NIST SP 800-171 Rev 2
ActiveCommon framework
Best for: NIST SP 800-171 is intended to be used by federal agencies in contracts or other agreements established with nonfederal organizations. Its requirements apply to all components of nonfederal systems and organizations that process, store, and/or transmit CUI.
| Mandatory? | Mandatory for federal contractors handling CUI |
|---|---|
| Who validates? | C3PAO (CMMC) or self-assessment for lower CMMC levels |
| Renewal | Annual self-assessment; C3PAO every 3 years (CMMC Level 2+) |
| Scope | Non-federal systems and organizations handling CUI |
| Governing body | NIST (National Institute of Standards and Technology), published through its Computer Security Resource Center (CSRC), NIST SP 800-171 Rev 2. Official source |
Controls by category
183 controls are Mapped to NIST SP 800-171 Rev 2.
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.12 Monitor and control remote access sessions
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
3.1.14 Route remote access via managed access control points
3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
3.1.3 Control the flow of CUI in accordance with approved authorizations
3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion
| Control | Status |
|---|---|
| Azure subscriptions should have more than one owner | Mapped |
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts
| Control | Status |
|---|---|
| Custom RBAC roles should not be used | Mapped |
| Azure subscriptions should limit owners to 3 | Mapped |
3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
3.11.3 Remediate vulnerabilities in accordance with risk assessments
3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
3.13.16 Protect the confidentiality of CUI at rest
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
3.14.1 Identify, report, and correct system flaws in a timely manner
3.14.2 Provide protection from malicious code at designated locations within organizational systems
3.14.3 Monitor system security alerts and advisories and take action in response
3.14.4 Update malicious code protection mechanisms when new releases are available
3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
3.14.7 Identify unauthorized use of organizational systems
3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
3.3.4 Alert in the event of an audit logging process failure
3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities
| Control | Status |
|---|---|
| Azure subscriptions should have Microsoft Defender for Servers enabled | Mapped |
3.5.1 Identify system users, processes acting on behalf of users, and devices
3.5.10 Store and transmit only cryptographically-protected passwords
3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
3.5.5 Prevent reuse of identifiers for a defined period
3.5.6 Disable identifiers after a defined period of inactivity
3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
3.5.8 Prohibit password reuse for a specified number of generations
3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization
3.8.9 Protect the confidentiality of backup CUI at storage locations
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST SP 800-53 Rev 5 | High 97% | |
| FedRAMP High | High 93% | |
| CMMC 2.0 Level 2 | High 68% |