Cmmc Assessment Objectives

CMMC Assessment Objectives — 800-171A Rev 2 (with Rev 3 Crosswalk)

The scoreable layer underneath every CMMC Level 2 assessment. Where cmmc-expert describes the CMMC program, this skill captures the 320 specific objectives an assessor is actually scoring against, plus the structural Rev 2 → Rev 3 mapping.

How to use this skill (paired with cmmc-expert)

Lookup patterns:

• By control: Jump to the family heading (## 3.X) → find the practice number.
• By objective: Each practice lists [a], [b], [c]... — these are the scoreable units.
• By Rev 3 equivalent: Jump to "Rev 2 → Rev 3 Crosswalk" → find the family → row by Rev 2 ID.
• For withdrawn controls: See the "Quick Reference: Withdrawn Rev 2 Controls" table.

Source & Verification Status

Layer 1 — Assessment objectives (Rev 2):

• Source: NIST SP 800-171A (June 2018; published assessment guide for 800-171 Rev 2).
• Status: Withdrawn May 14, 2024; still operative for CMMC Level 2 under current DoD rulemaking.
• DOI for parent 800-171 Rev 2: https://doi.org/10.6028/NIST.SP.800-171r2
• Text below is verbatim from the PDF.

Layer 2 — Rev 2 → Rev 3 crosswalk:

• Source: NIST SP 800-171 Rev 3 (Final, May 2024).
• AC, AT, AU families: PDF-verified.
• CM through SI families: high-confidence training-knowledge mapping; verify against the Rev 3 PDF before relying on it for a Rev 3 assessment deliverable.

Critical constants for Rev 2:

• 14 control families · 110 controls · 320 assessment objectives.
• Numbering scheme: Chapter.Family.Requirement[Objective] — e.g., 3.1.1[a] = AC, requirement 1, objective a.

Quick Reference: Counts by Family

Assessment Methods Reference (per NIST SP 800-171A)

Three methods — not four. "Determine" is the verb each objective opens with, not a separate method.

Assessment Objects

• Specifications — policies, procedures, plans, SSP, designs, requirements.
• Mechanisms — hardware, software, firmware controls.
• Activities — system operations, exercises, backup operations.
• Individuals — system owners, admins, security personnel, users.

How to read an assessment objective

Each lettered sub-item ([a], [b], ...) is one scoreable assessment objective. For each, the assessor will (per NIST 800-171A):

1. Determine if the objective is satisfied.
2. Support that determination with E/I/T evidence — typically all three for any non-trivial control.
3. Mark it Satisfied or Other Than Satisfied for SPRS / CMMC purposes.

Practice-level rollup: all AOs within a practice must be Satisfied for the practice to be MET in a C3PAO assessment.

320 Assessment Objectives (NIST SP 800-171A Rev 2)

Text below is verbatim from NIST SP 800-171A. Each lettered sub-item is one scoreable assessment objective.

3.1 ACCESS CONTROL (22 controls, 70 objectives)

3.1.1 — Limit system access to authorized users, processes acting on behalf of authorized users, and devices.

• [a] authorized users are identified
• [b] processes acting on behalf of authorized users are identified
• [c] devices (and other systems) authorized to connect to the system are identified
• [d] system access is limited to authorized users
• [e] system access is limited to processes acting on behalf of authorized users
• [f] system access is limited to authorized devices (including other systems)

3.1.2 — Limit system access to the types of transactions and functions that authorized users are permitted to execute.

• [a] the types of transactions and functions that authorized users are permitted to execute are defined
• [b] system access is limited to the defined types of transactions and functions for authorized users

3.1.3 — Control the flow of CUI in accordance with approved authorizations.

