NIST SP 800-171 · Rev 3Reference standard · cross-referenced from CMMC
Protecting CUI in Nonfederal Systems (Revision 3)
A reference standard cross-referenced from CMMC. Open any requirement to see the CMMC practices it supports and its related controls in the other standards.
Numbers, titles and cross-references are public. Sign in or create a free account to read the control text.
130 requirements · View source ↗
03.01.01Account Management03.01.02Access Enforcement03.01.03Information Flow Enforcement03.01.04Separation of Duties03.01.05Least Privilege03.01.06Least Privilege – Privileged Accounts03.01.07Least Privilege – Privileged Functions03.01.08Unsuccessful Logon Attempts03.01.09System Use Notification03.01.10Device Lock03.01.11Session Termination03.01.12Remote Access03.01.13Requirement text — sign in to readwithdrawn03.01.16Wireless Access03.01.14Requirement text — sign in to readwithdrawn03.01.18Access Control for Mobile Devices03.01.15Requirement text — sign in to readwithdrawn03.01.20Use of External Systems03.01.22Publicly Accessible Content03.01.17Requirement text — sign in to readwithdrawn03.02.01Literacy Training and Awareness03.02.02Role-Based Training03.01.19Requirement text — sign in to readwithdrawn03.03.01Event Logging03.03.02Audit Record Content03.01.21Requirement text — sign in to readwithdrawn03.03.03Audit Record Generation03.03.04Response to Audit Logging Process Failures03.03.05Audit Record Review, Analysis, and Reporting03.03.06Audit Record Reduction and Report Generation03.02.03Requirement text — sign in to readwithdrawn03.03.07Time Stamps03.03.08Protection of Audit Information03.04.01Baseline Configuration03.04.02Configuration Settings03.04.03Configuration Change Control03.04.04Impact Analyses03.04.05Access Restrictions for Change03.04.06Least Functionality03.04.08Authorized Software – Allow by Exception03.03.09Requirement text — sign in to readwithdrawn03.04.10System Component Inventory03.04.11Information Location03.04.12System and Component Configuration for High-Risk Areas03.05.01User Identification and Authentication03.05.02Device Identification and Authentication03.05.03Multi-Factor Authentication03.05.04Replay-Resistant Authentication03.04.07Requirement text — sign in to readwithdrawn03.05.05Identifier Management03.05.07Password Management03.04.09Requirement text — sign in to readwithdrawn03.05.11Authentication Feedback03.05.12Authenticator Management03.06.01Incident Handling03.06.02Incident Monitoring, Reporting, and Response Assistance03.06.03Incident Response Testing03.06.04Incident Response Training03.06.05Incident Response Plan03.07.04Maintenance Tools03.07.05Nonlocal Maintenance03.05.06Requirement text — sign in to readwithdrawn03.07.06Maintenance Personnel03.08.01Media Storage03.05.08Requirement text — sign in to readwithdrawn03.08.02Media Access03.05.09Requirement text — sign in to readwithdrawn03.08.03Media Sanitization03.05.10Requirement text — sign in to readwithdrawn03.08.04Media Marking03.08.05Media Transport03.08.07Media Use03.08.09System Backup – Cryptographic Protection03.09.01Personnel Screening03.09.02Personnel Termination and Transfer03.10.01Physical Access Authorizations03.10.02Monitoring Physical Access03.07.01Requirement text — sign in to readwithdrawn03.10.06Alternate Work Site03.07.02Requirement text — sign in to readwithdrawn03.10.07Physical Access Control03.07.03Requirement text — sign in to readwithdrawn03.10.08Access Control for Transmission03.11.01Risk Assessment03.11.02Vulnerability Monitoring and Scanning03.11.04Risk Response03.12.01Security Assessment03.12.02Plan of Action and Milestones03.12.03Continuous Monitoring03.12.05Information Exchange03.13.01Boundary Protection03.08.06Requirement text — sign in to readwithdrawn03.13.04Information in Shared System Resources03.13.06Network Communications – Deny by Default – Allow by Exception03.08.08Requirement text — sign in to readwithdrawn03.13.08Transmission and Storage Confidentiality03.13.09Network Disconnect03.13.10Cryptographic Key Establishment and Management03.13.11Cryptographic Protection03.13.12Collaborative Computing Devices and Applications03.13.13Mobile Code03.10.03Requirement text — sign in to readwithdrawn03.13.15Session Authenticity03.10.04Requirement text — sign in to readwithdrawn03.14.01Flaw Remediation03.10.05Requirement text — sign in to readwithdrawn03.14.02Malicious Code Protection03.14.03Security Alerts, Advisories, and Directives03.14.06System Monitoring03.14.08Information Management and Retention03.15.01Policy and Procedures03.15.02System Security Plan03.11.03Requirement text — sign in to readwithdrawn03.15.03Rules of Behavior03.16.01Security Engineering Principles03.16.02Unsupported System Components03.16.03External System Services03.17.01Supply Chain Risk Management Plan03.12.04Requirement text — sign in to readwithdrawn03.17.02Acquisition Strategies, Tools, and Methods03.17.03Supply Chain Requirements and Processes03.13.02Requirement text — sign in to readwithdrawn03.13.03Requirement text — sign in to readwithdrawn03.13.05Requirement text — sign in to readwithdrawn03.13.07Requirement text — sign in to readwithdrawn03.13.14Requirement text — sign in to readwithdrawn03.13.16Requirement text — sign in to readwithdrawn03.14.04Requirement text — sign in to readwithdrawn03.14.05Requirement text — sign in to readwithdrawn03.14.07Requirement text — sign in to readwithdrawn