November 6, 2018

DoD Guidance for Reviewing System Security Plans andthe NIST SP 800-171 Security Requirements Not Yet Implemented
This guidance was developed to facilitate the consistent review of how the System Security Plan and associatedPlans of Action address the NIST SP 800-171 security requirements, and the impact that the ‘not yet implemented’ NIST SP
800-171 Security Requirements have on an information system. The guidance is designed to help the program
office/requiring activity determine the impact of NIST SP 800-171 security requirements not yet met, and in certain cases,
to identify when a contractor may have misinterpreted a requirement (which they actually may meet). The guidance is
not to be used to assess implemented security requirements, nor to compare or score a company’s approach to
implementing a security requirement.
The column “Impact if this requirement is not yet implemented” addresses the potential security consequences if a
specific NIST SP 800-171 requirement is not implemented. While for many requirements this may be obvious, for others
the actual impact is less clear because the requirement is essential for the implementation of other security requirements.
For example, an accurate inventory of software and hardware is necessary in order to know what patches need to be
applied.
The column “Implementation” addresses the approach a company might use to implement the NIST SP 800-171
security requirement, such as a policy, process, configuration, software or hardware change, or any combination of these.
In many cases, the approach is determined by the size or complexity of the information system. DoD clarifying
information is also provided in the implementation column to address requirements which are often over-analyzed and/or
misunderstood. If the security requirement is unimplemented, the Requiring Activity might consider a follow-up to ensure
the company understands the requirement.

1November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation

3.1 ACCESS CONTROL
Access is the ability to make use of any system resource. Access control is the process of granting or denying requests to: use information; use information
processing services; and enter company facilities. System-based access controls are called logical access controls. Logical access controls prescribe not only
who or what (in the case of a process) is permitted to have access to a system resource, but also the type of access that is permitted. Controlling physicalaccess to company facilities is also important. It provides for the protection of employees, plant equipment, hardware, software, networks, and data fromphysical actions and events that could cause serious loss or damage to the company.
3.1.1

Limit system access to authorized users,
processes acting on behalf of authorizedusers, and devices (including othersystems).

Failure to limit system use to authorized users,
processes or devices puts the security of thesystem at extreme risk, increases the likelihood of
unauthorized access and loss of CUI.

METHOD(S)(S) TO IMPLEMENT: IT Configuration

3.1.2

Limit system access to the types oftransactions and functions that
authorized users are permitted to
execute.

Failure to limit system access to transactions andfunctions authorized users are permitted to
execute puts the security of the system at
extreme risk, increases the likelihood of
unauthorized access and loss of CUI.

METHOD(S) TO IMPLEMENT: IT Configuration

3.1.3

Control the flow of CUI in accordancewith approved authorizations.

Failure to define and control where CUI can flow
(i.e., between system components) can result inunauthorized access to or exposure of CUI.

METHOD(S) TO IMPLEMENT: IT Configuration
The solutions may include firewalls, proxies,
encryption, and other security technologies.

3.1.4

Separate the duties of individuals to
reduce the risk of malevolent activity
without collusion.

Failure to separate duties may result in a single
individual being able to conduct unauthorized
activities alone, without having to involve otherindividuals, thus increasing the security risk to thesystem and the likelihood of unauthorized accessto CUI.

METHOD(S) TO IMPLEMENT: IT Configuration

3.1.5

Employ the principle of least privilege,
including for specific security functions
and privileged accounts.

Failure to apply the principle of least privilege
may result in a single individual being able toconduct unauthorized or inappropriate activities –including those which directly affect the security
state of the system, thus increasing the security
risk to the system and the likelihood of
unauthorized access to CUI.

METHOD(S) TO IMPLEMENT: IT Configuration

2

November 6, 2018
NIST SP 800-171
Security Requirement
3.1.6

Impact if this requirement
is not yet Implemented

Implementation

Use non-privileged accounts or roles
when accessing non-security functions.

Use of privileged accounts for non-privileged
functions (e.g., checking e-mail, browsing theInternet) increases the exposure of the privilegedrole to malicious activity.

METHOD(S) TO IMPLEMENT: IT Configuration

Prevent non-privileged users fromexecuting privileged functions andcapture the execution of such functionsin audit logs.

Allowing non-privileged users to executeprivileged functions defeats the purpose of leastprivilege and puts the system’s security at riskboth to insider and external threats. Failure to
audit execution of privilege functions puts thesystems security at risk of unauthorized orinappropriate activity by the privileged user.

METHOD(S) TO IMPLEMENT: IT Configuration

3.1.8

Limit unsuccessful logon attempts.

Failure to limit unsuccessful logon attempts
makes the system susceptible to brute force
attacks.

METHOD(S) TO IMPLEMENT: IT Configuration

3.1.9

Provide privacy and security notices
consistent with applicable CUI rules.

Failure to provide proper notices may result in theunauthorized and inadvertent exposure ofparticular categories of CUI data, such as Privacy,
Export Controlled or Law Enforcement Sensitive
information.

METHOD(S) TO IMPLEMENT: IT Configuration

Failure to implement session lock with patternhiding displays may allow unauthorized personnel
access to the system itself or to view CUI
displayed on the screen.

METHOD(S) TO IMPLEMENT: IT Configuration

3.1.7

3.1.10 Use session lock with pattern-hiding
displays to prevent access and viewing ofdata after period of inactivity.

3

When all regular users have limited administrative
privileges (e.g., to load software), they are notconsidered privileged users.
IMPLEMENTATION NOTES:
 When all regular users have limited
administrative privileges (e.g., to load
software), they are not considered privileged
users, and do not require auditing as privileged
users.

IMPLEMENTATION NOTES: This requirement references the National
Archives and Records Administration’s (NARA)
Federal rule (32 CFR 2002) implementing its CUI
program. It would apply if a specific type of
CUI (i.e., information that requires safeguarding
or dissemination controls pursuant to law,regulation or Government-wide policy) requires
such notices (e.g., before accessing or entering
the data). This is not common.

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

3.1.11 Terminate (automatically) a user session
after a defined condition.

Failure to terminate a user session automatically
may allow unauthorized access to a session nolonger in active use.

METHOD(S) TO IMPLEMENT: IT Configuration

3.1.12 Monitor and control remote accesssessions.

Failure to monitor and control remote accesssessions puts the information system at high risk
for unauthorized use.

METHOD(S) TO IMPLEMENT: Hardware

3.1.13 Employ cryptographic mechanisms toprotect the confidentiality of remote
access sessions.

Failure to use cryptographic mechanism toprotect the confidentiality of remote accesssessions makes the CUI transmitted subject tointercept.

METHOD(S) TO IMPLEMENT: Software

3.1.14 Route remote access via managed access
control points.

Failure to employ managed access control points
means remote access is not actually controlled,
and puts the information system at high risk forunauthorized access.

3.1.15 Authorize remote execution of privilegedcommands and remote access tosecurity-relevant information.

Failure to explicitly authorize any remote
execution of privileged commands or access tosecurity-related information puts the information
system at extreme risk for unauthorized accessand subversion.

METHOD(S) TO IMPLEMENT: IT Configuration

3.1.16 Authorize wireless access prior toallowing such connections.

Failure to authorize wireless connections
generally means there is little to no control ofwireless connections, and puts the information
system at extreme risk for unauthorized accessand subversion.

