03.01 Access Control

Statement

• a. Define the types of system accounts allowed and prohibited.

• b. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria.

• c. Specify:

  • 01. Authorized users of the system,

  • 02. Group and role membership, and

  • 03. Access authorizations (i.e., privileges) for each account.

• d. Authorize access to the system based on:

  • 01. A valid access authorization and

  • 02. Intended system usage.

• e. Monitor the use of system accounts.

• f. Disable system accounts when:

  • 01. The accounts have expired,

  • 02. The accounts have been inactive for {{ insert: param, A.03.01.01.ODP.01 }},

  • 03. The accounts are no longer associated with a user or individual,

  • 04. The accounts are in violation of organizational policy, or

  • 05. Significant risks associated with individuals are discovered.

• g. Notify account managers and designated personnel or roles within:

  • 01. {{ insert: param, A.03.01.01.ODP.02 }} when accounts are no longer required.

  • 02. {{ insert: param, A.03.01.01.ODP.03 }} when users are terminated or transferred.

  • 03. {{ insert: param, A.03.01.01.ODP.04 }} when system usage or the need-to-know changes for an individual.

• h. Require that users log out of the system after {{ insert: param, A.03.01.01.ODP.05 }} of expected inactivity or when {{ insert: param, A.03.01.01.ODP.06 }}.

Guidance

This requirement focuses on account management for systems and applications. The definition and enforcement of access authorizations other than those determined by account type (e.g., privileged access, non-privileged access) are addressed in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.02)03.01.02. System account types include individual, group, temporary, system, guest, anonymous, emergency, developer, and service. Users who require administrative privileges on system accounts receive additional scrutiny by personnel responsible for approving such accounts and privileged access. Types of accounts that organizations may prohibit due to increased risk include group, emergency, guest, anonymous, and temporary. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of both. Other attributes required for authorizing access include restrictions on the time of day, day of the week, and point of origin. When defining other system account attributes, organizations consider system requirements (e.g., system upgrades, scheduled maintenance) and mission and business requirements (e.g., time zone differences, remote access to facilitate travel requirements). Users who pose a significant security risk include individuals for whom reliable evidence indicates either the intention to use authorized access to the system to cause harm or that adversaries will cause harm through them. Close coordination among mission and business owners, system administrators, human resource managers, and legal staff is essential when disabling system accounts for high-risk individuals. Time periods for the notification of organizational personnel or roles may vary. Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.10) 03.01.10.

Assessment objective

system accounts are created in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system accounts are enabled in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system accounts are modified in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system accounts are disabled in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system accounts are removed in accordance with organizational policy, procedures, prerequisites, and criteria.

Assessment objective

system account types allowed are defined.

Assessment objective

system account types prohibited are defined.

Assessment objective

authorized users of the system are specified.

Assessment objective

group and role memberships are specified.

Assessment objective

access authorizations (i.e., privileges) for each account are specified.

Assessment objective

access to the system is authorized based on a valid access authorization.

Assessment objective

access to the system is authorized based on intended system usage.

Assessment objective

the use of system accounts is monitored.

Assessment objective

system accounts are disabled when the accounts have expired.

Assessment objective

system accounts are disabled when the accounts have been inactive for {{ insert: param, A.03.01.01.ODP.01 }}.

Assessment objective

system accounts are disabled when the accounts are no longer associated with a user or individual.

Assessment objective

system accounts are disabled when the accounts violate organizational policy.

Assessment objective

account managers and designated personnel or roles are notified within {{ insert: param, A.03.01.01.ODP.02 }} when accounts are no longer required.

Assessment objective

account managers and designated personnel or roles are notified within {{ insert: param, A.03.01.01.ODP.03 }} when users are terminated or transferred.

Assessment objective

account managers and designated personnel or roles are notified within {{ insert: param, A.03.01.01.ODP.04 }} when system usage or the need-to-know changes for an individual.

Assessment objective

system accounts are disabled when significant risks associated with individuals are discovered.

Assessment objective

users are required to log out of the system after {{ insert: param, A.03.01.01.ODP.05 }} of expected inactivity or when the following circumstances occur: {{ insert: param, A.03.01.01.ODP.06 }}.

