NIST SP 800-172 Rev. 3 日本語訳

Victoria Pillitteri Ron Ross

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172r3

Victoria Pillitteri

Ron Ross¹

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172r3

May 2026

U.S. Department of Commerce

Howard Lutnick, Secretary of Commerce

National Institute of Standards and Technology

Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

Publication History Approved by the NIST Editorial Review Board on 2026-04-27

Pillitteri V, Ross R (2026) Enhanced Security Requirements for Protecting Controlled Unclassified Information. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-172r3. https://doi.org/10.6028/NIST.SP.800-172r3

Victoria Pillitteri: 0000-0002-7446-7506

Ron Ross: 0000-0002-1099-9757

Contact Information sec-cert@nist.gov National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Additional Information Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/172/r3/final, including related content, potential updates, and document history.

All comments are subject to release under the Freedom of Information Act (FOIA).

The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides federal agencies with a set of recommended enhanced security requirements for providing additional protection to the confidentiality, integrity, and availability of CUI when it is resident in a nonfederal system and organization and associated with a critical program or high value asset (HVA). It is designed as a supplement to NIST Special Publication (SP) 800-171 to protect against advanced persistent threats (APTs). The security requirements apply to the components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components only when selected and required by federal agencies to manage risks to CUI. The enhanced security requirements are intended for use by federal agencies in contractual vehicles or other agreements established between those agencies and nonfederal organizations. There is no expectation that all of the enhanced security requirements will be selected by federal agencies. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by agencies’ ongoing risk assessments.

advanced persistent threat; contractor systems; controlled unclassified information; CUI registry; enhanced security requirement; Executive Order 13556; FISMA; NIST Special Publication 800-172; NIST Special Publication 800-53; nonfederal organizations; nonfederal systems; security assessment; security control; security requirement.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Supplemental Content

The following materials are available on the publication details page to supplement the guidelines provided in this publication:

Audience

This publication serves a diverse group of individuals and organizations in the public and private sectors, including individuals with:

The above roles and responsibilities can be viewed from two perspectives:

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

The authors gratefully acknowledge and appreciate the contributions from individuals and organizations in the public and private sectors whose constructive comments improved the overall quality, thoroughness, and usefulness of this publication. In particular, the authors wish to thank Jeffrey Eyink from the Department of Defense (DOD) Chief Information Office for his contributions to this update. The authors also wish to thank the NIST technical editing and production staff — Jim Foti, Jeff Brewer, Eduardo Takamura, Jeremy Licata, Isabel Van Wyk, Derek Sappington, Michaela Iorga, Selena Xiao, and Cristina Ritfeld — for their outstanding support in preparing this document and datasets for publication. NIST also acknowledges the Howard County, MD mentoring program at Mt. Hebron High School in its ongoing commitment to developing the next generation of cybersecurity professionals. In particular, the authors recognize and thank Rithwik Puli for his outstanding contributions to the draft of this publication.

Historical Contributions

The authors also acknowledge the following organizations and individuals for their historic contributions to this publication:

Executive Order (EO) 13556 [1] established a government-wide program to standardize how the executive branch handles Controlled Unclassified Information (CUI).¹ EO 13556 required that the CUI program emphasize government-wide openness, transparency, and uniformity and that the program implementation take place in a manner consistent with Office of Management and Budget (OMB) policies and National Institute of Standards and Technology (NIST) standards and guidelines. The National Archives and Records Administration (NARA), as the CUI program Executive Agent, provides information, guidance, policy, and requirements on handling CUI [4]. This includes approved CUI categories and category descriptions, the basis for safeguarding and disseminating controls, and procedures for the use of CUI.² The CUI federal regulation provides guidance to federal agencies on the designation, safeguarding, marking, dissemination, decontrolling, and disposition of CUI; establishes self-inspection and oversight requirements; and delineates other facets of the program [5].

The CUI regulation requires federal agencies that use federal information systems³ to process, store, or transmit CUI to comply with NIST standards and guidelines. The responsibility of federal agencies to protect CUI does not change when such information is shared with nonfederal organizations.⁴ Therefore, a similar level of protection is needed when CUI is processed, stored, or transmitted by nonfederal organizations using nonfederal systems. The requirements for protecting CUI in nonfederal systems and organizations must comply with Federal Information Processing Standards (FIPS) 199 [6] and FIPS 200 [7] to maintain a consistent level of protection. The requirements for the protection of CUI in NIST SP 800-171 and the enhanced security requirements in NIST SP 800-172 are derived from the controls in NIST Special Publication (SP) 800-53 [8].

In certain situations, CUI may be associated with a critical program⁵ or a high value asset.⁶ These programs and assets are potential targets for the advanced persistent threat (APT). An APT is an adversary or adversarial group that possesses the expertise and resources that allow it to create opportunities to achieve its objectives by using multiple attack vectors, including cyber, physical, and deception.⁷ These objectives include establishing and extending footholds within the systems of targeted organizations for the purpose of exfiltrating information; undermining or impeding critical aspects of a mission, function, program, or organization; or positioning itself to carry out these objectives in the future. The APT pursues its objectives repeatedly over an extended period, attempts to avoid detection, adapts to defenders’ efforts to resist it, and is determined to maintain the level of interaction needed to execute its objectives. CUI associated with critical programs or high value assets is at increased risk and requires additional protection because the APT is likely to target such information.

The APT is dangerous to the national and economic security interests of the United States since organizations depend on systems⁸ of all types, including information technology (IT) systems, operational technology (OT) systems, and (3) Internet of Things (IoT) devices. The convergence of these types of systems and devices has brought forth a new class of systems known as cyber-physical systems, many of which are in sectors of United States critical infrastructure, including energy, transportation, defense, manufacturing, healthcare, finance, and information and communications. Therefore, CUI that is processed, stored, or transmitted by any systems related to a critical program or high value asset requires additional protection from the APT.

This publication provides federal agencies with a set of recommended enhanced security requirements⁹ for protecting the confidentiality, integrity, and availability of CUI when such information is resident in nonfederal systems and organizations and where there are no specific safeguarding requirements prescribed by the authorizing law, regulation, or government-wide policy for the CUI category listed in the CUI registry [4].¹⁰ The enhanced security requirements are designed to provide additional protection for CUI in nonfederal systems and organizations when such information is associated with critical programs or high value assets by promoting penetration-resistant architecture, damage-limiting operations, and cyber resiliency.¹¹ The enhanced security requirements supplement the security requirements in SP 800-171 [12] and apply to components¹² of nonfederal systems that process, store, or transmit CUI associated with a critical program or a high value asset or that provide protection for such components. Both the security requirements and enhanced security requirements are intended for use by federal agencies in contractual vehicles or other agreements that are established between those agencies and nonfederal organizations.

There are three types of enhanced security requirements in this publication: (1) requirements that enhance a security requirement in SP 800-171 [12]; (2) requirements that are sourced to security controls tailored out of the SP 800-53B [13] moderate baseline in SP 800-171; and (3) requirements that are not directly related to the security requirements in SP 800-171, but can be used to strengthen the protection of CUI associated with critical programs or high value assets. The type of security requirement is noted in the discussion section of each requirement.

Appropriately scoping security requirements is an important factor in determining protection-related investment decisions and managing security risks for nonfederal organizations. If nonfederal organizations designate specific system components to process, store, or transmit CUI associated with a critical program or a high value asset, those organizations may limit the scope of the security requirements by isolating the system components in a separate CUI security domain. Isolation can be achieved by applying architectural and design concepts (e.g., implementing subnetworks with firewalls, software-defined perimeters, micro-segmentation, zero trust network architectures, and information flow control mechanisms). Security domains may employ physical separation, logical separation, or a combination of both. This approach can provide adequate security for CUI and avoid increasing the organization’s security posture beyond what it requires to protect its missions, functions, operations, and assets.

This publication does not provide guidance on which organizational programs or assets are determined to be critical or of high value. Those determinations are made by the federal agencies mandating the use of the security requirements for additional protection and can be guided and informed by laws, Executive Orders, directives, regulations, or policies. Additionally, this publication does not provide guidance on specific types of threats or attack scenarios that justify the use of the security requirements. Finally, there is no expectation that all of the security requirements will be needed in every situation. Rather, requirements are selected by federal agencies based on mission needs and risk.

The remainder of this publication is organized as follows:

The following sections provide additional information to support the protection of CUI:

This section describes the assumptions and methodology used to develop the enhanced security requirements for nonfederal systems and organizations to protect the confidentiality, integrity, and availability of CUI associated with critical systems or high value assets.

