# Cmmc Assessment Objectives > Verbatim reference for all 320 NIST 800-171A Rev 2 assessment objectives, plus the Rev 2 → Rev 3 control crosswalk. Use for AO-level lookups (e.g., 3.1.1[c]), evidence planning, and forward-mapping to Rev 3. Pairs with cmmc-expert. - Skill: `grcengclub/cmmc-assessment-objectives` (Agent Skill) - Install (CLI): `npx skillmds@latest add grcengclub/cmmc-assessment-objectives` - Raw SKILL.md: https://api.skillmd.com/api/skills/grcengclub/cmmc-assessment-objectives/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: grcengclub (https://skillmd.com/u/grcengclub) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/grcengclub/cmmc-assessment-objectives --- # CMMC Assessment Objectives — 800-171A Rev 2 (with Rev 3 Crosswalk) The scoreable layer underneath every CMMC Level 2 assessment. Where `cmmc-expert` describes the CMMC program, this skill captures the **320 specific objectives** an assessor is actually scoring against, plus the structural Rev 2 → Rev 3 mapping. ## How to use this skill (paired with cmmc-expert) | Question | Skill | |---|---| | What does CMMC require, who needs L1 vs L2, how does SPRS scoring work, what's POA&M-eligible? | `cmmc-expert` | | What does an assessor look for at the objective level for 3.1.1? What does 3.13.11[a] actually say? | **this skill** | | Where does Rev 2 3.5.7 land in Rev 3? Which Rev 2 controls were withdrawn? | **this skill** | | What FedRAMP level does a CSP need for CUI? | `cmmc-expert` | | What does FIPS-validated cryptography mean in Rev 3 vs. Rev 2? | **this skill** (note in 3.13.11 crosswalk row) | **Lookup patterns:** - **By control:** Jump to the family heading (`## 3.X`) → find the practice number. - **By objective:** Each practice lists `[a], [b], [c]...` — these are the scoreable units. - **By Rev 3 equivalent:** Jump to "Rev 2 → Rev 3 Crosswalk" → find the family → row by Rev 2 ID. - **For withdrawn controls:** See the "Quick Reference: Withdrawn Rev 2 Controls" table. ## Source & Verification Status **Layer 1 — Assessment objectives (Rev 2):** - Source: **NIST SP 800-171A** (June 2018; published assessment guide for 800-171 Rev 2). - Status: Withdrawn May 14, 2024; **still operative for CMMC Level 2** under current DoD rulemaking. - DOI for parent 800-171 Rev 2: https://doi.org/10.6028/NIST.SP.800-171r2 - Text below is verbatim from the PDF. **Layer 2 — Rev 2 → Rev 3 crosswalk:** - Source: **NIST SP 800-171 Rev 3** (Final, May 2024). - AC, AT, AU families: PDF-verified. - CM through SI families: high-confidence training-knowledge mapping; verify against the Rev 3 PDF before relying on it for a Rev 3 assessment deliverable. **Critical constants for Rev 2:** - 14 control families · 110 controls · **320 assessment objectives**. - Numbering scheme: `Chapter.Family.Requirement[Objective]` — e.g., `3.1.1[a]` = AC, requirement 1, objective a. --- ## Quick Reference: Counts by Family | Family | Rev 2 Controls | Rev 2 Assessment Objectives | |---|---|---| | 3.1 Access Control (AC) | 22 | **70** | | 3.2 Awareness & Training (AT) | 3 | 9 | | 3.3 Audit & Accountability (AU) | 9 | 29 | | 3.4 Configuration Management (CM) | 9 | **44** | | 3.5 Identification & Authentication (IA) | 11 | 25 | | 3.6 Incident Response (IR) | 3 | 14 | | 3.7 Maintenance (MA) | 6 | 10 | | 3.8 Media Protection (MP) | 9 | 15 | | 3.9 Personnel Security (PS) | 2 | 4 | | 3.10 Physical Protection (PE) | 6 | 16 | | 3.11 Risk Assessment (RA) | 3 | 9 | | 3.12 Security Assessment (CA) | 4 | 14 | | 3.13 System & Comms Protection (SC) | 16 | **41** | | 3.14 System & Info Integrity (SI) | 7 | 20 | | **TOTAL** | **110** | **320** | --- ## Assessment Methods Reference (per NIST SP 800-171A) Three methods — **not four.** "Determine" is the verb each objective opens with, not a separate method. | Method | What it means | Depth attributes | |---|---|---| | **EXAMINE** | Reviewing, inspecting, observing, studying, or analyzing assessment objects (specifications, mechanisms, activities). | Basic / Focused / Comprehensive | | **INTERVIEW** | Discussions with individuals or groups to facilitate understanding, achieve clarification, or obtain evidence. | Basic / Focused / Comprehensive | | **TEST** | Exercising assessment objects under specified conditions to compare actual with expected behavior. | Basic (black box) / Focused (gray box) / Comprehensive (white box) | ### Assessment Objects - **Specifications** — policies, procedures, plans, SSP, designs, requirements. - **Mechanisms** — hardware, software, firmware controls. - **Activities** — system operations, exercises, backup operations. - **Individuals** — system owners, admins, security personnel, users. ### How to read an assessment objective Each lettered sub-item (`[a]`, `[b]`, ...) is **one scoreable assessment objective**. For each, the assessor will (per NIST 800-171A): 1. **Determine** if the objective is satisfied. 2. Support that determination with **E/I/T** evidence — typically all three for any non-trivial control. 