Assessment method

• access control policy and procedures personnel termination or transfer policies and procedures procedures for account management list of active system accounts and the name of the individual associated with each account system design documentation list of conditions for group and role membership system configuration settings notifications of recent transfers, separations, or terminations of employees list of recently disabled system accounts and the name of the individual associated with each account list of user activities that pose significant organizational risks access authorization records account management compliance reviews system monitoring and audit records system security plan system-generated list of accounts removed system-generated list of emergency accounts disabled system-generated list of disabled accounts other relevant documents and records

Assessment method

• personnel with account management responsibilities system administrators personnel with information security responsibilities system developers

Assessment method

• processes for account management on the system mechanisms for implementing account management

Statement

Enforce approved authorizations for logical access to CUI and system resources in accordance with applicable access control policies.

Guidance

Access control policies control access between active entities or subjects (i.e., users or system processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. Types of system access include remote access and access to systems that communicate through external networks, such as the internet. Access enforcement mechanisms can also be employed at the application and service levels to provide increased protection for CUI. This recognizes that the system can host many applications and services in support of mission and business functions. Access control policies are defined in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.15.01) 03.15.01.

Assessment objective

approved authorizations for logical access to CUI are enforced in accordance with applicable access control policies.

Assessment objective

approved authorizations for logical access to system resources are enforced in accordance with applicable access control policies.

Assessment method

• access control policy and procedures procedures for access enforcement system design documentation system configuration settings list of approved authorizations (i.e., user privileges) system audit records system security plan other relevant documents or records

Assessment method

• personnel with access enforcement responsibilities system administrators personnel with information security responsibilities system developers

Assessment method

• mechanisms for implementing the access control policy

Statement

Enforce approved authorizations for controlling the flow of CUI within the system and between connected systems.

Guidance

Information flow control regulates where CUI can transit within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information. Flow control restrictions include keeping CUI from being transmitted in the clear to the internet, blocking external communications traffic that claims to be sourced from within the organization, restricting requests to the internet that are not from the internal web proxy server, and limiting CUI transfers between organizations based on data structures and content. Transferring CUI between organizations may require an agreement that specifies how the information flow is enforced (see [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.12.05)03.12.05). Transferring CUI between systems that represent different security domains with different security policies introduces the risk that such transfers violate one or more domain security policies. In such situations, information owners or stewards provide guidance at designated policy enforcement points between interconnected systems. Organizations consider mandating specific architectural solutions when required to enforce specific security policies. Enforcement includes prohibiting CUI transfers between interconnected systems (i.e., allowing information access only), employing hardware mechanisms to enforce one-way information flows, and implementing trustworthy regrading mechanisms to reassign security attributes and security labels. Organizations commonly use information flow control policies and enforcement mechanisms to control the flow of CUI between designated sources and destinations (e.g., networks, individuals, and devices) within systems and between interconnected systems. Flow control is based on characteristics of the information or the information path. Enforcement occurs in boundary protection devices (e.g., encrypted tunnels, routers, gateways, and firewalls) that use rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Organizations also consider the trustworthiness of filtering and inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement.

Assessment objective

approved authorizations are enforced for controlling the flow of CUI within the system.

Assessment objective

approved authorizations are enforced for controlling the flow of CUI between connected systems.

Assessment method

• access control policy and procedures information flow control policies procedures for information flow enforcement security architecture and design documentation system configuration settings system baseline configuration system audit records list of information flow authorizations system security plan other relevant documents or records

Assessment method

• system administrators personnel with security architecture responsibilities personnel with information security responsibilities system developers

Assessment method

• mechanisms for implementing the information flow enforcement policy

Statement

• a. Identify the duties of individuals requiring separation.

• b. Define system access authorizations to support separation of duties.

Guidance

Separation of duties addresses the potential for abuse of authorized privileges and reduces the risk of malevolent activity without collusion. Separation of duties includes dividing mission functions and support functions among different individuals or roles, conducting system support functions with different individuals or roles (e.g., quality assurance, configuration management, network security, system management, assessments, and programming), and ensuring that personnel who administer access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations consider the entirety of their systems and system components when developing policies on separation of duties. This requirement is enforced by [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.02) 03.01.02.

Assessment objective

duties of individuals requiring separation are identified.

Assessment objective

system access authorizations to support separation of duties are defined.

Assessment method

• access control policy and procedures procedures for the separation of duties and the division of responsibilities system configuration settings system audit records system access authorizations list of divisions of responsibility and separation of duties system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for defining the separation of duties and the division of responsibilities personnel with information security responsibilities system administrators

Assessment method

• mechanisms for implementing the separation of duties policy

Statement

• a. Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks.

