CMMC Control Explorer

Official requirement · DoD Level 2 guide

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

Determine if:

1. [a]authorized users are identified;
2. [b]processes acting on behalf of authorized users are identified;
3. [c]devices (and other systems) authorized to connect to the system are identified;
4. [d]system access is limited to authorized users;
5. [e]system access is limited to processes acting on behalf of authorized users; and
6. [f]system access is limited to authorized devices (including other systems).

Official requirement · DoD Level 2 guide

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

Determine if:

1. [a]the types of transactions and functions that authorized users are permitted to execute are defined; and
2. [b]system access is limited to the defined types of transactions and functions for authorized users.

Official requirement · DoD Level 2 guide

Control the flow of CUI in accordance with approved authorizations.

Determine if:

1. [a]information flow control policies are defined;
2. [b]methods and enforcement mechanisms for controlling the flow of CUI are defined;
3. [c]designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified;
4. [d]authorizations for controlling the flow of CUI are defined; and
5. [e]approved authorizations for controlling the flow of CUI are enforced.

Official requirement · DoD Level 2 guide

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

Determine if:

1. [a]the duties of individuals requiring separation are defined;
2. [b]responsibilities for duties that require separation are assigned to separate individuals; and
3. [c]access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.

Official requirement · DoD Level 2 guide

Employ the principle of least privilege, including for specific security functions and privileged accounts.

Determine if:

1. [a]privileged accounts are identified;
2. [b]access to privileged accounts is authorized in accordance with the principle of least privilege;
3. [c]se curity functions are identified; and
4. [d]access to security functions is authorized in accordance with the principle of least privilege.

Official requirement · DoD Level 2 guide

Use non-privileged accounts or roles when accessing nonsecurity functions.

Determine if:

1. [a]nonsecurity functions are identified; and
2. [b]users are required to use non-privileged accounts or roles when accessing nonsecurity functions.

Official requirement · DoD Level 2 guide

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Determine if:

1. [a]privileged functions are defined;
2. [b]non-privileged users are defined;
3. [c]non-privileged users are prevented from executing privileged functions; and
4. [d]the execution of privileged functions is captured in audit logs.

Official requirement · DoD Level 2 guide

Limit unsuccessful logon attempts.

Determine if:

1. [a]the means of limiting unsuccessful logon attempts is defined; and
2. [b]the defined means of limiting unsuccessful logon attempts is implemented.

Official requirement · DoD Level 2 guide

Provide privacy and security notices consistent with applicable CUI rules.

Determine if:

1. [a]privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category; and
2. [b]privacy and security notices are displayed.

Official requirement · DoD Level 2 guide

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

Determine if:

1. [a]the period of inactivity after which the system initiates a session lock is defined;
2. [b]access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and
3. [c]previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.

Official requirement · DoD Level 2 guide

Terminate (automatically) a user session after a defined condition.

Determine if:

1. [a]conditions requiring a user session to terminate are defined; and
2. [b]a user session is automatically terminated after any of the defined conditions occur.

Official requirement · DoD Level 2 guide

Monitor and control remote access sessions.

Determine if:

1. [a]remote access sessions are permitted;
2. [b]the types of permitted remote access are identified;
3. [c]remote access sessions are controlled; and
4. [d]remote access sessions are monitored.

Official requirement · DoD Level 2 guide

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Determine if:

1. [a]cryptographic mechanisms to protect the confidentiality of remote access sessions are identified; and
2. [b]cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.

Official requirement · DoD Level 2 guide

Route remote access via managed access control points.

Determine if:

1. [a]managed access control points are identified and implemented; and
2. [b]remote access is routed through managed network access control points.

Official requirement · DoD Level 2 guide

Authorize remote execution of privileged commands and remote access to security-relevant information.

Determine if:

1. [a]privileged commands authorized for remote execution are identified;
2. [b]security-relevant information authorized to be accessed remotely is identified;
3. [c]the execution of the identified privileged commands via remote access is authorized; and
4. [d]access to the identified security-relevant information via remote access is authorized.

Official requirement · DoD Level 2 guide

Authorize wireless access prior to allowing such connections.