• [a] information flow control policies are defined
• [b] methods and enforcement mechanisms for controlling the flow of CUI are defined
• [c] designated sources and destinations for CUI within the system and between interconnected systems are identified
• [d] authorizations for controlling the flow of CUI are defined
• [e] approved authorizations for controlling the flow of CUI are enforced

3.1.4 — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

• [a] the duties of individuals requiring separation are defined
• [b] responsibilities for duties that require separation are assigned to separate individuals
• [c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals

3.1.5 — Employ the principle of least privilege, including for specific security functions and privileged accounts.

• [a] privileged accounts are identified
• [b] access to privileged accounts is authorized in accordance with the principle of least privilege
• [c] security functions are identified
• [d] access to security functions is authorized in accordance with the principle of least privilege

3.1.6 — Use non-privileged accounts or roles when accessing nonsecurity functions.

• [a] nonsecurity functions are identified
• [b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions

3.1.7 — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

• [a] privileged functions are defined
• [b] non-privileged users are defined
• [c] non-privileged users are prevented from executing privileged functions
• [d] the execution of privileged functions is captured in audit logs

3.1.8 — Limit unsuccessful logon attempts.

• [a] the means of limiting unsuccessful logon attempts is defined
• [b] the defined means of limiting unsuccessful logon attempts is implemented

3.1.9 — Provide privacy and security notices consistent with applicable CUI rules.

• [a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category
• [b] privacy and security notices are displayed

3.1.10 — Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

• [a] the period of inactivity after which the system initiates a session lock is defined
• [b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity
• [c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity

3.1.11 — Terminate (automatically) a user session after a defined condition.

• [a] conditions requiring a user session to terminate are defined
• [b] a user session is automatically terminated after any of the defined conditions occur

3.1.12 — Monitor and control remote access sessions.

• [a] remote access sessions are permitted
• [b] the types of permitted remote access are identified
• [c] remote access sessions are controlled
• [d] remote access sessions are monitored

3.1.13 — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

• [a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified
• [b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented

3.1.14 — Route remote access via managed access control points.

• [a] managed access control points are identified and implemented
• [b] remote access is routed through managed network access control points

3.1.15 — Authorize remote execution of privileged commands and remote access to security-relevant information.

• [a] privileged commands authorized for remote execution are identified
• [b] security-relevant information authorized to be accessed remotely is identified
• [c] the execution of the identified privileged commands via remote access is authorized
• [d] access to the identified security-relevant information via remote access is authorized

3.1.16 — Authorize wireless access prior to allowing such connections.

• [a] wireless access points are identified
• [b] wireless access is authorized prior to allowing such connections

3.1.17 — Protect wireless access using authentication and encryption.

• [a] wireless access to the system is protected using authentication
• [b] wireless access to the system is protected using encryption

3.1.18 — Control connection of mobile devices.

• [a] mobile devices that process, store, or transmit CUI are identified
• [b] mobile device connections are authorized
• [c] mobile device connections are monitored and logged

3.1.19 — Encrypt CUI on mobile devices and mobile computing platforms.

• [a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified
• [b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms

3.1.20 — Verify and control/limit connections to and use of external systems.

• [a] connections to external systems are identified
• [b] the use of external systems is identified
• [c] connections to external systems are verified
• [d] the use of external systems is verified
• [e] connections to external systems are controlled/limited
• [f] the use of external systems is controlled/limited

3.1.21 — Limit use of portable storage devices on external systems.

• [a] the use of portable storage devices containing CUI on external systems is identified and documented
• [b] limits on the use of portable storage devices containing CUI on external systems are defined
• [c] the use of portable storage devices containing CUI on external systems is limited as defined

3.1.22 — Control CUI posted or processed on publicly accessible systems.

• [a] individuals authorized to post or process information on publicly accessible systems are identified
• [b] procedures to ensure CUI is not posted or processed on publicly accessible systems are identified
• [c] a review process is in place prior to posting of any content to publicly accessible systems
• [d] content on publicly accessible systems is reviewed to ensure that it does not include CUI
• [e] mechanisms are in place to remove and address improper posting of CUI

3.2 AWARENESS AND TRAINING (3 controls, 9 objectives)

3.2.1 — Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities.

