Skip to content
Expert CMMC
← Tools

Tools

CMMC Level 2 Readiness Checklist

110 practices with their assessment objectives and, for 110 of them, the evidence to collect from published implementation guidance. Tick each objective only when the evidence exists and is current.

Printing hides the navigation and starts each domain on a new page. Objective text is from the CMMC Level 2 Assessment Guide v2.13.

AC · Access Control

AC.L2-3.1.1Authorized Access Control [CUI Data]

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

Assessment objectives

  • [a] authorized users are identified;
  • [b] processes acting on behalf of authorized users are identified;
  • [c] devices (and other systems) authorized to connect to the system are identified;
  • [d] system access is limited to authorized users;
  • [e] system access is limited to processes acting on behalf of authorized users; and
  • [f] system access is limited to authorized devices (including other systems).

Evidence to collect

  • SSP section and access control policy covering the CUI boundary · reviewed annually
  • CUI-Users group membership export · dated within 90 days
  • Service account inventory · reviewed quarterly
  • Device inventory and compliance report · dated within 90 days
  • Conditional Access policy showing device compliance and MFA requirements · current configuration
  • Quarterly access review records · most recent four quarters

AC.L2-3.1.2Transaction & Function Control

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

Assessment objectives

  • [a] the types of transactions and functions that authorized users are permitted to execute are defined; and
  • [b] system access is limited to the defined types of transactions and functions for authorized users.

Evidence to collect

  • Role-to-permission matrix · reviewed semi-annually
  • Group membership and permission exports · dated within 90 days
  • Privileged account separation evidence · current configuration
  • Permission reconciliation record · within the last six months

AC.L2-3.1.3Control CUI Flow

Control the flow of CUI in accordance with approved authorizations.

Assessment objectives

  • [a] information flow control policies are defined;
  • [b] methods and enforcement mechanisms for controlling the flow of CUI are defined;
  • [c] designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified;
  • [d] authorizations for controlling the flow of CUI are defined; and
  • [e] approved authorizations for controlling the flow of CUI are enforced.

Evidence to collect

  • Information flow policy · reviewed annually
  • CUI data-flow diagram · updated when the environment changes
  • DLP policy configuration and incident report · dated within 90 days
  • Firewall rule set for the enclave segment · current configuration
  • Approved recipient / channel list · reviewed quarterly

AC.L2-3.1.4Separation of Duties

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

Assessment objectives

  • [a] the duties of individuals requiring separation are defined;
  • [b] responsibilities for duties that require separation are assigned to separate individuals; and
  • [c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.

Evidence to collect

  • Separation-of-duties matrix · reviewed annually
  • Role assignments proving separation · dated within 90 days
  • Compensating control evidence · most recent reviews

AC.L2-3.1.5Least Privilege

Employ the principle of least privilege, including for specific security functions and privileged accounts.

Assessment objectives

  • [a] privileged accounts are identified;
  • [b] access to privileged accounts is authorized in accordance with the principle of least privilege;
  • [c] se curity functions are identified; and
  • [d] access to security functions is authorized in accordance with the principle of least privilege.

Evidence to collect

  • Privileged account and security function inventory · reviewed quarterly
  • Privileged role assignment export · dated within 90 days
  • Privileged access approval records · for every current holder
  • Quarterly privileged access review · most recent four quarters

AC.L2-3.1.6Non-Privileged Account Use

Use non-privileged accounts or roles when accessing nonsecurity functions.

Assessment objectives

  • [a] nonsecurity functions are identified; and
  • [b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions.

Evidence to collect

  • Policy defining non-security functions and the two-account rule · reviewed annually
  • Admin account list paired with standard accounts · dated within 90 days
  • Enforcement configuration · current configuration
  • Sign-in log check · dated within 90 days

AC.L2-3.1.7Privileged Functions

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Assessment objectives

  • [a] privileged functions are defined;
  • [b] non-privileged users are defined;
  • [c] non-privileged users are prevented from executing privileged functions; and
  • [d] the execution of privileged functions is captured in audit logs.

Evidence to collect

  • Definitions of privileged functions and non-privileged users · reviewed annually
  • Prevention controls · current configuration
  • Audit log configuration · current configuration
  • Sample privileged-action log entries · dated within 90 days

AC.L2-3.1.8Unsuccessful Logon Attempts

Limit unsuccessful logon attempts.

Assessment objectives

  • [a] the means of limiting unsuccessful logon attempts is defined; and
  • [b] the defined means of limiting unsuccessful logon attempts is implemented.

Evidence to collect

  • Documented lockout parameters · reviewed annually
  • Identity provider lockout settings · current configuration
  • Device lockout configuration · current configuration
  • Lockout test record · within the last year

AC.L2-3.1.9Privacy & Security Notices

Provide privacy and security notices consistent with applicable CUI rules.

Assessment objectives

  • [a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category; and
  • [b] privacy and security notices are displayed.

Evidence to collect

  • Notice inventory · reviewed annually
  • Logon banner screenshots · current configuration
  • Banner configuration · current configuration
  • Document marking sample · current configuration

AC.L2-3.1.10Session Lock

Use session lock with pattern- hiding displays to prevent access and viewing of data after a period of inactivity.

Assessment objectives

  • [a] the period of inactivity after which the system initiates a session lock is defined;
  • [b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and
  • [c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.

Evidence to collect

  • Defined inactivity period · reviewed annually
  • Device management session lock policy · current configuration
  • Device compliance report · dated within 90 days
  • Browser idle timeout settings · current configuration

AC.L2-3.1.11Session Termination

Terminate (automatically) a user session after a defined condition.

Assessment objectives

  • [a] conditions requiring a user session to terminate are defined; and
  • [b] a user session is automatically terminated after any of the defined conditions occur.

Evidence to collect

  • Defined termination conditions · reviewed annually
  • Identity session controls · current configuration
  • VPN / RDP / SSH timeout configuration · current configuration
  • Termination test record · within the last year

AC.L2-3.1.12Control Remote Access

Monitor and control remote access sessions.

Assessment objectives

  • [a] remote access sessions are permitted;
  • [b] the types of permitted remote access are identified;
  • [c] remote access sessions are controlled; and
  • [d] remote access sessions are monitored.

Evidence to collect

  • Remote access policy and permitted types · reviewed annually
  • Remote access control configuration · current configuration
  • Remote access logs and alerts · dated within 90 days
  • Monthly review and vendor session records · most recent three months

AC.L2-3.1.13Remote Access Confidentiality

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Assessment objectives

  • [a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified; and
  • [b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.

Evidence to collect

  • Remote access cryptography inventory · reviewed annually
  • VPN / ZTNA cryptographic configuration · current configuration
  • Endpoint FIPS policy · current configuration
  • Blocked clear-text protocol rules · current configuration

AC.L2-3.1.14Remote Access Routing

Route remote access via managed access control points.

Assessment objectives

  • [a] managed access control points are identified and implemented; and
  • [b] remote access is routed through managed network access control points.

Evidence to collect

  • Network diagram showing managed access points · updated when the network changes
  • Firewall inbound rule set · current configuration
  • External port scan results · dated within 90 days
  • Access point hardening evidence · current configuration

AC.L2-3.1.15Privileged Remote Access

Authorize remote execution of privileged commands and remote access to security-relevant information.