Determine if:

1. [a]wireless access points are identified; and
2. [b]wireless access is authorized prior to allowing such connections.

Official requirement · DoD Level 2 guide

Protect wireless access using authentication and encryption.

Determine if:

1. [a]wireless access to the system is protected using authentication; and
2. [b]wireless access to the system is protected using encryption.

Official requirement · DoD Level 2 guide

Control connection of mobile devices.

Determine if:

1. [a]mobile devices that process, store, or transmit CUI are identified;
2. [b]mobile device connections are authorized; and
3. [c]mobile device connections are monitored and logged.

Official requirement · DoD Level 2 guide

Encrypt CUI on mobile devices and mobile computing platforms.

Determine if:

1. [a]mobile devices and mobile computing platforms that process, store, or transmit CUI are identified; and
2. [b]encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.

Official requirement · DoD Level 2 guide

Verify and control/limit connections to and use of external systems.

Determine if:

1. [a]connections to external systems are identified;
2. [b]the use of external systems is identified;
3. [c]connections to external systems are verified;
4. [d]the use of external systems is verified;
5. [e]connections to external systems are controlled/limited; and
6. [f]the use of external systems is controlled/limited.

Official requirement · DoD Level 2 guide

Limit use of portable storage devices on external systems.

Determine if:

1. [a]the use of portable storage devices containing CUI on external systems is identified and documented;
2. [b]limits on the use of portable storage devices containing CUI on external systems are defined; and
3. [c]the use of portable storage devices containing CUI on external systems is limited as defined.

Official requirement · DoD Level 2 guide

Control CUI posted or processed on publicly accessible systems.

Determine if:

1. [a]individuals authorized to post or process information on publicly accessible systems are identified;
2. [b]procedures to ensure CUI is not posted or processed on publicly accessible systems are identified;
3. [c]a review process is in place prior to posting of any content to publicly accessible systems;
4. [d]content on publicly accessible systems is reviewed to ensure that it does not include CUI; and
5. [e]mechanisms are in place to remove and address improper posting of CUI.

Official requirement · DoD Level 2 guide

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

Determine if:

1. [a]security risks associated with organizational activities involving CUI are identified;
2. [b]policies, standards, and procedures related to the security of the system are identified;
3. [c]managers, systems administrators, and users of the system are made aware of the security risks associated with their activities; and
4. [d]managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.

Official requirement · DoD Level 2 guide

Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.

Determine if:

1. [a]information security-related duties, roles, and responsibilities are defined;
2. [b]information security-related duties, roles, and responsibilities are assigned to designated personnel; and
3. [c]personnel are adequately trained to carry out their assigned information security- related duties, roles, and responsibilities.

Official requirement · DoD Level 2 guide

Provide security awareness training on recognizing and reporting potential indicators of insider threat.

Determine if:

1. [a]potential indicators associated with insider threats are identified; and
2. [b]security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.

Official requirement · DoD Level 2 guide

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Determine if:

1. [a]audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified;
2. [b]the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined;
3. [c]audit records are created (generated);
4. [d]audit records, once created, contain the defined content;
5. [e]retention requirements for audit records are defined; and
6. [f]audit records are retained as defined.

Official requirement · DoD Level 2 guide

Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Determine if:

1. [a]the content of the audit records needed to support the ability to uniquely trace users to their actions is defined; and
2. [b]audit records, once created, contain the defined content.

Official requirement · DoD Level 2 guide

Review and update logged events.

Determine if:

1. [a]a process for determining when to review logged events is defined;
2. [b]event types being logged are reviewed in accordance with the defined review process; and
3. [c]event types being logged are updated based on the review.

Official requirement · DoD Level 2 guide

Alert in the event of an audit logging process failure.

Determine if:

1. [a]personnel or roles to be alerted in the event of an audit logging process failure are identified;
2. [b]types of audit logging process failures for which alert will be generated are defined; and
3. [c]identified personnel or roles are alerted in the event of an audit logging process failure.

Official requirement · DoD Level 2 guide

Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

Determine if:

1. [a]audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined; and
2. [b]defined audit record review, analysis, and reporting processes are correlated.