3. Mark it **Satisfied** or **Other Than Satisfied** for SPRS / CMMC purposes. **Practice-level rollup:** all AOs within a practice must be Satisfied for the practice to be **MET** in a C3PAO assessment. --- ## 320 Assessment Objectives (NIST SP 800-171A Rev 2) > Text below is verbatim from NIST SP 800-171A. Each lettered sub-item is one scoreable assessment objective. ## 3.1 ACCESS CONTROL (22 controls, 70 objectives) **3.1.1** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices. - [a] authorized users are identified - [b] processes acting on behalf of authorized users are identified - [c] devices (and other systems) authorized to connect to the system are identified - [d] system access is limited to authorized users - [e] system access is limited to processes acting on behalf of authorized users - [f] system access is limited to authorized devices (including other systems) **3.1.2** — Limit system access to the types of transactions and functions that authorized users are permitted to execute. - [a] the types of transactions and functions that authorized users are permitted to execute are defined - [b] system access is limited to the defined types of transactions and functions for authorized users **3.1.3** — Control the flow of CUI in accordance with approved authorizations. - [a] information flow control policies are defined - [b] methods and enforcement mechanisms for controlling the flow of CUI are defined - [c] designated sources and destinations for CUI within the system and between interconnected systems are identified - [d] authorizations for controlling the flow of CUI are defined - [e] approved authorizations for controlling the flow of CUI are enforced **3.1.4** — Separate the duties of individuals to reduce the risk of malevolent activity without collusion. - [a] the duties of individuals requiring separation are defined - [b] responsibilities for duties that require separation are assigned to separate individuals - [c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals **3.1.5** — Employ the principle of least privilege, including for specific security functions and privileged accounts. - [a] privileged accounts are identified - [b] access to privileged accounts is authorized in accordance with the principle of least privilege - [c] security functions are identified - [d] access to security functions is authorized in accordance with the principle of least privilege **3.1.6** — Use non-privileged accounts or roles when accessing nonsecurity functions. - [a] nonsecurity functions are identified - [b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions **3.1.7** — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. - [a] privileged functions are defined - [b] non-privileged users are defined - [c] non-privileged users are prevented from executing privileged functions - [d] the execution of privileged functions is captured in audit logs **3.1.8** — Limit unsuccessful logon attempts. - [a] the means of limiting unsuccessful logon attempts is defined - [b] the defined means of limiting unsuccessful logon attempts is implemented **3.1.9** — Provide privacy and security notices consistent with applicable CUI rules. - [a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category - [b] privacy and security notices are displayed **3.1.10** — Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. - [a] the period of inactivity after which the system initiates a session lock is defined - [b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity - [c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity **3.1.11** — Terminate (automatically) a user session after a defined condition. - [a] conditions requiring a user session to terminate are defined - [b] a user session is automatically terminated after any of the defined conditions occur **3.1.12** — Monitor and control remote access sessions. - [a] remote access sessions are permitted - [b] the types of permitted remote access are identified - [c] remote access sessions are controlled - [d] remote access sessions are monitored **3.1.13** — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. - [a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified - [b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented **3.1.14** — Route remote access via managed access control points. - [a] managed access control points are identified and implemented - [b] remote access is routed through managed network access control points **3.1.15** — Authorize remote execution of privileged commands and remote access to security-relevant information. - [a] privileged commands authorized for remote execution are identified - [b] security-relevant information authorized to be accessed remotely is identified - [c] the execution of the identified privileged commands via remote access is authorized - [d] access to the identified security-relevant information via remote access is authorized **3.1.16** — Authorize wireless access prior to allowing such connections. - [a] wireless access points are identified - [b] wireless access is authorized prior to allowing such connections **3.1.17** — Protect wireless access using authentication and encryption. - [a] wireless access to the system is protected using authentication - [b] wireless access to the system is protected using encryption **3.1.18** — Control connection of mobile devices. - [a] mobile devices that process, store, or transmit CUI are identified - [b] mobile device connections are authorized - [c] mobile device connections are monitored and logged **3.1.19** — Encrypt CUI on mobile devices and mobile computing platforms. - [a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified - [b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms **3.1.20** — Verify and control/limit connections to and use of external systems. - [a] connections to external systems are identified - [b] the use of external systems is identified - [c] connections to external systems are verified - [d] the use of external systems is verified - [e] connections to external systems are controlled/limited - [f] the use of external systems is controlled/limited **3.1.21** — Limit use of portable storage devices on external systems. - [a] the use of portable storage devices containing CUI on external systems is identified and documented - [b] limits on the use of portable storage devices containing CUI on external systems are defined - [c] the use of portable storage devices containing CUI on external systems is limited as defined **3.1.22** — Control CUI posted or