• [a] security risks associated with organizational activities involving CUI are identified
• [b] policies, standards, and procedures related to the security of the system are identified
• [c] managers, systems administrators, and users of the system are made aware of the security risks associated with their activities
• [d] managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system

3.2.2 — Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.

• [a] information security-related duties, roles, and responsibilities are defined
• [b] information security-related duties, roles, and responsibilities are assigned to designated personnel
• [c] personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities

3.2.3 — Provide security awareness training on recognizing and reporting potential indicators of insider threat.

• [a] potential indicators associated with insider threats are identified
• [b] security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees

3.3 AUDIT AND ACCOUNTABILITY (9 controls, 29 objectives)

3.3.1 — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

• [a] audit logs needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified
• [b] the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined
• [c] audit records are created (generated)
• [d] audit records, once created, contain the defined content
• [e] retention requirements for audit records are defined
• [f] audit records are retained as defined

3.3.2 — Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

• [a] the content of the audit records needed to support the ability to uniquely trace users to their actions is defined
• [b] audit records, once created, contain the defined content

3.3.3 — Review and update logged events.

• [a] a process for determining when to review logged events is defined
• [b] event types being logged are reviewed in accordance with the defined review process
• [c] event types being logged are updated based on the review

3.3.4 — Alert in the event of an audit logging process failure.

• [a] personnel or roles to be alerted in the event of an audit logging process failure are identified
• [b] types of audit logging process failures for which alert will be generated are defined
• [c] identified personnel or roles are alerted in the event of an audit logging process failure

3.3.5 — Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

• [a] audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined
• [b] defined audit record review, analysis, and reporting processes are correlated

3.3.6 — Provide audit record reduction and report generation to support on-demand analysis and reporting.

• [a] an audit record reduction capability that supports on-demand analysis is provided
• [b] a report generation capability that supports on-demand reporting is provided

3.3.7 — Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

• [a] internal system clocks are used to generate time stamps for audit records
• [b] an authoritative source with which to compare and synchronize internal system clocks is specified
• [c] internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source

3.3.8 — Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

• [a] audit information is protected from unauthorized access
• [b] audit information is protected from unauthorized modification
• [c] audit information is protected from unauthorized deletion
• [d] audit logging tools are protected from unauthorized access
• [e] audit logging tools are protected from unauthorized modification
• [f] audit logging tools are protected from unauthorized deletion

3.3.9 — Limit management of audit logging functionality to a subset of privileged users.

• [a] a subset of privileged users granted access to manage audit logging functionality is defined
• [b] management of audit logging functionality is limited to the defined subset of privileged users

3.4 CONFIGURATION MANAGEMENT (9 controls, 44 objectives)

3.4.1 — Establish and maintain baseline configurations and inventories of organizational systems throughout the respective system development life cycles.

• [a] a baseline configuration is established
• [b] the baseline configuration includes hardware, software, firmware, and documentation
• [c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle
• [d] a system inventory is established
• [e] the system inventory includes hardware, software, firmware, and documentation
• [f] the inventory is maintained (reviewed and updated) throughout the system development life cycle

3.4.2 — Establish and enforce security configuration settings for information technology products employed in organizational systems.

• [a] security configuration settings for information technology products employed in the system are established and included in the baseline configuration
• [b] security configuration settings for information technology products employed in the system are enforced

3.4.3 — Track, review, approve or disapprove, and log changes to organizational systems.

• [a] changes to the system are tracked
• [b] changes to the system are reviewed
• [c] changes to the system are approved or disapproved
• [d] changes to the system are logged

3.4.4 — Analyze the security impact of changes prior to implementation.

• [a] the security impact of changes to the system is analyzed prior to implementation

3.4.5 — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.