• b. Authorize access to {{ insert: param, A.03.01.05.ODP.01 }} and {{ insert: param, A.03.01.05.ODP.02 }}.

• c. Review the privileges assigned to roles or classes of users {{ insert: param, A.03.01.05.ODP.03 }} to validate the need for such privileges.

• d. Reassign or remove privileges, as necessary.

Guidance

Organizations employ the principle of least privilege for specific duties and authorized access for users and system processes. Least privilege is applied to the development, implementation, and operation of the system. Organizations consider creating additional processes, roles, and system accounts to achieve least privilege. Security functions include establishing system accounts and assigning privileges, installing software, configuring access authorizations, configuring settings for events to be audited, establishing vulnerability scanning parameters, establishing intrusion detection parameters, and managing audit information. Security-relevant information includes threat and vulnerability information, filtering rules for routers or firewalls, configuration parameters for security services, security architecture, cryptographic key management information, access control lists, and audit information.

Assessment objective

system access for users (or processes acting on behalf of users) is authorized only when necessary to accomplish assigned organizational tasks.

Assessment objective

access to {{ insert: param, A.03.01.05.ODP.01 }} is authorized.

Assessment objective

access to {{ insert: param, A.03.01.05.ODP.02 }} is authorized.

Assessment objective

the privileges assigned to roles or classes of users are reviewed {{ insert: param, A.03.01.05.ODP.03 }} to validate the need for such privileges.

Assessment objective

privileges are reassigned or removed, as necessary.

Assessment method

• access control policy and procedures procedures for least privilege list of assigned access authorizations (i.e., privileges) system configuration settings system audit records list of security functions (implemented in hardware, software, and firmware) security-relevant information for which access must be explicitly authorized list of system-generated roles or classes of users and assigned privileges validation reviews of privileges assigned to roles or classes of users records of privilege removals or reassignments for roles or classes of users system security plan system design documentation other relevant documents or records

Assessment method

• personnel with responsibilities for defining least privileges personnel with information security responsibilities system administrators

Assessment method

• mechanisms for implementing least privilege functions mechanisms for implementing reviews of user privileges

Statement

• a. Restrict privileged accounts on the system to {{ insert: param, A.03.01.06.ODP.01 }}..

• b. Require that users (or roles) with privileged accounts use non-privileged accounts when accessing non-security functions or non-security information.

Guidance

Privileged accounts refer to accounts that are granted elevated privileges to access resources (including security functions or security-relevant information) that are otherwise restricted for non-privileged accounts. These accounts are typically described as system administrator or super user accounts. For example, a privileged account is often required in order to perform privileged functions such as executing commands that could modify system behavior. Restricting privileged accounts to specific personnel or roles ensures that only those authorized users can access and manipulate security functions or security-relevant information. Requiring the use of non-privileged accounts when such access is not needed can limit unauthorized access to and manipulation of security functions or security-relevant information.

Assessment objective

privileged accounts on the system are restricted to {{ insert: param, A.03.01.06.ODP.01 }}.

Assessment objective

users (or roles) with privileged accounts are required to use non-privileged accounts when accessing non-security functions or non-security information.

Assessment method

• access control policy and procedures procedures for least privilege list of system-generated privileged accounts list of system administration personnel system audit records system configuration settings system security plan list of system-generated security functions or security-relevant information assigned to system accounts or roles other relevant documents or records

Assessment method

• personnel with responsibilities for defining least privileges personnel with information security responsibilities system administrators

Assessment method

• mechanisms for implementing least privilege functions

Statement

• a. Prevent non-privileged users from executing privileged functions.

• b. Log the execution of privileged functions.

Guidance

Privileged functions include establishing system accounts, performing system integrity checks, conducting patching operations, changing system configuration settings, or administering cryptographic key management activities. Non-privileged users do not possess the authorizations to execute privileged functions. Bypassing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. This requirement represents a condition achieved by the definition of authorized privileges in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.01)03.01.01 and privilege enforcement in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.02)03.01.02. The misuse of privileged functions — whether intentionally or unintentionally by authorized users or by unauthorized external entities that have compromised system accounts — is a serious and ongoing concern that can have significant adverse impacts on organizations. Logging the use of privileged functions is one way to detect such misuse and mitigate risks from advanced persistent threats and insider threats.