METHOD(S) TO IMPLEMENT: IT Configuration

4

Implementation

IMPLEMENTATION NOTES: Cryptography used to protect theconfidentiality of CUI (or in this case covered
defense information) must use FIPS-validated
cryptography, which means the cryptographic
module has to have been tested and validated
to meet FIPS 140-1 or-2 requirements.
METHOD(S) TO IMPLEMENT: Hardware

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

3.1.17 Protect wireless access using
authentication and encryption.

Failure to authenticate and encrypt wirelessaccess makes such access susceptible tounauthorized access, and puts the information
system at extreme risk for unauthorized accessand subversion.

3.1.18 Control connection of mobile devices.

Due to the wide variety and capability of mobile
devices, failure to control their connection (whatdevices can be connected under what conditions),
puts the information system at high risk forunauthorized access.

3.1.19 Encrypt CUI on mobile devices andmobile computing platforms.

Failure to encrypt CUI on mobile devices puts any
CUI on the devices at risk for unauthorized accessif there is a loss of control of the device.

3.1.20 Verify and control/limit connections toand use of external systems.

Failure to control and limit the connection to anduse of external systems (e.g., a support
contractor, a business partner system) can
increase the risk for unauthorized access to thesystem and CUI.

5

Implementation
METHOD(S) TO IMPLEMENT: Software
IMPLEMENTATION NOTES: Requirements for cryptography used toprotect the confidentiality of CUI (or in thiscase covered defense information) must use
FIPS-validated cryptography, which means
the cryptographic module has to have beentested and validated to meet FIPS 140-1 or-2
requirements.
METHOD(S) TO IMPLEMENT: IT Configuration

METHOD(S) TO IMPLEMENT: Software
IMPLEMENTATION NOTES: Requirements for cryptography used to protect
the confidentiality of CUI (or in this casecovered defense information) must use FIPSvalidated cryptography, which means thecryptographic module has to have been tested
and validated to meet FIPS 140-1 or-2
requirements.
METHOD(S) TO IMPLEMENT: Hardware

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

3.1.21 Limit use of portable storage devices on
external systems.

Failure to limit use of an organization’s portablestorage devices on external systems may result in
the exposure of CUI and increase exposure to
malicious software via the portable storage
device.

3.1.22 Control CUI posted or processed on
publicly accessible systems.

Failure to control how CUI is posted or processedon publicly accessible systems may result in the
inadvertent exposure of CUI on a public system(e.g., public website).

Implementation
METHOD(S) TO IMPLEMENT: Policy/Process
IMPLMENTATION NOTES: This is generally implemented by policy
restricting use of the device outside thecompany (e.g., do not use with hotel
computers). No IT configuration, orsoftware/hardware is required, though somedevices can be configured to work only whenconnected to a system to which they canauthenticate (this is, however, not arequirement).
METHOD(S) TO IMPLEMENT: Policy/Process

3.2 AWARENESS AND TRAINING
The purpose of information security awareness, training, and education is to enhance security by raising awareness of the need to protect system resources,developing skills and knowledge so system users can perform their jobs more securely, and building in-depth knowledge as needed to design, implement, or
operate security programs for organizations and systems. The company is responsible for making sure that managers and users are aware of the security
risks associated with their activities and that employees are trained to carry out their information security-related duties and responsibilities.
3.2.1

Ensure that managers, systems
administrators, and users oforganizational systems are made awareof the security risks associated with theiractivities and of the applicable policies,
standards, and procedures related to thesecurity of those systems.

Users who are not trained are not aware of cyberrisks and thereby pose a significant risk to thesecurity of a network.

METHOD(S) TO IMPLEMENT: Policy/Process

3.2.2

Ensure that personnel are trained to carryout their assigned information securityrelated duties and responsibilities.

Inadequately trained system administrators andsecurity personnel present a severe risk to thesecurity of the information system as they can
improperly configure the system and so rendersecurity protections ineffective.

METHOD(S) TO IMPLEMENT: Policy/Process

6November 6, 2018
NIST SP 800-171
Security Requirement
3.2.3

Provide security awareness training on
recognizing and reporting potential
indicators of insider threat.

Impact if this requirement
is not yet Implemented
Users unaware of the characteristics of the Insider
Threat may be unable to detect an active Insider,
putting the security of the system and its
information at risk.

Implementation
METHOD(S) TO IMPLEMENT: Policy/Process
No cost training available athttps://www.cdse.edu/catalog/insiderthreat.html

3.3 AUDIT AND ACCOUNTABILITY
An audit is an independent review and examination of records and activities to assess the adequacy of system requirements and ensure compliance withestablished policies and operational procedures. An audit trail is a record of individuals who have accessed a system as well as what operations the user has
performed during a given period. Audit trails maintain a record of system activity both by system and application processes and by user activity of systems
and applications. In conjunction with appropriate tools and procedures, audit trails can assist in detecting security violations, performance issues, and flaws
in applications. Companies should create, protect, and retain system audit records to the extent needed to enable the monitoring, analysis, investigation,and reporting of unlawful, unauthorized, or inappropriate system activity and ensure that the actions of users can be uniquely traced to those users so they
can be held accountable.
3.3.1

Create and retain system audit logs andrecords to the extent needed to enable
the monitoring, analysis, investigation,and reporting of unlawful or
unauthorized system activity.

Failure to maintain an adequate audit capability
will result in an inability to detect
unauthorized/unlawful system activity, putting
the information system and its information at asevere risk.

METHOD(S) TO IMPLEMENT: IT Configuration

3.3.2

Ensure that the actions of individual
system users can be uniquely traced tothose users so they can be held
accountable for their actions.

If the audit system is incapable of tracing actions
to individuals, it will not be possible to identify
and correct improper or illegal activity on the
network.

METHOD(S) TO IMPLEMENT: IT Configuration

3.3.3

Review and update events.

Failure to review and update which event areaudited (e.g., which event, how and how often)
can result in an inadequate audit capability as
new or changed system capabilities may not be
audited, putting the system at risk.

METHOD(S) TO IMPLEMENT: IT Configuration

3.3.4

Alert in the event of an audit logging
process failure.

Failure to activate alerts of audit logging failures(e.g., audit storage has reached capacity) will
result in loss of auditing capabilities and failure todetect other failures or improper activity.

METHOD(S) TO IMPLEMENT: IT Configuration

7

This is typically a standard (default) configuration.

November 6, 2018
NIST SP 800-171
Security Requirement
3.3.5

Impact if this requirement
is not yet Implemented

Implementation

Correlate audit record review, analysis,
and reporting processes for investigation
and response to indications of unlawful,
unauthorized, suspicious, or unusual
activity.
Provide audit record reduction and report
generation to support on-demand
analysis and reporting.
Provide a system capability thatcompares and synchronizes internal
system clocks with an authoritative
source to generate time stamps for audit
records.

Lack of an ability to correlate audit review,
analysis, and reporting may result in a failure toproperly identify or efficiently investigate orreport improper activity.

METHOD(S) TO IMPLEMENT: Policy/ProcessThis capability improves the ability to identify
improper activity revealed by audit reports.

METHOD(S) TO IMPLEMENT: Software

Time stamps synchronized with an authoritative
source are a requirement for proper analysis ofaudit results since this insures that various audit
results can be properly sequenced, e.g., establish
cause and effect, to support investigation.

METHOD(S) TO IMPLEMENT: IT Configuration

3.3.8

Protect audit information and audit
logging tools from unauthorized access,modification, and deletion.

Auditing can be rendered ineffective (and actuallyused to cover-up improper activity) if not properly
protected from alteration or deletion.