• [a] physical access restrictions associated with changes to the system are defined
• [b] physical access restrictions associated with changes to the system are documented
• [c] physical access restrictions associated with changes to the system are approved
• [d] physical access restrictions associated with changes to the system are enforced
• [e] logical access restrictions associated with changes to the system are defined
• [f] logical access restrictions associated with changes to the system are documented
• [g] logical access restrictions associated with changes to the system are approved
• [h] logical access restrictions associated with changes to the system are enforced

3.4.6 — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

• [a] essential system capabilities are defined based on the principle of least functionality
• [b] the system is configured to provide only the defined essential capabilities

3.4.7 — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

• [a] essential programs are defined
• [b] the use of nonessential programs is defined
• [c] the use of nonessential programs is restricted, disabled, or prevented as defined
• [d] essential functions are defined
• [e] the use of nonessential functions is defined
• [f] the use of nonessential functions is restricted, disabled, or prevented as defined
• [g] essential ports are defined
• [h] the use of nonessential ports is defined
• [i] the use of nonessential ports is restricted, disabled, or prevented as defined
• [j] essential protocols are defined
• [k] the use of nonessential protocols is defined
• [l] the use of nonessential protocols is restricted, disabled, or prevented as defined
• [m] essential services are defined
• [n] the use of nonessential services is defined
• [o] the use of nonessential services is restricted, disabled, or prevented as defined

3.4.8 — Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

• [a] a policy specifying whether whitelisting or blacklisting is to be implemented is specified
• [b] the software allowed to execute under whitelisting or denied use under blacklisting is specified
• [c] whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified

3.4.9 — Control and monitor user-installed software.

• [a] a policy for controlling the installation of software by users is established
• [b] installation of software by users is controlled based on the established policy
• [c] installation of software by users is monitored

3.5 IDENTIFICATION AND AUTHENTICATION (11 controls, 25 objectives)

3.5.1 — Identify system users, processes acting on behalf of users, and devices.

• [a] system users are identified
• [b] processes acting on behalf of users are identified
• [c] devices accessing the system are identified

3.5.2 — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

• [a] the identity of each user is authenticated or verified as a prerequisite to system access
• [b] the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access
• [c] the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access

3.5.3 — Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

• [a] privileged accounts are identified
• [b] multifactor authentication is implemented for local access to privileged accounts
• [c] multifactor authentication is implemented for network access to privileged accounts
• [d] multifactor authentication is implemented for network access to non-privileged accounts

3.5.4 — Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

• [a] replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts

3.5.5 — Prevent reuse of identifiers for a defined period.

• [a] a period within which identifiers cannot be reused is defined
• [b] reuse of identifiers is prevented within the defined period

3.5.6 — Disable identifiers after a defined period of inactivity.

• [a] a period of inactivity after which an identifier is disabled is defined
• [b] identifiers are disabled after the defined period of inactivity

3.5.7 — Enforce a minimum password complexity and change of characters when new passwords are created.

• [a] password complexity requirements are defined
• [b] password change of character requirements are defined
• [c] minimum password complexity requirements as defined are enforced when new passwords are created
• [d] minimum password change of character requirements as defined are enforced when new passwords are created

3.5.8 — Prohibit password reuse for a specified number of generations.

• [a] the number of generations during which a password cannot be reused is specified
• [b] reuse of passwords is prohibited during the specified number of generations

3.5.9 — Allow temporary password use for system logons with an immediate change to a permanent password.

• [a] an immediate change to a permanent password is required when a temporary password is used for system logon

3.5.10 — Store and transmit only cryptographically-protected passwords.

• [a] passwords are cryptographically protected in storage
• [b] passwords are cryptographically protected in transit

3.5.11 — Obscure feedback of authentication information.