Official requirement · DoD Level 2 guide

Provide audit record reduction and report generation to support on-demand analysis and reporting.

Determine if:

1. [a]an audit record reduction capability that supports on-demand analysis is provided; and
2. [b]a report generation capability that supports on-demand reporting is provided.

Official requirement · DoD Level 2 guide

Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

Determine if:

1. [a]internal system clocks are used to generate time stamps for audit records;
2. [b]an authoritative source with which to compare and synchronize internal system clocks is specified; and
3. [c]internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source.

Official requirement · DoD Level 2 guide

Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

Determine if:

1. [a]audit information is protected from unauthorized access;
2. [b]audit information is protected from unauthorized modification;
3. [c]audit information is protected from unauthorized deletion;
4. [d]audit logging tools are protected from unauthorized access;
5. [e]audit logging tools are protected from unauthorized modification; and
6. [f]audit logging tools are protected from unauthorized deletion.

Official requirement · DoD Level 2 guide

Limit management of audit logging functionality to a subset of privileged users.

Determine if:

1. [a]a subset of privileged users granted access to manage audit logging functionality is defined; and
2. [b]management of audit logging functionality is limited to the defined subset of privileged users.

Official requirement · DoD Level 2 guide

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

Determine if:

1. [a]a baseline configuration is established;
2. [b]the baseline configuration includes hardware, software, firmware, and documentation;
3. [c]the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle;
4. [d]a system inventory is established;
5. [e]the system inventory includes hardware, software, firmware, and documentation; and
6. [f]the inventory is maintained (reviewed and updated) throughout the system development life cycle.

Official requirement · DoD Level 2 guide

Establish and enforce security configuration settings for information technology products employed in organizational systems.

Determine if:

1. [a]security configuration settings for information technology products employed in the system are established and included in the baseline configuration; and
2. [b]security configuration settings for information technology products employed in the system are enforced.

Official requirement · DoD Level 2 guide

Track, review, approve or disapprove, and log changes to organizational systems.

Determine if:

1. [a]changes to the system are tracked;
2. [b]changes to the system are reviewed;
3. [c]changes to the system are approved or disapproved; and
4. [d]changes to the system are logged.

Official requirement · DoD Level 2 guide

Analyze the security impact of changes prior to implementation.

Determine if:

1. [a]the security impact of changes to the system is analyzed prior to implementation.

Official requirement · DoD Level 2 guide

Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.

Determine if:

1. [a]physical access restrictions associated with changes to the system are defined;
2. [b]physical access restrictions associated with changes to the system are documented;
3. [c]physical access restrictions associated with changes to the system are approved;
4. [d]physical access restrictions associated with changes to the system are enforced;CAP location planning
5. [e]logical access restrictions associated with changes to the system are defined;
6. [f]logical access restrictions associated with changes to the system are documented;
7. [g]logical access restrictions associated with changes to the system are approved; and
8. [h]logical access restrictions associated with changes to the system are enforced.

Official requirement · DoD Level 2 guide

Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

Determine if:

1. [a]essential system capabilities are defined based on the principle of least functionality; and
2. [b]the system is configured to provide only the defined essential capabilities.

Official requirement · DoD Level 2 guide

Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

Determine if:

1. [a]essential programs are defined;
2. [b]the use of nonessential programs is defined;
3. [c]the use of nonessential programs is restricted, disabled, or prevented as defined;
4. [d]essential functions are defined;
5. [e]the use of nonessential functions is defined;
6. [f]the use of nonessential functions is restricted, disabled, or prevented as defined;
7. [g]essential ports are defined;
8. [h]the use of nonessential ports is defined;
9. [i]the use of nonessential ports is restricted, disabled, or prevented as defined;
10. [j]essential protocols are defined;
11. [k]the use of nonessential protocols is defined;
12. [l]the use of nonessential protocols is restricted, disabled, or prevented as defined;
13. [m]essential services are defined;
14. [n]the use of nonessential services is defined; and
15. [o]the use of nonessential services is restricted, disabled, or prevented as defined.