Assessment objective

the execution of privileged functions is logged.

Assessment objective

non-privileged users are prevented from executing privileged functions.

Assessment method

• access control policy and procedures procedures for least privilege system design documentation system configuration settings system audit records list of audited events list of privileged functions to be audited and associated user account assignments system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for reviewing least privileges personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for auditing the execution of least privilege functions mechanisms for implementing least privilege functions for non-privileged users

Statement

• a. Enforce a limit of {{ insert: param, A.03.01.08.ODP.01 }} consecutive invalid logon attempts by a user during a {{ insert: param, A.03.01.08.ODP.02 }}.

• b. Automatically {{ insert: param, A.03.01.08.ODP.03 }} when the maximum number of unsuccessful attempts is exceeded.

Guidance

Due to the potential for denial of service, automatic system lockouts are in most cases, temporary and automatically release after a predetermined time period established by the organization (i.e., using a delay algorithm). Organizations may employ different delay algorithms for different system components based on the capabilities of the respective components. Responses to unsuccessful system logon attempts may be implemented at the system and application levels. Organization-defined actions that may be taken include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of a full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles, such as location, time of day, IP address, device, or Media Access Control (MAC) address.

Assessment objective

a limit of {{ insert: param, A.03.01.08.ODP.01 }} consecutive invalid logon attempts by a user during {{ insert: param, A.03.01.08.ODP.02 }} is enforced.

Assessment objective

{{ insert: param, A.03.01.08.ODP.03 }} when the maximum number of unsuccessful attempts is exceeded.

Assessment method

• access control policy and procedures procedures for unsuccessful logon attempts system design documentation system audit records system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for implementing the access control policy for unsuccessful logon attempts

Statement

Display a system use notification message with privacy and security notices consistent with applicable CUI rules before granting access to the system.

Guidance

System use notifications can be implemented using messages or warning banners. The messages or warning banners are displayed before individuals log in to a system that processes, stores, or transmits CUI. System use notifications are used for access via logon interfaces with human users and are not required when human interfaces do not exist. Organizations consider whether a secondary use notification is needed to access applications or other system resources after the initial network logon. Posters or other printed materials may be used in lieu of an automated system message. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.15.03) 03.15.03.

Assessment objective

a system use notification message with privacy and security notices consistent with applicable CUI rules is displayed before granting access to the system.

Assessment method

• access control policy and procedures privacy and security policies, procedures for system use notification documented approval of system use notification messages system audit records user acknowledgements of system use notification messages system design documentation system configuration settings system use notification messages system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities legal counsel system developers system administrators

Assessment method

• mechanisms for implementing system use notifications

Statement

• a. Prevent access to the system by {{ insert: param, A.03.01.10.ODP.01 }}.

• b. Retain the device lock until the user reestablishes access using established identification and authentication procedures.

• c. Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Guidance

Device locks are temporary actions taken to prevent access to the system when users depart from the immediate vicinity of the system but do not want to log out due to the temporary nature of their absences. Device locks can be implemented at the operating system level or application level. User-initiated device locking is behavior- or policy-based and requires users to take physical action to initiate the device lock. Device locks are not an acceptable substitute for logging out of the system (e.g., when organizations require users to log out at the end of workdays). Publicly viewable images can include static or dynamic images, such as patterns used with screen savers, solid colors, photographic images, a clock, a battery life indicator, or a blank screen with the caveat that controlled unclassified information is not displayed.

Assessment objective

access to the system is prevented by {{ insert: param, A.03.01.10.ODP.01 }}.

Assessment objective

information previously visible on the display is concealed via device lock with a publicly viewable image.

Assessment objective

the device lock is retained until the user reestablishes access using established identification and authentication procedures.

Assessment method

• access control policy and procedures procedures for session lock and identification and authentication system design documentation system configuration settings display screen with session lock activated system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for implementing the access control policy for session lock session lock mechanisms

Statement

Terminate a user session automatically after {{ insert: param, A.03.01.11.ODP.01 }}.

Guidance

This requirement addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., disconnecting from the network) in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.09)03.13.09. A logical session is initiated whenever a user (or processes acting on behalf of a user) accesses a system. Logical sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination ends all system processes associated with a user’s logical session except those processes that are created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic session termination can include organization-defined periods of user inactivity, time-of-day restrictions on system use, and targeted responses to certain types of incidents.