processed on publicly accessible systems. - [a] individuals authorized to post or process information on publicly accessible systems are identified - [b] procedures to ensure CUI is not posted or processed on publicly accessible systems are identified - [c] a review process is in place prior to posting of any content to publicly accessible systems - [d] content on publicly accessible systems is reviewed to ensure that it does not include CUI - [e] mechanisms are in place to remove and address improper posting of CUI --- ## 3.2 AWARENESS AND TRAINING (3 controls, 9 objectives) **3.2.1** — Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities. - [a] security risks associated with organizational activities involving CUI are identified - [b] policies, standards, and procedures related to the security of the system are identified - [c] managers, systems administrators, and users of the system are made aware of the security risks associated with their activities - [d] managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system **3.2.2** — Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. - [a] information security-related duties, roles, and responsibilities are defined - [b] information security-related duties, roles, and responsibilities are assigned to designated personnel - [c] personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities **3.2.3** — Provide security awareness training on recognizing and reporting potential indicators of insider threat. - [a] potential indicators associated with insider threats are identified - [b] security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees --- ## 3.3 AUDIT AND ACCOUNTABILITY (9 controls, 29 objectives) **3.3.1** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. - [a] audit logs needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified - [b] the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined - [c] audit records are created (generated) - [d] audit records, once created, contain the defined content - [e] retention requirements for audit records are defined - [f] audit records are retained as defined **3.3.2** — Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. - [a] the content of the audit records needed to support the ability to uniquely trace users to their actions is defined - [b] audit records, once created, contain the defined content **3.3.3** — Review and update logged events. - [a] a process for determining when to review logged events is defined - [b] event types being logged are reviewed in accordance with the defined review process - [c] event types being logged are updated based on the review **3.3.4** — Alert in the event of an audit logging process failure. - [a] personnel or roles to be alerted in the event of an audit logging process failure are identified - [b] types of audit logging process failures for which alert will be generated are defined - [c] identified personnel or roles are alerted in the event of an audit logging process failure **3.3.5** — Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. - [a] audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined - [b] defined audit record review, analysis, and reporting processes are correlated **3.3.6** — Provide audit record reduction and report generation to support on-demand analysis and reporting. - [a] an audit record reduction capability that supports on-demand analysis is provided - [b] a report generation capability that supports on-demand reporting is provided **3.3.7** — Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. - [a] internal system clocks are used to generate time stamps for audit records - [b] an authoritative source with which to compare and synchronize internal system clocks is specified - [c] internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source **3.3.8** — Protect audit information and audit logging tools from unauthorized access, modification, and deletion. - [a] audit information is protected from unauthorized access - [b] audit information is protected from unauthorized modification - [c] audit information is protected from unauthorized deletion - [d] audit logging tools are protected from unauthorized access - [e] audit logging tools are protected from unauthorized modification - [f] audit logging tools are protected from unauthorized deletion **3.3.9** — Limit management of audit logging functionality to a subset of privileged users. - [a] a subset of privileged users granted access to manage audit logging functionality is defined - [b] management of audit logging functionality is limited to the defined subset of privileged users --- ## 3.4 CONFIGURATION MANAGEMENT (9 controls, 44 objectives) **3.4.1** — Establish and maintain baseline configurations and inventories of organizational systems throughout the respective system development life cycles. - [a] a baseline configuration is established - [b] the baseline configuration includes hardware, software, firmware, and documentation - [c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle - [d] a system inventory is established - [e] the system inventory includes hardware, software, firmware, and documentation - [f] the inventory is maintained (reviewed and updated) throughout the system development life cycle **3.4.2** — Establish and enforce security configuration settings for information technology products employed in organizational systems. - [a] security configuration settings for information technology products employed in the system are established and included in the baseline configuration - [b] security configuration settings for information technology products employed in the system are enforced **3.4.3** — Track, review, approve or disapprove, and log changes to organizational systems. - [a] changes to