Official requirement · DoD Level 2 guide

Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

Determine if:

1. [a]a policy specifying whether whitelisting or blacklisting is to be implemented is specified;
2. [b]the software allowed to execute under whitelisting or denied use under blacklisting is specified; and
3. [c]whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.

Official requirement · DoD Level 2 guide

Control and monitor user-installed software.

Determine if:

1. [a]a policy for controlling the installation of software by users is established;
2. [b]installation of software by users is controlled based on the established policy; and
3. [c]installation of software by users is monitored.

Official requirement · DoD Level 2 guide

Identify system users, processes acting on behalf of users, and devices.

Determine if:

1. [a]system users are identified;
2. [b]processes acting on behalf of users are identified; and
3. [c]devices accessing the system are identified.

Official requirement · DoD Level 2 guide

Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

Determine if:

1. [a]the identity of each user is authenticated or verified as a prerequisite to system access;
2. [b]the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and
3. [c]the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.

Official requirement · DoD Level 2 guide

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

Determine if:

1. [a]privileged accounts are identified;
2. [b]multifactor authentication is implemented for local access to privileged accounts;
3. [c]multifactor authentication is implemented for network access to privileged accounts; and
4. [d]multifactor authentication is implemented for network access to non-privileged accounts.

Official requirement · DoD Level 2 guide

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

Determine if:

1. [a]replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts.

Official requirement · DoD Level 2 guide

Prevent reuse of identifiers for a defined period.

Determine if:

1. [a]a period within which identifiers cannot be reused is defined; and
2. [b]reuse of identifiers is prevented within the defined period.

Official requirement · DoD Level 2 guide

Disable identifiers after a defined period of inactivity.

Determine if:

1. [a]a period of inactivity after which an identifier is disabled is defined; and
2. [b]identifiers are disabled after the defined period of inactivity.

Official requirement · DoD Level 2 guide

Enforce a minimum password complexity and change of characters when new passwords are created.

Determine if:

1. [a]password complexity requirements are defined;
2. [b]password change of character requirements are defined;
3. [c]minimum password complexity requirements as defined are enforced when new passwords are created; and
4. [d]minimum password change of character requirements as defined are enforced when new passwords are created.

Official requirement · DoD Level 2 guide

Prohibit password reuse for a specified number of generations.

Determine if:

1. [a]the number of generations during which a password cannot be reused is specified and
2. [b]reuse of passwords is prohibited during the specified number of generations.

Official requirement · DoD Level 2 guide

Allow temporary password use for system logons with an immediate change to a permanent password.

Determine if:

1. [a]an immediate change to a permanent password is required when a temporary password is used for system logon.

Official requirement · DoD Level 2 guide

Store and transmit only cryptographically-protected passwords.

Determine if:

1. [a]passwords are cryptographically protected in storage; and
2. [b]passwords are cryptographically protected in transit.

Official requirement · DoD Level 2 guide

Obscure feedback of authentication information.

Determine if:

1. [a]authentication information is obscured during the authentication process.

Official requirement · DoD Level 2 guide

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

Determine if:

1. [a]an operational incident-handling capability is established;
2. [b]the operational incident-handling capability includes preparation;
3. [c]the operational incident-handling capability includes detection;
4. [d]the operational incident-handling capability includes analysis;
5. [e]the operational incident-handling capability includes containment;
6. [f]the operational incident-handling capability includes recovery; and
7. [g]the operational incident-handling capability includes user response activities.

Official requirement · DoD Level 2 guide

Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

Determine if:

1. [a]incidents are tracked;
2. [b]incidents are documented;
3. [c]authorities to whom incidents are to be reported are identified;
4. [d]organizational officials to whom incidents are to be reported are identified;
5. [e]identified authorities are notified of incidents; and
6. [f]identified organizational officials are notified of incidents.

Official requirement · DoD Level 2 guide

Test the organizational incident response capability.

Determine if:

1. [a]the incident response capability is tested.

Official requirement · DoD Level 2 guide

Perform maintenance on organizational systems.

Determine if:

1. [a]system maintenance is performed.