METHOD(S) TO IMPLEMENT: IT Configuration

3.3.9

Limit management of audit logging
functionality to a subset of privileged
users.

If personnel who are subject to audit (e.g.,
privileged users) are allowed to manage audit
functionality they are subject to, they caninvalidate the audit to hide improper activity,
putting the security of system at high risk.

METHOD(S) TO IMPLEMENT: IT Configuration

3.3.6

3.3.7

8

This is a simple configuration to synchronize withauthoritative time source (e.g., NIST Internet time
service at https://www.nist.gov/pml/time-andfrequency-division/services/internet-time-serviceits?iframe=true&width=95%25&height=95%25)
and, for small networks, can be synchronizedmanually.

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation

3.4 CONFIGURATION MANAGEMENT
Configuration management is a collection of activities focused on establishing and maintaining the integrity of information technology products and systems
through the control of processes for initializing, changing, and monitoring the configurations of those products and systems throughout the System
Development Life Cycle (SDLC). Configuration management consists of determining and documenting the appropriate specific settings for a system,
conducting security impact analyses, and managing changes through a change control board. It allows the entire system to be reviewed to help ensure thata change made on one system does not have adverse effects on another system. Companies establish and maintain baseline configurations and inventories
of company systems, including hardware, software, firmware, and documentation throughout the respective SDLC and establish and enforce security
configuration settings for information technology products employed in company systems.
3.4.1

3.4.2

3.4.3

3.4.4

Establish and maintain baseline
configurations and inventories oforganizational systems (including
hardware, software, firmware, anddocumentation) throughout therespective system development life
cycles.

Establishing baseline configurations is essential as‘out of the box’ default configurations are
typically insecure (e.g., Password = password, PIN= 0000) and allow anyone to change theconfiguration, resulting in a severe risk to thesecurity of the system.

METHOD(S) TO IMPLEMENT: Policy/Process or
SoftwareEstablish and enforce security
configuration settings for information
technology products employed inorganizational systems.
Track, review, approve or disapprove, andlog changes to organizational systems.

If security configuration settings are notestablished and enforced, the overall system will
be insecure and at high risk.

METHOD(S) TO IMPLEMENT: IT Configuration or
SoftwareIf changes are not properly managed the system
will rapidly fall out of proper configuration,
become insecure and at high risk. Additionally,
failure to log approved changes makes identifying
unauthorized changes made by an intruder,extremely difficult to detect.

METHOD(S) TO IMPLEMENT: Policy/Process

Analyze the security impact of changes
prior to implementation.

Failure to analyze the security implications of achange before implementation may result inunintended and severe security consequences.

METHOD(S) TO IMPLEMENT: Policy/Process

Inventories of system hardware, software,
firmware, etc.) are essential to proper scanning,
patching and configuration of the system.

9

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation

3.4.5

Define, document, approve, and enforce
physical and logical access restrictions
associated with changes to organizational
systems.

Failure to impose access restrictions related tochanges (e.g., insuring only qualified, authorized
personnel can implement changes) can result inunauthorized changes being made (purposely or
inadvertently) that result in the system being
insecure and at high risk.

METHOD(S) TO IMPLEMENT: IT Configuration

3.4.6

Employ the principle of least functionality
by configuring organizational systems toprovide only essential capabilities.

Systems should be configured to provide only
functions that are needed. Systems withunconstrained or unnecessary functions are
inherently more insecure and so susceptible tointrusion or subversion.

METHOD(S) TO IMPLEMENT: IT Configuration

3.4.7

Restrict, disable, or prevent the use ofnonessential programs, functions, ports,
protocols, and services.

Unneeded but enabled programs, functions,ports, protocols and services can provide readyaccess for misuse or intrusion (especially since if
not needed they typically are not securely
configured or monitored).

METHOD(S) TO IMPLEMENT: IT Configuration or
Software3.4.8

Apply deny-by-exception (blacklisting)policy to prevent the use of unauthorizedsoftware or deny-all, permit-by-exception(whitelisting) policy to allow theexecution of authorized software.

Failure to prevent the use of unauthorizedsoftware can expose the information system tomalicious software, covert channels for
exploitation of the system, or compromise of its
data.

METHOD(S) TO IMPLEMENT: Policy/Process,
IT Configuration, or Software

10This requirement is to Blacklist OR Whitelist.
Blacklist can be a policy and process to prohibit
types of software (e.g., games) or non-company
software, and enforced by periodic review ofsoftware on workstations.

November 6, 2018

3.4.9

NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Control and monitor user-installedsoftware.

Failure to control the software a user can install
may introduce malware and vulnerabilities to the
network.

Implementation
METHOD(S) TO IMPLEMENT: Policy/Process, IT
Configuration; Software This requirement does not necessarily require
use of IT configuration or software, althoughthat would be the typical means of
implementing. A policy/process of periodic
examination of user accounts is acceptable.
IMPLEMENTATION NOTES: This requirement is necessary to protect theoverall system processing CUI. It is not about
software used to actually process CUI.

3.5 IDENTIFICATION AND AUTHENTICATION
For most systems, identification and authentication is often the first line of defense. Identification is the means of verifying the identity of a user, process, or
device, typically as a prerequisite for granting access to resources in a system. Identification and authentication is a technical measure that prevents
unauthorized individuals or processes from entering a system. Identification and authentication is a critical building block of information security since it is
the basis for most types of access control and for establishing user accountability. Access control often requires that the system can identify anddifferentiate between users. Companies should identify system users, processes acting on behalf of users, or devices and authenticate or verify theidentities of those users, processes, or devices, as a prerequisite to allowing access to company systems.
3.5.1

Identify system users, processes acting
on behalf of users, and devices.

If users, devices or processes are not identified,the activity on the system cannot be properly
controlled or monitored, placing the security ofthe system and its information at high risk.

METHOD(S) TO IMPLEMENT: IT Configuration

3.5.2

Authenticate (or verify) the identities ofusers, processes, or devices, as aprerequisite to allowing access toorganizational systems.

If identities are not authenticated prior toproviding access to the system, then the activities
of users, devices, and processes cannot beproperly controlled and monitored, placing thesecurity of the system and its information at highrisk.

METHOD(S) TO IMPLEMENT: IT Configuration

11

November 6, 2018
NIST SP 800-171
Security Requirement
3.5.3

Use multifactor authentication for local
and network access to privileged
accounts and for network access to nonprivileged accounts.

Impact if this requirement
is not yet Implemented
Failure to use multifactor authentication results inweak authentication, typically via simple
passwords, which makes it easier for the intruder
to assume the identity of an authorized user or
privileged user, and compromise the security ofthe system and its information.

12

Implementation
METHOD(S) TO IMPLEMENT: Hardware/Software
IMPLEMENTATION NOTES: Multifactor authentication (MFA) to an
information system uses two or more methodsof authentication involving something you know
(e.g., password); something you have (e.g., a
One-Time Password (OTP) generating device
like a fob, smart-card, or a mobile app on asmart-phone); and something you are (e.g., abiometric like a fingerprint or iris).
 Where you are, even in a controlled accessfacility, is not one of these factors and,generally, would be a condition that applied tomany and not unique to the individual being
authenticated.
 Local Access means access to an organizational
system by a user (or process acting on behalf ofa user) communicating through a directconnection without the use of a network.
 Network Access means access to a system by auser (or a process acting on behalf of a user)
communicating through a network (e.g., local
area network, wide area network, Internet).
 For a NON-PRIVILEGED user, if it’s a standalone
computer (e.g., a laptop computer), with no
network access, the access can be via single
factor authentication (SFA) - MFA is not
required. However, if used to connect to a LAN,
the network access has to be MFA. Typically,organizational desktops are used for network
access and so the user has to use MFA to accesstheir network account. For a PRIVILEGED user,
even local access (e.g., to the standalone)requires MFA.

