Rev. 3 system and communications protection requirements: boundary protection, deny-by-default networking, encryption of CUI in transit and at rest, key management, session controls, collaborative devices and mobile code.
Monitoring and controlling communications at external and key internal managed interfaces, separating publicly accessible components into their own subnetworks and connecting to external systems only through managed boundary devices. Rev. 3 folded Rev. 2's 3.13.5 into it.
Preventing unauthorized and unintended information transfer through shared system resources that are released and reused between users or processes (object reuse and residual information protection).
Denying network communications traffic by default and allowing only traffic that is specifically permitted.
Using cryptography to prevent unauthorized disclosure of CUI in transit and at rest. Rev. 3 incorporated Rev. 2's 3.8.6 (encrypting CUI on media in transport) and 3.13.16 (CUI at rest) here and treats 3.1.13 (remote sessions) as addressed by it.
Terminating the network connection for a communications session at the end of the session or after a defined period of inactivity.
Establishing and managing cryptographic keys under defined requirements for key generation, distribution, storage, access and destruction.
Implementing the organization-defined types of cryptography where cryptography protects the confidentiality of CUI; NIST's discussion recommends FIPS-validated cryptography, and the Rev. 2 counterpart carries partial credit in DoD and CMMC scoring.
Blocking remote activation of collaborative devices and applications such as cameras, microphones and whiteboards, except where defined, and giving people in the room an explicit indication of use.
Defining acceptable mobile code and mobile code technologies, such as JavaScript or HTML5 content that runs without explicit installation, and authorizing, monitoring and controlling its use.
Protecting the authenticity of communications sessions against adversary-in-the-middle attacks, session hijacking and insertion of false information.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.