The enhanced security requirements in this publication are based on the following assumptions:

The enhanced security requirements provide the capability to achieve a multidimensional, defense-in-depth protection strategy [14] focused on the APT that includes:

This strategy recognizes that the APT may find ways to compromise established defenses despite the best safeguards implemented by organizations. When this occurs, organizations must have access to additional safeguards to detect, outmaneuver, confuse, deceive, mislead, and impede the adversary — that is, removing the adversary’s tactical advantage and protecting the organization’s critical programs and high value assets. Figure 1 shows the complementary nature of the enhanced security requirements when they are implemented as part of a multidimensional protection strategy

Fig. 1. Multidimensional protection strategy

The enhanced security requirements are derived from the security controls and control enhancements in SP 800-53 [8]. The requirements address safeguards to protect CUI from the APT and ensure the cyber resiliency of systems and organizations. The security requirements focus on the following key elements, which are essential to addressing the APT:

Similar to the security requirements in SP 800-171 [12], the enhanced security requirements are organized into 17 families, as illustrated in Table 1.

Table 1. Enhanced security requirement families

Each family contains the security requirements related to the general security topic of the family.¹⁵ The structure of the security requirements is the same as the requirements in SP 800-171 [12]. The enhanced security requirements are distinguished from the security requirements in SP 800-171 by appending the letter “E” to the requirement numbers. However, the sequential numbering of enhanced security requirements in SP 800-172 does not mean that an enhanced security requirement (e.g., 03.01.01E) is an enhancement to the similarly numbered requirement (e.g., 03.01.01) in SP 800-171.

Organization-defined parameters (ODPs) are used in certain enhanced security requirements. ODPs provide flexibility in implementation through the use of assignment and selection operations to allow federal agencies and nonfederal organizations to specify values for the designated parameters in the requirements.¹⁶ Assignment and selection operations provide the capability to customize the enhanced security requirements based on specific protection needs.

The determination of ODP values can be guided and informed by laws, Executive Orders, directives, regulations, policies, standards, guidance, or mission and business needs. Once specified, the values for the ODPs become part of the requirement. A discussion section is included with each requirement. It is derived from the control discussion section in SP 800-53 [8] and provides additional information to facilitate the implementation and assessment of the requirement. The discussion section is informative, not normative. It is not intended to extend the scope of a requirement or influence the solutions that organizations may implement to satisfy a requirement. The use of examples is notional, not exhaustive, and does not reflect the potential options available to organizations. If applicable, the security requirement in SP 800-171 [12] that is enhanced by the requirement is noted in this section.

A protection strategy section describes which of the three elements of the multidimensional protection strategy (i.e., penetration-resistant architecture [PRA], damage-limiting operations [DLO], and cyber resiliency [CRS]) are addressed by the enhanced security requirement.

An adversary effects section describes the potential effects of implementing the enhanced security requirement on risk, specifically by reducing the likelihood of the occurrence of threat events, the ability of threat events to cause harm, and the extent of that harm. Five desired effects on the adversary can be identified: preclude, expose, redirect, impede, and limit. Each adversary effect is further decomposed to include specific impacts on risk and expected results. The adversary effects are described in SP 800-160v2, (Volume 2) [14]and in Appendix D.

Finally, a references section lists the source controls¹⁷ from SP 800-53 [8] that are associated with the enhanced security requirement. The hyperlink associated with each control provides access to the NIST Cybersecurity and Privacy Reference Tool (CPRT),¹⁸ which includes references to a variety of supporting technical publications. The structure and content of an enhanced security requirement is provided in the example below.

03.13.08E Decoys

Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.

Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and deflect attacks away from the operational systems that support organizational missions and business functions. The use of decoys requires some supporting isolation measures to ensure that any deflected malicious code does not infect organizational systems. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Expose (Detect), Limit (Reduce)

Source Control: SC-26

Organizations¹⁹ can select the enhanced security requirements either comprehensively or selectively as part of their overarching risk management strategy. However, there are dependencies among certain requirements that may affect the selection process. The decision to select specific enhanced security requirements is based on the mission and business needs of the federal agency, group of agencies, or the Federal Government (i.e., federal entity) and is guided and informed by ongoing assessments of risk.

Federal agencies may scope the application of the enhanced security requirements as long as the needed protection is achieved, such as by applying the enhanced security requirements to the components of nonfederal systems that process, store, or transmit CUI that is associated with a critical program or high value asset; provide protection for such components; or provide a direct attack path to such components (e.g., due to established trust relationships between system components).²⁰

The security requirements for a nonfederal system processing, storing, or transmitting CUI that is associated with a critical program or a high value asset are conveyed to the nonfederal organization by the federal entity in a contract, grant, or other agreement. The implementation guidance associated with the security requirements is beyond the scope of this publication. Organizations have flexibility in the methods, techniques, technologies, and approaches used to satisfy the requirements.²¹

The enhanced security requirements are implemented in addition to security requirements in SP 800-171, since those requirements are not designed to address the APT. The enhanced security requirements apply to those components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components.

There is no expectation that all of the enhanced security requirements will be selected by federal agencies implementing this guidance. The decision to select a particular set of enhanced security requirements will be based on the mission and business needs of federal agencies and guided and informed by ongoing risk assessments.

The enhanced security requirements for nonfederal systems that process, store, or transmit CUI associated with critical programs or high value assets will be conveyed to nonfederal organizations by federal agencies in a contract, grant, or other agreement. The application of the enhanced security requirements to subcontractors will also be addressed by federal agencies in consultation with nonfederal organizations.

This section describes enhanced security requirements that are designed to protect the confidentiality, integrity, and availability of CUI in nonfederal systems and organizations. The enhanced security requirements are not required for any particular category or article of CUI. However, if a federal agency determines that CUI is associated with a critical program or a high value asset, the CUI and the system that processes, stores, or transmits such information are potential targets for the APT and, therefore, may require increased protection. Such protection is expressed through the enhanced security requirements and is mandated by a federal agency in a contract, grant, or other agreement. The enhanced security requirements are selected in addition to the foundational requirements in SP 800-171 [12]; there is no expectation that all of the enhanced security requirements will be selected by the federal agency.

Enhanced security requirements support one or more protection strategies with potential effects on adversaries. The strategies and adversary effects are included in the supplementary information for each enhanced security requirement to assist organizations in ascertaining whether the requirement is appropriate. Ideally, the selected requirements should be balanced across the three protection strategies. Selecting requirements that fall exclusively in one area could result in an unbalanced response strategy for dealing with the APT. Similarly, organizations should attempt to have as broad a set of effects on an adversary as possible, given their specific mission or business objectives.

Certain enhanced security requirements have been withdrawn because they are no longer relevant, or they are covered by other requirements in SP 800-171 [12] and this publication.

SP 800-172A provides a set of procedures to assess the security requirements described in this publication. The assessment procedures are based on the procedures described in SP 800-53A [16].

03.01.01E Dual Authorization

Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Dual authorization requires the approval of two authorized individuals to execute privileged commands and/or other organizational actions that may affect the protection of CUI. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals as part of a separation of duties policy. Organizations also consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.01.02.

Preclude (Preempt), Impede (Exert)

Source Control: AC-03(02)

03.01.02E Non-Organizationally Owned Systems – Restricted Use

Restrict the use of non-organizationally owned systems or system components to process, store, or transmit CUI using [Assignment: organization-defined restrictions].

Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. These also include systems and system components that are leased, part of subscription services, government-furnished equipment, or “bring your own” devices. There are risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high to prohibit such use. In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved safeguards prior to authorizing connections to non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to system components that are provisioned by the organization; and agreeing to the terms and conditions for usage. This requirement enhances SP 800-171 requirement 03.01.20.

Preclude (Preempt), Impede (Contain, Exert)

Source Control: AC-20(03)

03.01.03E Withdrawn

Addressed by 03.01.09E, 03.01.10E, and 03.01.03 (SP 800-171).

03.01.04E Concurrent Session Control

Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [Assignment: organization-defined number].

Organizations may define the maximum number of concurrent sessions for system accounts globally, by account type, by account, or any combination thereof. For example, organizations may limit the number of concurrent sessions for system administrators or other individuals working in particularly sensitive domains or mission-critical applications. Concurrent session control addresses concurrent sessions for system accounts. It does not, however, address concurrent sessions by single users via multiple system accounts. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Contain, Exert)

Source Control: AC-10

03.01.05E Automated Monitoring and Control for Remote Access

Employ automated mechanisms to monitor and control remote access methods.