Official requirement · DoD Level 2 guide

Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

Determine if:

1. [a]tools used to conduct system maintenance are controlled;
2. [b]techniques used to conduct system maintenance are controlled;
3. [c]mechanisms used to conduct system maintenance are controlled; and
4. [d]personnel used to conduct system maintenance are controlled.CAP location planning

Official requirement · DoD Level 2 guide

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

Determine if:

1. [a]equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.

Official requirement · DoD Level 2 guide

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

Determine if:

1. [a]media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI.

Official requirement · DoD Level 2 guide

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

Determine if:

1. [a]multifactor authentication is used to establish nonlocal maintenance sessions via external network connections; and
2. [b]nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.

Official requirement · DoD Level 2 guide

Supervise the maintenance activities of maintenance personnel without required access authorization.

Determine if:

1. [a]maintenance personnel without required access authorization are supervised during maintenance activities.

Official requirement · DoD Level 2 guide

Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

Determine if:

1. [a]paper media containing CUI is physically controlled;
2. [b]digital media containing CUI is physically controlled;
3. [c]paper media containing CUI is securely stored; andCAP location planning
4. [d]digital media containing CUI is securely stored.CAP location planning

Official requirement · DoD Level 2 guide

Limit access to CUI on system media to authorized users.

Determine if:

1. [a]access to CUI on system media is limited to authorized users.

Official requirement · DoD Level 2 guide

Sanitize or destroy system media containing CUI before disposal or release for reuse.

Determine if:

1. [a]system media containing CUI is sanitized or destroyed before disposal; and
2. [b]system media containing CUI is sanitized before it is released for reuse.

Official requirement · DoD Level 2 guide

Mark media with necessary CUI markings and distribution limitations.

Determine if:

1. [a]media containing CUI is marked with applicable CUI markings; andCAP location planning
2. [b]media containing CUI is marked with distribution limitations.CAP location planning

Official requirement · DoD Level 2 guide

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

Determine if:

1. [a]access to media containing CUI is controlled; and
2. [b]accountability for media containing CUI is maintained during transport outside of controlled areas.

Official requirement · DoD Level 2 guide

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

Determine if:

1. [a]the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.

Official requirement · DoD Level 2 guide

Control the use of removable media on system components.

Determine if:

1. [a]the use of removable media on system components is controlled.

Official requirement · DoD Level 2 guide

Prohibit the use of portable storage devices when such devices have no identifiable owner.

Determine if:

1. [a]the use of portable storage devices is prohibited when such devices have no identifiable owner.

Official requirement · DoD Level 2 guide

Protect the confidentiality of backup CUI at storage locations.

Determine if:

1. [a]the confidentiality of backup CUI is protected at storage locations.

Official requirement · DoD Level 2 guide

Screen individuals prior to authorizing access to organizational systems containing CUI.

Determine if:

1. [a]individuals are screened prior to authorizing access to organizational systems containing CUI.

Official requirement · DoD Level 2 guide

Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

Determine if:

1. [a]a policy and/or process for terminating system access and any credentials coincident with personnel actions is established;
2. [b]system access and credentials are terminated consistent with personnel actions such as termination or transfer; and
3. [c]the system is protected during and after personnel transfer actions.

Official requirement · DoD Level 2 guide

Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.

Determine if:

1. [a]authorized individuals allowed physical access are identified;
2. [b]physical access to organizational systems is limited to authorized individuals;CAP location planning
3. [c]physical access to equipment is limited to authorized individuals; andCAP location planning
4. [d]physical access to operating environments is limited to authorized individuals.CAP location planning

Official requirement · DoD Level 2 guide

Protect and monitor the physical facility and support infrastructure for organizational systems.

Determine if:

1. [a]the physical facility where organizational systems reside is protected;CAP location planning
2. [b]the support infrastructure for organizational systems is protected;CAP location planning
3. [c]the physical facility where organizational systems reside is monitored; andCAP location planning
4. [d]the support infrastructure for organizational systems is monitored.CAP location planning

Official requirement · DoD Level 2 guide

Escort visitors and monitor visitor activity.

Determine if:

1. [a]visitors are escorted; andCAP location planning
2. [b]visitor activity is monitored.CAP location planning

Official requirement · DoD Level 2 guide

Maintain audit logs of physical access.