Assessment objectives

  • [a] privileged commands authorized for remote execution are identified;
  • [b] security-relevant information authorized to be accessed remotely is identified;
  • [c] the execution of the identified privileged commands via remote access is authorized; and
  • [d] access to the identified security-relevant information via remote access is authorized.

Evidence to collect

  • Authorized remote privileged commands and information list · reviewed annually
  • Policy authorization · reviewed annually
  • Enforcement configuration · current configuration
  • Remote privileged activity log review · most recent three months

AC.L2-3.1.16Wireless Access Authorization

Authorize wireless access prior to allowing such connections.

Assessment objectives

  • [a] wireless access points are identified; and
  • [b] wireless access is authorized prior to allowing such connections.

Evidence to collect

  • Wireless access point inventory · reviewed quarterly
  • Wireless authorization policy · reviewed annually
  • 802.1X / certificate authentication configuration · current configuration
  • Rogue AP scan and client review records · dated within the last year / quarter

AC.L2-3.1.17Wireless Access Protection

Protect wireless access using authentication and encryption.

Assessment objectives

  • [a] wireless access to the system is protected using authentication; and
  • [b] wireless access to the system is protected using encryption.

Evidence to collect

  • Wireless security configuration · current configuration
  • Certificate / RADIUS profile · current configuration
  • Wireless scan showing SSID security types · dated within the last year
  • Wireless standard in the SSP · reviewed annually

AC.L2-3.1.18Mobile Device Connection

Control connection of mobile devices.

Assessment objectives

  • [a] mobile devices that process, store, or transmit CUI are identified;
  • [b] mobile device connections are authorized; and
  • [c] mobile device connections are monitored and logged.

Evidence to collect

  • Mobile device inventory · dated within 90 days
  • Mobile device policy · reviewed annually
  • MDM compliance and access policies · current configuration
  • Connection logs and monthly review · dated within 90 days

AC.L2-3.1.19Encrypt CUI on Mobile

Encrypt CUI on mobile devices and mobile computing platforms.

Assessment objectives

  • [a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified; and
  • [b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.

Evidence to collect

  • Devices identified as CUI-capable · dated within 90 days
  • Encryption policy configuration · current configuration
  • Encryption compliance report · dated within 90 days
  • FIPS validation references · reviewed annually

AC.L2-3.1.20External Connections [CUI Data]

Verify and control/limit connections to and use of external systems.

Assessment objectives

  • [a] connections to external systems are identified;
  • [b] the use of external systems is identified;
  • [c] connections to external systems are verified;
  • [d] the use of external systems is verified;
  • [e] connections to external systems are controlled/limited; and
  • [f] the use of external systems is controlled/limited.

Evidence to collect

  • External systems inventory for CUI · reviewed quarterly
  • Verification evidence · reviewed annually
  • External systems policy · reviewed annually
  • Enforcement configuration · current configuration

AC.L2-3.1.21Portable Storage Use

Limit use of portable storage devices on external systems.

Assessment objectives

  • [a] the use of portable storage devices containing CUI on external systems is identified and documented;
  • [b] limits on the use of portable storage devices containing CUI on external systems are defined; and
  • [c] the use of portable storage devices containing CUI on external systems is limited as defined.

Evidence to collect

  • Portable storage use inventory · reviewed quarterly
  • Portable storage limits in policy · reviewed annually
  • Device control configuration and logs · current configuration
  • Issued drive register and exception approvals · dated within 90 days

AC.L2-3.1.22Control Public Information [CUI Data]

Control CUI posted or processed on publicly accessible systems.

Assessment objectives

  • [a] individuals authorized to post or process information on publicly accessible systems are identified;
  • [b] procedures to ensure CUI is not posted or processed on publicly accessible systems are identified;
  • [c] a review process is in place prior to posting of any content to publicly accessible systems;
  • [d] content on publicly accessible systems is reviewed to ensure that it does not include CUI; and
  • [e] mechanisms are in place to remove and address improper posting of CUI.

Evidence to collect

  • Public content policy and authorized publisher roles · reviewed annually
  • Pre-publication review records · most recent quarter
  • Publishing permission configuration · current configuration
  • Annual public content review · within the last year
  • Takedown and reporting procedure · reviewed annually

AT · Awareness & Training

AT.L2-3.2.1Role-Based Risk Awareness

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

Assessment objectives

  • [a] security risks associated with organizational activities involving CUI are identified;
  • [b] policies, standards, and procedures related to the security of the system are identified;
  • [c] managers, systems administrators, and users of the system are made aware of the security risks associated with their activities; and
  • [d] managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.

Evidence to collect

  • CUI risk list used for awareness content · reviewed annually
  • Security awareness and training policy with policy map · reviewed annually
  • Training materials · current version, reviewed within 12 months
  • Training completion and policy acknowledgement records · covering the last 12 months for every current user
  • Ongoing awareness records · most recent 12 months

AT.L2-3.2.2Role-Based Training

Ensure that personnel are trained to carry out their assigned information security -related duties and responsibilities.

Assessment objectives

  • [a] information security-related duties, roles, and responsibilities are defined;
  • [b] information security-related duties, roles, and responsibilities are assigned to designated personnel; and
  • [c] personnel are adequately trained to carry out their assigned information security- related duties, roles, and responsibilities.

Evidence to collect

  • Security roles and responsibilities matrix · reviewed annually
  • Role assignment record · current; updated on any change
  • Role-based training records · completions within the last 12 months or since the last tool change
  • Role-based training plan or curriculum · reviewed annually

AT.L2-3.2.3Insider Threat Awareness

Provide security awareness training on recognizing and reporting potential indicators of insider threat.

Assessment objectives

  • [a] potential indicators associated with insider threats are identified; and
  • [b] security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.

Evidence to collect

  • Insider threat indicator list · reviewed annually
  • Insider threat reporting procedure · reviewed annually
  • Training content with insider threat module · current version, reviewed within 12 months
  • Training completion records for managers and employees · last 12 months for all current staff

AU · Audit & Accountability

AU.L2-3.3.1System Auditing

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Assessment objectives

  • [a] audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified;
  • [b] the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined;
  • [c] audit records are created (generated);
  • [d] audit records, once created, contain the defined content;
  • [e] retention requirements for audit records are defined; and
  • [f] audit records are retained as defined.

Evidence to collect

  • Audit and accountability policy with logging standard · reviewed annually
  • Log source inventory · reviewed quarterly
  • Audit configuration exports · current configuration
  • Sample audit records · dated within 90 days
  • Retention configuration and oldest-record evidence · dated within 90 days

AU.L2-3.3.2User Accountability

Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Assessment objectives

  • [a] the content of the audit records needed to support the ability to uniquely trace users to their actions is defined; and
  • [b] audit records, once created, contain the defined content.

Evidence to collect

  • Audit policy section defining user-traceable record content · reviewed annually
  • Account list showing individual ownership · dated within 90 days
  • Sample log records with user identity · dated within 90 days
  • Trace test record · within the last 12 months
  • Vault checkout log for shared credentials · dated within 90 days

AU.L2-3.3.3Event Review

Review and update logged events.

Assessment objectives

  • [a] a process for determining when to review logged events is defined;
  • [b] event types being logged are reviewed in accordance with the defined review process; and
  • [c] event types being logged are updated based on the review.

Evidence to collect

  • Event review procedure · reviewed annually
  • Event type review record · within the last 12 months and after each trigger event
  • Versioned logging standard and change ticket · matches the most recent review

AU.L2-3.3.4Audit Failure Alerting

Alert in the event of an audit logging process failure.