Monitoring and controlling remote access methods allows organizations to detect attacks and ensure compliance with remote access policies. This is accomplished by auditing the connection activities of remote users on system components, including servers, notebook computers, workstations, smart phones, and tablets. This requirement enhances SP 800-171 requirement 03.01.02.

Preclude (Preempt), Impede (Exert)

Source Control: AC-17(01)

03.01.06E Protection of Remote Access Mechanism Information

Protect information about remote access mechanisms from unauthorized use and disclosure.

Access to organizational information about remote access mechanisms by non-organizational entities can increase the risk of unauthorized use and disclosure. The organization considers including remote access requirements in the information exchange agreements with other organizations, as applicable. Remote access requirements can also be included in rules of behavior and access agreements. This requirement enhances SP 800-171 requirement 03.01.12.

Preclude (Preempt), Impede (Exert)

Source Control: AC-17(06)

03.01.07E Automated Audit Actions for Account Management

Use automated mechanisms to audit account creation, modification, enabling, disabling, and removal actions.

The use of automated mechanisms to audit account management activities provides more timely and comprehensive data to guide and inform needed actions by system administrators. Security information and event management (SIEM) tools can help automate account management audit activities. This requirement enhances SP 800-171 requirement 03.01.01.

Preclude (Preempt), Impede (Exert)

Source Control: AC-02(04)

b. Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].

Atypical usage includes accessing systems at certain times of the day or from locations that are not consistent with the normal usage patterns of individuals. Monitoring for atypical usage may reveal rogue behavior by individuals or provide indicators of compromise, including evidence of an attack in progress. This requirement enhances SP 800-171 requirement 03.01.01.

Expose (Detect)

Source Control: AC-02(12)

b. Control access based upon [Assignment: organization-defined attributes to assume access permissions].

Attribute-based access control is an access control policy that restricts system access to authorized users based on specified organizational attributes (e.g., job function, role, identity), action attributes (e.g., read, write, delete), environmental attributes (e.g., time of day, location), and resource attributes (e.g., document classification). Organizations can create rules based on specified attributes and the authorizations (i.e., privileges) to perform needed operations on the systems associated with organization-defined attributes and rules. When users are assigned to attributes that are defined in attribute-based access control policies or rules, they can be provisioned to a system with the appropriate privileges or dynamically granted access to a protected resource. Attribute-based access control can be implemented as either a mandatory or discretionary form of access control. This requirement enhances SP 800-171 requirement 03.01.02.

Preclude (Preempt), Impede (Exert)

Source Control: AC-03(13)

03.01.10E Object Security Attributes

Use [Assignment: organization-defined security attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.

Organizations implement information flow control policies and enforcement mechanisms to control the flow of CUI between designated sources and destinations within systems and between connected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content. Information flow enforcement mechanisms compare the security attributes associated with information (i.e., data content and structure) and source and destination objects and respond appropriately when the enforcement mechanisms encounter information flows that are not explicitly allowed by information flow policies. Security attributes can also include source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security attributes can be used, for example, to control the release of certain types of information. This requirement enhances SP 800-171 requirement 03.01.03.

Preclude (Preempt), Impede (Exert)

Source Control: AC-04(01)

b. Control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].

Role-based access control (RBAC) is an access control policy that enforces access to objects and system functions based on the defined role (i.e., job function) of the subject. Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on the systems associated with the organization-defined roles. When users are assigned to specific roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a large number of individuals) but are instead acquired through role assignments. RBAC can also increase security risks if individuals assigned to a role are given access to information beyond what they need to support organizational mission or business functions. RBAC can be implemented as a mandatory or discretionary form of access control. This requirement enhances SP 800-171 requirement 03.01.02.

Preclude (Preempt), Impede (Exert)

Source Control: AC-03(07)

Separate CUI flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques].

Enforcing the separation of information flows associated with defined types of data can enhance protection by ensuring that CUI is not commingled while in transit and by enabling flow control by transmission paths that are not otherwise achievable. This requirement enhances SP 800-171 requirement 03.01.03.

Preclude (Preempt), Impede (Exert)

Source Control: AC-04(21)

03.01.13E Metadata

Enforce information flow control based on [Assignment: organization-defined metadata].

Metadata is information that describes the characteristics of data. Metadata can include structural metadata that describes data structures or descriptive metadata that describes data content. The enforcement of allowed information flows based on metadata enables simpler and more effective flow control. Organizations consider the trustworthiness of metadata regarding data accuracy (i.e., knowledge that the metadata values are correct with respect to the data), data integrity (i.e., protecting against unauthorized changes to metadata tags), and the binding of metadata to the data payload (i.e., employing sufficiently strong binding techniques with appropriate assurance). This requirement enhances SP 800-171 requirement 03.01.03.

Preclude (Preempt), Impede (Exert)

Source Control: AC-04(06)

a. Enforce information flow control using [Assignment: organization-defined security policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows].

b. [Selection (one or more): Block; Strip; Modify; Quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined security policy].

Security policy filters for data structures check for maximum file lengths, maximum field sizes, and data/file types for structured and unstructured data. Security policy filters for data content check for specific words, enumerated values or data value ranges, and hidden content. Structured data permits the interpretation of data content by applications. Unstructured data refers to digital information without a data structure or with a data structure that does not facilitate the development of rule sets to address the criticality or sensitivity of information conveyed by the data or the flow enforcement decisions. Unstructured data consists of bitmap objects that are inherently non-language-based (e.g., image, video, or audio files) and textual objects that are based on written or printed languages. This requirement enhances SP 800-171 requirement 03.01.03.

Preclude (Preempt), Impede (Exert)

Source Control: AC-04(08)

03.01.15E Data Type Identifiers

Use [Assignment: organization-defined data type identifiers] to validate data that is essential for information flow decisions when transferring CUI between security domains.

Data type identifiers include filenames, file types, file signatures or tokens, and multiple internal file signatures or tokens. Systems only allow for the transfer of data that is compliant with data type format specifications. The identification and validation of data types is based on defined specifications associated with each allowed data format. The filename and number alone are not used for data type identification. Content is validated syntactically and semantically against its specification to ensure that it is the proper data type. This requirement enhances SP 800-171 requirement 03.01.03.

Preclude (Preempt), Impede (Exert)

Source Control: AC-04(12)

03.01.16E Decomposition Into Policy-Relevant Subcomponents

Decompose CUI into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mechanisms when transferring CUI between different security domains.

Decomposing CUI into policy-relevant subcomponents prior to information transfer facilitates policy decisions on source, destination, certificates, and other security-related component differentiators. Policy enforcement mechanisms apply filtering, inspection, and/or sanitization rules to the policy-relevant subcomponents of information to facilitate flow enforcement prior to transferring such information to different security domains. This requirement enhances SP 800-171 requirement 03.01.03.

Preclude (Preempt), Impede (Exert)

Source Control: AC-04(13)

a. Examine CUI for the presence of [Assignment: organization-defined unsanctioned information] when transferring information between different security domains.

b. Prohibit the transfer of the CUI defined in 03.01.17E.a in accordance with the [Assignment: organization-defined security policy].

Unsanctioned information in CUI includes malicious code, information that is inappropriate for release from the source network, information that is not authorized to be stored or processed on the system, or executable code that could disrupt or harm services or systems on the destination network. This requirement enhances SP 800-171 requirement 03.01.03.

Preclude (Preempt), Impede (Exert)

Source Control: AC-04(15)

a. Provide security literacy training to system users:

b. Update security literacy training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

An effective way to detect APTs, address the cyber threat environment, and preclude successful attacks is to provide specific literacy training for individuals. Threat literacy training includes educating individuals on the various ways that APTs can infiltrate the organization (e.g., through websites, emails, pop-ups, articles, and social engineering) and describes techniques for recognizing suspicious emails, the use of removable systems in non-secure settings, and the potential targeting of individuals at home. Personnel are also trained on what constitutes suspicious communications and how to respond to such communications. Training personnel on how to recognize anomalous behaviors in systems can provide organizations with early warning of the presence of malicious code. Recognizing anomalous behavior in systems can supplement the malicious code detection and protection tools and systems used by organizations. Since threats continue to change over time, threat literacy training is dynamic. Moreover, threat literacy training is not performed in isolation from the system operations that support organizational missions and business functions. This requirement enhances SP 800-171 requirement 03.02.01.

Preclude (Preempt), Expose (Detect)

Source Controls: AT-02(04); AT-02(05); AT-02(06)

03.02.02E Literacy and Awareness Training Practical Exercises

Provide practical exercises in literacy training that simulate events and incidents.