November 6, 2018
NIST SP 800-171
Security Requirement

3.5.4

Employ replay-resistant authentication
mechanisms for network access toprivileged and non-privileged accounts.

Impact if this requirement
is not yet Implemented

Use of non-replay resistant authentication
mechanisms make a system susceptible tointruders recording and replaying previous
authentication messages, and increases thelikelihood of unauthorized access to the system.

13

Implementation
 MFA is not required for access to mobile devices
such as smartphones or tablets as there is aseparate requirement (3.1.19) to encrypt CUI on
mobile devices and mobile computing
platforms, and typically mobile devices do notsupport MFA in order to access the device.
However, if the mobile device is used to accessa Covered Contractor Information System, thenthe system has to provide the capability for
MFA for access by the device, and which would
be entered via the device (e.g., use of a OTP
device and a password).
 The multifactor authentication system is arequirement for local or network access to theinformation system, which is different fromauthentication to a specific information systemcomponent (e.g., a router) or an application(e.g., database). While many systemcomponents and applications now support (andexpect) multifactor authentication, it is not arequirement to implement two-factor
authentication on specific devices.
METHOD(S) TO IMPLEMENT: IT Configuration or
Software or Hardware
Replay-resistant techniques include, for example,
protocols that use nonces or challenges such as
time synchronous or challenge-response one-timeauthenticators. (3.5.4, Appendix F, NIST SP 800171). This capability is typically standard in recent
Operating Systems.

November 6, 2018
NIST SP 800-171
Security Requirement
3.5.5

Impact if this requirement
is not yet Implemented

Implementation

Prevent reuse of identifiers for a defined
period.

This prevents reuse of the Identifiers (e.g., logonname) assigned to an individual, groups, etc.,
being reassigned to a different individual andgroup to insure the identifier is associated with
only one user/group. If an identifier is reassigned,
the new user may be permitted inappropriate
access to system resources (e.g., files) allowed tothe previous user.

METHOD(S) TO IMPLEMENT: IT Configuration

3.5.6

Disable identifiers after a defined period
of inactivity.

Failure to disable inactive identifies could enable
an intruder to exploit the inactive identifier (andgo unnoticed since the account owner may notnotice).

METHOD(S) TO IMPLEMENT: IT Configuration

3.5.7

Enforce a minimum password complexity
and change of characters when new
passwords are created.

Using weak passwords or not changing characterswhen creating new passwords makes it
substantially easier for the intruder to attack the
password.

METHOD(S) TO IMPLEMENT: IT Configuration

3.5.8

Prohibit password reuse for a specified
number of generations.

Reusing recently expired passwords makes it
substantially easier for the intruder to attack orcompromise the password.

METHOD(S) TO IMPLEMENT: IT Configuration

3.5.9

Allow temporary password use forsystem logons with an immediate change
to a permanent password.

Failure to change temporary passwords
immediately puts the system at risk since thetemporary password is typically more susceptible
to attack or compromise, and known to morethan a single individual.

METHOD(S) TO IMPLEMENT: IT Configuration

14

IMPLEMENTATION NOTES: There are no minimum acceptable values for "adefined period.” The values are left to the DoD
contractor to determine.

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

3.5.10 Store and transmit only
cryptographically-protected passwords.

Failure to properly encrypt passwords in transit orwhen stored makes all passwords susceptible tointercept or exfiltration and puts the security ofthe system and its information at high risk.

3.5.11 Obscure feedback of authentication
information.

Failure to obscure authentication information(e.g., passwords) when entered may result in theobservation and compromise of the password(e.g., shoulder surfing).

Implementation
METHOD(S) TO IMPLEMENT: IT Configuration
IMPLEMENTATION NOTES: The Supplemental Guidance in NIST SP 800-53,
Security and Privacy Controls for Federal
Information Systems and Organizations, for the
related security control IA-5(1) notes that
“Encrypted representations of passwords
include, for example, encrypted versions ofpasswords and one-way cryptographic hashesof passwords.” Best practice would add a
unique “salt” to the password before hashing.
This description applies to the use of“cryptographically-protected passwords” in
NIST SP 800-171 as well.
METHOD(S) TO IMPLEMENT: IT Configuration
This is typically a default configuration to replace
password text with “dots”.

3.6 INCIDENT RESPONSE
Systems are subject to a wide range of threat events, from corrupted data files to viruses to natural disasters. Vulnerability to some threat events can belessened by having standard operating procedures that can be followed in the event of an incident. Companies should establish an operational incident
handling capability for company systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities andtrack, document, and report incidents to company management and/or authorities.
3.6.1

Establish an operational incidenthandling capability for organizational
systems that includes preparation,
detection, analysis, containment,
recovery, and user response activities.

Lack of an operational incident-handling capability
can result in a failure to detect an incident (e.g.,
intrusion) or to properly analyze the impact andrespond, which places the system and its
information at high risk.

METHOD(S) TO IMPLEMENT: Policy/Process or
Software3.6.2

Track, document, and report incidents todesignated officials and/or authorities

Failure to track and report incidents can result inineffective and inappropriate response, adversely
impacting the system.

METHOD(S) TO IMPLEMENT: Policy/Process or
Software15

November 6, 2018
NIST SP 800-171
Security Requirement
3.6.3

both internal and external to theorganization.
Test the organizational incident response
capability.

Impact if this requirement
is not yet Implemented
Failure to test the incident response capability
may result improper response to an actual
incident, placing the security of the system athigher risk.

Implementation

METHOD(S) TO IMPLEMENT: Policy/Process

3.7 MAINTENANCE
To keep systems in good working order and to minimize risks from hardware and software failures, it is important that companies establish procedures for
systems maintenance. There are many ways a company can address these maintenance requirements. Companies should perform periodic and timely
maintenance on company systems and provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct system
maintenance.
3.7.1

Perform maintenance on organizational
systems.

This refers to information security aspects of themaintenance program – failure to maintain thesystem (e.g., apply SW updates, revise
configuration settings, refresh SW beyond end oflife, maintain licenses) can result in significant
security vulnerabilities.

METHOD(S) TO IMPLEMENT: Policy/Process

3.7.2

Provide controls on the tools, techniques,mechanisms, and personnel used to
conduct system maintenance.

Failure to control maintenance can result in the
introduction of malicious code, theft of data or
creation of ‘back doors’ for future exploitation.

METHOD(S) TO IMPLEMENT: Policy/Process

3.7.3

Ensure equipment removed for off-site
maintenance is sanitized of any CUI.

Failure to sanitize equipment can result in
exposure or loss of CUI.

METHOD(S) TO IMPLEMENT: Policy/Process

3.7.4

Check media containing diagnostic andtest programs for malicious code before
the media are used in organizational
systems.

Failure to check diagnostic or test media formalicious code can result in the introduction ofmalicious code into the system, and may result in
exfiltration of data or creation of ‘back doors’ forfuture exploitation.

METHOD(S) TO IMPLEMENT: Software

16

November 6, 2018
NIST SP 800-171
Security Requirement
3.7.5

3.7.6

Impact if this requirement
is not yet Implemented

Require multifactor authentication toestablish nonlocal maintenance sessions
via external network connections andterminate such connections when
nonlocal maintenance is complete.