the system are tracked - [b] changes to the system are reviewed - [c] changes to the system are approved or disapproved - [d] changes to the system are logged **3.4.4** — Analyze the security impact of changes prior to implementation. - [a] the security impact of changes to the system is analyzed prior to implementation **3.4.5** — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. - [a] physical access restrictions associated with changes to the system are defined - [b] physical access restrictions associated with changes to the system are documented - [c] physical access restrictions associated with changes to the system are approved - [d] physical access restrictions associated with changes to the system are enforced - [e] logical access restrictions associated with changes to the system are defined - [f] logical access restrictions associated with changes to the system are documented - [g] logical access restrictions associated with changes to the system are approved - [h] logical access restrictions associated with changes to the system are enforced **3.4.6** — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. - [a] essential system capabilities are defined based on the principle of least functionality - [b] the system is configured to provide only the defined essential capabilities **3.4.7** — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. - [a] essential programs are defined - [b] the use of nonessential programs is defined - [c] the use of nonessential programs is restricted, disabled, or prevented as defined - [d] essential functions are defined - [e] the use of nonessential functions is defined - [f] the use of nonessential functions is restricted, disabled, or prevented as defined - [g] essential ports are defined - [h] the use of nonessential ports is defined - [i] the use of nonessential ports is restricted, disabled, or prevented as defined - [j] essential protocols are defined - [k] the use of nonessential protocols is defined - [l] the use of nonessential protocols is restricted, disabled, or prevented as defined - [m] essential services are defined - [n] the use of nonessential services is defined - [o] the use of nonessential services is restricted, disabled, or prevented as defined **3.4.8** — Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. - [a] a policy specifying whether whitelisting or blacklisting is to be implemented is specified - [b] the software allowed to execute under whitelisting or denied use under blacklisting is specified - [c] whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified **3.4.9** — Control and monitor user-installed software. - [a] a policy for controlling the installation of software by users is established - [b] installation of software by users is controlled based on the established policy - [c] installation of software by users is monitored --- ## 3.5 IDENTIFICATION AND AUTHENTICATION (11 controls, 25 objectives) **3.5.1** — Identify system users, processes acting on behalf of users, and devices. - [a] system users are identified - [b] processes acting on behalf of users are identified - [c] devices accessing the system are identified **3.5.2** — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. - [a] the identity of each user is authenticated or verified as a prerequisite to system access - [b] the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access - [c] the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access **3.5.3** — Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. - [a] privileged accounts are identified - [b] multifactor authentication is implemented for local access to privileged accounts - [c] multifactor authentication is implemented for network access to privileged accounts - [d] multifactor authentication is implemented for network access to non-privileged accounts **3.5.4** — Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. - [a] replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts **3.5.5** — Prevent reuse of identifiers for a defined period. - [a] a period within which identifiers cannot be reused is defined - [b] reuse of identifiers is prevented within the defined period **3.5.6** — Disable identifiers after a defined period of inactivity. - [a] a period of inactivity after which an identifier is disabled is defined - [b] identifiers are disabled after the defined period of inactivity **3.5.7** — Enforce a minimum password complexity and change of characters when new passwords are created. - [a] password complexity requirements are defined - [b] password change of character requirements are defined - [c] minimum password complexity requirements as defined are enforced when new passwords are created - [d] minimum password change of character requirements as defined are enforced when new passwords are created **3.5.8** — Prohibit password reuse for a specified number of generations. - [a] the number of generations during which a password cannot be reused is specified - [b] reuse of passwords is prohibited during the specified number of generations **3.5.9** — Allow temporary password use for system logons with an immediate change to a permanent password. - [a] an immediate change to a permanent password is required when a temporary password is used for system logon **3.5.10** — Store and transmit only cryptographically-protected passwords. - [a] passwords are cryptographically protected in storage - [b] passwords are cryptographically protected in transit **3.5.11** — Obscure feedback of authentication information. - [a] authentication information is obscured during the authentication process --- ## 3.6 INCIDENT RESPONSE (3 controls, 14 objectives) **3.6.1** — Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. - [a] an operational incident-handling