Practical exercises include no-notice social engineering attempts to collect information, gain unauthorized access, or simulate the adverse impact of opening malicious email attachments or invoking malicious web links via spear phishing attacks. This requirement enhances SP 800-171 requirement 03.02.01.

Preclude (Preempt), Expose (Detect)

Source Control: AT-02(01)

03.02.03E Literacy and Awareness Training Feedback

Provide feedback on organizational training results to the following personnel [Assignment: organization-defined personnel].

Training feedback includes literacy and role-based training results, which can indicate a potentially serious problem, especially the failures of personnel in critical roles. Managers should be made aware of such situations so that they can respond accordingly. Training feedback supports the evaluation and update of organizational training content and methodology. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Expose (Detect)

Source Control: AT-06

03.02.04E Anti-Counterfeit Training

Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components.

System components include hardware, software, and firmware components as well as the documentation for those components. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

Preclude (Preempt), Expose (Detect)

Source Control: SR-11(01)

03.03.01E Protection of Audit Record Storage in Separate Physical Systems or Components

Store audit records in a repository that is part of a physically different system or system component than the system or component being audited.

Storing audit records in a repository that is separate from the audited system or system component helps to ensure that a compromise of the system being audited does not also result in a compromise of the audit records. Storing audit records on separate physical systems or components preserves the confidentiality, integrity, and availability of audit records and facilitates the management of audit records as an organization-wide activity. Storing audit records on separate systems or system components applies to the initial generation and backup or long-term storage of audit records. This requirement enhances SP 800-171 requirement 03.03.08.

Preclude (Preempt), Impede (Exert)

Source Control: AU-09(02)

03.03.02E Real-Time Alerts for Audit Processing Failures

Provide an alert within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: organization-defined audit logging failure events requiring real-time alerts].

Alerts provide organizations with urgent messages. Real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or less). This requirement enhances SP 800-171 requirement 03.03.04.

Preclude (Preempt), Impede (Exert)

Source Control: AU-05(02)

03.03.03E Dual Authorization for Audit Information and Actions

Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information].

Dual authorization is also known as two-person control since it requires the approval of two authorized individuals to reduce the risk related to insider threat when executing audit functions. Dual authorization reduces risks related to insider threats, including adversaries who have obtained credentials. Organizations may choose different selection options for different types of audit information. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.03.08. It is also related to requirement 03.01.01E.

Preclude (Preempt), Impede (Exert)

Source Control: AU-09(05)

03.03.04E Integrated Analysis of Audit Records

Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources]] to further enhance the ability to identify inappropriate or unusual activity.

Integrated analysis of audit records requires that the analysis of information generated by scanning, monitoring, or other data collection activities is integrated with the analysis of audit record information. Security information and event management (SIEM) tools can facilitate audit record aggregation or consolidation from multiple system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by organizations (with localized script adjustments, as necessary) provides more cost-effective approaches to analyzing audit record information. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of vulnerability scans of the system and in correlating attack detection events with scanning results. Correlation with performance data can uncover denial-of-service (DoS) attacks or other types of attacks that result in the unauthorized use of resources. Correlation with system monitoring information can also assist in uncovering attacks and relating audit information to operational situations. This requirement enhances SP 800-171 requirement 03.03.05.

Preclude (Preempt), Expose (Detect)

Source Control: AU-06(05)

03.04.01E Withdrawn

Addressed by 03.04.08E, 03.14.04E, 03.17.03E, 03.17.04E, 03.17.05E, 03.04.01 (SP 800-171), 03.04.03 (SP 800-171), and 03.04.10 (SP 800-171).

03.04.02E Automated Unauthorized Component Detection

a. Detect the presence of unauthorized or misconfigured system components using [Assignment: organization-defined automated mechanisms].

b. Take the following actions when unauthorized or misconfigured components are detected: [Selection (one or more): disable network access by such components; isolate the components; notify [Assignment: organization-defined personnel or roles]].

Monitoring for unauthorized or misconfigured components may be accomplished on an ongoing basis or by the periodic scanning of systems for that purpose. Automated mechanisms may also be used to prevent the connection of unauthorized or misconfigured system components. Automated mechanisms can be implemented in systems or in separate system components. When acquiring and implementing automated mechanisms, organizations consider whether such mechanisms depend on the ability of the system component to support an agent or supplicant in order to be detected since some types of components do not have or cannot support agents (e.g., IoT devices, sensors). Isolation can be achieved, for example, by placing unauthorized system components in separate domains or subnets or quarantining such components. This type of component isolation is commonly referred to as “sandboxing.” This requirement enhances SP 800-171 requirement 03.04.10.

Preclude (Expunge, Preempt); Impede (Contain); Expose (Detect)

Source Control: CM-06(01); CM-06(02); CM-08(03)

03.04.03E Automated Maintenance of System Component Inventory

Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].

The system component inventory includes system-specific information required for component accountability and to provide support to identify, control, monitor, and verify configuration items based on the authoritative source. The information necessary for the accountability of system components includes the system name, hardware and software component owners, hardware inventory specifications, software license information, software version numbers, and—for networked components—the machine names and network addresses. Inventory specifications include the manufacturer, supplier information, component type, date of receipt, cost, model, serial number, and physical location. System component inventory information can include historic versioning of the information that can be used to track changes in the inventory and its ownership over the lifecycle of the system component inventory. Organizations also use automated mechanisms to implement and maintain authoritative (i.e., up-to-date, complete, accurate, and available) baseline configurations for systems that include hardware and software inventory tools, configuration management tools, and network management tools. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels. This requirement enhances SP 800-171 requirement 03.04.10.

Preclude (Preempt), Impede (Exert), Expose (Detect)

Source Control: CM-08(02)

03.04.04E Automation Support for Baseline Configuration

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].

Automated mechanisms that help organizations maintain consistent baseline configurations for systems include configuration management tools; hardware, software, and firmware inventory tools; and network management tools. Automated tools can be used to track version numbers on operating systems, applications, the types of software installed, and current patch levels. Automation support for accuracy and currency can be satisfied by the implementation of 03.04.03E for organizations that combine system component inventory and baseline configuration activities. This requirement enhances SP 800-171 requirement 03.04.01.

Preclude (Preempt), Impede (Exert), Expose (Detect)

Source Control: CM-02(02)

03.04.05E Dual Authorization for System Changes

Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information].

Dual authorization is also known as two-person control. Organizations employ dual authorization to help ensure that any changes to selected system components and system-level information cannot occur unless two qualified individuals approve and implement such changes. Requiring two individuals to implement system changes provides an increased level of assurance that the proposed changes are correct implementations of approved changes. The individuals are also accountable for the changes that have been implemented. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. System-level information includes operational procedures. This requirement enhances SP 800-171 requirement 03.04.05.

Preclude (Preempt), Impede (Exert)

Source Control: CM-05(04)

03.04.06E Retention of Previous Configurations

Retain [Assignment: organization-defined number] previous versions of baseline configurations of the system to support rollback.

Retaining previous versions of baseline configurations to support rollback includes configuration files for hardware, software, and firmware, configuration records, and associated documentation. This requirement enhances SP 800-171 requirement 03.04.01.

Preclude (Preempt), Impede (Exert), Limit (Shorten, Reduce)

Source Control: CM-02(03)

03.04.07E Testing, Validation, and Documentation of Changes

Test, validate, and document changes to the system before finalizing the implementation of the changes.

Changes to systems include modifications to hardware, software, or firmware components and defined configuration settings. Organizations ensure that testing does not interfere with system operations that support organizational missions and business functions. Individuals or groups that conduct the tests understand the system security policies and procedures associated with the specific facilities or processes. Operational systems may need to be taken offline or replicated to the extent feasible before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating protection measures. This requirement enhances SP 800-171 requirement 03.04.03.

Preclude (Preempt), Impede (Exert)

Source Control: CM-03(02)

03.04.08E Centralized Repository

Provide a centralized repository for the inventory of system components.

Organizations may implement centralized system component inventories that include components from all organizational systems. Centralized repositories of component inventories provide opportunities for efficiencies in accounting for organizational hardware, software, and firmware assets. Such repositories can help organizations rapidly identify the location and responsible individuals of system components that have been compromised, breached, or are otherwise in need of mitigation actions. This requirement enhances SP 800-171 requirement 03.04.10.

Preclude (Preempt), Impede (Exert)

Source Control: CM-08(07)

03.05.01E Cryptographic Bidirectional Authentication

Authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a system connection using bidirectional authentication that is cryptographically based.

