CyberStrikeus/CyberStrike - Page 112

account-management-03-01-01-account-management

Define the types of system accounts allowed and prohibited.

device-lock-03-01-10-device-lock

Prevent access to the system by [organization-defined].

least-privilege-03-01-05-least-privilege

Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks.

publicly-accessible-content-03-01-22-publicly-accessible-content

Train authorized individuals to ensure that publicly accessible information does not contain CUI.

remote-access-03-01-12-remote-access

Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access.

separation-of-duties-03-01-04-separation-of-duties

Identify the duties of individuals requiring separation.

session-termination-03-01-11-session-termination

Session Termination

sp-800-171-03-01-13-030113

03.01.13

sp-800-171-03-01-14-030114

03.01.14

sp-800-171-03-01-15-030115

03.01.15

sp-800-171-03-01-17-030117

03.01.17

sp-800-171-03-01-19-030119

03.01.19

sp-800-171-03-01-21-030121

03.01.21

system-use-notification-03-01-09-system-use-notification

System Use Notification

unsuccessful-logon-attempts-03-01-08-unsuccessful-logon-attempts

Enforce a limit of [organization-defined] consecutive invalid logon attempts by a user during a [organization-defined].

use-of-external-systems-03-01-20-use-of-external-systems

Prohibit the use of external systems unless the systems are specifically authorized.

wireless-access-03-01-16-wireless-access

Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system.

role-based-training-03-02-02-role-based-training

Provide role-based security training to organizational personnel: Before authorizing access to the system or CUI, before performing assigned duties, a

sp-800-171-03-02-03-030203

03.02.03

audit-record-content-03-03-02-audit-record-content

Include the following content in audit records: What type of event occurred When the event occurred Where the event occurred Source of the event Outco

audit-record-generation-03-03-03-audit-record-generation

Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02.

event-logging-03-03-01-event-logging

Specify the following event types selected for logging within the system: [organization-defined].

sp-800-171-03-03-09-030309

03.03.09

time-stamps-03-03-07-time-stamps

Use internal system clocks to generate time stamps for audit records.

baseline-configuration-03-04-01-baseline-configuration

Develop and maintain under configuration control, a current baseline configuration of the system.

configuration-settings-03-04-02-configuration-settings

Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with opera...

impact-analyses-03-04-04-impact-analyses

Analyze changes to the system to determine potential security impacts prior to change implementation.

information-location-03-04-11-information-location

Identify and document the location of CUI and the system components on which the information is processed and stored.

least-functionality-03-04-06-least-functionality

Configure the system to provide only mission-essential capabilities.

sp-800-171-03-04-07-030407

03.04.07

sp-800-171-03-04-09-030409

03.04.09

system-component-inventory-03-04-10-system-component-inventory

Develop and document an inventory of system components.

authentication-feedback-03-05-11-authentication-feedback

Authentication Feedback

authenticator-management-03-05-12-authenticator-management

Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution.

identifier-management-03-05-05-identifier-management

Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier.

multi-factor-authentication-03-05-03-multi-factor-authentication

Multi-Factor Authentication

password-management-03-05-07-password-management

Maintain a list of commonly-used, expected, or compromised passwords, and update the list [organization-defined] and when organizational passwords ...

sp-800-171-03-05-06-030506

03.05.06

sp-800-171-03-05-08-030508

03.05.08

sp-800-171-03-05-09-030509

03.05.09