capability is established - [b] the operational incident-handling capability includes preparation - [c] the operational incident-handling capability includes detection - [d] the operational incident-handling capability includes analysis - [e] the operational incident-handling capability includes containment - [f] the operational incident-handling capability includes recovery - [g] the operational incident-handling capability includes user response activities **3.6.2** — Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. - [a] incidents are tracked - [b] incidents are documented - [c] authorities to whom incidents are to be reported are identified - [d] organizational officials to whom incidents are to be reported are identified - [e] identified authorities are notified of incidents - [f] identified organizational officials are notified of incidents **3.6.3** — Test the organizational incident response capability. - [a] the incident response capability is tested --- ## 3.7 MAINTENANCE (6 controls, 10 objectives) **3.7.1** — Perform maintenance on organizational systems. - [a] system maintenance is performed **3.7.2** — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. - [a] tools used to conduct system maintenance are controlled - [b] techniques used to conduct system maintenance are controlled - [c] mechanisms used to conduct system maintenance are controlled - [d] personnel used to conduct system maintenance are controlled **3.7.3** — Ensure equipment removed for off-site maintenance is sanitized of any CUI. - [a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI **3.7.4** — Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. - [a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI **3.7.5** — Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. - [a] multifactor authentication is used to establish nonlocal maintenance sessions via external network connections - [b] nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete **3.7.6** — Supervise the maintenance activities of maintenance personnel without required access authorization. - [a] maintenance personnel without required access authorization are supervised during maintenance activities --- ## 3.8 MEDIA PROTECTION (9 controls, 15 objectives) **3.8.1** — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. - [a] paper media containing CUI is physically controlled - [b] digital media containing CUI is physically controlled - [c] paper media containing CUI is securely stored - [d] digital media containing CUI is securely stored **3.8.2** — Limit access to CUI on system media to authorized users. - [a] access to CUI on system media is limited to authorized users **3.8.3** — Sanitize or destroy system media containing CUI before disposal or release for reuse. - [a] system media containing CUI is sanitized or destroyed before disposal - [b] system media containing CUI is sanitized before it is released for reuse **3.8.4** — Mark media with necessary CUI markings and distribution limitations. - [a] media containing CUI is marked with applicable CUI markings - [b] media containing CUI is marked with distribution limitations **3.8.5** — Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. - [a] access to media containing CUI is controlled - [b] accountability for media containing CUI is maintained during transport outside of controlled areas **3.8.6** — Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. - [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards **3.8.7** — Control the use of removable media on system components. - [a] the use of removable media on system components is controlled **3.8.8** — Prohibit the use of portable storage devices when such devices have no identifiable owner. - [a] the use of portable storage devices is prohibited when such devices have no identifiable owner **3.8.9** — Protect the confidentiality of backup CUI at storage locations. - [a] the confidentiality of backup CUI is protected at storage locations --- ## 3.9 PERSONNEL SECURITY (2 controls, 4 objectives) **3.9.1** — Screen individuals prior to authorizing access to organizational systems containing CUI. - [a] individuals are screened prior to authorizing access to organizational systems containing CUI **3.9.2** — Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. - [a] a policy and/or process for terminating system access and any credentials coincident with personnel actions is established - [b] system access and credentials are terminated consistent with personnel actions such as termination or transfer - [c] the system is protected during and after personnel transfer actions --- ## 3.10 PHYSICAL PROTECTION (6 controls, 16 objectives) **3.10.1** — Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. - [a] authorized individuals allowed physical access are identified - [b] physical access to organizational systems is limited to authorized individuals - [c] physical access to equipment is limited to authorized individuals - [d] physical access to operating environments is limited to authorized individuals **3.10.2** — Protect and monitor the physical facility and support infrastructure for organizational systems. - [a] the physical facility where organizational systems reside is protected - [b] the support infrastructure for organizational systems is protected - [c] the physical facility where organizational systems reside is monitored - [d] the support infrastructure for organizational systems is monitored **3.10.3** — Escort visitors and monitor visitor activity. - [a] visitors are escorted - [b] visitor activity is monitored **3.10.4** — Maintain audit logs of physical access. - [a] audit logs of physical access are maintained **3.10.5** — Control and manage physical access devices. - [a] physical access