• [a] authentication information is obscured during the authentication process

3.6 INCIDENT RESPONSE (3 controls, 14 objectives)

3.6.1 — Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

• [a] an operational incident-handling capability is established
• [b] the operational incident-handling capability includes preparation
• [c] the operational incident-handling capability includes detection
• [d] the operational incident-handling capability includes analysis
• [e] the operational incident-handling capability includes containment
• [f] the operational incident-handling capability includes recovery
• [g] the operational incident-handling capability includes user response activities

3.6.2 — Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

• [a] incidents are tracked
• [b] incidents are documented
• [c] authorities to whom incidents are to be reported are identified
• [d] organizational officials to whom incidents are to be reported are identified
• [e] identified authorities are notified of incidents
• [f] identified organizational officials are notified of incidents

3.6.3 — Test the organizational incident response capability.

• [a] the incident response capability is tested

3.7 MAINTENANCE (6 controls, 10 objectives)

3.7.1 — Perform maintenance on organizational systems.

• [a] system maintenance is performed

3.7.2 — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

• [a] tools used to conduct system maintenance are controlled
• [b] techniques used to conduct system maintenance are controlled
• [c] mechanisms used to conduct system maintenance are controlled
• [d] personnel used to conduct system maintenance are controlled

3.7.3 — Ensure equipment removed for off-site maintenance is sanitized of any CUI.

• [a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI

3.7.4 — Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

• [a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI

3.7.5 — Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

• [a] multifactor authentication is used to establish nonlocal maintenance sessions via external network connections
• [b] nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete

3.7.6 — Supervise the maintenance activities of maintenance personnel without required access authorization.

• [a] maintenance personnel without required access authorization are supervised during maintenance activities

3.8 MEDIA PROTECTION (9 controls, 15 objectives)

3.8.1 — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

• [a] paper media containing CUI is physically controlled
• [b] digital media containing CUI is physically controlled
• [c] paper media containing CUI is securely stored
• [d] digital media containing CUI is securely stored

3.8.2 — Limit access to CUI on system media to authorized users.

• [a] access to CUI on system media is limited to authorized users

3.8.3 — Sanitize or destroy system media containing CUI before disposal or release for reuse.

• [a] system media containing CUI is sanitized or destroyed before disposal
• [b] system media containing CUI is sanitized before it is released for reuse

3.8.4 — Mark media with necessary CUI markings and distribution limitations.

• [a] media containing CUI is marked with applicable CUI markings
• [b] media containing CUI is marked with distribution limitations

3.8.5 — Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

• [a] access to media containing CUI is controlled
• [b] accountability for media containing CUI is maintained during transport outside of controlled areas

3.8.6 — Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

• [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards

3.8.7 — Control the use of removable media on system components.

• [a] the use of removable media on system components is controlled

3.8.8 — Prohibit the use of portable storage devices when such devices have no identifiable owner.

• [a] the use of portable storage devices is prohibited when such devices have no identifiable owner

3.8.9 — Protect the confidentiality of backup CUI at storage locations.

• [a] the confidentiality of backup CUI is protected at storage locations

3.9 PERSONNEL SECURITY (2 controls, 4 objectives)

3.9.1 — Screen individuals prior to authorizing access to organizational systems containing CUI.

• [a] individuals are screened prior to authorizing access to organizational systems containing CUI

3.9.2 — Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

• [a] a policy and/or process for terminating system access and any credentials coincident with personnel actions is established
• [b] system access and credentials are terminated consistent with personnel actions such as termination or transfer
• [c] the system is protected during and after personnel transfer actions

3.10 PHYSICAL PROTECTION (6 controls, 16 objectives)

3.10.1 — Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.

• [a] authorized individuals allowed physical access are identified
• [b] physical access to organizational systems is limited to authorized individuals
• [c] physical access to equipment is limited to authorized individuals
• [d] physical access to operating environments is limited to authorized individuals

3.10.2 — Protect and monitor the physical facility and support infrastructure for organizational systems.

• [a] the physical facility where organizational systems reside is protected
• [b] the support infrastructure for organizational systems is protected
• [c] the physical facility where organizational systems reside is monitored
• [d] the support infrastructure for organizational systems is monitored

3.10.3 — Escort visitors and monitor visitor activity.