Determine if:

1. [a]audit logs of physical access are maintained.

Official requirement · DoD Level 2 guide

Control and manage physical access devices.

Determine if:

1. [a]physical access devices are identified;
2. [b]physical access devices are controlled; andCAP location planning
3. [c]physical access devices are managed.CAP location planning

Official requirement · DoD Level 2 guide

Enforce safeguarding measures for CUI at alternate work sites.

Determine if:

1. [a]safeguarding measures for CUI are defined for alternate work sites; and
2. [b]safeguarding measures for CUI are enforced for alternate work sites.

Official requirement · DoD Level 2 guide

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

Determine if:

1. [a]the frequency to assess risk to organizational operations, organizational assets, and individuals is defined; and
2. [b]risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency.

Official requirement · DoD Level 2 guide

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

Determine if:

1. [a]the frequency to scan for vulnerabilities in organizational systems and applications is defined;
2. [b]vulnerability scans are performed on organizational systems with the defined frequency;
3. [c]vulnerability scans are performed on applications with the defined frequency;
4. [d]vulnerability scans are performed on organizational systems when new vulnerabilities are identified; and
5. [e]vulnerability scans are performed on applications when new vulnerabilities are identified.

Official requirement · DoD Level 2 guide

Remediate vulnerabilities in accordance with risk assessments.

Determine if:

1. [a]vulnerabilities are identified; and
2. [b]vulnerabilities are remediated in accordance with risk assessments.

Official requirement · DoD Level 2 guide

Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

Determine if:

1. [a]the frequency of security control assessments is defined; and
2. [b]security controls are assessed with the defined frequency to determine if the controls are effective in their application.

Official requirement · DoD Level 2 guide

Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.

Determine if:

1. [a]deficiencies and vulnerabilities to be addressed by the plan of action are identified;
2. [b]a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities; and
3. [c]the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.

Official requirement · DoD Level 2 guide

Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

Determine if:

1. [a]security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.

Official requirement · DoD Level 2 guide

Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

Determine if:

1. [a]a system security plan is developed;
2. [b]the system boundary is described and documented in the system security plan;
3. [c]the system environment of operation is described and documented in the system security plan;
4. [d]the security requirements identified and approved by the designated authority as non-applicable are identified;
5. [e]the method of security requirement implementation is described and documented in the system security plan;
6. [f]the relationship with or connection to other systems is described and documented in the system security plan;
7. [g]the frequency to update the system security plan is defined; and
8. [h]system security plan is updated with the defined frequency.

Official requirement · DoD Level 2 guide

Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

Determine if:

1. [a]the external system boundary is defined;
2. [b]key internal system boundaries are defined;
3. [c]communications are monitored at the external system boundary;
4. [d]communications are monitored at key internal boundaries;
5. [e]communications are controlled at the external system boundary;
6. [f]communications are controlled at key internal boundaries;
7. [g]communications are protected at the external system boundary; and
8. [h]communications are protected at key internal boundaries.

Official requirement · DoD Level 2 guide

Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

Determine if:

1. [a]architectural designs that promote effective information security are identified;
2. [b]software development techniques that promote effective information security are identified;
3. [c]systems engineering principles that promote effective information security are identified;
4. [d]identified architectural designs that promote effective information security are employed;
5. [e]identified software development techniques that promote effective information security are employed; and
6. [f]identified systems engineering principles that promote effective information security are employed.

Official requirement · DoD Level 2 guide

Separate user functionality from system management functionality.

Determine if:

1. [a]user functionality is identified;
2. [b]system management functionality is identified; and
3. [c]user functionality is separated from system management functionality.

Official requirement · DoD Level 2 guide

Prevent unauthorized and unintended information transfer via shared system resources.

Determine if:

1. [a]unauthorized and unintended information transfer via shared system resources is prevented.

Official requirement · DoD Level 2 guide

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Determine if:

1. [a]publicly accessible system components are identified; and
2. [b]subnetworks for publicly accessible system components are physically or logically separated from internal networks.

Official requirement · DoD Level 2 guide

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Determine if:

1. [a]network communications traffic is denied by default; and
2. [b]network communications traffic is allowed by exception.