devices are identified - [b] physical access devices are controlled - [c] physical access devices are managed **3.10.6** — Enforce safeguarding measures for CUI at alternate work sites. - [a] safeguarding measures for CUI are defined for alternate work sites - [b] safeguarding measures for CUI are enforced for alternate work sites --- ## 3.11 RISK ASSESSMENT (3 controls, 9 objectives) **3.11.1** — Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. - [a] the frequency to assess risk to organizational operations, organizational assets, and individuals is defined - [b] risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency **3.11.2** — Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. - [a] the frequency to scan for vulnerabilities in organizational systems and applications is defined - [b] vulnerability scans are performed on organizational systems with the defined frequency - [c] vulnerability scans are performed on applications with the defined frequency - [d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified - [e] vulnerability scans are performed on applications when new vulnerabilities are identified **3.11.3** — Remediate vulnerabilities in accordance with risk assessments. - [a] vulnerabilities are identified - [b] vulnerabilities are remediated in accordance with risk assessments --- ## 3.12 SECURITY ASSESSMENT (4 controls, 14 objectives) **3.12.1** — Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. - [a] the frequency of security control assessments is defined - [b] security controls are assessed with the defined frequency to determine if the controls are effective in their application **3.12.2** — Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. - [a] deficiencies and vulnerabilities to be addressed by the plan of action are identified - [b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities - [c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities **3.12.3** — Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. - [a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls **3.12.4** — Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. - [a] a system security plan is developed - [b] the system boundary is described and documented in the system security plan - [c] the system environment of operation is described and documented in the system security plan - [d] the security requirements identified and approved by the designated authority as non-applicable are identified - [e] the method of security requirement implementation is described and documented in the system security plan - [f] the relationship with or connection to other systems is described and documented in the system security plan - [g] the frequency to update the system security plan is defined - [h] system security plan is updated with the defined frequency --- ## 3.13 SYSTEM AND COMMUNICATIONS PROTECTION (16 controls, 41 objectives) **3.13.1** — Monitor, control, and protect communications at the external boundaries and key internal boundaries of organizational systems. - [a] the external system boundary is defined - [b] key internal system boundaries are defined - [c] communications are monitored at the external system boundary - [d] communications are monitored at key internal boundaries - [e] communications are controlled at the external system boundary - [f] communications are controlled at key internal boundaries - [g] communications are protected at the external system boundary - [h] communications are protected at key internal boundaries **3.13.2** — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. - [a] architectural designs that promote effective information security are identified - [b] software development techniques that promote effective information security are identified - [c] systems engineering principles that promote effective information security are identified - [d] identified architectural designs that promote effective information security are employed - [e] identified software development techniques that promote effective information security are employed - [f] identified systems engineering principles that promote effective information security are employed **3.13.3** — Separate user functionality from system management functionality. - [a] user functionality is identified - [b] system management functionality is identified - [c] user functionality is separated from system management functionality **3.13.4** — Prevent unauthorized and unintended information transfer via shared system resources. - [a] unauthorized and unintended information transfer via shared system resources is prevented **3.13.5** — Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. - [a] publicly accessible system components are identified - [b] subnetworks for publicly accessible system components are physically or logically separated from internal networks **3.13.6** — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). - [a] network communications traffic is denied by default - [b] network communications traffic is allowed by exception **3.13.7** — Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). - [a] remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (split tunneling) **3.13.8** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. - [a] cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified - [b] alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified - [c] either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission **3.13.9** — Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. - [a] a period of inactivity to terminate network connections associated with communications sessions is defined - [b] network connections associated with communications sessions are terminated at the end of the sessions - [c] network co …(truncated)