Assessment objective

a user session is terminated automatically after {{ insert: param, A.03.01.11.ODP.01 }}.

Assessment method

• access control policy and procedures procedures for session termination system design documentation system configuration settings list of conditions or trigger events requiring session disconnect system audit records system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system developers system administrators

Assessment method

• automated mechanisms for implementing user session termination

Statement

• a. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access.

• b. Authorize each type of remote system access prior to establishing such connections.

• c. Route remote access to the system through authorized and managed access control points.

• d. Authorize the remote execution of privileged commands and remote access to security-relevant information.

Guidance

Remote access is access to systems (or processes acting on behalf of users) that communicate through external networks, such as the internet. Monitoring and controlling remote access methods allows organizations to detect attacks and ensure compliance with remote access policies. Routing remote access through managed access control points enhances explicit control over such connections and reduces susceptibility to unauthorized access to the system, which could result in the unauthorized disclosure of CUI. Remote access to the system represents a significant potential vulnerability that can be exploited by adversaries. Restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and its susceptibility to threats by adversaries. A privileged command is a human-initiated command executed on a system that involves the control, monitoring, or administration of the system, including security functions and security-relevant information. Security-relevant information is information that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data. Privileged commands give individuals the ability to execute sensitive, security-critical, or security-relevant system functions.

Assessment objective

types of allowable remote system access are defined.

Assessment objective

usage restrictions are established for each type of allowable remote system access.

Assessment objective

configuration requirements are established for each type of allowable remote system access.

Assessment objective

connection requirements are established for each type of allowable remote system access.

Assessment objective

each type of remote system access is authorized prior to establishing such connections.

Assessment objective

remote access to the system is routed through authorized access control points.

Assessment objective

remote access to the system is routed through managed access control points.

Assessment objective

remote execution of privileged commands is authorized.

Assessment objective

remote access to security-relevant information is authorized.

Assessment method

• access control policy and procedures procedures for remote system access remote system access configuration and connection requirements configuration management plan system configuration settings remote access authorizations system audit records system design documentation procedures for remote access to the system system monitoring records list of managed network access control points system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for managing remote access connections personnel with information security responsibilities system administrators

Assessment method

• mechanisms for monitoring and controlling remote access methods mechanisms for routing remote accesses through managed access control points remote access management capability for the system

Statement

• a. Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system.

• b. Authorize each type of wireless access to the system prior to establishing such connections.

• c. Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment.

• d. Protect wireless access to the system using authentication and encryption.

Guidance

Wireless networking capabilities represent a significant potential vulnerability that can be exploited by adversaries. Establishing usage restrictions, configuration requirements, and connection requirements for wireless access to the system provides criteria to support access authorization decisions. These restrictions and requirements reduce susceptibility to unauthorized system access through wireless technologies. Wireless networks use authentication protocols that provide credential protection and mutual authentication. Organizations authenticate individuals and devices to protect wireless access to the system. Special attention is given to the variety of devices with potential wireless access to the system, including small form factor mobile devices (e.g., smart phones, tablets, smart watches). Wireless networking capabilities that are embedded within system components represent a potential vulnerability that can be exploited by adversaries. Strong authentication of users and devices, strong encryption, and disabling wireless capabilities that are not needed for essential mission or business functions can reduce susceptibility to threats by adversaries involving wireless technologies.

Assessment objective

each type of wireless access to the system is defined.

Assessment objective

usage restrictions are established for each type of wireless access to the system.

Assessment objective

configuration requirements are established for each type of wireless access to the system.

Assessment objective

connection requirements are established for each type of wireless access to the system.

Assessment objective

each type of wireless access to the system is authorized prior to establishing such connections.

Assessment objective

wireless networking capabilities not intended for use are disabled prior to issuance and deployment.

Assessment objective

wireless access to the system is protected using authentication.

Assessment objective

wireless access to the system is protected using encryption.

Assessment method

• access control policy and procedures procedures for wireless system access wireless system access configuration and connection requirements configuration management plan system configuration settings wireless access authorizations system audit records system design documentation system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for managing wireless access connections personnel with information security responsibilities system developers system administrators

Assessment method

• wireless access management capability for the system mechanisms for implementing wireless access protections to the system mechanisms for managing the disabling of wireless networking capabilities

Statement

• a. Establish usage restrictions, configuration requirements, and connection requirements for mobile devices.

