NIST SP800-171
NIST SP800-171 is a codification of the requirements that any non-federal computer system must follow in order to store,
process, or transmit Controlled Unclassified Information (CUI) or provide security protection for such systems. This setof guidelines imposes administrative and technical requirements on contractors and sub-contractors of federal agencies
to ensure that sensitive federal information remains confidential when stored in non-federal information systems andorganizations. First published in 2015 by the National Institute of Standards and Technology (NIST), NIST SP800-171 went
into full effect in 2017 and has been updated several times since then.
This document maps out how Sophos solutions offer effective tools to help address some of the requirements as part of acustomer’s efforts to comply with NIST SP800-171.
Specifications and descriptions are subject to change without notice. Sophos disclaims all warranties and guarantees regarding this information. The use of Sophos products
alone does not guarantee legal compliance. The information in this document does not constitute legal advice. Customers are solely responsible for compliance with all laws andregulations and should consult their own legal counsel for advice regarding such compliance.

No.

Security Requirements

Sophos Solution

How It Helps

Sophos Firewall

User awareness across all areas of our firewall governs all firewall policies and reporting,giving user-level controls over applications, bandwidth, and other network resources.

3.1 Access Control
Basic Security Requirements
3.1.1

Limit system access to authorized users,
processes acting on behalf of authorized users,
and devices (including other systems).

Supports flexible multi-factor authentication options, including directory services, for access to key system areas.
Sophos Central Device Encryption

Enables protection of devices and data with full disk encryption for Windows and macOS.

Sophos Mobile

A rich set of device management capabilities keeps sensitive business email and documents protectedon mobile devices – even for users working with personal devices. Flexible compliance rules monitor
device health and can automatically deny access to sensitive data in case of a compromised device.

Sophos Cloud Optix

Connects disparate actions with Sophos AI to pinpoint unusual access patterns and locations
to cloud provider consoles in near real time to identify credential misuse or theft.
It includes an IAM visualization tool that provides a complete map of IAM relationships
and allows teams to quickly and easily identify over-privileged access and create
right-sized IAM policies before they are exploited in cyberattacks.

NIST SP800-171

No.

3.1.2

Security Requirements

Limit system access to the types oftransactions and functions that authorizedusers are permitted to execute.

Sophos Solution

How It Helps

Sophos ZTNA

Continuously validates user identity, device health, and compliance
before granting access to applications and data.

Sophos Central

Keeps access lists and user privileges information up-to-date. Procedures are in place
to ensure that access rights are revoked if individuals no longer meet the conditions toreceive access (e.g., because they change position or leave the company).

Sophos Firewall

User awareness across all areas of our firewall governs all firewall policies and reporting,giving user-level controls over applications, bandwidth, and other network resources.
Supports flexible multi-factor authentication options including directory services for access to key system areas.

Sophos Central Device Encryption

Enables protection of devices and data with full disk encryption for Windows and macOS.

Sophos Intercept X

Integrates innovative technology like deep learning, anti-exploit, and anti-adversary
into malicious traffic detection with real-time threat intelligence to help prevent,detect, and remediate threats with ease across all devices and platforms.

Sophos Intercept X for Server
Sophos ZTNA

Continuously validates user identity, device health, and compliance
before granting access to applications and data.

Sophos Managed Detection
and Response (MDR)

Sophos MDR continuously monitors signals from across the security environment, including
network, email, mobile, identity, endpoint and more, enabling us to quickly and accurately detect
potential cybersecurity events. Anomalous behaviors and code use are detected, investigated,and correlated to identify malicious activities and enable us to quickly neutralize the event.

Sophos Network Detection
and Response (NDR)

Continuously analyzes trafﬁc for suspicious patterns. It works with your managed endpoints and ﬁrewalls
to monitor network activity for suspicious and malicious patterns that your endpoints and ﬁrewalls cannot
see. It detects abnormal trafﬁc ﬂows from unmanaged systems and IoT devices, rogue assets,insider
threats, previously unseen zero-day attacks, and unusual patterns deep within the network.

Sophos Cloud Optix

Connects disparate actions with Sophos AI to pinpoint unusual access patterns and locations
to cloud provider consoles in near real time to identify credential misuse or theft.
It includes an IAM visualization tool that provides a complete map of IAM relationships
and allows teams to quickly and easily identify over-privileged access and create
right-sized IAM policies before they are exploited in cyberattacks.

Sophos Mobile

A rich set of device management capabilities keeps sensitive business email and documents
protected on mobile devices – even for users working with personal devices.
Flexible compliance rules monitor device health and flag deviation from desired settings.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Sophos Firewall

User awareness across all areas of Sophos firewall governs all firewall policies and reporting,enabling user-level control over applications, bandwidth and other network resources.

Derived Security Requirements
3.1.3

Control the flow of CUI in accordancewith approved authorizations.

Supports flexible multi-factor authentication options, including directory services, for access to key system areas.
Sophos ZTNA

Validates user identity, device health, and compliance before granting access to resources.

Sophos Cloud Optix

Connects disparate actions with Sophos AI to pinpoint unusual access patterns and locations
to cloud provider consoles in near real time to identify credential misuse or theft.
It includes an IAM visualization tool that provides a complete map of IAM relationships
and allows teams to quickly and easily identify over-privileged access and create
right-sized IAM policies before they are exploited in cyberattacks.

3.1.4

Separate the duties of individuals to reduce therisk of malevolent activity without collusion.