Assessment objectives

  • [a] personnel or roles to be alerted in the event of an audit logging process failure are identified;
  • [b] types of audit logging process failures for which alert will be generated are defined; and
  • [c] identified personnel or roles are alerted in the event of an audit logging process failure.

Evidence to collect

  • Audit failure alerting procedure · reviewed annually
  • Alert rule configuration · current configuration
  • Alert test record · within the last 90 days
  • Logging failure tickets · within the assessment period

AU.L2-3.3.5Audit Correlation

Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

Assessment objectives

  • [a] audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined; and
  • [b] defined audit record review, analysis, and reporting processes are correlated.

Evidence to collect

  • Audit record review, analysis and reporting procedure · reviewed annually
  • Central log source list · dated within 90 days
  • Correlation rules or manual cross-source checklist · current configuration
  • Log review and escalation records · most recent three months

AU.L2-3.3.6Reduction & Reporting

Provide audit record reduction and report generation to support on- demand analysis and reporting.

Assessment objectives

  • [a] an audit record reduction capability that supports on-demand analysis is provided; and
  • [b] a report generation capability that supports on-demand reporting is provided.

Evidence to collect

  • Saved query and filter library · current configuration
  • Sample on-demand report · within the last 12 months
  • Reporting procedure · reviewed annually

AU.L2-3.3.7Authoritative Time Source

Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

Assessment objectives

  • [a] internal system clocks are used to generate time stamps for audit records;
  • [b] an authoritative source with which to compare and synchronize internal system clocks is specified; and
  • [c] internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source.

Evidence to collect

  • Time source statement in SSP or configuration standard · reviewed annually
  • Time synchronization configuration · current configuration
  • Synchronization status output · dated within 90 days
  • Sample audit records with time stamps · dated within 90 days

AU.L2-3.3.8Audit Protection

Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

Assessment objectives

  • [a] audit information is protected from unauthorized access;
  • [b] audit information is protected from unauthorized modification;
  • [c] audit information is protected from unauthorized deletion;
  • [d] audit logging tools are protected from unauthorized access;
  • [e] audit logging tools are protected from unauthorized modification; and
  • [f] audit logging tools are protected from unauthorized deletion.

Evidence to collect

  • Authorized audit users and tool administrators list · reviewed quarterly
  • Log store access and retention-lock configuration · current configuration
  • Agent tamper protection settings · current configuration
  • Tamper alert rules and sample alert · within the last 12 months
  • Audit of access to the log system · dated within 90 days

AU.L2-3.3.9Audit Management

Limit management of audit logging functionality to a subset of privileged users.

Assessment objectives

  • [a] a subset of privileged users granted access to manage audit logging functionality is defined; and
  • [b] management of audit logging functionality is limited to the defined subset of privileged users.

Evidence to collect

  • Defined audit manager list · reviewed quarterly
  • Role assignment exports for audit functions · dated within 90 days
  • Audit-management change alerts · current configuration
  • Quarterly audit-manager access review · most recent four quarters

CM · Configuration Management

CM.L2-3.4.1System Baselining

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

Assessment objectives

  • [a] a baseline configuration is established;
  • [b] the baseline configuration includes hardware, software, firmware, and documentation;
  • [c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle;
  • [d] a system inventory is established;
  • [e] the system inventory includes hardware, software, firmware, and documentation; and
  • [f] the inventory is maintained (reviewed and updated) throughout the system development life cycle.

Evidence to collect

  • Configuration management policy · reviewed annually
  • Baseline configuration documents · reviewed quarterly or at each significant change
  • System inventory export · dated within 30 days
  • Baseline and inventory review records · most recent four quarters

CM.L2-3.4.2Security Configuration Enforcement

Establish and enforce security configuration settings for information technology products employed in organizational systems.

Assessment objectives

  • [a] security configuration settings for information technology products employed in the system are established and included in the baseline configuration; and
  • [b] security configuration settings for information technology products employed in the system are enforced.

Evidence to collect

  • Security configuration standard with deviation log · reviewed annually and at each deviation
  • Enforced configuration exports · current configuration
  • Configuration compliance scan reports · within the last 90 days

CM.L2-3.4.3System Change Management

Track, review, approve or disapprove, and log changes to organizational systems.

Assessment objectives

  • [a] changes to the system are tracked;
  • [b] changes to the system are reviewed;
  • [c] changes to the system are approved or disapproved; and
  • [d] changes to the system are logged.

Evidence to collect

  • Change management procedure · reviewed annually
  • Change records sample · within the assessment period
  • Change log · most recent 12 months
  • Change meeting minutes or approval records · most recent three months
  • Unauthorized-change reconciliation · most recent quarter

CM.L2-3.4.4Security Impact Analysis

Analyze the security impact of changes prior to implementation.

Assessment objectives

  • [a] the security impact of changes to the system is analyzed prior to implementation.

Evidence to collect

  • Change template with security impact section · reviewed annually
  • Completed security impact analyses · within the assessment period
  • Pre-production test results · within the assessment period
  • SSP or baseline updates from changes · matches recent changes

CM.L2-3.4.5Access Restrictions for Change

Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.

Assessment objectives

  • [a] physical access restrictions associated with changes to the system are defined;
  • [b] physical access restrictions associated with changes to the system are documented;
  • [c] physical access restrictions associated with changes to the system are approved;
  • [d] physical access restrictions associated with changes to the system are enforced;
  • [e] logical access restrictions associated with changes to the system are defined;
  • [f] logical access restrictions associated with changes to the system are documented;
  • [g] logical access restrictions associated with changes to the system are approved; and
  • [h] logical access restrictions associated with changes to the system are enforced.

Evidence to collect

  • Access restrictions for change procedure · reviewed annually
  • Approval records for change access · for every current holder
  • Physical access evidence · dated within 90 days
  • Logical change-rights configuration · dated within 90 days
  • Quarterly change-access review · most recent four quarters

CM.L2-3.4.6Least Functionality

Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

Assessment objectives

  • [a] essential system capabilities are defined based on the principle of least functionality; and
  • [b] the system is configured to provide only the defined essential capabilities.

Evidence to collect

  • System role and essential capability matrix · reviewed annually and when roles change
  • Baseline build documentation · current version
  • Installed software and enabled feature reports · dated within 90 days
  • Least functionality review record · within the last 12 months

CM.L2-3.4.7Nonessential Functionality

Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

Assessment objectives

  • [a] essential programs are defined;
  • [b] the use of nonessential programs is defined;
  • [c] the use of nonessential programs is restricted, disabled, or prevented as defined;
  • [d] essential functions are defined;
  • [e] the use of nonessential functions is defined;
  • [f] the use of nonessential functions is restricted, disabled, or prevented as defined;
  • [g] essential ports are defined;
  • [h] the use of nonessential ports is defined;
  • [i] the use of nonessential ports is restricted, disabled, or prevented as defined;
  • [j] essential protocols are defined;
  • [k] the use of nonessential protocols is defined;
  • [l] the use of nonessential protocols is restricted, disabled, or prevented as defined;
  • [m] essential services are defined;
  • [n] the use of nonessential services is defined; and
  • [o] the use of nonessential services is restricted, disabled, or prevented as defined.