Failure to strongly authenticate remote
maintenance sessions can result in unauthorizedaccess to the information system, introduction ofmalicious code or creation of back doors for
future exploitation.

Supervise the maintenance activities ofmaintenance personnel without required
access authorization.

Failure to properly supervise ‘outside’
maintenance personnel can result in unauthorized
exposure of CUI, theft of CUI, introduction ofmalicious code or creation of ‘back doors’ forfuture exploitation.

Implementation
METHOD(S) TO IMPLEMENT: Hardware
IMPLEMENTATION NOTES: If remote maintenance sessions are not allowed
or company can ‘prohibit’ remote maintenanceaccess until MFA capability implemented, thisrequirement is met.
 The multifactor authentication for non-local
maintenance is intended for recurring non-local
maintenance by organizational personnel rather
than episodic non-local maintenance by outside
vendors where issuance of such credentials for
one-time activities is not efficient and may not
be advisable. Nevertheless, presuming theindividual performing the repair is known andtrusted, it is possible to provide for “one-time”
multifactor authentication through the use of apassword and a separately provided token (e.g.,
PIN via text message to a cell phone).
METHOD(S) TO IMPLEMENT: Policy/Process

3.8 MEDIA PROTECTION Media protection is a requirement that addresses the defense of system media, which can be described as both digital and nondigital. Media protections can restrict access and make media available to authorized personnel only, apply security labels to sensitive information, andprovide instructions on how to remove information from media so that the information cannot be retrieved or reconstructed. Media protections also
include physically controlling system media and ensuring accountability, as well as restricting mobile devices capable of storing and carrying information intoor outside of restricted areas. Companies should protect system media, both paper and digital, limit access to information on system media to authorizedusers, and sanitize or destroy system media before disposal or release for reuse.
3.8.1 Protect (i.e., physically control and
Failure to properly protect media can lead to loss/ METHOD(S) TO IMPLEMENT: Policy/Processsecurely store) system media containing
theft of CUI. It can also allow introduction of
CUI, both paper and digital.
malicious code or other alteration of the media

17

November 6, 2018
NIST SP 800-171
Security Requirement
3.8.2

Limit access to CUI on system media toauthorized users.

Impact if this requirement
is not yet Implemented
that can affect the security of the system using
the media.
Failure to limit the access to CUI on system media
to authorized users may result in unauthorized
exposure of CUI.

Implementation

METHOD(S) TO IMPLEMENT: Policy/Process
IMPLEMENTATION NOTES: This requirement is meant to be applied byusing physical controls to access physical media,
but other mechanisms for logical access, such as
digital rights management protections or
discretionary access control lists, areacceptable.

3.8.3

Sanitize or destroy system media
containing CUI before disposal or release
for reuse.

Failure to sanitize system media containing CUIprior to disposal or release may result in an
unauthorized exposure of CUI.

METHOD(S) TO IMPLEMENT: Software

3.8.4

Mark media with necessary CUI markingsand distribution limitations.

Failure to properly mark media containing CUI
may result in an unauthorized exposure of CUI.

METHOD(S) TO IMPLEMENT: Policy/Process

18

IMPLEMENTATION NOTES: This requirement applies to information system
media with CUI, which includes both digital andnon-digital media. Digital media includes, forexample, diskettes, magnetic tapes,
external/removable hard disk drives, flash
drives, compact disks, and digital video disks.
Non-digital media includes, for example, paper
and microfilm. It would not include cell phones.
 It is NOT a requirement about marking nonsystem media (e.g., contract deliverables) with
CUI markings.
 The requirements of the clause only apply tocovered defense information, i.e., information
provided or developed by the contractor for
DoD which is Controlled Technical Informationor other information requiring protection bylaw, regulation or government-wide policy, that

November 6, 2018
NIST SP 800-171
Security Requirement

3.8.5

3.8.6

3.8.7

3.8.8

Impact if this requirement
is not yet Implemented

Implementation
is processed, transmitted or stored in thecontractor’s unclassified information system. It
does not apply to information provided by ordeveloped for non-DoD organizations.
Guidance on marking media, along with othermaterials, should be addressed separately in thecontract and is derived from DoD Manual
5200.01, Volume 4, “DoD Information Security
Program: Controlled Unclassified Information(CUI).
METHOD(S) TO IMPLEMENT: Policy/Process

Control access to media containing CUI
and maintain accountability for media
during transport outside of controlledareas.
Implement cryptographic mechanisms toprotect the confidentiality of CUI stored
on digital media during transport outsideof controlled areas unless otherwise
protected by alternative physicalsafeguards.

Failure to control access/maintain accountabilityof media with CUI during transport may result inunauthorized exposure of CUI.
Failure to encrypt media with CUI, if nototherwise protected, could result in the loss andunauthorized exposure of CUI.

METHOD(S) TO IMPLEMENT: Policy/Process or
Software.

Control the use of removable media on
system components.

Failure to control of the use of removable media
on system components can result in the
introduction of malware and/or massive
theft/exfiltration of CUI from the system.

METHOD(S) TO IMPLEMENT: IT Configuration

Prohibit the use of portable storage
devices when such devices have noidentifiable owner.

Use of portable storage devices of unknown
provenance makes introduction of malware into
the system a high probability.

METHOD(S) TO IMPLEMENT: Policy/Process

19

Physical control such as in custody of employees
during transport or shipment via commercial
carrier – USPS, UPS, FedEx – are examples of“alternative physical safeguards”.

A policy and process on allowable use ofremovable media (e.g., thumb drives, DVDs),
including monitoring for compliance, would
address this requirement.

A policy prohibiting use of anonymous portablestorage devices (e.g., thumb drives) and a process

November 6, 2018
NIST SP 800-171
Security Requirement
3.8.9

Protect the confidentiality of backup CUI
at storage locations.

Impact if this requirement
is not yet Implemented
Failure to protect the confidentiality of CUI in
backups at storage locations could result in theundetected compromise, loss, or theft of the CUI.

Implementation
to check on compliance would address thisrequirement.
METHOD(S) TO IMPLEMENT: Policy/Process or
Software

3.9 PERSONNEL SECURITY
Personnel security seeks to minimize the risk that staff (permanent, temporary, or contractor) pose to company assets through the malicious use or
exploitation of their legitimate access to the company’s resources. Companies should be vigilant when recruiting and hiring new employees, as well as
when an employee transfers or is terminated. Companies should ensure that individuals occupying positions of responsibility within the company (including
third-party service providers) are trustworthy and meet established security criteria for those positions, ensure that company information and systems areprotected during and after personnel actions such as terminations and transfers, and employ formal sanctions for personnel failing to comply with company
security policies and procedures.
3.9.1

Screen individuals prior to authorizing
access to organizational systems
containing CUI.

Failure to properly screen individuals prior toaccess to systems containing CUI can result in the
inappropriate exposure of CUI (especially CUI withlimited dissemination controls).

METHOD(S) TO IMPLEMENT: Policy/Process

3.9.2

Ensure that organizational systems
containing CUI are protected during andafter personnel actions such as
terminations and transfers.

Failure to update personnel access following
transfers and terminations can result in the
inappropriate access/exposure of CUI.