Sophos Switch

Allows network access control that enables you to authenticate users using LDAP,
MAC address, or other authentication methods to connect to a network. This prevents
unauthenticated users and devices from gaining access to your LAN.

Sophos Mobile

Provides enterprise mobility and security management capabilities for traditional and mobile
endpoints, including security and device policies. Flexible compliance rules monitor device healthand can automatically deny access to sensitive data in case of a compromised device.

All Sophos products

Sophos’ user-identity-based policy technology allows user-level controls
over network resources and other organization assets.

Sophos Central

Does not permit shared administrator accounts. Each employee has his or her
own account, with explicit permissions granted to each account.
Enables protection of privileged and administrator accounts with advanced two-factor authentication.

3.1.5

Employ the principle of least privilege, including forspecific security functions and privileged accounts.

Sophos Cloud Optix

Connects disparate actions with Sophos AI to pinpoint unusual access patterns and locations
to cloud provider consoles in near real time to identify credential misuse or theft.
It includes an IAM visualization tool that provides a complete map of IAM relationships
and allows teams to quickly and easily identify over-privileged access and create
right-sized IAM policies before they are exploited in cyberattacks.

Sophos Central

Configurable role-based administration provides granular control of administrator privileges.
It keeps access lists and user privileges information up to date and protects privileged
and administrator accounts with advanced two-factor authentication.
Does not permit shared administrator accounts. Each employee has his or her
own account, with explicit permissions granted to each account.

3.1.7

Prevent non-privileged users from executing
privileged functions and capture theexecution of such functions in audit logs.

All Sophos products

Generate security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos Cloud Optix

Sophos Cloud Optix, Cloud Security Posture Management solution, connects disparate
actions with Sophos AI to pinpoint unusual access patterns and locations to cloudprovider consoles in near real time to identify credential misuse or theft.
It includes an IAM visualization tool that provides a complete map of IAM relationships
and allows teams to quickly and easily identify over-privileged access and create
right-sized IAM policies before they are exploited in cyberattacks.

Sophos Central

Does not permit shared administrator accounts. Each employee has his or her
own account, with explicit permissions granted to each account.
Protects privileged and administrator accounts with advanced two-factor authentication.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

3.1.12

Monitor and control remote access sessions.

All Sophos products

Generate security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos Firewall

Controls remote access authentication and user monitoring for remote access and logs all access attempts.

Sophos ZTNA

Continuously validates user identity, device health, and compliance before granting access to applications
and data. It authenticates requests for access from trusted users, irrespective of the location.

Sophos Wireless

Monitors the health status of any Sophos-managed endpoint or mobile device and automatically
restricts web access on trusted Wi-Fi networks for those with serious compliance issues.

Sophos Email

Sophos SPX encryption provides encryption in transit and at rest. SPX encryption is able to dynamicallyencapsulate email content and attachments into a secure encrypted PDF to ensure compliance.

Sophos Firewall

Facilitates two-factor authentication for VPN connections, with granular RADIUS/TACACS integration.

3.1.13

Employ cryptographic mechanisms to protect
the confidentiality of remote access sessions.

The Sophos Cryptographic Module incorporated into the Sophos Firewall systems provides
FIPS 140-2 validated cryptography for the protection of sensitive information.
Sophos WirelessCreates dynamic encrypted Wi-Fi sessions, protecting information intransit on Sophos-managed networks and hotspots.

3.1.14

Route remote access via managed
access control points.

Sophos WirelessAutomatically controls access for Sophos-managed clients based upon their health status.
Web access is restricted on trusted Wi-Fi networks for non-compliant devices.

3.1.16

Authorize wireless access prior toallowing such connections.

Sophos Wireless

Monitors the health status of any Sophos-managed endpoint or mobile device and automatically
restricts web access on trusted Wi-Fi networks for those with serious compliance issues.
Provides controlled internet access and hotspots for visitors, contractors, and other guests on the
network using enterprise-grade backend authentication for a seamless user experience.

3.1.17

Protect wireless access using
authentication and encryption.

Sophos WirelessEnterprise-grade backend authentication provides seamless and controlled internet
access and hotspots for visitors, contractors, and other guests on the network.
Dynamic encrypted Wi-Fi sessions protect the information in transit on Sophos-managed networks and hotspots.

3.1.18Control connection of mobile devices.

Sophos Intercept X for Mobile

Integration with Microsoft Intune allows administrators to build conditional accesspolicies, restricting access to applications and data when a threat is detected.

3.1.19

Encrypt CUI on mobile devices andmobile computing platforms.

Sophos Mobile

Ensures the integrity of sensitive data on the mobile devices that your employees use to access your company
database and other corporate resources. It promotes device encryption and ensures you can deny accessto emails, networks, and other resources if a device does not comply with your company’s policies.

Sophos Training and Certifications

Training courses and certifications to help partners and customers get the best out of Sophos security
deployments and access to the latest know-how and expertise for security best practices.

Sophos Phish Threat

Provides simulated phishing cyberattacks and security awareness training for theorganization’s end users. Courses cover a wide range of topics, from phishing and cybersecurity
overview lessons to data loss prevention, password protection, and more.

3.2 Awareness and Training
Basic Security Requirements
3.2.1

Ensure that managers, systems administrators,
and users of organizational systems are
made aware of the security risks associatedwith their activities and of the applicablepolicies, standards, and procedures related
to the security of those systems.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Sophos Phish Threat

Provides simulated phishing cyberattacks and security awareness training for theorganization’s end users. Courses cover a wide range of topics, from phishing and cybersecurity
overview lessons to data loss prevention, password protection, and more.