Evidence to collect

  • Ports, protocols and services list · reviewed annually and at each change
  • Approved software list · reviewed quarterly
  • Essential and restricted functions standard · reviewed annually
  • Firewall rule exports · current configuration
  • Group Policy, Intune and ASR configuration exports · current configuration
  • Port and service scan results · within the last 90 days

CM.L2-3.4.8Application Execution Policy

Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

Assessment objectives

  • [a] a policy specifying whether whitelisting or blacklisting is to be implemented is specified;
  • [b] the software allowed to execute under whitelisting or denied use under blacklisting is specified; and
  • [c] whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.

Evidence to collect

  • Application execution policy · reviewed annually
  • Authorized or prohibited software list · reviewed quarterly
  • Application control policy export · current configuration
  • Block event logs · dated within 90 days
  • Exception request records · within the assessment period

CM.L2-3.4.9User-Installed Software

Control and monitor user-installed software.

Assessment objectives

  • [a] a policy for controlling the installation of software by users is established;
  • [b] installation of software by users is controlled based on the established policy; and
  • [c] installation of software by users is monitored.

Evidence to collect

  • User-installed software policy and user acknowledgments · reviewed annually; acknowledgments at hire and annually
  • Local administrator membership report · dated within 90 days
  • Install restriction configuration · current configuration
  • Software inventory and monthly review · most recent three months

IA · Identification & Authentication

IA.L2-3.5.1Identification [CUI Data]

Identify system users, processes acting on behalf of users, and devices.

Assessment objectives

  • [a] system users are identified;
  • [b] processes acting on behalf of users are identified; and
  • [c] devices accessing the system are identified.

Evidence to collect

  • SSP section and identification and authentication policy · reviewed annually
  • User account export for the CUI environment · dated within 90 days
  • Service account, integration and app-registration inventory · reviewed quarterly
  • Device inventory and management-console export · dated within 90 days
  • Sample log entries showing identifiers · dated within 90 days
  • Quarterly identity reconciliation records · most recent four quarters

IA.L2-3.5.2Authentication [CUI Data]

Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

Assessment objectives

  • [a] the identity of each user is authenticated or verified as a prerequisite to system access;
  • [b] the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and
  • [c] the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.

Evidence to collect

  • Identification and authentication policy and SSP section · reviewed annually
  • Identity-provider authentication configuration · current configuration
  • Service account inventory with authentication method · reviewed quarterly
  • Device authentication configuration · current configuration
  • Default-credential change records · one for each in-scope device
  • Sign-in logs showing authentication results · dated within 90 days

IA.L2-3.5.3Multifactor Authentication

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

Assessment objectives

  • [a] privileged accounts are identified;
  • [b] multifactor authentication is implemented for local access to privileged accounts;
  • [c] multifactor authentication is implemented for network access to privileged accounts; and
  • [d] multifactor authentication is implemented for network access to non-privileged accounts.

Evidence to collect

  • Privileged account inventory · reviewed quarterly
  • MFA policy section · reviewed annually
  • Network MFA enforcement configuration · current configuration
  • Local privileged logon MFA configuration · current configuration
  • MFA registration report · dated within 90 days
  • Sign-in logs filtered for single-factor success · dated within 90 days

IA.L2-3.5.4Replay-Resistant Authentication

Employ replay -resistant authentication mechanisms for network access to privileged and non-privileged accounts.

Assessment objectives

  • [a] replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts.

Evidence to collect

  • Approved authentication mechanisms standard · reviewed annually
  • Windows authentication settings export · current configuration
  • Legacy authentication block policy · current configuration
  • Network device management configuration · current configuration
  • Protocol and TLS scan results · within 12 months and after significant change

IA.L2-3.5.5Identifier Reuse

Prevent reuse of identifiers for a defined period.

Assessment objectives

  • [a] a period within which identifiers cannot be reused is defined; and
  • [b] reuse of identifiers is prevented within the defined period.

Evidence to collect

  • Identifier reuse policy statement · reviewed annually
  • Retired identifier register · updated with every departure; reviewed annually
  • Disabled account export · dated within 90 days
  • Onboarding procedure with uniqueness check · reviewed annually
  • Account creation audit sample · covering the last 12 months

IA.L2-3.5.6Identifier Handling

Disable identifiers after a defined period of inactivity.

Assessment objectives

  • [a] a period of inactivity after which an identifier is disabled is defined; and
  • [b] identifiers are disabled after the defined period of inactivity.

Evidence to collect

  • Inactivity policy statement · reviewed annually
  • Inactive account reports · most recent three months of runs
  • Automation script and schedule · current configuration
  • Disablement audit entries and tickets · dated within 90 days
  • Exception register · reviewed quarterly

IA.L2-3.5.7Password Complexity

Enforce a minimum password complexity and change of characters when new passwords are created.

Assessment objectives

  • [a] password complexity requirements are defined;
  • [b] password change of character requirements are defined;
  • [c] minimum password complexity requirements as defined are enforced when new passwords are created; and
  • [d] minimum password change of character requirements as defined are enforced when new passwords are created.

Evidence to collect

  • Password policy · reviewed annually
  • AD password policy export · current configuration
  • Cloud identity password settings · current configuration
  • Password filter configuration (if used) · current configuration
  • Rejection test record · within 12 months
  • Inventory of systems with local password stores · reviewed annually

IA.L2-3.5.8Password Reuse

Prohibit password reuse for a specified number of generations.

Assessment objectives

  • [a] the number of generations during which a password cannot be reused is specified and
  • [b] reuse of passwords is prohibited during the specified number of generations.

Evidence to collect

  • Password policy with reuse generations · reviewed annually
  • AD password history settings export · current configuration
  • Cloud and appliance reuse settings · current configuration
  • Reuse rejection test record · within 12 months
  • Per-system enforcement table · reviewed annually

IA.L2-3.5.9Temporary Passwords

Allow temporary password use for system logons with an immediate change to a permanent password.

Assessment objectives

  • [a] an immediate change to a permanent password is required when a temporary password is used for system logon.

Evidence to collect

  • Temporary credential procedure · reviewed annually
  • Account creation and reset settings · current configuration
  • Temporary Access Pass policy (if used) · current configuration
  • Helpdesk reset tickets · dated within 90 days
  • Unchanged temporary password report · monthly; most recent three

IA.L2-3.5.10Cryptographically-Protected Passwords

Store and transmit only cryptographically-protected passwords.

Assessment objectives

  • [a] passwords are cryptographically protected in storage; and
  • [b] passwords are cryptographically protected in transit.

Evidence to collect

  • Password storage and transmission policy · reviewed annually
  • Windows password storage settings · current configuration
  • Password manager or vault deployment record · dated within 90 days
  • Application and vendor password-hashing statements · reviewed annually
  • Encrypted-transmission configuration · current configuration
  • Password-exposure and protocol scan results · within 12 months

IA.L2-3.5.11Obscure Feedback

Obscure feedback of authentication information.

Assessment objectives

  • [a] authentication information is obscured during the authentication process.

Evidence to collect

  • Policy statement on obscured feedback · reviewed annually
  • Password reveal button configuration · current configuration
  • Masked sign-in screenshots · within 12 months
  • Application review note · reviewed annually or on release

IR · Incident Response

IR.L2-3.6.1Incident Handling

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

Assessment objectives

  • [a] an operational incident-handling capability is established;
  • [b] the operational incident-handling capability includes preparation;
  • [c] the operational incident-handling capability includes detection;
  • [d] the operational incident-handling capability includes analysis;
  • [e] the operational incident-handling capability includes containment;
  • [f] the operational incident-handling capability includes recovery; and
  • [g] the operational incident-handling capability includes user response activities.