METHOD(S) TO IMPLEMENT: Policy/Process

3.10 PHYSICAL PROTECTION
The term physical (and environmental) security refers to measures taken to protect systems, buildings, and related supporting infrastructure against threats
associated with their physical environment. Companies should limit physical access to systems, equipment, and the respective operating environments toauthorized individuals, protect the physical plant and support infrastructure for systems, provide supporting utilities for systems, protect systems against
environmental hazards, and provide appropriate environmental controls in facilities containing systems.
3.10.1 Limit physical access to organizational
systems, equipment, and the respective
operating environments to authorizedindividuals.

Failure to protect physical access to theinformation system could result in theunauthorized access to equipment, disclosure orloss of CUI, introduction of malware, etc.

20

METHOD(S) TO IMPLEMENT: Policy/Process,Software, Hardware
IMPLEMENTATION NOTES:

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation
 The purpose of this requirement is to protect
the information system/equipment by limiting
physical access to the information systemequipment to authorized organizational
personnel (e.g., employees).
Businesses with IT systems that are not in
restricted spaces (e.g., distributed within officeenvironment) may meet this requirement throughobservation/escort procedures.

3.10.2 Protect and monitor the physical facility
and support infrastructure fororganizational systems.

Failure to protect and monitor the physical facility
can result in physical tampering, eavesdropping,monitoring otherwise ‘protected’communications and the exposure or loss of CUI.

METHOD(S) TO IMPLEMENT: Policy/Process,Software, Hardware

3.10.3 Escort visitors and monitor visitor
activity.

Failure to escort and monitor visitors can result in
the unauthorized exposure or loss of CUI andunauthorized access to equipment.

METHOD(S) TO IMPLEMENT: Policy/Process

3.10.4 Maintain audit logs of physical access.

Failure to maintain logs eliminates ability toidentify persons who may have inappropriately
accessed CUI or equipment.

METHOD(S) TO IMPLEMENT: Policy/Process

3.10.5 Control and manage physical accessdevices.

Failure to control and manage physical accessdevices can make physical controls / protections
ineffective.

3.10.6 Enforce safeguarding measures for CUI at
alternate work sites.

Failure to provide proper safeguarding for CUI at
alternate work sites can result in inappropriate
exposure or loss of CUI.

21

Audit logs of physical access specifically to IT
systems may be impractical for small IT systems
not in restricted space while risk is mitigated byincreased observation by employees. Thisrequirement can be met by visitor logs.
METHOD(S) TO IMPLEMENT: Policy/ProcessThis requirement means having control over keys,
combinations and similar access control devices.
METHOD(S) TO IMPLEMENT: Policy/Process
IMPLEMENTATION NOTES: If you have alternate work sites that will be
used to store, process or transmit covered
defense information, the same requirements
apply (i.e., there is no difference inrequirements between the primary andNovember 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation
alternate work sites), although different
methods may be used to meet therequirements at the alternate site.

3.11 RISK ASSESSMENT
Risk assessments identify and prioritize risks to company operations, assets, employees, and other organizations that may result from the operation of asystem. Risk assessments inform company decision makers and support risk responses by identifying: relevant threats to organizations or threats directed
through organizations against other organizations, vulnerabilities both internal and external to organizations, impact (i.e., harm) to the company that may
occur given the potential for threats exploiting vulnerabilities, and the likelihood that harm will occur. Companies should periodically assess the risk tooperations (e.g., mission, functions, image, and reputation), assets, and employees, which may result from the operation of company systems and theassociated processing, storage, or transmission of company information.
3.11.1 Periodically assess the risk toorganizational operations (including
mission, functions, image, or reputation),organizational assets, and individuals,
resulting from the operation oforganizational systems and theassociated processing, storage, ortransmission of CUI.

Failure to assess risk periodically can result in notaddressing emerging or changing threats orvulnerabilities and increased risk to theinformation system’s security and exposure orloss of CUI.

3.11.2 Scan for vulnerabilities in organizational
systems and applications periodically andwhen new vulnerabilities affecting thosesystems and applications are identified.

Failure to scan for vulnerabilities in the system
will result in unidentified vulnerabilities that canbe used to gain unauthorized access to thesystem, introduction of malware, and exfiltrationof CUI.

3.11.3 Remediate vulnerabilities in accordancewith risk assessments.

Failure to patch systems will result invulnerabilities persisting that can be used to gain

22

METHOD(S) TO IMPLEMENT: Policy/Process
IMPLEMENTATION NOTES: There is no defined requirement, methodology
or period for the risk assessments, nor is areport required. All of these are dependent on
the organization, its mission, changes to its
systems and environment – this is a periodic
assessment of how you operate to insure you
understand your risk, which can change overtime. Any changes resulting from theassessment would be reflected in implementing
plans of action and in the system security planper 3.12.2 and 3.12.4.
METHOD(S) TO IMPLEMENT: Software

METHOD(S) TO IMPLEMENT: IT Configuration

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation

unauthorized access to the system, introductionof malware, and exfiltration of CUI.

3.12 SECURITY ASSESMENT
A security requirement assessment is the testing and/or evaluation of the management, operational, and technical security requirements on a system todetermine the extent to which the requirements are implemented correctly, operating as intended, and producing the desired outcome with respect tomeeting the security requirements for the system. The assessment also helps determine if the implemented requirements are the most effective and costefficient solution for the function they are intended to serve. Companies should periodically assess the security requirements in company systems todetermine if the requirements are effective in their application, develop and implement plans of action designed to correct deficiencies and reduce or
eliminate vulnerabilities in company systems, authorize the operation of company systems and any associated system connections, and monitor security
requirements on an ongoing basis to ensure the continued effectiveness of the requirements, and document these actions in the System Security Plan.
3.12.1 Periodically assess the security controls inorganizational systems to determine if
the controls are effective in theirapplication

Failure to periodically assess the security controls
may result in ineffective controls that can result inunauthorized access to the system, introductionof malware, and exfiltration of CUI.

METHOD(S) TO IMPLEMENT: Policy/Process

3.12.2 Develop and implement plans of action
designed to correct deficiencies andreduce or eliminate vulnerabilities inorganizational systems.

Failure to develop and implement plans of action
can result in deficiencies not being resolved in atimely manner, placing the security of the system
at risk.

METHOD(S) TO IMPLEMENT: Policy/Process

23

IMPLEMENTATION NOTES: There are no minimum acceptable values for"Periodically assess…” The values are left to the
DoD contractor to determine.
 There is no defined period for security control
assessments, nor is there a report required.
The organization should define for itself whencontrols are assessed, which may be based on atime period determined by its needs and/or
events, such as a change to the system or its
environment.

IMPLEMENTATION NOTES: Plans of Action are required for requirementsthat are applicable and not yet implemented, orwhen there is a deficiency in a requirement.
When all requirements are met and noNovember 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation
deficiencies have been identified, no planof action is required.

3.12.3 Monitor security controls on ongoingbasis to ensure the continued
effectiveness of the controls.

Failure to monitor the effectiveness of security
controls on an ongoing basis may result inineffective controls that increase risk ofunauthorized access to the system, introductionof malware, and exfiltration of CUI.

METHOD(S) TO IMPLEMENT: Policy/Process or
Software3.12.4 Develop, document, and periodically update
system security plans that describe systemboundaries, system environments ofoperation, how security requirements are
implemented, and the relationships with orconnections to other systems.

Lack of a current System Security Plan can resultin necessary security controls not being applied or
misapplied, unanticipated and unsecureconnections allowed, and generally may result inan unacceptable security posture, putting theoverall security of the system and its information
at risk.

METHOD(S) TO IMPLEMENT: Policy/Process

24

IMPLEMENTATION NOTES: There is no defined period for security control
monitoring, nor is there a report required.
The organization should define for itself how
and when controls are monitored, which may
be based on a time period determined by its
needs and/or certain events, such as achange to the system or environment.

