system. Monitor and review activities associated with configuration-controlled changes to the system.

Analyze changes to the system to determine potential security impacts prior to change implementation. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented.

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Configure the system to provide only mission-essential capabilities. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: [Assignment: organization-defined] . Review the system [Assignment: organization-defined] to identify unnecessary or nonsecure functions, ports, protocols, connections, and services. Disable or remove functions, ports, protocols, connections, and services that are unnecessary or nonsecure.

Identify software programs authorized to execute on the system. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system. Review and update the list of authorized software programs [Assignment: organization-defined].

Develop and document an inventory of system components. Review and update the system component inventory [Assignment: organization-defined]. Update the system component inventory as part of installations, removals, and system updates.

Identify and document the location of CUI and the system components on which the information is processed and stored. Document changes to the system or system component location where CUI is processed and stored.

Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [Assignment: organization-defined]. Apply the following security requirements to the systems or components when the individuals return from travel: [Assignment: organization-defined].

Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users. Re-authenticate users when [Assignment: organization-defined] .

Uniquely identify and authenticate [Assignment: organization-defined] before establishing a system connection.

Implement multi-factor authentication for access to privileged and non-privileged accounts.

Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.

Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier. Select and assign an identifier that identifies an individual, group, role, service, or device. Prevent the reuse of identifiers for [Assignment: organization-defined]. Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined].

Maintain a list of commonly-used, expected, or compromised passwords, and update the list [Assignment: organization-defined] and when organizational passwords are suspected to have been compromised. Verify that passwords are not found on the list of commonly used, expected, or compromised passwords when users create or update passwords. Transmit passwords only over cryptographically protected channels. Store passwords in a cryptographically protected form. Select a new password upon first use after account recovery. Enforce the following composition and complexity rules for passwords: [Assignment: organization-defined].

Obscure feedback of authentication information during the authentication process.

Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution. Establish initial authenticator content for any authenticators issued by the organization. Establish and implement administrative procedures for initial authenticator distribution; for lost, compromised, or damaged authenticators; and for revoking authenticators. Change default authenticators at first use. Change or refresh authenticators [Assignment: organization-defined] or when the following events occur: [Assignment: organization-defined]. Protect authenticator content from unauthorized disclosure and modification.

Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.

Track and document system security incidents. Report suspected incidents to the organizational incident response capability within [Assignment: organization-defined]. Report incident information to [Assignment: organization-defined]. Provide an incident response support resource that offers advice and assistance to system users on handling and reporting incidents.

Test the effectiveness of the incident response capability [Assignment: organization-defined].

Provide incident response training to system users consistent with assigned roles and responsibilities: Within [Assignment: organization-defined] of assuming an incident response role or responsibility or acquiring system access, When required by system changes, and [Assignment: organization-defined] thereafter. Review and update incident response training content [Assignment: organization-defined] and following [Assignment: organization-defined].

Develop an incident response plan that: Provides the organization with a roadmap for implementing its incident response capability, Describes the structure and organization of the incident response capability, Provides a high-level approach for how the incident response capability fits into the overall organization, Defines reportable incidents, Addresses the sharing of incident information, and Designates responsibilities to organizational entities, personnel, or roles. Distribute copies of the incident response plan to designated incident response personnel (identified by name and/or by role) and organizational elements. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing. Protect the incident response plan from unauthorized disclosure.

Approve, control, and monitor the use of system maintenance tools. Check media with diagnostic and test programs for malicious code before it is used in the system. Prevent the removal of system maintenance equipment containing CUI by verifying that there is no CUI on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.

Approve and monitor nonlocal maintenance and diagnostic activities. Implement multi-factor authentication and replay resistance in the establishment of nonlocal maintenance and diagnostic sessions. Terminate session and network connections when nonlocal maintenance is completed.

Establish a process for maintenance personnel authorization. Maintain a list of authorized maintenance organizations or personnel. Verify that non-escorted personnel who perform maintenance on the system possess the required access authorizations. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

Physically control and securely store system media that contain CUI.

Restrict access to CUI on system media to authorized personnel or roles.

Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse.

Mark system media that contain CUI to indicate distribution limitations, handling caveats, and applicable CUI markings.

Protect and control system media that contain CUI during transport outside of controlled areas. Maintain accountability of system media that contain CUI during transport outside of controlled areas. Document activities associated with the transport of system media that contain CUI.

Restrict or prohibit the use of [Assignment: organization-defined]. Prohibit the use of removable system media without an identifiable owner.

Protect the confidentiality of backup information. Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI at backup storage locations.

Screen individuals prior to authorizing access to the system. Rescreen individuals in accordance with [Assignment: organization-defined].

When individual employment is terminated: Disable system access within [Assignment: organization-defined], Terminate or revoke authenticators and credentials associated with the individual, and Retrieve security-related system property. When individuals are reassigned or transferred to other positions in the organization: Review and confirm the ongoing operational need for current logical and physical access authorizations to the system and facility, and Modify access authorization to correspond with any changes in operational need.

Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides. Issue authorization credentials for facility access. Review the facility access list [Assignment: organization-defined]. Remove individuals from the facility access list when access is no longer required.

Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. Review physical access logs [Assignment: organization-defined] and upon occurrence of [Assignment: organization-defined].

Determine alternate work sites allowed for use by employees. Employ the following security requirements at alternate work sites: [Assignment: organization-defined].

Enforce physical access authorizations at entry and exit points to the facility where the system resides by: Verifying individual physical access authorizations before granting access to the facility and Controlling ingress and egress with physical access control systems, devices, or guards. Maintain physical access audit logs for entry or exit points. Escort visitors, and control visitor activity. Secure keys, combinations, and other physical access devices. Control physical access to output devices to prevent unauthorized individuals from obtaining access to CUI.

Control physical access to system distribution and transmission lines within organizational facilities.

Assess the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI. Update risk assessments [Assignment: organization-defined].

Monitor and scan the system for vulnerabilities [Assignment: organization-defined] and when new vulnerabilities affecting the system are identified. Remediate system vulnerabilities within [Assignment: organization-defined]. Update system vulnerabilities to be scanned [Assignment: organization-defined] and when new vulnerabilities are identified and reported.

Respond to findings from security assessments, monitoring, and audits.

Assess the security requirements for the system and its environment of operation [Assignment: organization-defined] to determine if the requirements have been satisfied.

Develop a plan of action and milestones for the system: To document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments and To reduce or eliminate known system vulnerabilities. Update the existing plan of action and milestones based on the findings from: Security assessments, Audits or reviews, and Continuous monitoring activities.

Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.

Approve and manage the exchange of CUI between the system and other systems using [Assignment: organization-defined]. Document interface characteristics, security requirements, and responsibilities for each system as part of the exchange agreements. Review and update the exchange agreements [Assignment: organization-defined].

Monitor and control communications at external managed interfaces to the system and key internal managed interfaces within the system. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. Connect to external systems only through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.

Prevent unauthorized and unintended information transfer via shared system resources.

Deny network communications traffic by default, and allow network communications traffic by exception.

Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI during transmission and while in storage.

Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined] of inactivity.

Establish and manage cryptographic keys in the system in accordance with the following key management requirements: [Assignment: organization-defined].

Implement the following types of cryptography to protect the confidentiality of CUI: [Assignment: organization-defined].

Prohibit the remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined]. Provide an explicit indication of use to users physically present at the devices.

Define acceptable mobile code and mobile code technologies. Authorize, monitor, and control the use of mobile code.

Protect the authenticity of communications sessions.

Identify, report, and correct system flaws. Install security-relevant software and firmware updates within [Assignment: organization-defined] of the release of the updates.

Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. Update malicious code protection mechanisms as new releases are available in accordance with configuration management policies and procedures. Configure malicious code protection mechanisms to: Perform scans of the system [Assignment: organization-defined] and real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed; and Block malicious code, quarantine malicious code, or take other mitigation actions in response to malicious code detection.

Receive system security alerts, advisories, and directives from external organizations on an ongoing basis. Generate and disseminate internal system security alerts, advisories, and directives, as necessary.

Monitor the system to detect: Attacks and indicators of potential attacks and Unauthorized connections. Identify unauthorized use of the system. Monitor inbound and outbound communications traffic to detect unusual or unauthorized activities or conditions.

Manage and retain CUI within the system and CUI output from the system in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for the protection of CUI. Review and update policies and procedures [Assignment: organization-defined].

Develop a system security plan that: Defines the constituent system components; Identifies the information types processed, stored, and transmitted by the system; Describes specific threats to the system that are of concern to the organization; Describes the operational environment for the system and any dependencies on or connections to other systems or system components; Provides an overview of the security requirements for the system; Describes the safeguards in place or planned for meeting the security requirements; Identifies individuals that fulfill system roles and responsibilities; and Includes other relevant information necessary for the protection of CUI. Review and update the system security plan [Assignment: organization-defined]. Protect the system security plan from unauthorized disclosure.

Establish rules that describe the responsibilities and expected behavior for system usage and protecting CUI. Provide rules to individuals who require access to the system. Receive a documented acknowledgement from individuals indicating that they have read, understand, and agree to abide by the rules of behavior before authorizing access to CUI and the system. Review and update the rules of behavior [Assignment: organization-defined].

Apply the following systems security engineering principles to the development or modification of the system and system components: [Assignment: organization-defined].

Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. Provide options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced.

Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security requirements: [Assignment: organization-defined]. Define and document user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers. Implement processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis.

Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of the system, system components, or system services. Review and update the supply chain risk management plan [Assignment: organization-defined]. Protect the supply chain risk management plan from unauthorized disclosure.

Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks.

Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes. Enforce the following security requirements to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences from supply chain-related events: [Assignment: organization-defined].