Derived Security Requirements
3.2.3

Provide security awareness training on recognizing
and reporting potential indicators of insider threat.

Sophos Phish Threat connects with Sophos Email to identify those who have a highrisk profile. You can then seamlessly enroll them into targeted phishing simulations
and training to improve awareness and cut your risk of attack.

3.3 Audit and Accountability
Basic Security Requirements
3.3.1

Create and retain system audit logs and records
to the extent needed to enable the monitoring,
analysis, investigation, and reporting of
unlawful or unauthorized system activity.

All Sophos products

Generate security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos Intercept X

Creates detailed log events for all malicious activity on endpoint systems, helping to
identify suspicious activity on systems that may store or process CUI.

Sophos Intercept X for Server

3.3.2

Ensure that the actions of individual systemusers can be uniquely traced to those users sothey can be held accountable for their actions.

Sophos Firewall

Allows real-time insights into network and user events and quick and easy access tohistorical data. It retains finite logs on the device itself and also summarizes the logs in
the form of drill-down on-appliance reports for analysis. The logs can also be integrated
into an independent external Syslog server or Sophos Central for analysis.

Sophos XDR

Goes beyond the endpoint, pulling in rich network, email, cloud, and mobile data sources to give you aneven broader picture of your cybersecurity posture with the ability to drill down into granular detail whenneeded. With data from each product flowing into the Sophos Data Lake you can quickly answer businesscritical questions, correlate events from different data sources and take even more informed action.

Sophos Managed Detection
and Response (MDR)

Sophos MDR detects and investigates suspicious events from across the full security
environment to identify threats and appropriate response activities. Data is collectedacross endpoints, networks, identity, email, and more, and then correlated using powerful
AI tools, threat intelligence, and human expertise to identify impact and response.

All Sophos products

Sophos’ user-identity-based technology powers all policies and reporting across all Sophos
products. This allows organizations to enforce role-based user-level controls over network
resources and other organizational assets and trace the actions of individual users.

Synchronized Security feature
in Sophos product

The Synchronized User ID feature shares user identity between Sophos Endpoint Protectionand Sophos Firewall, making user identity completely transparent and trouble-free.

Sophos Firewall

Stored logs cannot be accessed, destroyed, or altered without administrator privileges.

Derived Security Requirements
3.3.8

Protect audit information and audit
logging tools from unauthorized access,modification, and deletion.

To prevent accidental destruction due to the destruction of the firewall device altogether,
the logs can be integrated into an independent Syslog server or Sophos Central.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Sophos Cloud Optix

Offers inventory management across multiple cloud providers with continuous asset
monitoring and complete network topology and traffic visualization.

3.4 Configuration Management
Basic Security Requirements
3.4.1

Establish and maintain baseline configurations
and inventories of organizational systems(including hardware, software, firmware, anddocumentation) throughout the respective
system development life cycles

It establishes guardrails to prevent, detect, and remediate accidental or malicious changes in
network configuration, network traffic, resource configuration, and user behavior or activities.

Derived Security Requirements
3.4.3

Track, review, approve or disapprove, andlog changes to organizational systems.

All Sophos products

All administrative actions are logged and available for reporting and audits.

3.4.6

Employ the principle of least functionality
by configuring organizational systems toprovide only essential capabilities.

Sophos Firewall

User awareness across all areas of our firewall governs all firewall policies
and reporting, enabling user-level access controls.

Restrict, disable, or prevent the use of nonessential
programs, functions, ports, protocols, and services.

Sophos Firewall

3.4.7

Supports flexible multi-factor authentication options including directory services for access to key system areas.
Enables role-based administration for delegating secure network security management; blocks traffic, services,
ports and protocols except those explicitly allowed and defined as appropriate and necessary for the organization.
Supports flexible multi-factor authentication options, including directory services for access to key system areas.

3.4.8

Apply deny-by-exception (blacklisting) policy
to prevent the use of unauthorized software or
deny-all, permit-by-exception (whitelisting) policy
to allow the execution of authorized software.

Sophos Firewall

Synchronized Application Control in Sophos Firewall identifies all networked
applications in the environment running on Sophos-managed endpoints.
User-based application policies enable custom-tailored application control to be added to
any user, group, or network policy with the option also to apply traffic shaping.

Sophos Intercept X

Endpoint Protection application control policies restrict the use of unauthorized applications.

Sophos Intercept X for Server

3.4.9

Control and monitor user-installed software.

Sophos Intercept X for Server

Integrates server application whitelisting/lockdown with advanced anti-malware and HIPS thatallows application whitelisting at the click of a button and permits only trusted applications.

Sophos Mobile

Monitor devices for jailbreaking and application sideloading and deny access to email,network, and other resources if the device is not in compliance with the policy.

Sophos Intercept X

Exploit prevention capabilities stop vulnerabilities in applications and operating systems

Sophos Intercept X for Server

from being exploited by attackers.
Endpoint Protection application control policies restrict the use of unauthorized applications.

Sophos Managed Detection
and Response (MDR)

Sophos MDR continuously monitors signals from across the security environment, including
network, email, mobile, identity, endpoint and more, enabling us to quickly and accurately detect
potential cybersecurity events. Anomalous behaviors and code use are detected, investigatedand correlated to identify malicious activities and enable us to quickly neutralize the event.