IMPLEMENTATION NOTES: Revision 1 of the NIST SP 800-171 states thatwhen requested by the requiring activity andsubmitted by contractor, the system security
plan and any associated plans of action
demonstrate implementation or planned
implementation of the security requirements.
 Additionally, Revision 1 notes that “Federal
agencies may consider the submitted systemsecurity plans and plans of action as critical
inputs to an overall risk management decision
to process, store, or transmit CUI on a systemhosted by a nonfederal organization andwhether or not it is advisable to pursue anagreement or contract with the nonfederal
organization.”

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation
 Requiring activities may utilize the systemsecurity plan and associated plans of action in avariety of ways in the contract
formation/administration process in order toobtain the level of security that they require.
 Footnote 26 to NIST SP 800-171 Security
Requirement 3.12.4 states that, “There is noprescribed format or specified level of detail forsystem security plans. However, organizations
must ensure that the required information in
3.12.4 is appropriately conveyed in thoseplans.” Additionally, Chapter 3 of NIST SP 800171, Revision 1 states that, “Organizations candocument the system security plan and plan ofaction as separate or combined documents andin any chosen format.” Due to popular request, NIST has posted asample template for an SSP – associated with
the NIST SP 800-171 posting – but notes that
there is no prescribed format.

3.13 SYSTEM AND COMMUNICATIONS PROTECTION
System and communications protection requirements provide an array of safeguards for the system. Some of the requirements in this family address theconfidentiality information at rest and in transit. The protection of confidentiality can be provided by these requirements through physical or logical means.
Companies can better safeguard their information by separating user functionality and system management functionality. Providing this type of protection
prevents the presentation of system management-related functionality on an interface for non-privileged users. System and communications protection
also establishes boundaries that restrict access to publicly accessible information within a system. Using boundary protections, a company can monitor andcontrol communications at external boundaries as well as key internal boundaries within the system.
3.13.1 Monitor, control, and protect
communications (i.e., informationtransmitted or received by organizational
systems) at the external boundaries andkey internal boundaries of organizational
systems.

Failure to monitor and control communications at
external boundaries and key internal boundaries
will likely result (and certainly not prevent)
unauthorized communications within and outside
the system, increasing the probability of

25

METHOD(S) TO IMPLEMENT: Hardware

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation

unauthorized access or intrusion into the system,
introduction of malware, exfiltration of data, etc.
3.13.2 Employ architectural designs, softwaredevelopment techniques, and systems
engineering principles that promote
effective information security withinorganizational systems.
3.13.3 Separate user functionality from systemmanagement functionality.

Failure to employ appropriate architecturaldesigns, SW development techniques or System
Engineering can result in an insecure system built
from individually ‘secure’ parts.

METHOD(S) TO IMPLEMENT: Policy/Process

Failure to separate user and system management
functionality can result in users being able toaccess system administration or management
functions, putting the system at risk andincreasing the access available to intruders.

METHOD(S) TO IMPLEMENT: IT Configuration

3.13.4 Prevent unauthorized and unintended
information transfer via shared system
resources.

Failure to prevent information transfer via sharedresources (e.g., cache memory, shared disks) canresult in unauthorized access to CUI.

METHOD(S) TO IMPLEMENT: IT Configuration or
Software or Hardware

3.13.5 Implement subnetworks for publicly
accessible system components that arephysically or logically separated frominternal networks.

Failure to use subnetworks (e.g., DMZs) toseparate publicly accessible components frominternal networks can result in the inadvertent
exposure of CUI on the publicly accessible
component or inappropriate access byunauthorized personnel to the internal network
and CUI.

METHOD(S) TO IMPLEMENT: IT Configuration or
Software or Hardware

26

The subnetwork, or “DMZ,” can be single or dual
firewall(s) that separate the internal networkfrom system components connected to external
networks (e.g., the Internet).

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

3.13.6 Deny network communications traffic bydefault and allow network
communications traffic by exception (i.e.,deny all, permit by exception).

Failure to employ ‘deny by default connections’
may result in unintentional connections/traffic,
put the security of the system at risk and result in
the unauthorized exposure/loss of CUI.

Implementation
METHOD(S) TO IMPLEMENT: IT Configuration or
Software or Hardware
This is a standard configuration of a firewall,though may require addition of a firewall if none
exists.
IMPLEMENTATION NOTES: This requirement can be met if there is amechanism to implement “deny all, permit byexception” rule within the path between theexternal network and the CUI information, but if
there are internal elements/segments of theinformation system that do not have theprotections in place to process/store CUI, thenthey would also fall under this provision.

3.13.7 Prevent remote devices fromsimultaneously establishing non-remoteconnections with organizational systems
and communicating via some otherconnection to resources in external
networks (i.e. split tunneling).

Failure to prevent split tunneling can provide an
intruder access to the protected network via theunprotected network connected via the tunnel,
putting the security of the system and CUI at risk.

3.13.8 Implement cryptographic mechanisms toprevent unauthorized disclosure of CUI
during transmission unless otherwise
protected by alternative physicalsafeguards.

Failure to encrypt CUI during transmission(outside the protected information system) puts
the confidentiality of the CUI at risk.

27

METHOD(S) TO IMPLEMENT: IT Configuration
This is a configuration setting on (typically)
laptops to prevent split-tunneling when operating
remotely (i.e., connecting to a local unprotectedresource (e.g., printer) while simultaneously
connected remotely to the protected network.
METHOD(S) TO IMPLEMENT: IT Configuration or
Software or Hardware
IMPLEMENTATION NOTES: Requirements for cryptography used toprotect the confidentiality of CUI (or in thiscase covered defense information) must use
FIPS-validated cryptography, which means
the cryptographic module has to have beentested and validated to meet FIPS 140-1 or-2
requirements.
 When implementing this requirement,
encryption, though preferred, is not required if

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation
using common-carrier provided MPLS, as the
MPLS separation provides sufficient protection
without encryption.
 Transport Layer Security (TLS) protocol can beused to protect CUI during transmission overthe Internet.
 The current version of TLS (TLS 1.2) ispreferred. If earlier versions must be used tointeract with certain organizations, theservers shall not support Secure Sockets
Layer (SSL) version 3.0 or earlier. For further
information see NIST SP 800-52, Rev 1,
Guidelines for the Selection, Configuration,and Use of Transport Layer Security (TLS)
Implementations, April 2014.
 Common Carrier telecommunications circuits orPlain Old Telephone Service (POTS) would notnormally be considered part of the information
system processing CUI. Data traversing
Common Carrier systems should be separately
encrypted per 3.13.8. Contracts with Common
Carriers to provide telecommunications services
may include DFARS Clause 252.204-7012, butshould not be interpreted to imply the Common
Carrier telecommunications systems themselves
have to meet the DFARS requirements. Datatransmission of CUI transmitted over standard
telephone dial-up service (POTS) similarly
should be separately encrypted as no protection
is expected to be provided by the telephonesystem. Voice communication of CUI over the
telephone is not addressed by NIST SP 800-171
or by DFARS clause 252.204-7012.

28

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

3.13.9 Terminate network connections
associated with communications sessions
at the end of the sessions or after adefined period of inactivity.

Failure to terminate communications session at
the completion of the session may result inunintended access to the system and data.