Official requirement · DoD Level 2 guide

Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

Determine if:

1. [a]remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).

Official requirement · DoD Level 2 guide

Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Determine if:

1. [a]cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified;
2. [b]alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified; and
3. [c]either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission.

Official requirement · DoD Level 2 guide

Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

Determine if:

1. [a]a period of inactivity to terminate network connections associated with communications sessions is defined;
2. [b]network connections associated with communications sessions are terminated at the end of the sessions; and
3. [c]network connections associated with communications sessions are terminated after the defined period of inactivity.

Official requirement · DoD Level 2 guide

Establish and manage cryptographic keys for cryptography employed in organizational systems.

Determine if:

1. [a]cryptographic keys are established whenever cryptography is employed; and
2. [b]cryptographic keys are managed whenever cryptography is employed.

Official requirement · DoD Level 2 guide

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

Determine if:

1. [a]FIPS-validated cryptography is employed to protect the confidentiality of CUI.

Official requirement · DoD Level 2 guide

Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.

Determine if:

1. [a]collaborative computing devices are identified;
2. [b]collaborative computing devices provide indication to users of devices in use; andCAP location planning
3. [c]remote activation of collaborative computing devices is prohibited.

Official requirement · DoD Level 2 guide

Control and monitor the use of mobile code.

Determine if:

1. [a]use of mobile code is controlled; and
2. [b]use of mobile code is monitored.

Official requirement · DoD Level 2 guide

Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.

Determine if:

1. [a]use of Voice over Internet Protocol (VoIP) technologies is controlled; and
2. [b]use of Voice over Internet Protocol (VoIP) technologies is monitored.

Official requirement · DoD Level 2 guide

Protect the authenticity of communications sessions.

Determine if:

1. [a]the authenticity of communications sessions is protected.

Official requirement · DoD Level 2 guide

Protect the confidentiality of CUI at rest.

Determine if:

1. [a]the confidentiality of CUI at rest is protected.

Official requirement · DoD Level 2 guide

Identify, report, and correct system flaws in a timely manner.

Determine if:

1. [a]the time within which to identify system flaws is specified;
2. [b]system flaws are identified within the specified time frame;
3. [c]the time within which to report system flaws is specified;
4. [d]system flaws are reported within the specified time frame;
5. [e]the time within which to correct system flaws is specified; and
6. [f]system flaws are corrected within the specified time frame.

Official requirement · DoD Level 2 guide

Provide protection from malicious code at designated locations within organizational systems.

Determine if:

1. [a]designated locations for malicious code protection are identified; and
2. [b]protection from malicious code at designated locations is provided.

Official requirement · DoD Level 2 guide

Monitor system security alerts and advisories and take action in response.

Determine if:

1. [a]response actions to system security alerts and advisories are identified;
2. [b]system security alerts and advisories are monitored; and
3. [c]actions in response to system security alerts and advisories are taken.

Official requirement · DoD Level 2 guide

Update malicious code protection mechanisms when new releases are available.

Determine if:

1. [a]malicious code protection mechanisms are updated when new releases are available.

Official requirement · DoD Level 2 guide

Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

Determine if:

1. [a]the frequency for malicious code scans is defined;
2. [b]malicious code scans are performed with the defined frequency; and
3. [c]real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.

Official requirement · DoD Level 2 guide

Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

Determine if:

1. [a]the system is monitored to detect attacks and indicators of potential attacks;
2. [b]inbound communications traffic is monitored to detect attacks and indicators of potential attacks; and
3. [c]outbound communications traffic is monitored to detect attacks and indicators of potential attacks.

Official requirement · DoD Level 2 guide

Identify unauthorized use of organizational systems.

Determine if:

1. [a]authorized use of the system is defined; and
2. [b]unauthorized use of the system is identified.

Official requirement · DoD Level 1 guide

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

Determine if:

1. [a]authorized users are identified;
2. [b]processes acting on behalf of authorized users are identified;
3. [c]devices (and other systems) authorized to connect to the system are identified;
4. [d]system access is limited to authorized users;
5. [e]system access is limited to processes acting on behalf of authorized users; and
6. [f]system access is limited to authorized devices (including other systems).