Evidence to collect

  • Incident response policy and plan · reviewed annually and after major changes
  • Incident contact list and reporting channels · verified within the last 6 months
  • Incident playbooks · reviewed annually
  • Detection alert routing configuration · current configuration
  • Incident log and incident records · covering the last 12 months (a log with only near misses is acceptable)
  • User reporting guidance and training record · within the last 12 months
  • DoD medium assurance certificate record · certificate not expired

IR.L2-3.6.2Incident Reporting

Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

Assessment objectives

  • [a] incidents are tracked;
  • [b] incidents are documented;
  • [c] authorities to whom incidents are to be reported are identified;
  • [d] organizational officials to whom incidents are to be reported are identified;
  • [e] identified authorities are notified of incidents; and
  • [f] identified organizational officials are notified of incidents.

Evidence to collect

  • Incident reporting section of the IR plan · reviewed annually
  • Incident tracking log · covering the last 12 months
  • Incident records and final reports · within the assessment period
  • Notification evidence · for every reportable incident
  • ECA certificate and DIBNet readiness record · certificate current

IR.L2-3.6.3Incident Response Testing

Test the organizational incident response capability.

Assessment objectives

  • [a] the incident response capability is tested.

Evidence to collect

  • Incident response testing requirement · reviewed annually
  • Exercise plan and scenario · for the most recent exercise
  • Attendance record · within the last 12 months
  • After-action report and corrective actions · within the last 12 months, with open items tracked

MA · Maintenance

MA.L2-3.7.1Perform Maintenance

Perform maintenance on organizational systems.

Assessment objectives

  • [a] system maintenance is performed.

Evidence to collect

  • Maintenance policy or SSP maintenance section · reviewed annually
  • Maintenance schedule · current year
  • Patch compliance report · dated within 30 days
  • Maintenance log or ticket history · most recent six to twelve months
  • End-of-life asset list · reviewed quarterly

MA.L2-3.7.2System Maintenance Control

Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

Assessment objectives

  • [a] tools used to conduct system maintenance are controlled;
  • [b] techniques used to conduct system maintenance are controlled;
  • [c] mechanisms used to conduct system maintenance are controlled; and
  • [d] personnel used to conduct system maintenance are controlled.

Evidence to collect

  • Maintenance policy covering tools, techniques, mechanisms and personnel · reviewed annually
  • Approved maintenance tool list · reviewed quarterly
  • Access permissions on maintenance documentation · current configuration
  • RMM and script permission settings · dated within 90 days
  • Authorized maintenance personnel list · dated within 90 days
  • Quarterly maintenance access review · most recent four quarters

MA.L2-3.7.3Equipment Sanitization

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

Assessment objectives

  • [a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.

Evidence to collect

  • Off-site maintenance sanitization procedure · reviewed annually
  • Sanitization records for equipment sent off-site · every off-site shipment in the assessment period
  • Drive-retention entitlement · current warranty term
  • Equipment shipment log · most recent twelve months

MA.L2-3.7.4Media Inspection

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

Assessment objectives

  • [a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI.

Evidence to collect

  • Maintenance tool and media inspection procedure · reviewed annually
  • Anti-malware removable-media and real-time scanning configuration · current configuration
  • Inspection records for diagnostic tools · every use in the assessment period
  • Endpoint protection scan log · dated within the assessment period

MA.L2-3.7.5Nonlocal Maintenance

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

Assessment objectives

  • [a] multifactor authentication is used to establish nonlocal maintenance sessions via external network connections; and
  • [b] nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.

Evidence to collect

  • Nonlocal maintenance policy section · reviewed annually
  • MFA configuration for remote-maintenance tools · current configuration
  • Session timeout settings · current configuration
  • Remote maintenance session logs · most recent three months
  • Monthly remote-session review · most recent three months

MA.L2-3.7.6Maintenance Personnel

Supervise the maintenance activities of maintenance personnel without required access authorization.

Assessment objectives

  • [a] maintenance personnel without required access authorization are supervised during maintenance activities.

Evidence to collect

  • Maintenance personnel supervision procedure · reviewed annually
  • Maintenance visit tickets with supervisor named · every visit in the assessment period
  • Visitor log entries for maintenance personnel · retained per your log retention period
  • Temporary account records · every temporary account in the assessment period

MP · Media Protection

MP.L2-3.8.1Media Protection

Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

Assessment objectives

  • [a] paper media containing CUI is physically controlled;
  • [b] digital media containing CUI is physically controlled;
  • [c] paper media containing CUI is securely stored; and
  • [d] digital media containing CUI is securely stored.

Evidence to collect

  • Media protection procedure · reviewed annually
  • CUI media inventory · reconciled quarterly
  • Media check-out log · most recent twelve months
  • Photos of locked storage · current
  • Quarterly media reconciliation · most recent four quarters

MP.L2-3.8.2Media Access

Limit access to CUI on system media to authorized users.

Assessment objectives

  • [a] access to CUI on system media is limited to authorized users.

Evidence to collect

  • Authorized-user list per CUI data set · reviewed quarterly
  • Media check-out log · most recent twelve months
  • Key and combination holder list · reviewed quarterly
  • Permissions on CUI repositories and encrypted media · current configuration
  • Quarterly access review by data owner · most recent four quarters

MP.L2-3.8.3Media Disposal [CUI Data]

Sanitize or destroy system media containing CUI before disposal or release for reuse.

Assessment objectives

  • [a] system media containing CUI is sanitized or destroyed before disposal; and
  • [b] system media containing CUI is sanitized before it is released for reuse.

Evidence to collect

  • Media sanitization procedure · reviewed annually
  • Sanitization and destruction log · most recent twelve months
  • Vendor certificates of destruction or sanitization · each pickup in the assessment period
  • Erasure tool reports · each reuse in the assessment period
  • Retired asset reconciliation · reviewed quarterly

MP.L2-3.8.4Media Markings

Mark media with necessary CUI markings and distribution limitations.

Assessment objectives

  • [a] media containing CUI is marked with applicable CUI markings; and
  • [b] media containing CUI is marked with distribution limitations.

Evidence to collect

  • CUI marking procedure · reviewed annually
  • Examples of marked documents and media · current
  • Sensitivity label configuration · current configuration
  • Marking training records · within the last year
  • Quarterly marking spot-check · most recent four quarters

MP.L2-3.8.5Media Accountability

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

Assessment objectives

  • [a] access to media containing CUI is controlled; and
  • [b] accountability for media containing CUI is maintained during transport outside of controlled areas.

Evidence to collect

  • Media access and transport procedure · reviewed annually
  • Media access / check-out log · most recent twelve months
  • Media transport log with tracking and receipts · every transport in the assessment period
  • Authorized custodian list · reviewed quarterly
  • Encryption evidence for transported media · current

MP.L2-3.8.6Portable Storage Encryption

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

Assessment objectives

  • [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.

Evidence to collect

  • Media encryption policy section · reviewed annually
  • Encryption compliance report · dated within 30 days
  • FIPS validation evidence · checked annually
  • Encrypted removable media inventory · reconciled quarterly
  • Physical safeguard records (if used) · every such transport

MP.L2-3.8.7Removeable Media

Control the use of removable media on system components.