Bidirectional authentication provides stronger protection to validate the identity of other devices for connections that are of greater risk. This requirement enhances SP 800-171 requirement 03.05.02.

Preclude (Preempt, Negate), Impede (Exert), Expose (Detect)

Source Controls: IA-03(01)

03.05.02E Password Managers

a. Employ [Assignment: organization-defined password managers] to generate and manage passwords.

b. Protect the passwords using [Assignment: organization-defined safeguards].

A potential risk of using password managers is that adversaries can target the collection of passwords generated by the password manager. Therefore, the passwords require strong protection, including encrypting the passwords. This requirement enhances SP 800-171 requirement 03.05.07.

Preclude (Preempt), Impede (Delay, Exert)

Source Control: IA-05(18)

03.05.03E Device Attestation

Handle device identification and authentication based on attestation by [Assignment: organization-defined configuration management process].

Device attestation refers to the identification and authentication of a device based on its configuration and known operating state. Device attestation can be determined via a cryptographic hash of the device. If device attestation is the means of identification and authentication, then it is important that patches and updates to the device are handled via a configuration management process such that the patches and updates are done securely and do not disrupt identification and authentication to other devices. This requirement enhances SP 800-171 requirement 03.05.02.

Preclude (Preempt), Impede (Exert), Expose (Detect)

Source Control: IA-03(04)

03.05.04E No Embedded Unencrypted Static Authenticators

Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.

In addition to applications, other forms of static storage include access scripts and function keys. Organizations exercise caution when determining whether embedded or stored authenticators are encrypted or unencrypted. If authenticators are used in the manner stored, then those representations are considered unencrypted authenticators. This requirement enhances SP 800-171 requirement 03.05.07.

Preclude (Preempt), Impede (Exert)

Source Control: IA-05(07)

03.05.05E Expiration of Cached Authenticators

Prohibit the use of cached authenticators after [Assignment: organization-defined time period].

Cached authenticators are used to authenticate to a local machine when the network is not available. If cached authentication information is out of date, the validity of the authentication information may be questionable. This requirement enhances SP 800-171 requirement 03.05.07.

Preclude (Preempt), Impede (Exert)

Source Control: IA-05(13)

03.05.06E Identity Proofing

a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines.

b. Resolve user identities to a unique individual.

c. Collect, validate, and verify identity evidence.

Identity proofing is the process of collecting, validating, and verifying user identity information to establish credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Resolving user identities ensures that each user identity belongs to a unique individual. Organizations may be subject to laws, Executive Orders, directives, regulations, or policies that address the collection of identity evidence. An example of an applicable guideline that covers identity proofing is SP 800-63 [27]. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

Preclude (Preempt), Impede (Exert)

Source Control: IA-12

03.05.07E Identity Providers and Authorization Servers

Employ identity providers and authorization servers to manage user, device, and non-person entity identities, attributes, and access rights that support authentication and authorization decisions in accordance with [Assignment: organization-defined identification and authentication policy] using [Assignment: organization-defined mechanisms].

Identity providers (both internal and external to the organization) manage user, device, and non-person entity authenticators and issue statements (often called identity assertions) that attest to the identities of other systems or system components. Authorization servers create and issue access tokens to identified and authenticated users and devices that can be used to gain access to organizational systems or information resources. For example, single sign-on (SSO) provides identity provider and authorization server functions. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Exert)

Source Control: IA-13

03.06.01E Security Operations Center

Establish and maintain a security operations center.

A security operations center (SOC) is the focal point for security operations and computer network defense for an organization. The purpose of the SOC is to defend and monitor an organization’s systems and networks on an ongoing basis. The SOC is also responsible for detecting, analyzing, and responding to security incidents in a timely manner. The SOC is staffed with skilled technical and operational personnel (e.g., security analysts, incident response personnel, systems security engineers) and implements a combination of technical, management, and operational controls (including monitoring, scanning, and forensics tools) to monitor, fuse, correlate, analyze, and respond to threat and security-relevant event data from multiple sources. These sources include perimeter defenses, network devices (e.g., routers, switches), and endpoint agent data feeds. The SOC provides a holistic situational awareness capability to help organizations determine the security posture of the system and organization. A SOC capability can be obtained in a variety of ways. Larger organizations may implement a dedicated SOC, while smaller organizations may employ third-party organizations to provide this capability. This requirement enhances SP 800-171 requirement 03.06.01.

Limit (Shorten, Reduce); Expose (Detect, Reveal)

Source Control: IR-04(14)

03.06.02E Integrated Incident Response Team

Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [Assignment: organization-defined time period].

An integrated incident response team is a group of individuals who assess, document, and respond to incidents so that organizational systems and networks can recover quickly and implement the necessary controls to avoid future incidents. Incident response team personnel include forensic and malicious code analysts, tool developers, systems security engineers, and real-time operations personnel. The incident handling capability includes performing rapid forensic preservation of evidence and analysis of and response to intrusions.

An integrated incident response team facilitates information sharing and allows organizational personnel (e.g., developers, implementers, and operators) to leverage team knowledge of the threat and implement defensive measures that enable organizations to deter intrusions more effectively. Moreover, integrated teams promote the rapid detection of intrusions, the development of appropriate mitigations, and the deployment of effective defensive measures. Integrated incident response teams are better able to identify adversary tactics, techniques, and procedures that are linked to the operations tempo or specific mission and business functions and to define responsive actions in a way that does not disrupt those mission and business functions. Incident response teams can be distributed within organizations to make the capability resilient. For some organizations, the incident response team can be a cross-organizational entity. This requirement enhances SP 800-171 requirement 03.06.01.

Preclude (Expunge), Impede (Contain, Exert), Limit (Shorten, Reduce), Expose (Scrutinize)

Source Control: IR-04(11)

03.06.03E Behavior Analysis

Analyze anomalous or suspected adversarial behavior in or related to [Assignment: organization-defined environments or resources].

If the organization maintains a deception environment, an analysis of behaviors in that environment, including resources targeted by the adversary and the timing of the incident or event, can provide significant insights into adversarial tactics, techniques, and procedures. External to a deception environment, the analysis of anomalous behavior (e.g., changes in system performance or usage patterns) or suspected adversarial behavior (e.g., changes in searches for the location of specific resources) can give the organization such insight. This requirement enhances SP 800-171 requirement 03.06.01.

Expose (Detect, Reveal)

Source Control: IR-04(13)

03.06.04E Automated Tracking, Data Collection, and Analysis for Incident Monitoring

Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].

Automated mechanisms for tracking incidents and collecting and analyzing incident information include electronic databases of incidents and network monitoring devices. This requirement enhances SP 800-171 requirement 03.06.02.

Expose (Detect, Reveal)

Source Control: IR-05(01)

03.07.01E Software Updates and Patches for Maintenance Tools

Inspect maintenance tools to ensure the latest software updates and patches are installed.

Maintenance tools using outdated and/or unpatched software can provide a threat vector for adversaries and result in a significant vulnerability for organizations. This requirement enhances SP 800-171 requirement 03.07.04.

Preclude (Preempt)

Source Control: MA-03(06)

03.08.01E Dual Authorization for Media Sanitization

Enforce dual authorization for the sanitization of [Assignment: organization-defined system media containing CUI].

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Organizations employ dual authorization to help ensure that the sanitization of system media cannot occur unless two technically qualified individuals conduct the designated task. Individuals who sanitize system media possess sufficient skills and expertise to determine whether the proposed sanitization reflects applicable federal and organizational standards, policies, and procedures. Dual authorization also helps to ensure that sanitization occurs as intended to protect against errors and false claims of having performed the sanitization actions. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations consider the risks associated with implementing dual authorization when immediate responses are necessary to help ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.08.03.

Preclude (Preempt), Impede (Exert)

Source Control: MP-06(07)

03.08.02E Dual Authorization for System Backup Deletion and Destruction

Enforce dual authorization for the deletion or destruction of [Assignment: organization-defined system backup information].

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Dual authorization ensures that the deletion or destruction of backup information cannot occur unless two qualified individuals carry out the task. Individuals who delete or destroy backup information possess the knowledge, skills, or expertise to determine whether the proposed deletion or destruction of such information reflects organizational policies and procedures. To reduce the risk of collusion, organizations often rotate dual authorization duties among various individuals. Organizations also consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.08.09.

Preclude (Preempt), Impede (Exert)

Source Control: CP-09(07)

03.08.03E Testing System Backups for Reliability and Integrity

Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.