Sophos Firewall

Provides visibility and control over thousands of applications via customizable policy templates with granular
controls based on category, risk, technology, or other undesirable characteristics (P2P apps, IMs, games andother harmful software). It ensures fully automated application security with pre-defined policy templates
for commonly used enterprise applications/software packages. Synchronized Application Control in Sophos
Firewall identifies all networked applications in the environment running on Sophos Managed Endpoints.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Sophos Firewall

User awareness across all areas of our firewall governs all firewall policies and reporting, enabling next-gen
control over applications, web surfing, bandwidth quotas, and other network resources by user/group.

All Sophos products

Sophos’ user-identity-based technology powers all policies and reporting across all Sophos
products. This allows organizations to enforce role-based user-level controls over network
resources and other organizational assets and trace the actions of individual users.

Sophos Cloud Optix

Connects disparate actions with Sophos AI to identify unusual user access patterns
and locations to identify credential misuse or theft. Ensures all identities only
perform actions that are required for their tasks and nothing more.

Sophos Firewall

Supports flexible multi-factor authentication options including directory services for access to key system areas.

Sophos Switch

Allows network access control that enables user authentication using LDAP, MAC
address, or other authentication methods to connect to a network. This prevents
unauthenticated users and devices from gaining access to the LAN.

Sophos ZTNA

Validates user identity, device health, and compliance before granting access to resources.

Sophos Mobile

A rich set of device management capabilities keeps sensitive business email and documents
protected on mobile devices – even for users working with personal devices.

3.5 Identification and Authentication
Basic Security Requirements
3.5.1

3.5.2

Identify system users, processes acting
on behalf of users, and devices.

Authenticate (or verify) the identities of users,
processes, or devices, as a prerequisite toallowing access to organizational systems.

Denies access to email, network, and other resources if the device is not in compliance with the policy.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Sophos Firewall

Supports flexible multi-factor authentication options including directory services for access to key system areas.

Sophos Switch

Allows network access control that enables user authentication using LDAP, MAC
address, or other authentication methods to connect to a network. This prevents
unauthenticated users and devices from gaining access to the LAN.

Sophos Central

Protects privileged and administrator accounts with advanced two-factor authentication.

Derived Security Requirements
3.5.3

Use multifactor authentication for local andnetwork access to privileged accounts and for
network access to non-privileged accounts.

Keeps access lists and user privileges information up to date. Provides procedures toensure that access rights are revoked if individuals no longer meet the conditions toreceive access (e.g., because they change position or leave the company).
3.5.7

3.5.8

Enforce a minimum password
complexity and change of characterswhen new passwords are created.

Prohibit password reuse for a specified
number of generations.

Sophos Central

Disables or removes default passwords. Passwords are sufficiently complex towithstand targeted “brute force” attacks and must be rotated periodically.

Sophos Firewall

Ensures strong passphrase policy to be applied for admin accounts in terms ofcomplexity, length, password reuse and use of a single dictionary word.

Sophos Firewall

Allows strong passphrase policy to be applied for admin accounts in terms ofcomplexity, length, password reuse, and use of a single dictionary word.

Synchronized Security feature
in Sophos products

Shares telemetry and health status, enabling coordinated isolation, detection, and malware
remediation across servers, endpoints, and firewalls – stopping advanced attacks.

All Sophos products

Generate security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos Intercept X

Integrates innovative technology like deep learning, anti-exploit, and anti-adversary
into malicious traffic detection with real-time threat intelligence to help prevent,detect, and remediate threats with ease across all devices and platforms.

3.6 Incident Response
Basic Security Requirements
3.6.1

Establish an operational incident-handlingcapability for organizational systems that includes
preparation, detection, analysis, containment,
recovery, and user response activities.

Sophos Intercept X for Server

Includes rollback to original files after a ransomware or master boot record attack. Provides forensic-level
remediation by eradicating malicious code as well as eliminating nasty registry key changes created by malware.
Sophos Managed Detection
and Response (MDR)

Sophos MDR detects and investigates suspicious events from across the full security
environment to identify threats and appropriate response activities. Data is collectedacross endpoint, network, identity email, and more, and then correlated using powerful AI
tools, threat intelligence and human expertise to identify impact and response.

Sophos Rapid Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

Sophos Cloud Optix

Scans cloud resources for security misconfigurations, profiling any alerts by risk level to help teams
focus on the priority areas, and provide detailed remediation guidance to fix those issues.

Sophos Firewall

Uniquely integrates with Sophos Endpoint, Sophos XDR, and Sophos MDR to automatically
respond to any threat or attack identified at the firewall, the endpoint, or by a security
analyst. It automatically isolates compromised hosts, preventing lateral movement andexternal communications until a threat can be investigated and cleaned up.

Sophos Network Detection
and Response (NDR)

When Sophos NDR identiﬁes an indicator of compromise, active threat, or adversary,
analysts are immediately alerted and can instantly push a threat feed to Sophos
Firewall to trigger an automated response to isolate the compromised host.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

3.6.2

Track, document, and report incidents todesignated officials and/or authorities bothinternal and external to the organization.

Sophos Managed Detection
and Response (MDR)

Sophos MDR includes full incident response, delivered by a dedicated team of response specialists who areexperts at battling adversaries. Clear procedures and documentation enable consistent information sharing.

Sophos Intercept X

Device Control allows admins to control the use of removable media through policy settings.

3.8 Media Protection
Derived Security Requirements
3.8.7

Control the use of removable media
on system components.

Sophos Intercept X for Server

3.9 Personnel Security
Basic Security Requirements
3.9.1

3.9.2

Screen individuals prior to authorizing accessto organizational systems containing CUI.