Assessment objectives

  • [a] the use of removable media on system components is controlled.

Evidence to collect

  • Removable media policy · reviewed annually
  • Device control configuration · current configuration
  • Approved removable media register · reviewed quarterly
  • Device control event logs · most recent three months

MP.L2-3.8.8Shared Media

Prohibit the use of portable storage devices when such devices have no identifiable owner.

Assessment objectives

  • [a] the use of portable storage devices is prohibited when such devices have no identifiable owner.

Evidence to collect

  • Policy prohibiting ownerless portable storage · reviewed annually
  • Portable storage device register · reconciled quarterly
  • Device-control allow list · current configuration
  • Photo of labeled devices · current
  • Training record covering unknown devices · within the last year

MP.L2-3.8.9Protect Backups

Protect the confidentiality of backup CUI at storage locations.

Assessment objectives

  • [a] the confidentiality of backup CUI is protected at storage locations.

Evidence to collect

  • Backup locations and protections (SSP section) · reviewed annually
  • Backup encryption settings · current configuration
  • FIPS validation evidence · checked annually
  • Backup system access list · dated within 90 days
  • Cloud backup provider FedRAMP evidence · current
  • Quarterly backup protection check and restore test · most recent four quarters

PS · Personnel Security

PS.L2-3.9.1Screen Individuals

Screen individuals prior to authorizing access to organizational systems containing CUI.

Assessment objectives

  • [a] individuals are screened prior to authorizing access to organizational systems containing CUI.

Evidence to collect

  • Personnel screening policy and position criteria · reviewed annually
  • Screening log · current; reviewed quarterly
  • Access-request tickets showing screening confirmation · for people onboarded in the last 12 months
  • Service-provider screening clauses and attestations · current contracts; attestation per named individual
  • Quarterly screening reconciliation · most recent four quarters

PS.L2-3.9.2Personnel Actions

Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

Assessment objectives

  • [a] a policy and/or process for terminating system access and any credentials coincident with personnel actions is established;
  • [b] system access and credentials are terminated consistent with personnel actions such as termination or transfer; and
  • [c] the system is protected during and after personnel transfer actions.

Evidence to collect

  • Personnel actions (offboarding and transfer) procedure · reviewed annually
  • Completed termination checklists · for departures in the last 12 months
  • Account disablement audit entries · for departures in the last 12 months
  • Equipment, badge and key return records · for departures and transfers in the last 12 months
  • Transfer access-change tickets · for transfers in the last 12 months
  • Signed exit acknowledgments · for departures in the last 12 months
  • HR-to-access reconciliation report · most recent four quarters

PE · Physical Protection

PE.L2-3.10.1Limit Physical Access [CUI Data]

Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.

Assessment objectives

  • [a] authorized individuals allowed physical access are identified;
  • [b] physical access to organizational systems is limited to authorized individuals;
  • [c] physical access to equipment is limited to authorized individuals; and
  • [d] physical access to operating environments is limited to authorized individuals.

Evidence to collect

  • Physical security policy and SSP controlled-area description · reviewed annually
  • Physical access authorization list · reviewed quarterly
  • Facility floor plan with controlled areas · current
  • Access-control system user export or key holder list · dated within 90 days
  • Photos of physical protections · current
  • Quarterly physical access review · most recent four quarters

PE.L2-3.10.2Monitor Facility

Protect and monitor the physical facility and support infrastructure for organizational systems.

Assessment objectives

  • [a] the physical facility where organizational systems reside is protected;
  • [b] the support infrastructure for organizational systems is protected;
  • [c] the physical facility where organizational systems reside is monitored; and
  • [d] the support infrastructure for organizational systems is monitored.

Evidence to collect

  • Physical and environmental protection policy · reviewed annually
  • Facility diagram with protections and monitoring · current
  • Camera and alarm system configuration · current configuration
  • Infrastructure monitoring alerts · current configuration
  • Monitoring review and test log · most recent twelve months
  • Photos of protected infrastructure · current

PE.L2-3.10.3Escort Visitors [CUI Data]

Escort visitors and monitor visitor activity.

Assessment objectives

  • [a] visitors are escorted; and
  • [b] visitor activity is monitored.

Evidence to collect

  • Visitor escort policy · reviewed annually
  • Visitor log with host or escort · most recent twelve months
  • Visitor badge sample · current
  • Camera coverage of entrances and controlled areas · current configuration
  • Monthly visitor log review · most recent three months
  • Escort training records · within the last year

PE.L2-3.10.4Physical Access Logs [CUI Data]

Maintain audit logs of physical access.

Assessment objectives

  • [a] audit logs of physical access are maintained.

Evidence to collect

  • Physical access logging policy with retention period · reviewed annually
  • Visitor logs · full retention period retained
  • Badge-reader or entry logs · full retention period retained
  • Log retention setting · current configuration
  • Monthly log review record · most recent three months

PE.L2-3.10.5Manage Physical Access [CUI Data]

Control and manage physical access devices.

Assessment objectives

  • [a] physical access devices are identified;
  • [b] physical access devices are controlled; and
  • [c] physical access devices are managed.

Evidence to collect

  • Physical access device inventory · reconciled quarterly
  • Key and badge issuance records · for every current holder
  • Access-control administrator list · dated within 90 days
  • Revocation and rekey records · every change in the assessment period
  • Quarterly reconciliation · most recent four quarters

PE.L2-3.10.6Alternative Work Sites

Enforce safeguarding measures for CUI at alternate work sites.

Assessment objectives

  • [a] safeguarding measures for CUI are defined for alternate work sites; and
  • [b] safeguarding measures for CUI are enforced for alternate work sites.

Evidence to collect

  • Telework and alternate work site policy · reviewed annually
  • Signed telework agreements and home-office checklists · renewed annually
  • Device compliance report for remote users · dated within 30 days
  • Remote access configuration · current configuration
  • Print and removable-media restriction settings · current configuration
  • Monthly remote compliance review · most recent three months

RA · Risk Assessment

RA.L2-3.11.1RIsk Assessments

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

Assessment objectives

  • [a] the frequency to assess risk to organizational operations, organizational assets, and individuals is defined; and
  • [b] risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency.

Evidence to collect

  • Risk assessment policy or SSP section with defined frequency · reviewed annually
  • Risk assessment report · within the defined frequency (typically the last 12 months)
  • Risk register · updated at each assessment and on trigger events
  • Prior assessment history · previous cycle

RA.L2-3.11.2Vulnerability Scan

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

Assessment objectives

  • [a] the frequency to scan for vulnerabilities in organizational systems and applications is defined;
  • [b] vulnerability scans are performed on organizational systems with the defined frequency;
  • [c] vulnerability scans are performed on applications with the defined frequency;
  • [d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified; and
  • [e] vulnerability scans are performed on applications when new vulnerabilities are identified.

Evidence to collect

  • Vulnerability management policy with scan frequency · reviewed annually
  • Scheduled system scan reports · every cycle within the last 12 months
  • Application and code scan reports · every cycle within the last 12 months
  • Scanner configuration and update status · current
  • Out-of-cycle scan records · most recent 12 months
  • Scan coverage reconciliation · each cycle

RA.L2-3.11.3Vulnerability Remediation

Remediate vulnerabilities in accordance with risk assessments.