Organizations need assurance that backup information can be reliably retrieved. Reliability pertains to the systems and system components in which the backup information is stored, the operations used to retrieve the information, and the integrity of the information being retrieved. Independent and specialized tests can be used for each of these aspects of reliability. For example, decrypting and transporting (or transmitting) a random sample of backup files from the alternate storage or backup site and comparing the information to the same information at the primary processing site can provide such assurance. This requirement enhances SP 800-171 requirement 03.08.09.

Preclude (Preempt), Impede (Exert), Limit (Shorten, Reduce)

Source Control: CP-09(01)

03.08.04E System Recovery and Reconstitution

Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.

Recovery is executing contingency plan activities to restore organizational mission and business functions. Reconstitution occurs following recovery operations and includes activities for returning systems to fully operational states. Recovery and reconstitution operations reflect mission and business priorities; recovery point, recovery time, and reconstitution objectives; and organizational metrics consistent with contingency plan requirements. Reconstitution includes the deactivation of interim system capabilities that may have been needed during recovery operations. Reconstitution also includes assessments of fully restored system capabilities, the reestablishment of continuous monitoring activities, and activities to prepare the system and organization for future disruptions, breaches, compromises, or failures. Recovery and reconstitution capabilities can include automated mechanisms and manual procedures. Organizations establish recovery time and recovery point objectives as part of contingency planning. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Limit (Shorten, Reduce)

Source Control: CP-10

03.09.01E Withdrawn

Addressed by 03.09.01 (SP 800-171).

03.09.02E Withdrawn

Addressed by 03.01.01 (SP 800-171) and 03.09.01 (SP 800-171).

c. Verify that individuals requiring access to CUI and systems processing, storing, or transmitting CUI:

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with systems processing, storing, or transmitting CUI to which they have authorized access. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

Preclude (Preempt)

Source Control: PS-06

03.09.04E Citizenship Requirements

Verify that individuals accessing a system that processes, stores, or transmits CUI meet [Assignment: organization-defined citizenship requirements].

Organizations may determine that individuals who need access to CUI associated with a high value asset or critical program require U.S. citizenship status. This requirement enhances SP 800-171 requirement 03.09.01.

Preclude (Preempt)

Source Control: PS-03(04)

03.10.01E Intrusion Alarms and Surveillance Equipment

Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.

Physical intrusion alarms can be used to alert security personnel when unauthorized access to the facility is attempted. Alarm systems work in conjunction with physical barriers, physical access control systems, and facility security guards by triggering a response when these other forms of security have been compromised or breached. Physical intrusion alarms can include different types of sensor devices, including motion sensors, contact sensors, and broken glass sensors. Surveillance equipment includes video cameras installed at strategic locations throughout the facility. This requirement enhances SP 800-171 requirement 03.10.02.

Expose (Detect, Reveal)

Source Control: PE-06(01)

b. Maintain records of the system components.

Enforcing authorizations for the entry and exit of system components may require restricting access to delivery areas and isolating the areas from the system and media libraries. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt)

Source Control: PE-16

03.11.01E Threat Awareness Program

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be likely that adversaries can successfully breach or compromise organizational systems. One of the techniques that organizations can use to address this concern is to share threat information. This can include the tactics, techniques, and procedures that organizations have experienced; mitigations that organizations have found to be effective against certain types of threats; and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing can include organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Negate), Impede (Exert), Expose (Detect)

Source Controls: PM-16

a. Establish and maintain a cyber threat-hunting capability to:

b. Employ the threat-hunting capability [Assignment: organization-defined frequency].

Threat hunting is an active means of cyber defense in contrast to traditional protection measures, such as firewalls, intrusion detection and prevention systems, quarantining malicious code in sandboxes, and Security Information and Event Management (SIEM) technologies and systems. Cyber threat hunting involves proactively searching organizational systems, networks, and infrastructure for advanced threats. The objective is to track and disrupt adversaries as early as possible in the attack sequence and to measurably improve the speed and accuracy of responses. Indications of compromise include unusual network traffic, unusual file changes, and the presence of malicious code. Threat-hunting teams leverage existing threat intelligence and may create new threat intelligence that is shared with peer organizations, Information Sharing and Analysis Organizations (ISAO), Information Sharing and Analysis Centers (ISAC), and relevant government departments and agencies. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Expunge), Limit (Shorten, Reduce), Expose (Detect, Scrutinize)

Source Control: RA-10

03.11.03E Predictive Cyber Analytics

Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined advanced automation and analytics capabilities].

A properly resourced security operations center (SOC) or computer incident response team (CIRT) may be overwhelmed by the volume of information generated by the proliferation of security tools and appliances unless it employs advanced automation and analytics to analyze the data. Advanced automation and predictive analytics capabilities are typically supported by artificial intelligence concepts and machine learning. Examples include automated threat discovery and response (which includes broad-based collection, context-based analysis, and adaptive response capabilities), automated workflow operations, and machine-assisted decision tools. However, sophisticated adversaries may be able to extract information related to analytic parameters and retrain the machine learning to classify malicious activity as benign. Accordingly, machine learning is augmented by human monitoring to help ensure that sophisticated adversaries are not able to conceal their activities. This requirement enhances SP 800-171 requirement 03.11.01.

Preclude (Expunge), Limit (Shorten, Reduce), Expose (Detect, Scrutinize)

Source Control: RA-03(04)

03.11.04E Withdrawn

Addressed by 03.15.01E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), and 03.15.02 (SP 800-171).

03.11.05E Withdrawn

Addressed by 03.11.01E, 03.11.03E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), 03.12.01 (SP 800-171), and 03.12.03 (SP 800-171).

03.11.06E Withdrawn

Addressed by 03.12.03E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), 03.12.01 (SP 800-171), 03.12.03 (SP 800-171), and 03.17.03 (SP 800-171).

03.11.07E Withdrawn

Addressed by 03.17.01 (SP 800-171).

03.11.08E Dynamic Threat Awareness

Determine the current cyber threat environment on an ongoing basis using [Assignment: organization-defined means].

The threat awareness information that is gathered feeds into the organization’s security operations to ensure that procedures are updated in response to the changing threat environment. For example, at higher threat levels, organizations may change the privilege or authentication thresholds required to perform certain operations. This requirement enhances SP 800-171 requirement 03.11.01.

Expose (Detect, Reveal)

Source Control: RA-03(03)

03.11.09E Indicators of Compromise

Discover, collect, and distribute to [Assignment: organization-defined personnel or roles], indicators of compromise provided by [Assignment: organization-defined sources].

Indicators of compromise (IOCs) are forensic artifacts from intrusions that are identified on organizational systems at the host or network level. IOCs provide valuable information on systems that have been compromised. IOCs can include the creation of registry key values. IOCs for network traffic include universal resource locator (URL) or protocol elements that indicate malicious code command and control servers. The rapid distribution and adoption of IOCs can improve information security by reducing the time that systems and organizations are vulnerable to the same exploit or attack. Threat indicators, signatures, tactics, techniques, procedures, and other IOCs may be available via government and non-government cooperatives, including the Forum of Incident Response and Security Teams (FIRST), the Computer Emergency Response Team Coordination Center (CERT/CC), the United States Computer Emergency Readiness Team (US-CERT), and the Defense Industrial Base (DIB) Cybersecurity Information Sharing Program. This requirement enhances SP 800-171 requirement 03.14.06.

Expose (Detect, Reveal)

Source Control: SI-04(24)

03.11.10E Criticality Analysis

Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle].

Organizations conduct a functional decomposition of a system to identify mission-critical functions and system components. The functional decomposition includes the identification of organizational missions supported by the system, the specific functions to perform those missions, and traceability to the hardware, software, and firmware components that implement those functions, including when the functions are shared by components within and external to the system. The operational environment of a system or a system component may impact its criticality, including the connections to and dependencies on other systems, devices, system-of-systems, and outsourced IT services. System components that allow unmediated access to critical system components or functions are considered critical due to the inherent vulnerabilities that such components create. Criticality analysis is performed when an architecture or design is being developed, modified, or upgraded. If such analysis is performed early and throughout the system development life cycle, organizations may be able to modify the system design to reduce the critical nature of these functions and components, such as by adding redundancy or alternate paths into the system design. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

Preclude (Preempt)

Source Control: RA-09

03.11.11E Discoverable Information

Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].