Ensure that organizational systems containing
CUI are protected during and after personnel
actions such as terminations and transfers.

Sophos Firewall

Supports flexible multi-factor authentication options including directory services for access to key system areas.

Sophos Central

Protects privileged and administrator accounts with advanced two-factor authentication.

Sophos ZTNA

Validates user identity, device health, and compliance before granting access to resources.

Sophos Mobile

Ensures the integrity of sensitive data on the mobile devices that your employees use to access your company
database and other corporate resources. It promotes device encryption and ensures you can deny accessto emails, networks, and other resources if a device does not comply with your company’s policies.

Sophos Central

Keeps access lists and user privileges information up to date. Provides procedures toensure that access rights are revoked if individuals no longer meet the conditions toreceive access (e.g., because they change position or leave the company).

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Synchronized Security feature
in Sophos products

Shares telemetry and health status, enabling coordinated isolation, detection, and malware
remediation across servers, endpoints, and firewalls – stopping advanced attacks.

Sophos XDR

Detects and investigates across endpoints, servers, firewalls, and other data sources. Provides
a holistic view of organization’s cybersecurity posture with the ability to drill down into granulardetail when needed. The Sophos Data Lake allows to quickly answer business critical questions,correlate events from different data sources and take even more informed action.

Sophos Network Detection
and Response (NDR)

Continuously analyzes trafﬁc for suspicious patterns. It works with Sophos-managed endpoints
and ﬁrewalls to monitor network activity for suspicious and malicious patterns. It detects
abnormal trafﬁc ﬂows from unmanaged systems and IoT devices, rogue assets, insider threats,
previously unseen zero-day attacks, and unusual patterns deep within the network.

Sophos Cloud Optix

Cloud Optix enables organizations to design public cloud environments to meet Amazon Web
Services, Microsoft Azure, and Google Cloud Platform security best practice standards andmaintain them. This agentless service continually monitors public cloud resources, providing thevisibility to proactively identify unsanctioned activity, vulnerabilities, and misconfigurations.

Sophos Managed Detection
and Response (MDR)

Sophos MDR detects and investigates suspicious events from across the full security
environment to identify threats and appropriate response activities. Data is collectedacross endpoint, network, identity email, and more, and then correlated using powerful AI
tools, threat intelligence and human expertise to identify impact and response.

Sophos Rapid Response Service

Provides incredibly fast assistance, identifying and neutralizing active threats against
your organization – delivered by an expert team of incident responders.

All Sophos products

Generate security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos Firewall

Provides visibility and control over thousands of applications via customizable policy templateswith granular controls based on category, risk, technology, or other undesirable characteristics (P2P
apps, IMs, games and other harmful software). Allows fully automated application security with predefined policy templates for commonly used enterprise applications / software packages.

Sophos Mobile

Monitors mobile devices for jailbreaking and application sideloading. Denies access toemail, network, and other resources if device is not in compliance with policy.

Synchronized Security in Sophos products

Sophos Firewall’s Synchronized Security Endpoint Integration identifies all unknown, evasive, and custom
applications running on your network so you can easily identify rogue applications like Psiphon and block them.

Sophos Cloud Optix

Scans cloud resources for security misconfigurations, profiling any alerts by risk level to help teams
focus on the priority areas, and provide detailed remediation guidance to fix those issues.

Sophos Managed Detection
and Response (MDR)

Sophos MDR investigates and assesses potential security risks across the full environment 24/7, leveraging
world-leading threat intelligence from Sophos X-Ops to identify risk level and prioritize response.

3.11 Risk Assessment
Basic Security Requirements
3.11.1

Periodically assess the risk to organizational
operations (including mission, functions,image, or reputation), organizational assets,
and individuals, resulting from the operationof organizational systems and the associatedprocessing, storage, or transmission of CUI.

Derived Security Requirements
3.11.2

Scan for vulnerabilities in organizational
systems and applications periodically andwhen new vulnerabilities affecting thosesystems and applications are identified.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Sophos Intercept X

HIPS, deep learning, anti-exploit, anti-adversary, and malicious traffic detection
combine to proactively detect malicious behaviors occurring on the host.

Sophos Intercept X for Server

Endpoint Protection application control policies restrict the use of unauthorized applications.
Exploit prevention capabilities stop vulnerabilities in applications andoperating systems from being exploited by attackers.

3.11.3Remediate vulnerabilities in accordancewith risk assessments.

Synchronized Security in Sophos products

Shares telemetry and health status, enabling coordinated isolation, detection,and malware remediation across servers, endpoints, and firewalls.

Sophos Cloud Optix

Continuously monitors and detects drift in configuration standards, and prevents, detects, andautomatically remediates accidental or malicious changes in resource configuration.

Sophos Firewall

Uniquely integrates with Sophos Endpoint, Sophos XDR, and Sophos MDR to automatically
respond to any threat or attack identified at the firewall, the endpoint, or by a security
analyst. It automatically isolates compromised hosts, preventing lateral movement andexternal communications until a threat can be investigated and cleaned up.

Sophos Managed Detection
and Response (MDR)

24/7 detection, investigation and neutralization of suspicious activities by human experts
enables us to identify and stop exploitation of vulnerabilities by adversaries.
Sophos X-Ops experts keep operators up-to-date on the latest threat and vulnerability developments.

Sophos Rapid Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

Sophos Intercept X

Integrates innovative technology like deep learning, anti-exploit, and anti-adversary
into malicious traffic detection with real-time threat intelligence to help prevent,detect, and remediate threats with ease across all devices and platforms.