• [a] visitors are escorted
• [b] visitor activity is monitored

3.10.4 — Maintain audit logs of physical access.

• [a] audit logs of physical access are maintained

3.10.5 — Control and manage physical access devices.

• [a] physical access devices are identified
• [b] physical access devices are controlled
• [c] physical access devices are managed

3.10.6 — Enforce safeguarding measures for CUI at alternate work sites.

• [a] safeguarding measures for CUI are defined for alternate work sites
• [b] safeguarding measures for CUI are enforced for alternate work sites

3.11 RISK ASSESSMENT (3 controls, 9 objectives)

3.11.1 — Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

• [a] the frequency to assess risk to organizational operations, organizational assets, and individuals is defined
• [b] risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency

3.11.2 — Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

• [a] the frequency to scan for vulnerabilities in organizational systems and applications is defined
• [b] vulnerability scans are performed on organizational systems with the defined frequency
• [c] vulnerability scans are performed on applications with the defined frequency
• [d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified
• [e] vulnerability scans are performed on applications when new vulnerabilities are identified

3.11.3 — Remediate vulnerabilities in accordance with risk assessments.

• [a] vulnerabilities are identified
• [b] vulnerabilities are remediated in accordance with risk assessments

3.12 SECURITY ASSESSMENT (4 controls, 14 objectives)

3.12.1 — Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

• [a] the frequency of security control assessments is defined
• [b] security controls are assessed with the defined frequency to determine if the controls are effective in their application

3.12.2 — Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.

• [a] deficiencies and vulnerabilities to be addressed by the plan of action are identified
• [b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities
• [c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities

3.12.3 — Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

• [a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls

3.12.4 — Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

• [a] a system security plan is developed
• [b] the system boundary is described and documented in the system security plan
• [c] the system environment of operation is described and documented in the system security plan
• [d] the security requirements identified and approved by the designated authority as non-applicable are identified
• [e] the method of security requirement implementation is described and documented in the system security plan
• [f] the relationship with or connection to other systems is described and documented in the system security plan
• [g] the frequency to update the system security plan is defined
• [h] system security plan is updated with the defined frequency

3.13 SYSTEM AND COMMUNICATIONS PROTECTION (16 controls, 41 objectives)

3.13.1 — Monitor, control, and protect communications at the external boundaries and key internal boundaries of organizational systems.

• [a] the external system boundary is defined
• [b] key internal system boundaries are defined
• [c] communications are monitored at the external system boundary
• [d] communications are monitored at key internal boundaries
• [e] communications are controlled at the external system boundary
• [f] communications are controlled at key internal boundaries
• [g] communications are protected at the external system boundary
• [h] communications are protected at key internal boundaries

3.13.2 — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

• [a] architectural designs that promote effective information security are identified
• [b] software development techniques that promote effective information security are identified
• [c] systems engineering principles that promote effective information security are identified
• [d] identified architectural designs that promote effective information security are employed
• [e] identified software development techniques that promote effective information security are employed
• [f] identified systems engineering principles that promote effective information security are employed

3.13.3 — Separate user functionality from system management functionality.

• [a] user functionality is identified
• [b] system management functionality is identified
• [c] user functionality is separated from system management functionality

3.13.4 — Prevent unauthorized and unintended information transfer via shared system resources.

• [a] unauthorized and unintended information transfer via shared system resources is prevented

3.13.5 — Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

• [a] publicly accessible system components are identified
• [b] subnetworks for publicly accessible system components are physically or logically separated from internal networks

3.13.6 — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

• [a] network communications traffic is denied by default
• [b] network communications traffic is allowed by exception

3.13.7 — Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

• [a] remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (split tunneling)

3.13.8 — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

• [a] cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified
• [b] alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified
• [c] either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission

3.13.9 — Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

• [a] a period of inactivity to terminate network connections associated with communications sessions is defined
• [b] network connections associated with communications sessions are terminated at the end of the sessions
• [c] network co

…(truncated)