Discoverable information includes information that adversaries could obtain without compromising or breaching the system, such as by collecting information that the system is exposing or by conducting extensive web searches. Corrective actions include notifying organizational personnel, removing designated information, or changing the system to make the designated information less relevant or attractive to adversaries. This requirement excludes intentionally discoverable information that may be part of a decoy capability (e.g., honeypots, honeynets, or deception nets) implemented by the organization. This requirement enhances SP 800-171 requirement 03.11.02.

Expose (Reveal)

Source Control: RA-05(04)

03.11.12E Automated Means for Sharing Threat Intelligence

Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.

To maximize the effectiveness of monitoring and sharing threat intelligence information, it is important to know what threat observables and indicators the sensors need to be searching for. By using well-established frameworks, services, and automated tools, organizations improve their ability to rapidly share and feed the relevant threat detection signatures into monitoring tools. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Negate), Impede (Exert), Expose (Detect)

Source Controls: PM-16(01)

03.12.01E Penetration Testing

Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined systems or system components].

Penetration testing is a specialized type of assessment conducted on systems or system components to identify vulnerabilities that could be exploited by adversaries. It is conducted by penetration testing agents and teams with particular skills and experience that include technical expertise in network, operating system, and application-level security. Penetration testing can be used to validate vulnerabilities or to determine a system’s penetration resistance to adversaries within specified constraints, such as time, resources, and skills. It can be conducted internally or externally on the hardware, software, or firmware components of a system and can exercise both physical and technical controls. A standard method for conducting penetration testing includes pretest analysis based on full knowledge of the system, pretest identification of potential vulnerabilities based on the pretest analysis, and testing designed to determine the exploitability of vulnerabilities. All parties agree to the specified rules of engagement before the commencement of penetration testing. Organizations may also supplement penetration testing with red team exercises. Red teams attempt to duplicate the actions of adversaries in carrying out attacks against organizations and provide an in-depth analysis of security-related weaknesses or deficiencies. Organizations correlate the rules of engagement for penetration tests and red teaming exercises (if used) with the tools, techniques, and procedures that they anticipate adversaries may employ. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Exert), Expose (Detect)

Source Control: CA-08

03.12.02E Independent Assessors

Use independent assessors or assessment teams to conduct security requirement assessments.

Independent assessors or assessment teams are individuals or groups who conduct impartial assessments of systems. Impartiality means that assessors are free from any perceived or actual conflicts of interest regarding the development, operation, sustainment, or management of the systems under assessment or the determination of security requirement effectiveness. To achieve impartiality, assessors do not create a mutual or conflicting interest with the organizations where the assessments are being conducted, assess their own work, act as management or employees of the organizations they are serving, or place themselves in positions of advocacy for the organizations acquiring their services. Independent assessments can be obtained from entities that are internal or external to organizations. Organizations determine whether the level of assessor independence provides sufficient assurance such that the assessment results are sound and can be used to make effective risk-based decisions. This requirement enhances SP 800-171 requirement 03.12.01.

Preclude (Preempt)

Source Control: CA-02(01)

03.12.03E Risk Monitoring

Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes effectiveness monitoring, compliance monitoring, and change monitoring.

Risk monitoring is guided and informed by the established organizational risk tolerance. Effectiveness monitoring determines the ongoing effectiveness of the implemented risk response measures. Compliance monitoring verifies that required risk response measures are implemented. It also verifies that security requirements are satisfied. Change monitoring identifies changes to organizational systems and environments of operation that may affect security risk. This requirement enhances SP 800-171 requirement 03.12.03.

Preclude (Preempt), Impede (Exert), Expose (Detect)

Source Control: CA-07(04)

a. Authorize internal connections of [Assignment: organization-defined system components or classes of components] to the system.

b. Document, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.

c. Terminate internal system connections after [Assignment: organization-defined conditions].

d. Review [Assignment: organization-defined frequency] the continued need for each internal connection.

Internal system connections are connections between organizational systems and separate constituent system components (i.e., connections between components that are part of the same system), including components that are used for system development. Intra-system connections include connections with mobile devices, notebook and desktop computers, tablets, printers, copiers, facsimile machines, scanners, sensors, and servers. Organizations can authorize internal connections for a class of system components with common characteristics and/or configurations, including printers, scanners, and copiers with a specified processing, transmission, and storage capability or smart phones and tablets with a specific baseline configuration. The continued need for an internal system connection is reviewed from the perspective of whether it provides support for organizational missions or business functions. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

Preclude (Preempt), Impede (Exert)

Source Control: CA-09

03.13.01E Heterogeneity

Employ a diverse set of information technologies for the following system components in the implementation of the system: [Assignment: organization-defined system components].

Increasing the diversity of information technologies within organizational systems reduces the impact of exploitations or compromises of specific technologies. Such diversity protects against common mode failures, including those failures induced by supply chain attacks. Diversity in information technologies also reduces the likelihood that the means adversaries use to compromise one system component will be effective against other system components, thus further increasing the adversary work factor to successfully complete planned attacks. An increase in diversity may add complexity and management overhead that could ultimately lead to mistakes and unauthorized configurations. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Contain, Exert), Limit (Reduce)

Source Control: SC-29

03.13.02E Randomness

Employ [Assignment: organization-defined techniques] to introduce randomness into organizational operations and assets.

Randomness introduces increased levels of uncertainty for adversaries regarding the actions that organizations take to defend their systems against attacks. Such actions may impede the ability of adversaries to correctly target organizational systems that support critical missions or business functions. Uncertainty may cause adversaries to hesitate before initiating or continuing attacks. Misdirection techniques that involve randomness include performing certain routine actions at different times of day, employing different information technologies, using different suppliers, and rotating the roles and responsibilities of organizational personnel. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets. This requirement also depends on the selection of 03.13.03E.

Preclude (Preempt), Impede (Exert), Redirect (Deceive)

Source Control: SC-30(02)

03.13.03E Concealment and Misdirection

Employ the following concealment and misdirection techniques to mislead adversaries: [Assignment: organization-defined concealment and misdirection techniques].

Concealment and misdirection techniques can significantly reduce the targeting capabilities of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. For example, virtualization techniques provide organizations with the ability to disguise systems, potentially reducing the likelihood of successful attacks without the cost of having multiple platforms. The increased use of specific concealment and misdirection techniques and methods, including randomness, uncertainty, and virtualization, may sufficiently mislead adversaries and subsequently increase the risk of discovery or exposing tradecraft. Concealment and misdirection techniques may provide additional time to perform core mission and business functions. The implementation of concealment and misdirection techniques may add to the complexity and management overhead required for the system. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Exert), Redirect (Deceive)

Source Control: SC-30

03.13.04E Isolation of System Components

Employ boundary protection mechanisms to isolate [Assignment: organization-defined system components].

Organizations can isolate system components that perform different mission or business functions. Isolating system components with boundary protection mechanisms provides the capability for increased protection of individual system components and to more effectively control information flows between those components. The degree of isolation varies depending on the mechanisms selected. Boundary protection mechanisms include routers, gateways, and firewalls that separate system components into physically separate networks or subnetworks; cross-domain devices that separate subnetworks; virtualization techniques; and the encryption of information flows among system components using distinct encryption keys. This requirement enhances SP 800-171 requirement 03.13.01.

Preclude (Preempt), Impede (Exert), Limit (Reduce)

Source Control: SC-07(21)

03.13.05E Change Processing and Storage Locations

Change the location of [Assignment: organization-defined processing and/or storage] [Selection (one): [Assignment: organization-defined time frequency]; at random time intervals].

Adversaries target critical missions and business functions and the systems that support those missions and business functions while also trying to minimize the exposure of their existence and tradecraft. The static, homogeneous, and deterministic nature of organizational systems targeted by adversaries make such systems more susceptible to attacks with less adversary cost and effort to be successful. Changing processing and storage locations (also referred to as moving target defense) addresses the advanced persistent threat using techniques such as virtualization, distributed processing, and replication. This enables organizations to relocate the system components (i.e., processing, storage) that support critical missions and business functions. Changing the locations of processing activities and/or storage sites introduces a degree of uncertainty to the targeting activities of adversaries. The targeting uncertainty increases the work factor of adversaries and makes compromises or breaches of the organizational systems more difficult and time-consuming. Uncertainty also increases the chances that adversaries may inadvertently disclose aspects of their tradecraft while attempting to locate critical organizational assets. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt, Negate), Impede (Contain, Exert), Limit (Reduce)

Source Control: SC-30(03)

03.13.06E Platform-Independent Applications

Include within organizational systems the following platform independent applications: [Assignment: organization-defined platform-independent applications].