Sophos Intercept X for Server

3.12 Security Assessment
Basic Security Requirements
3.12.2Develop and implement plans of action designed
to correct deficiencies and reduce or eliminate
vulnerabilities in organizational systems.

Sophos Intercept X
Sophos Intercept X for Server

Integrates innovative technology like deep learning, anti-exploit, and anti-adversary
into malicious traffic detection with real-time threat intelligence to help prevent,detect, and remediate threats with ease across all devices and platforms.

Sophos Managed Detection
and Response (MDR)

24/7 detection, investigation and neutralization of suspicious activities by human experts
enables us to identify and stop exploitation of vulnerabilities by adversaries.
Sophos X-Ops experts keep operators up-to-date on the latest threat and vulnerability developments.

Sophos Firewall

lncludes the latest advanced protection technologies and threat intelligence, such
as TLS 1.3 and DPI inspection, machine learning, and cloud sandboxing.
It uniquely integrates with Sophos Endpoint, Sophos XDR, and Sophos MDR to automatically
respond to any threat or attack identified at the firewall, the endpoint, or by a security
analyst, automatically isolating compromised hosts, preventing lateral movement andexternal communications until a threat can be investigated and cleaned up.

Sophos Cloud Optix

Proactively identifies unsanctioned activity, vulnerabilities, and misconfigurations across AWS, Azure, and GCP.
Complete cloud edge firewall solution includes IPS, ATP, and URL filtering and lets you deploy several
network security products at once to protect your hybrid cloud environments against network threats.

Sophos Network Detection
and Response (NDR)

Continuously analyzes trafﬁc for suspicious patterns, working with Sophos-managed endpoints
and ﬁrewalls to monitor network activity for suspicious and malicious patterns. It detects
abnormal trafﬁc ﬂows from unmanaged systems and IoT devices, rogue assets, insider threats,
previously unseen zero-day attacks, and unusual patterns deep within the network.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Sophos Firewall

Data Leakage Prevention (DLP) capabilities in Sophos products can detect sensitive dataand prevent leaks of such information via email, uploads, and local copying.

3.13 System and Communications Protection
Derived Security Requirements
3.13.4

Prevent unauthorized and unintended informationtransfer via shared system resources.

Sophos Intercept X
Sophos Intercept X for Server
Sophos Intercept X

Device Control allows admins to control the use of removable media through policy settings.

Sophos Intercept X for Server
Sophos Central Device Encryption

Protect devices and data with full disk encryption for Windows and macOS.

Sophos Mobile

A rich set of device management capabilities keeps sensitive business email and documents
protected on mobile devices – even for users working with personal devices.
Flexible compliance rules monitor device health and flag deviation from desired settings.

3.13.5

Implement subnetworks for publicly accessible
system components that are physically or
logically separated from internal networks.

Sophos Firewall

Flexible and powerful segmentation options via zones and VLANs provide ways to separate levels of trust on yournetwork while enabling added protection against lateral movement between different parts of your network.

Sophos Switch

Allows configuration of VLANs to segment your internal traffic and reduce
the attack surface in case of an infection or breach.
Allows network access control that enables you to authenticate users using LDAP,
MAC address, or other authentication methods to connect to a network. This prevents
unauthenticated users and devices from gaining access to your LAN.

3.13.8Implement cryptographic mechanisms toprevent unauthorized disclosure of CUI duringtransmission unless otherwise protectedby alternative physical safeguards.

Sophos Mobile

Supports BYOD environments through the Android Enterprise Work Profile and iOS User Enrolment modesof management. Corporate emails and apps can be deployed to a device while these remain separate from auser’s personal data. Admins retain control over corporate content without intruding on the users’ privacy.

Sophos Email

Automatically scans message bodies and attachments for sensitive data, allowing you
to easily establish policies to block or encrypt messages with just a few clicks.
Sophos Email Offers TLS encryption and support for SMTP/S along with push-based encryption tosend encrypted emails and attachments as password protected documents direct to the user’s inbox,
full portal-based pull encryption to manage encrypted messages entirely from a secure portal, and S/MIME to encrypt email messages and add a digital signature to safeguard against email spoofing.

Sophos Mobile

Flexible compliance rules monitor device health and can automatically denyaccess to sensitive data in case of a compromised device.
A rich set of device management capabilities, containers, and market-leading encryption keeps sensitive
business email and documents protected on mobile devices – even for users working with personal devices.

3.13.11

Employ FIPS-validated cryptography whenused to protect the confidentiality of CUI.

Sophos WirelessCreates dynamic encrypted Wi-Fi sessions, protecting information intransit on Sophos managed networks and hotspots.

Sophos Firewall

Facilitates two-factor authentication for VPN connections, with granular RADIUS/TACACS integration.

Sophos Firewall

The Sophos Cryptographic Module incorporated into the Sophos Firewall systems provides
FIPS 140-2 validated cryptography for the protection of sensitive information.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

3.13.13

Control and monitor the use of mobile code.

Sophos Mobile

Monitors mobile devices for jailbreaking and application sideloading. Denies access toemail, network, and other resources if device is not in compliance with policy.

Sophos Managed Detection
and Response (MDR)

Continuously monitors signals from across the security environment, including network, email,mobile, identity, endpoint and more, enabling us to quickly and accurately detect potential
cybersecurity events. Anomalous behaviors and code use are detected, investigated, andcorrelated to identify malicious activities and enable us to quickly neutralize the event.

