03.01 Access control
Rev. 3 access control requirements: account management, access and information flow enforcement, least privilege, logon and session controls, remote, wireless and mobile access, external systems and public content.
NIST SP 800-171
NIST SP 800-171 Rev. 3 security requirements for protecting controlled unclassified information (CUI) in nonfederal systems: all 97 requirements by family, with SP 800-171A assessment procedures, plus guides on Rev. 2 versus Rev. 3, SPRS scores, assessments, cost and scoping.
03.02 Awareness and training
Rev. 3 awareness and training requirements: security literacy training for all users, including insider threat and social engineering, and role-based training for personnel with security duties.
03.03 Audit and accountability
Rev. 3 audit and accountability requirements: which events to log, what audit records contain, generating and retaining them, responding to logging failures, review and correlation, reduction tools, time stamps and protecting audit data.
03.04 Configuration management
Rev. 3 configuration management requirements: baselines, hardening settings, change control and impact analysis, least functionality, software allowlisting, component inventory, CUI location and devices for high-risk travel.
03.05 Identification and authentication
Rev. 3 identification and authentication requirements: unique user and device identity, multi-factor and replay-resistant authentication, identifier, password and authenticator management, and authentication feedback.
03.06 Incident response
Rev. 3 incident response requirements: the incident-handling capability, incident tracking and reporting, testing, role-based incident response training and the incident response plan.
03.07 Maintenance
Rev. 3 maintenance requirements: control of maintenance tools and equipment that may hold CUI, nonlocal (remote) maintenance and authorization and supervision of maintenance personnel.
03.08 Media protection
Rev. 3 media protection requirements for digital and non-digital media that contain CUI: storage, access, sanitization, marking, transport, restrictions on media use and encryption of backups.
03.09 Personnel security
Rev. 3 personnel security requirements: screening people before they get access to systems with CUI, rescreening, and removing or adjusting access when people leave or change roles.
03.10 Physical protection
Rev. 3 physical protection requirements: facility access lists, monitoring physical access, physical access control at entry and exit points, alternate work sites and protecting transmission lines.
03.11 Risk assessment
Rev. 3 risk assessment requirements: assessing the risk of unauthorized disclosure of CUI (including supply chain risk), vulnerability monitoring, scanning and remediation, and responding to findings.
03.12 Security assessment and monitoring
Rev. 3 security assessment and monitoring requirements: periodic assessment of the requirements, plans of action and milestones, continuous monitoring and agreements for exchanging CUI with other systems.
03.13 System and communications protection
Rev. 3 system and communications protection requirements: boundary protection, deny-by-default networking, encryption of CUI in transit and at rest, key management, session controls, collaborative devices and mobile code.
03.14 System and information integrity
Rev. 3 system and information integrity requirements: flaw remediation and patching, malicious code protection, security alerts and advisories, system monitoring, and management and retention of CUI.
03.15 Planning
Rev. 3 planning requirements, a family new in Rev. 3: the policies and procedures behind the requirements, the system security plan and rules of behavior for system users.
03.16 System and services acquisition
Rev. 3 system and services acquisition requirements, a family new in Rev. 3: security engineering principles, replacing unsupported components and security requirements for external service providers.
03.17 Supply chain risk management
Rev. 3 supply chain risk management requirements, a family new in Rev. 3: the supply chain risk management plan, acquisition strategies and tools, and supply chain requirements and processes.
NIST 800-171 and CUI
Controlled unclassified information from the contractor's side: what CUI is, how it differs from FCI, CUI Basic and Specified, marking, controlled technical information, export-controlled data, spotting CUI in a contract, destruction, training and incidents.
DFARS 252.204-7012 compliance
The DFARS clause that puts NIST SP 800-171 into DoD contracts: what it requires, 72-hour incident reporting, malware and media preservation, cloud providers, variances from SP 800-171, flow-down to subcontractors and DoD's voluntary DIB Cybersecurity Program.
NIST 800-171 for universities and civilian agencies
NIST SP 800-171 outside the usual defense prime: universities and research institutions, contractors to civilian agencies under the proposed FAR CUI rule, and DHS's own CUI clause.
NIST 800-171 assessments and enforcement
How compliance is checked and enforced: running a Basic Assessment, DCMA DIBCAC Medium and High assessments, keeping the SPRS score accurate, and False Claims Act settlements over NIST SP 800-171.
NIST 800-171 implementation
Putting NIST SP 800-171 in place: the order to work in, FIPS-validated encryption, sending CUI by email, and remote and hybrid work, with the Government's estimates of the effort involved.
NIST 800-171 guides
Questions organizations ask when a contract requires NIST SP 800-171: Rev. 2 versus Rev. 3, who must comply, the system security plan, SPRS scores, assessments, cost and scoping CUI into an enclave.