Platforms are the hardware, software, and firmware components used to execute the organization’s software applications. Platforms include operating systems, the underlying computer architectures, or both. Platform-independent applications are applications with the capability to execute on multiple platforms. Such applications promote portability and reconstitution on different platforms. The portability of applications and the ability to reconstitute applications on different platforms increase the availability of mission-essential functions within organizations when systems with specific operating systems are under attack. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Limit (Shorten, Reduce)

Source Control: SC-27

03.13.07E Virtualization Techniques

Employ virtualization techniques to support the deployment of a diversity of operating systems and applications that are changed [Assignment: organization-defined frequency].

While frequent changes to operating systems and applications can pose significant configuration management challenges, the changes can result in an increased work factor for adversaries to conduct successful attacks. Changing virtual operating systems or applications, as opposed to changing actual operating systems or applications, provides virtual changes that impede attacker success while reducing configuration management efforts. Virtualization techniques can assist in isolating untrustworthy software or software of dubious provenance into confined execution environments. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Exert), Limit (Reduce)

Source Control: SC-29(01)

03.13.08E Decoys

Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.

Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and deflect attacks away from the operational systems that support organizational missions and business functions. The use of decoys requires some supporting isolation measures to ensure that any deflected malicious code does not infect organizational systems. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Expose (Detect), Limit (Reduce)

Source Control: SC-26

03.13.09E Isolation of Security Tools, Mechanisms, and Support Components

Isolate [Assignment: organization-defined information security tools, mechanisms, and support components] from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

Physically separate subnetworks with managed interfaces are useful for isolating computer network defenses from critical operational processing networks to prevent adversaries from discovering the analysis and forensics techniques employed by organizations. This requirement enhances SP 800-171 requirement 03.13.01.

Preclude (Preempt), Impede (Exert)

Source Control: SC-07(13)

03.13.10E Separate Subnetworks

Implement separate network addresses to connect to systems in different security domains.

The decomposition of systems into subnetworks (i.e., subnets) helps to provide the appropriate level of protection for network connections to different security domains. This requirement enhances SP 800-171 requirement 03.13.01.

Preclude (Preempt), Impede (Exert), Limit (Reduce)

Source Control: SC-07(22)

03.13.11E Thin Nodes

Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components].

The deployment of system components with minimal functionality reduces the need to secure every endpoint and may reduce the exposure of information, systems, and services to attacks. Reduced or minimal functionality includes diskless nodes and thin client technologies. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Contain)

Source Control: SC-25

03.13.12E Denial-of-Service Protection

a. [Selection (one): Protect against; Limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events].

b. Employ the following safeguards to prevent the denial-of-service events[Assignment: organization-defined safeguards by type of denial-of-service event].

Denial-of-service events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of denial-of-service events. For example, boundary protection devices can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of denial-of-service attacks. Employing increased network capacity and bandwidth combined with service redundancy also reduces the susceptibility to denial-of-service events. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

Preclude (Preempt, Negate), Impede (Exert), Limit (Reduce)

Source Control: SC-05

03.13.13E Port and Input/Output Device Access

[Selection (one): Physically; Logically] disable or remove [Assignment: organization-defined connection ports or input/output devices] on the following systems or system components: [Assignment: organization-defined systems or system components].

Connection ports include Universal Serial Bus (USB), Thunderbolt, and Firewire (IEEE 1394). Input/output (I/O) devices include optical drives (e.g., compact disc and digital versatile disc drives), printers, and network-attached storage devices. Disabling or removing such connection ports and I/O devices helps prevent the exfiltration of information from systems and the introduction of malicious code from those ports or devices. Physically disabling or removing ports and/or devices is the stronger action. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Contain)

Source Control: SC-41

03.13.14E Detonation Chambers

Employ a detonation chamber capability within [Assignment: organization-defined system, system component, or location].

Detonation chambers (also known as dynamic execution environments) allow organizations to open email attachments, execute untrusted or suspicious applications, and execute URL requests in the safety of an isolated environment or a virtualized sandbox. Protected and isolated execution environments provide a means of determining whether the associated attachments or applications contain malicious code. While related to the concept of deception nets, the employment of detonation chambers is not intended to maintain a long-term environment in which adversaries can operate and their actions can be observed. Rather, detonation chambers are intended to quickly identify malicious code and either reduce the likelihood that the code is propagated to user environments of operation or prevent such propagation completely. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt, Negate), Impede (Contain, Exert), Expose (Detect, Reveal)

Source Control: SC-44

03.13.15E Separate Subnets to Isolate System Components and Functions

Implement [Selection (one): physically; logically] separate subnetworks to isolate the following critical system components and functions: [Assignment: organization-defined critical system components and functions].

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command-and-control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions. This requirement enhances SP 800-171 requirement 03.13.01.

Preclude (Preempt), Impede (Exert), Limit (Reduce)

Source Control: SC-07(29)

03.13.16E System Partitioning

Partition the system into [Assignment: organization-defined system components] residing in separate [Selection (one): physical; logical] security domains or environments based on [Assignment: organization-defined circumstances for physical or logical separation of components].

System partitioning is part of a defense-in-depth protection strategy. Organizations determine the degree of physical separation of system components. Physical separation options include physically distinct components in separate racks in the same room, critical components in separate rooms, and geographical separation of critical components. Managed interfaces restrict or prohibit network access and information flow among partitioned system components. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Exert), Limit (Reduce)

Source Control: SC-32

03.14.01E Software, Firmware, and Information Integrity

a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information].

b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].

Verifying the integrity of security-critical or essential software is an important capability since software vulnerabilities are the primary attack vector used by adversaries to undermine or disrupt the proper functioning of systems. Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes boot firmware, operating systems with key internal components (e.g., kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output Systems (BIOS). Information includes CUI and metadata that contains security attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications. There are many ways to verify software integrity throughout the system development life cycle. Root of trust mechanisms (e.g., secure boot, trusted platform modules [TPM], UEFI) verify that only trusted code is executed during boot processes. The employment of cryptographic signatures ensures the integrity and authenticity of critical software that stores, processes, or transmits, CUI. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

Preclude (Preempt), Expose (Detect)

Source Control: SI-07

03.14.02E Withdrawn

Addressed by 03.14.06 (SP 800-171).

03.14.03E Withdrawn

Addressed by 03.15.01E, 03.13.16E, 03.12.01 (SP 800-171), 03.13.01 (SP 800-171), and 03.16.01 (SP 800-171).

03.14.04E Refresh From Trusted Sources

Obtain software and data employed during system component and service refreshes from the following trusted sources: [Assignment: organization-defined trusted sources].

Trusted sources include software and data from write-once, read-only media or from selected offline secure storage facilities. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Exert)

Source Control: SI-14(01)

03.14.05E Non-Persistent Information

a. [Selection (one): Refresh [Assignment: organization-defined information] [Assignment: organization-defined frequency]; Generate [Assignment: organization-defined information] on demand].

b. Delete information when no longer needed.

Retaining information longer than is required makes that information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides adversaries with information that can assist in their reconnaissance and lateral movement through the system. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Exert)

Source Control: SI-14(02)

03.14.06E Withdrawn

Addressed by 03.11.02E and 03.11.09E.

03.14.07E Withdrawn

Addressed by 03.14.08E, 03.14.10E, 03.14.14E, 03.17.03E, 03.16.01 (SP 800-171)

03.14.08E Integrity Checks

Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]].

Security-relevant events include the identification of new threats to which organizational systems are susceptible and the installation of hardware, software, or firmware. Transitional states include system startup, restart, shutdown, and abort. This requirement is sourced to a control tailored out of the SP 800-53B [13] moderate baseline in SP 800-171.

Preclude (Preempt), Impede (Exert)

Source Control: SI-07(01)

03.14.09E Cryptographic Protection

Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.

Cryptographic mechanisms used to protect integrity include digital signatures and the computation and application of signed hashes using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information. Organizations that use cryptographic mechanisms also consider cryptographic key management solutions. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Preclude (Preempt), Impede (Exert), Expose (Detect)

Source Control: SI-07(06)

03.14.10E Protection of Boot Firmware

Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organization-defined mechanisms].

Unauthorized modifications to boot firmware may indicate a sophisticated, targeted attack. These types of targeted attacks can result in a permanent denial of service or a persistent malicious code presence. These situations can occur if the firmware is corrupted or malicious code is embedded in the firmware. System components can protect the integrity of boot firmware in organizational systems by verifying the integrity and authenticity of updates to the firmware prior to applying changes to the system component and preventing unauthorized processes from modifying the boot firmware. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.