Sophos Intercept X

Endpoint Protection application control policies restrict the use of unauthorized applications.

Sophos Intercept X for Server
3.13.15

Protect the authenticity ofcommunications sessions.

Sophos Email

Automatically scans message bodies and attachments for sensitive data, allowing you
to easily establish policies to block or encrypt messages with just a few clicks.
Sophos Email Offers TLS encryption and support for SMTP/S along with push-based encryption tosend encrypted emails and attachments as password protected documents direct to the user’s inbox,
full portal-based pull encryption to manage encrypted messages entirely from a secure portal, and S/MIME to encrypt email messages and add a digital signature to safeguard against email spoofing.

3.13.16

Protect the confidentiality of CUI at rest.

Sophos Cloud Optix

Establishes guardrails to prevent, detect, and remediate accidental or malicious changes in network
configuration, network traffic, resource configuration, and user behavior or activities.

Sophos Managed Detection
and Response (MDR)

Sophos MDR continuously monitors signals from across the security environment, including
network, email, mobile, identity, endpoint and more, enabling us to quickly and accurately detect
potential cybersecurity events. Anomalous behaviors and code use are detected, investigated,and correlated to identify malicious activities and enable us to quickly neutralize the event.

Sophos Firewall

With the Active Threat Response feature, it automatically coordinates a response with endpoints,
wireless, ZTNA, email, and other Sophos solutions to stop threats dead in their tracks when a threat
or indicator of compromise is detected. Dynamic firewall rules ensure that compromised devices
are unable to communicate with command-and-control servers or move around the network.

Sophos WirelessCreates dynamic encrypted Wi-Fi sessions, protecting information intransit on Sophos managed networks and hotspots.

Sophos Firewall

Data Leakage Prevention (DLP) capabilities in Sophos products can detect sensitive dataand can prevent leaks of such information via email, uploads, and local copying.

Sophos Intercept X
Sophos Intercept X for Server
Sophos Managed Detection
and Response (MDR)

24/7 monitoring of the environment plus investigation and neutralization of malicious
activities secures against data loss through adversarial activities.

Sophos Intercept X

HIPS, deep learning, anti-exploit, anti-adversary, and malicious traffic detection combine
to proactively detect malicious behaviors occurring on the host. Endpoint Protection
application control policies restrict the use of unauthorized applications.

Sophos Intercept X for Server
Sophos Firewall

Limits access between untrusted devices and critical servers with segmentation of the internal networkand by applying policies, adding a layer of protection and logging to disrupt the attack chain.

Sophos Mobile

A rich set of device management capabilities keeps sensitive business email and documents
protected on mobile devices – even for users working with personal devices.
Flexible compliance rules monitor device health and flag deviation from desired settings.

Sophos Cloud Optix

Public cloud security benchmark assessments proactively identify storage services (e.g. Amazon S3), hard
drive snapshots, and databases without encryption enabled, or with public access enabled and ports exposed.
Guided remediation then instructs the administrator on how to protect these services and data at rest.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

Sophos ZTNA

Validates user identity, device health, and compliance before granting access to resources.

Synchronized Security feature
in Sophos products

Synchronized Security allows Sophos Firewall and Intercept X endpoint protection to work together to identify,
isolate and clean up devices that have been compromised, preventing them from leaking confidential data.
When the threat is neutralized and there is no risk of lateral movement, network connectivity is restored.

Sophos Central Device Encryption

Protect devices and data with full disk encryption for Windows and macOS.
Verify device encryption status and demonstrate compliance.

All Sophos products

Generate security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos XDR

Goes beyond the endpoint, pulling in rich network, email, cloud and mobile data sources to give you aneven broader picture of your cybersecurity posture with the ability to drill down into granular detail whenneeded. With data from each product flowing into the Sophos Data Lake you can quickly answer businesscritical questions, correlate events from different data sources and take even more informed action.

Sophos Cloud Optix

Scans cloud resources for security misconfigurations, profiling any alerts by risk level to help teams
focus on the priority areas, and provide detailed remediation guidance to fix those issues.

Sophos Managed Detection
and Response (MDR)

Sophos MDR detects and investigates suspicious events from across the full security
environment to identify threats and appropriate response activities. Data is collectedacross endpoint, network, identity email, and more, and then correlated using powerful AI
tools, threat intelligence and human expertise to identify impact and response.

Sophos Rapid Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

Synchronized Security feature
in Sophos products

Shares telemetry and health status, enabling coordinated isolation, detection, and malware
remediation across servers, endpoints, and firewalls ¬– stopping advanced attacks.

Sophos Intercept X

Integrates innovative technology like deep learning, anti-exploit, and anti-adversary into malicious traffic
detection with real-time threat intelligence to help prevent, detect and remediate threats with ease.

3.14 System and Information Integrity
Basic Security Requirements
3.14.1

3.14.2

Identify, report, and correct system
flaws in a timely manner.

Provide protection from malicious code at
designated locations within organizational systems.

Sophos Intercept X for Server
Sophos Cloud Optix

Continuously monitors and detects drift in configuration standards, and prevents, detects, andautomatically remediates accidental or malicious changes in resource configuration.

Sophos Managed Detection
and Response (MDR)

Sophos MDR continuously monitors signals from across the security environment, including
network, email, mobile, identity, endpoint and more, enabling us to quickly and accurately detect
potential cybersecurity events. Anomalous behaviors and code use are detected, investigated,and correlated to identify malicious activities and enable us to quickly neutralize the event

Sophos Rapid Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

3.14.3

Monitor system security alerts andadvisories and take action in response.