Assessment objectives

  • [a] vulnerabilities are identified; and
  • [b] vulnerabilities are remediated in accordance with risk assessments.

Evidence to collect

  • Vulnerability management policy with risk-based timelines · reviewed annually
  • Vulnerability tracking list · current
  • Rescan or verification reports · within the last cycle
  • Risk acceptance and exception records · current; each reviewed by its review date
  • Patch compliance report · dated within 30 days

CA · Security Assessment

CA.L2-3.12.1Security Control Assessment

Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

Assessment objectives

  • [a] the frequency of security control assessments is defined; and
  • [b] security controls are assessed with the defined frequency to determine if the controls are effective in their application.

Evidence to collect

  • Security assessment policy or SSP section with frequency · reviewed annually
  • Security control assessment plan · for the most recent assessment
  • Security control assessment report · within the defined frequency, typically the last 12 months
  • SPRS submission record · current
  • Previous assessment report · previous cycle

CA.L2-3.12.2operational Plan of Action

Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.

Assessment objectives

  • [a] deficiencies and vulnerabilities to be addressed by the plan of action are identified;
  • [b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities; and
  • [c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.

Evidence to collect

  • Operational plan of action · updated at least monthly
  • Source findings · most recent cycle
  • Plan review records · most recent three months
  • Closure evidence · for items closed in the last 12 months
  • Plan of action procedure · reviewed annually

CA.L2-3.12.3Security Control Monitoring

Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

Assessment objectives

  • [a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.

Evidence to collect

  • Continuous monitoring plan · reviewed annually
  • Monitoring checklist or dashboard records · most recent three months
  • Management status reports · most recent two reports
  • Automated monitoring configuration · current

CA.L2-3.12.4System Security Plan

Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

Assessment objectives

  • [a] a system security plan is developed;
  • [b] the system boundary is described and documented in the system security plan;
  • [c] the system environment of operation is described and documented in the system security plan;
  • [d] the security requirements identified and approved by the designated authority as non-applicable are identified;
  • [e] the method of security requirement implementation is described and documented in the system security plan;
  • [f] the relationship with or connection to other systems is described and documented in the system security plan;
  • [g] the frequency to update the system security plan is defined; and
  • [h] system security plan is updated with the defined frequency.

Evidence to collect

  • System Security Plan · approved within the last 12 months
  • Boundary and data-flow diagrams · matches current environment; reviewed annually
  • Asset inventory referenced by the SSP · reviewed at least annually
  • Not-applicable requirement approvals · approved with the current SSP version
  • Interconnection and provider responsibility records · current versions
  • SSP revision history and review records · showing an update within the defined frequency

SC · System & Communications Protection

SC.L2-3.13.1Boundary Protection [CUI Data]

Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

Assessment objectives

  • [a] the external system boundary is defined;
  • [b] key internal system boundaries are defined;
  • [c] communications are monitored at the external system boundary;
  • [d] communications are monitored at key internal boundaries;
  • [e] communications are controlled at the external system boundary;
  • [f] communications are controlled at key internal boundaries;
  • [g] communications are protected at the external system boundary; and
  • [h] communications are protected at key internal boundaries.

Evidence to collect

  • SSP boundary diagram and data-flow description · reviewed annually and on network change
  • Edge and internal firewall rule exports · current configuration
  • Conditional Access or context-aware access policies · current configuration
  • Centralized boundary logs and alert samples · dated within 90 days
  • Boundary encryption configuration · current configuration
  • Boundary review records · most recent quarter of weekly reviews; last four rule reviews

SC.L2-3.13.2Security Engineering

Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

Assessment objectives

  • [a] architectural designs that promote effective information security are identified;
  • [b] software development techniques that promote effective information security are identified;
  • [c] systems engineering principles that promote effective information security are identified;
  • [d] identified architectural designs that promote effective information security are employed;
  • [e] identified software development techniques that promote effective information security are employed; and
  • [f] identified systems engineering principles that promote effective information security are employed.

Evidence to collect

  • Security architecture and engineering standard · reviewed annually
  • SSP architecture diagrams · updated on change; reviewed annually
  • Project and change records with security review · within the last 12 months
  • Hardened baseline configuration · current configuration
  • Secure development evidence · within the last 6 months
  • Legacy and end-of-life component register · reviewed annually

SC.L2-3.13.3Role Separation

Separate user functionality from system management functionality.

Assessment objectives

  • [a] user functionality is identified;
  • [b] system management functionality is identified; and
  • [c] user functionality is separated from system management functionality.

Evidence to collect

  • User vs. management functionality inventory · reviewed annually
  • Admin and standard account pairing list · dated within 90 days
  • Local administrator membership report · current configuration
  • Management network and jump host configuration · current configuration
  • Quarterly separation review · most recent four quarters

SC.L2-3.13.4Shared Resource Control

Prevent unauthorized and unintended information transfer via shared system resources.

Assessment objectives

  • [a] unauthorized and unintended information transfer via shared system resources is prevented.

Evidence to collect

  • Shared system resource inventory · reviewed annually
  • Patch and side-channel mitigation status · dated within 30 days
  • Share and profile permission report · dated within 90 days
  • Shared workstation and terminal server settings · current configuration
  • Printer and copier security settings · current configuration
  • Cloud provider responsibility matrix · current version

SC.L2-3.13.5Public-Access System Separation [CUI Data]

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Assessment objectives

  • [a] publicly accessible system components are identified; and
  • [b] subnetworks for publicly accessible system components are physically or logically separated from internal networks.

Evidence to collect

  • Publicly accessible component inventory · reviewed quarterly and on change
  • Network diagram with DMZ or external hosting · updated on change
  • DMZ firewall policy · current configuration
  • External scan results · within the last 90 days
  • Separation evidence for cloud-hosted public services · current configuration

SC.L2-3.13.6Network Communication by Exception

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Assessment objectives

  • [a] network communications traffic is denied by default; and
  • [b] network communications traffic is allowed by exception.

Evidence to collect

  • Firewall rule exports showing default deny · current configuration
  • Network services allowlist · reviewed quarterly
  • Host firewall policy · current configuration
  • Quarterly rule review records · most recent four quarters

SC.L2-3.13.7Split Tunneling

Prevent remote devices from simultaneously establishing non- remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

Assessment objectives

  • [a] remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).

Evidence to collect

  • Remote access policy statement on split tunneling · reviewed annually
  • VPN headend full-tunnel configuration · current configuration
  • Managed VPN client profile · current configuration
  • Split tunneling test record · within the last 12 months and after VPN changes

SC.L2-3.13.8Data in Transit

Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Assessment objectives

  • [a] cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified;
  • [b] alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified; and
  • [c] either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission.

Evidence to collect

  • CUI data-in-transit map and cryptography inventory · reviewed annually and on change
  • Physical safeguard documentation · reviewed annually
  • Email encryption configuration · current configuration
  • TLS and protocol configuration · current configuration
  • Protocol scan results · within the last 12 months

SC.L2-3.13.9Connections Termination

Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

Assessment objectives

  • [a] a period of inactivity to terminate network connections associated with communications sessions is defined;
  • [b] network connections associated with communications sessions are terminated at the end of the sessions; and
  • [c] network connections associated with communications sessions are terminated after the defined period of inactivity.