METHOD(S) TO IMPLEMENT: IT Configuration

3.13.10 Establish and manage cryptographic keys
for cryptography employed inorganizational systems.

Failure to establish and manage cryptographic
keys can result in unauthorized access to thesystem and CUI.

METHOD(S) TO IMPLEMENT: IT Configuration or
Software3.13.11 Employ FIPS-validated cryptography
when used to protect the confidentialityof CUI.

Failure to use FIPS-validated cryptography isconsidered by NIST to be the equivalent of notusing cryptography (i.e., not encrypting the data)
due to the high failure rate during validation
testing and therefore any CUI or systemdepending upon non-FIPS validated cryptography
is at risk of exposure.

METHOD(S) TO IMPLEMENT: IT Configuration or
Software or Hardware

29

Implementation

IMPLEMENTATION NOTES: Requirements for cryptography used to protect
the confidentiality of CUI (or in this casecovered defense information) must use FIPSvalidated cryptography, which means thecryptographic module has to have been tested& validated to meet FIPS 140-1 or-2
requirements.
 Simply using an approved algorithm (e.g., FIPS
197 for AES) is not sufficient – the module(software and/or hardware) used to implement
the algorithm must be separately validated
under FIPS 140.
 When an application or device allows a choice(by selecting FIPS-mode or not), then the FIPSmode has been validated under FIPS 140-2, but
the other options (non-FIPS) allow certain
operations that would not meet the FIPS
requirements.
 More information is available at
http://csrc.nist.gov/groups/STM/cmvp/ andNovember 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation
http://csrc.nist.gov/groups/STM/cmvp/validatio
n.html FIPS-validated cryptography is only required toprotect CUI, typically when transmitted orstored external to the covered contractor IT
system. It is NOT required for all cryptography –which is often used for other purposes within
the protected system.

3.13.12 Prohibit remote activation ofcollaborative computing devices andprovide indication of devices in use tousers present at the device.

Failure to prevent remote activation ofcollaborative computing devices (e.g., networked
whiteboards, cameras, microphones, etc) canresult in the unauthorized disclosure of CUI.

3.13.13 Control and monitor the use of mobile
code.

Failure to control/monitor mobile code (e.g., Java,JavaScript, ActiveX, Postscript), which can be used
maliciously, can result in damage or failure in the
security of the system.

3.13.14 Control and monitor the use of Voiceover Internet Protocol (VoIP)
technologies.

Failure to control and monitor VoIP technologies(treating VoIP as traditional telephone rather thanas IP traffic) can result in unauthorized access tothe system or exfiltration of CUI.

30

METHOD(S) TO IMPLEMENT: IT Configuration
This is typically a configuration option to prevent(turn off) activation by remote users. This is not
required for dedicated video conferencing
systems which rely on calling party to activate.
METHOD(S) TO IMPLEMENT: IT Configuration or
Software or Hardware
IMPLEMENTATION NOTES: This requirement is necessary to protect theoverall system processing CUI. It is not about
software used to actually process CUI and is not
related to mobile devices.
METHOD(S) TO IMPLEMENT: IT Configuration or
Software or Hardware
IMPLEMENTATION NOTES: This requires treating VoIP as IP (e.g.,
configuring firewalls appropriately). It does
NOT require monitoring content of calls.
 Even if outsourced, the internal IT systemshould have protections in place to control

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

3.13.15 Protect the authenticity ofcommunications sessions.

Failure to insure the authenticity ofcommunications sessions can result in theunauthorized loss of CUI and unauthorized accessto the information system via man-in the-middle
attacks, session hijacking, etc).

3.13.16 Protect the confidentiality of CUI at rest.

Failure to protect the confidentiality of CUI at rest
can result in the unauthorized disclosure of CUI.

31

Implementation(albeit limited) and monitor VoIP within thesystem.
 If physically or cryptographically isolated froman information system processing CUI, thiscontrol would not apply (but it would be
prudent to apply the requirement).
METHOD(S) TO IMPLEMENT: IT Configuration
This is often a default configuration.

METHOD(S) TO IMPLEMENT: IT Configuration or
Software
IMPLEMENTATION NOTES: This does NOT require encryption (except for
CUI on mobile devices) if the CUI is protected byother means (e.g., physical protection), or if it iswithin the boundary of the covered contractor
information system (e.g., NIST SP 800-171
compliant).
 CUI be stored at rest in any non-mobile device
or data center, unencrypted, as long as it isprotected by other approved logical or physicalmethods. The mapped NIST SP 800-53, Security
and Privacy Controls for Federal Information
Systems and Organizations, control (SC-8), notesthat this requirement is to protect theconfidentiality of CUI information at rest when
it is located on storage devices as specificcomponents of information systems and that“organizations may employ different
mechanisms to achieve confidentiality

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

Implementation
protection, including the use of cryptographic
mechanisms and file share scanning.” Thus,
encryption is an option, not a requirement.

3.14 SYSTEM AND INFORMATION INTEGRITY
Integrity is defined as guarding against improper information modification or destruction, and includes ensuring information non-repudiation andauthenticity. It is the assertion that data can only be accessed or modified by the authorized employees. System and information integrity provides
assurance that the information being accessed has not been meddled with or damaged by an error in the system. Companies should identify, report, andcorrect information and system flaws in a timely manner, provide protection from malicious code at appropriate locations within company systems, andmonitor system security alerts and advisories and respond appropriately.
3.14.1 Identify, report, and correct system flaws
in a timely manner.

Failure to identify and patch system
flaws/vulnerabilities in a timely manner makes
the system vulnerable to unauthorized access andmalicious software and the exfiltration of CUI.

METHOD(S) TO IMPLEMENT: IT Configuration or
Software3.14.2 Provide protection from malicious codeat designated locations withinorganizational systems.

Failure to provide malicious code protection (e.g.,
Antivirus) makes the system vulnerable tomalicious software, exfiltration of CUI, andunauthorized access.

METHOD(S) TO IMPLEMENT: Software

3.14.3 Monitor system security alerts andadvisories and take action in response.

Failure to monitor system security alerts andadvisories results in security flaws or threats not
being addressed and the system more vulnerable
to unauthorized access and exfiltration of CUI.

METHOD(S) TO IMPLEMENT: Policy or Software

3.14.4 Update malicious code protection
mechanisms when new releases areavailable.

Failure to update malicious code protections (e.g.,
Antivirus signatures) makes the system more
susceptible to malicious code, unauthorizedaccess and exfiltration of CUI.

METHOD(S) TO IMPLEMENT: IT Configuration

32

November 6, 2018
NIST SP 800-171
Security Requirement

Impact if this requirement
is not yet Implemented

3.14.5 Perform periodic scans of organizational
systems and real-time scans of files fromexternal sources as files are downloaded,
opened, or executed.

Failure to periodically scan the system and when
downloading, opening, executing files, etc., makes
the system more susceptible to malicious code,
unauthorized access and exfiltration of CUI.

METHOD(S) TO IMPLEMENT: IT Configuration

3.14.6 Monitor organizational systems, including
inbound and outbound communications
traffic, to detect attacks and indicators ofpotential attacks.
3.14.7 Identify unauthorized use oforganizational systems.

Failure to monitor the information system will
result in attacks not being detected and increases
the likelihood of unauthorized access to thesystem and exfiltration of CUI.
Failure to identify unauthorized use of the system
will present a severe risk to the information
system and unauthorized access to or exfiltrationof CUI.

METHOD(S) TO IMPLEMENT: Software or
Hardware33

Implementation

METHOD(S) TO IMPLEMENT: Software or
Hardware