Synchronized Security feature
in Sophos products

Shares telemetry and health status, enabling coordinated isolation, detection and malware
remediation across servers, endpoints, and firewalls – stopping advanced attacks.

Sophos Firewall

Integration with Sophos MDR and Sophos XDR allows Sophos Firewall to provide Automated Threat
Response and Synchronized Security to stop threats before they can cause serious problem.

Sophos Intercept X

Integrates innovative technology like deep learning, anti-exploit, and anti-adversary into malicious traffic
detection with real-time threat intelligence to help prevent, detect and remediate threats with ease.

Sophos Intercept X for Server

Sophos Network Detection
and Response (NDR)

Get a root cause analysis of an attack with complete visibility on the how and where of
the attack, along with recommendations on what your next steps should be.
Continuously analyzes trafﬁc for suspicious patterns and works with Sophos-managed endpoints
and ﬁrewalls to monitor network activity for suspicious and malicious patterns. It detects
abnormal trafﬁc ﬂows from unmanaged systems and IoT devices, rogue assets,insider threats,
previously unseen zero-day attacks, and unusual patterns deep within the network.
When an indicator of compromise, active threat, or adversary is detected, analysts
are immediately alerted and can instantly push a threat feed to Sophos Firewall
to trigger an automated response to isolate the compromised host.

Sophos Managed Detection
and Response (MDR)

Sophos MDR includes full incident response, delivered by a dedicated team of response specialists who areexperts at battling adversaries. Clear procedures and documentation enable consistent info sharing.

Sophos Rapid Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

Sophos Cloud Optix

Continuously monitors and detects drift in configuration standards, and prevents, detects, andautomatically remediates accidental or malicious changes in resource configuration.

Update malicious code protection mechanisms
when new releases are available.

Sophos Intercept X

Intercept X continuously looks at reported false positives and false negatives to ensure the product isbeing continuously improved. It integrates a deep learning malware detection model that can scale tohundreds of millions of training samples and can ‘memorize’ the entire observable threat landscape aspart of its training process. It is regularly trained by our SophosLabs team to stay up to date over time.

Monitor organizational systems, including inboundand outbound communications traffic, to detectattacks and indicators of potential attacks.

All Sophos products

Generate security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos Cloud Optix

Scans cloud resources for security misconfigurations, profiling any alerts by risk level to help teams
focus on the priority areas, and provide detailed remediation guidance to fix those issues.

Sophos XDR

Goes beyond the endpoint, pulling in rich network, email, cloud and mobile data sources to give you aneven broader picture of your cybersecurity posture with the ability to drill down into granular detail whenneeded. With data from each product flowing into the Sophos Data Lake you can quickly answer businesscritical questions, correlate events from different data sources and take even more informed action.

Sophos Network Detection
and Response (NDR)

Continuously analyzes trafﬁc for suspicious patterns. It detects abnormal trafﬁc ﬂows
from unmanaged systems and IoT devices, rogue assets, insider threats, previously
unseen zero-day attacks, and unusual patterns deep within the network.

Sophos Managed Detection
and Response (MDR)

Sophos MDR investigates suspicious signals, correlating data and behaviors and leveraging
Sophos X-Ops threat intelligence for context and insights. On notification of vulnerabilities,
Sophos MDR proactively hunts for exposure to enable swift remediation.

Sophos Rapid Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

Derived Security Requirements
3.14.43.14.6

Sophos Intercept X for Server

NIST SP800-171

No.

Security Requirements

Sophos Solution

How It Helps

3.14.7

Identify unauthorized use oforganizational systems.

Sophos Network Detection
and Response (NDR)

Continuously analyzes trafﬁc for suspicious patterns. It works with your managed endpoints and ﬁrewalls
to monitor network activity for suspicious and malicious patterns that your endpoints and ﬁrewalls cannot
see. It detects abnormal trafﬁc ﬂows from unmanaged systems and IoT devices, rogue assets,insider
threats, previously unseen zero-day attacks, and unusual patterns deep within the network.

Synchronized Security feature
in Sophos products

Synchronized Security allows Sophos Firewall and Intercept X endpoint protection to work together to identify,
isolate and clean up devices that have been compromised, preventing them from leaking confidential data.
When the threat is neutralized and there is no risk of lateral movement, network connectivity is restored.

Sophos Intercept X

HIPS, Deep Learning, Anti-exploit, Anti-adversary, and malicious traffic detection
combine to proactively detect malicious behaviors occurring on the host.

Sophos Intercept X for Server

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

All Sophos products

Generate security event logs that can be integrated into a centralized
monitoring program for incident detection and response.

Sophos Cloud Optix

Scans cloud resources for security misconfigurations, profiling any alerts by risk level to help teams
focus on the priority areas, and provide detailed remediation guidance to fix those issues.

Sophos XDR

Goes beyond the endpoint, pulling in rich network, email, cloud and mobile data sources to give you aneven broader picture of your cybersecurity posture with the ability to drill down into granular detail whenneeded. With data from each product flowing into the Sophos Data Lake you can quickly answer businesscritical questions, correlate events from different data sources and take even more informed action.

Sophos Managed Detection
and Response (MDR)

Sophos MDR investigates suspicious signals, correlating data and behaviors and leveraging
Sophos X-Ops threat intelligence for context and insights. On notification of vulnerabilities,
Sophos MDR proactively hunts for exposure to enable swift remediation.

Sophos Rapid Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2024-03-15 CC (MP)Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com