Evidence to collect

  • Session timeout standard · reviewed annually
  • VPN and remote access timeout configuration · current configuration
  • Remote desktop, SSH and appliance session settings · current configuration
  • Cloud session control settings · current configuration
  • Timeout test record and logs · within the last 12 months

SC.L2-3.13.10Key Management

Establish and manage cryptographic keys for cryptography employed in organizational systems.

Assessment objectives

  • [a] cryptographic keys are established whenever cryptography is employed; and
  • [b] cryptographic keys are managed whenever cryptography is employed.

Evidence to collect

  • Cryptographic key and certificate inventory · reviewed annually and on change
  • Key management procedure · reviewed annually
  • Disk encryption key escrow report · dated within 90 days
  • Key store access configuration · current configuration
  • Certificate issuance, renewal and revocation records · within the last 12 months

SC.L2-3.13.11CUI Encryption

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

Assessment objectives

  • [a] FIPS-validated cryptography is employed to protect the confidentiality of CUI.

Evidence to collect

  • FIPS cryptography inventory · reviewed annually and before purchases
  • FIPS mode configuration evidence · current configuration
  • CMVP certificate printouts and vendor FIPS statements · checked within the last 12 months
  • Removable media encryption standard · reviewed annually
  • POA&M or exception record · current

SC.L2-3.13.12Collaborative Device Control

Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.

Assessment objectives

  • [a] collaborative computing devices are identified;
  • [b] collaborative computing devices provide indication to users of devices in use; and
  • [c] remote activation of collaborative computing devices is prohibited.

Evidence to collect

  • Collaborative device inventory · reviewed annually
  • Room system configuration · current configuration
  • Endpoint camera and microphone policy · current configuration
  • Indicator and signage evidence · current
  • User guidance on collaborative devices · reviewed annually

SC.L2-3.13.13Mobile Code

Control and monitor the use of mobile code.

Assessment objectives

  • [a] use of mobile code is controlled; and
  • [b] use of mobile code is monitored.

Evidence to collect

  • Mobile code standard · reviewed annually
  • Browser, Office and PDF reader configuration · current configuration
  • Endpoint protection rule configuration · current configuration
  • Mobile code exception records · all current exceptions
  • Mobile code monitoring reports and review notes · most recent three months

SC.L2-3.13.14Voice over Internet Protocol

Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.

Assessment objectives

  • [a] use of Voice over Internet Protocol (VoIP) technologies is controlled; and
  • [b] use of Voice over Internet Protocol (VoIP) technologies is monitored.

Evidence to collect

  • VoIP acceptable use policy and signatures · reviewed annually; signature for every current user
  • VoIP security configuration · current configuration
  • VoIP patch records · most recent three months
  • VoIP monitoring logs and alerts · dated within 90 days
  • VoIP review records · most recent quarter

SC.L2-3.13.15Communications Authenticity

Protect the authenticity of communications sessions.

Assessment objectives

  • [a] the authenticity of communications sessions is protected.

Evidence to collect

  • Session protection inventory · reviewed annually
  • TLS configuration and scan results · within the last 12 months
  • SMB and LDAP signing policy · current configuration
  • VPN and Wi-Fi certificate authentication configuration · current configuration
  • Certificate inventory and renewal records · reviewed quarterly

SC.L2-3.13.16Data at Rest

Protect the confidentiality of CUI at rest.

Assessment objectives

  • [a] the confidentiality of CUI at rest is protected.

Evidence to collect

  • CUI storage location inventory · reviewed annually and on change
  • Endpoint encryption compliance report · dated within 30 days
  • Server and storage encryption evidence · current configuration
  • Removable media and mobile device policies · current configuration
  • Physical protection records · most recent three months
  • Cloud provider encryption-at-rest documentation · current version

SI · System & Information Integrity

SI.L2-3.14.1Flaw Remediation [CUI Data]

Identify, report, and correct system flaws in a timely manner.

Assessment objectives

  • [a] the time within which to identify system flaws is specified;
  • [b] system flaws are identified within the specified time frame;
  • [c] the time within which to report system flaws is specified;
  • [d] system flaws are reported within the specified time frame;
  • [e] the time within which to correct system flaws is specified; and
  • [f] system flaws are corrected within the specified time frame.

Evidence to collect

  • Vulnerability and patch management procedure · reviewed annually
  • Vulnerability scan reports · most recent three scan cycles
  • Remediation tickets or tracker · within the assessment period
  • Patch compliance report · dated within 30 days
  • Patch deployment configuration · current configuration
  • Exception and POA&M records · all open exceptions

SI.L2-3.14.2Malicious Code Protection [CUI Data]

Provide protection from malicious code at designated locations within organizational systems.

Assessment objectives

  • [a] designated locations for malicious code protection are identified; and
  • [b] protection from malicious code at designated locations is provided.

Evidence to collect

  • Malware protection standard / designated locations · reviewed annually
  • Endpoint protection coverage report · dated within 30 days
  • Endpoint protection policy configuration · current configuration
  • Email and web filtering configuration · current configuration
  • Monthly coverage reconciliation · most recent three months

SI.L2-3.14.3Security Alerts & Advisories

Monitor system security alerts and advisories and take action in response.

Assessment objectives

  • [a] response actions to system security alerts and advisories are identified;
  • [b] system security alerts and advisories are monitored; and
  • [c] actions in response to system security alerts and advisories are taken.

Evidence to collect

  • Security alert and advisory procedure · reviewed annually
  • Subscription evidence · current
  • Advisory review log · most recent three months
  • Response action records · within the assessment period

SI.L2-3.14.4Update Malicious Code Protection [CUI Data]

Update malicious code protection mechanisms when new releases are available.

Assessment objectives

  • [a] malicious code protection mechanisms are updated when new releases are available.

Evidence to collect

  • Malware protection update standard · reviewed annually
  • Update policy configuration · current configuration
  • Definition and agent version report · dated within 30 days
  • Firewall threat-prevention license status · dated within 90 days

SI.L2-3.14.5System & File Scanning [CUI Data]

Perform periodic scans of organizational systems and real -time scans of files from external sources as files are downloaded, opened, or executed.

Assessment objectives

  • [a] the frequency for malicious code scans is defined;
  • [b] malicious code scans are performed with the defined frequency; and
  • [c] real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.

Evidence to collect

  • Scan frequency and external source definition · reviewed annually
  • Scheduled scan configuration · current configuration
  • Scan history and detection report · dated within 30 days
  • Real-time, removable media and email scanning settings · current configuration

SI.L2-3.14.6Monitor Communications for Attacks

Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

Assessment objectives

  • [a] the system is monitored to detect attacks and indicators of potential attacks;
  • [b] inbound communications traffic is monitored to detect attacks and indicators of potential attacks; and
  • [c] outbound communications traffic is monitored to detect attacks and indicators of potential attacks.

Evidence to collect

  • Monitoring description and methodology · reviewed annually
  • Network diagram with monitoring points · updated with network changes
  • EDR and identity alert configuration · current configuration
  • Firewall IPS and egress logging configuration · current configuration
  • Alert and review records · most recent three months

SI.L2-3.14.7Identify Unauthorized Use

Identify unauthorized use of organizational systems.

Assessment objectives

  • [a] authorized use of the system is defined; and
  • [b] unauthorized use of the system is identified.

Evidence to collect

  • Acceptable use policy / rules of behavior · reviewed annually
  • Signed user acknowledgments · within the last 12 months
  • Unauthorized use detection configuration · current configuration
  • Review records and investigations · most recent three months