Official requirement · DoD Level 1 guide

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Determine if:

1. [a]the types of transactions and functions that authorized users are permitted to execute are defined; and
2. [b]system access is limited to the defined types of transactions and functions for authorized users.

Official requirement · DoD Level 1 guide

Verify and control/limit connections to and use of external information systems.

Determine if:

1. [a]connections to external systems are identified;
2. [b]the use of external systems is identified;
3. [c]connections to external systems are verified;
4. [d]the use of external systems is verified;
5. [e]connections to external systems are controlled/limited; and
6. [f]the use of external systems is controlled/limited.

Official requirement · DoD Level 1 guide

Control information posted or processed on publicly accessible information systems.

Determine if:

1. [a]individuals authorized to post or process information on publicly accessible systems are identified;
2. [b]procedures to ensure [FCI] is not posted or processed on publicly accessible systems are identified;
3. [c]a review process is in place prior to posting of any content to publicly accessible systems;
4. [d]content on publicly accessible systems is reviewed to ensure that it does not include [FCI]; and
5. [e]mechanisms are in place to remove and address improper posting of [FCI].

Official requirement · DoD Level 1 guide

Identify information system users, processes acting on behalf of users, or devices.

Determine if:

1. [a]system users are identified;
2. [b]processes acting on behalf of users are identified; and
3. [c]devices accessing the system are identified.

Official requirement · DoD Level 1 guide

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Determine if:

1. [a]the identity of each user is authenticated or verified as a prerequisite to system access;
2. [b]the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and
3. [c]the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.

Official requirement · DoD Level 1 guide

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

Determine if:

1. [a]system media containing [FCI] is sanitized or destroyed before disposal; and
2. [b]system media containing [FCI] is sanitized before it is released for reuse.

Official requirement · DoD Level 1 guide

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

Determine if:

1. [a]authorized individuals allowed physical access are identified;
2. [b]physical access to organizational systems is limited to authorized individuals;
3. [c]physical access to equipment is limited to authorized individuals; and
4. [d]physical access to operating environments is limited to authorized individuals.

Official requirement · DoD Level 1 guide

Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

Determine if:

1. [a]visitors are escorted;
2. [b]visitor activity is monitored;
3. [c]audit logs of physical access are maintained;
4. [d]physical access devices are identified;
5. [e]physical access devices are controlled; and
6. [f]physical access devices are managed.

Official requirement · DoD Level 1 guide

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

Determine if:

1. [a]the external system boundary is defined;
2. [b]key internal system boundaries are defined;
3. [c]communications are monitored at the external system boundary;
4. [d]communications are monitored at key internal boundaries;
5. [e]communications are controlled at the external system boundary;
6. [f]communications are controlled at key internal boundaries;
7. [g]communications are protected at the external system boundary; and
8. [h]communications are protected at key internal boundaries.

Official requirement · DoD Level 1 guide

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Determine if:

1. [a]publicly accessible system components are identified; and
2. [b]subnetworks for publicly accessible system components are physically or logically separated from internal networks.

Official requirement · DoD Level 1 guide

Identify, report, and correct information and information system flaws in a timely manner.

Determine if:

1. [a]the time within which to identify system flaws is specified;
2. [b]system flaws are identified within the specified time frame;
3. [c]the time within which to report system flaws is specified;
4. [d]system flaws are reported within the specified time frame;
5. [e]the time within which to correct system flaws is specified; and
6. [f]system flaws are corrected within the specified time frame.

Official requirement · DoD Level 1 guide

Provide protection from malicious code at appropriate locations within organizational information systems.

Determine if:

1. [a]designated locations for malicious code protection are identified; and
2. [b]protection from malicious code at designated locations is provided.

Official requirement · DoD Level 1 guide

Update malicious code protection mechanisms when new releases are available.

Determine if:

1. [a]malicious code protection mechanisms are updated when new releases are available.

Official requirement · DoD Level 1 guide

Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Determine if:

1. [a]the frequency for malicious code scans is defined;
2. [b]malicious code scans are performed with the defined frequency; and
3. [c]real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.