• b. Authorize the connection of mobile devices to the system.

• c. Implement full-device or container-based encryption to protect the confidentiality of CUI on mobile devices.

Guidance

A mobile device is a computing device with a small form factor such that it can be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable, or removable data storage; and includes a self-contained power source. Mobile device functionality may include on-board sensors that allow the device to capture information, voice communication capabilities, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones, smart watches, and tablets. Mobile devices are typically associated with a single individual. The processing, storage, and transmission capabilities of mobile devices may be comparable to or a subset of notebook or desktop systems, depending on the nature and intended purpose of the device. Some organizations may consider notebook computers to be mobile devices. The protection and control of mobile devices are behavior- or policy-based and require users to take physical action to protect and control such devices when outside of controlled areas. Controlled areas are spaces for which the organization provides physical or procedural controls to meet the requirements established for protecting CUI. Due to the large variety of mobile devices with different characteristics and capabilities, organizational restrictions may vary for the different classes or types of such devices. Usage restrictions, configuration requirements, and connection requirements for mobile devices include configuration management, device identification and authentication, implementing mandatory protective software, scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting operating system and possibly other software integrity checks, and disabling unnecessary hardware. On mobile devices, secure containers provide software-based data isolation designed to segment enterprise applications and information from personal apps and data. Containers may present multiple user interfaces, one of the most common being a mobile application that acts as a portal to a suite of business productivity apps, such as email, contacts, and calendar. Organizations can employ full-device encryption or container-based encryption to protect the confidentiality of CUI on mobile devices.

Assessment objective

usage restrictions are established for mobile devices.

Assessment objective

configuration requirements are established for mobile devices.

Assessment objective

connection requirements are established for mobile devices.

Assessment objective

the connection of mobile devices to the system is authorized.

Assessment objective

full-device or container-based encryption is implemented to protect the confidentiality of CUI on mobile devices.

Assessment method

• access control policy and procedures procedures for mobile device access control system design documentation configuration management plan system configuration settings authorizations for mobile device connections to organizational systems system audit records encryption mechanisms and associated configuration documentation system security plan other relevant documents or records

Assessment method

• personnel with access control responsibilities for mobile devices personnel using mobile devices to access organizational systems personnel with information security responsibilities system administrators

Assessment method

• access control capability for mobile device connections to organizational systems encryption mechanisms for protecting the confidentiality of CUI on mobile devices configurations of mobile devices

Statement

• a. Prohibit the use of external systems unless the systems are specifically authorized.

• b. Establish the following security requirements to be satisfied on external systems prior to allowing use of or access to those systems by authorized individuals: {{ insert: param, A.03.01.20.ODP.01 }}.

• c. Permit authorized individuals to use external systems to access the organizational system or to process, store, or transmit CUI only after:

  • 01. Verifying that the security requirements on the external systems as specified in the organization’s system security plans have been satisfied and

  • 02. Retaining approved system connection or processing agreements with the organizational entities hosting the external systems.

• d. Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems.

Guidance

External systems are systems that are used by but are not part of the organization. These systems include personally owned systems, system components, or devices; privately owned computing and communication devices in commercial or public facilities; systems owned or controlled by nonfederal organizations; and systems managed by contractors. Organizations have the option to prohibit the use of any type of external system or specified types of external systems (e.g., prohibit the use of external systems that are not organizationally owned). Terms and conditions are consistent with the trust relationships established with the entities that own, operate, or maintain external systems and include descriptions of shared responsibilities. Authorized individuals include organizational personnel, contractors, or other individuals with authorized access to the organizational system and over whom organizations have the authority to impose specific rules of behavior regarding system access. Restrictions that organizations impose on authorized individuals may vary depending on the trust relationships between organizations. Organizations need assurance that external systems satisfy the necessary security requirements so as not to compromise, damage, or harm the system. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.16.03) 03.16.03.

Assessment objective

the following security requirements to be satisfied on external systems prior to allowing the use of or access to those systems by authorized individuals are established: {{ insert: param, A.03.01.20.ODP.01 }}.

Assessment objective

the use of external systems is prohibited unless the systems are specifically authorized.

Assessment objective

authorized individuals are permitted to use external systems to access the organizational system or to process, store, or transmit CUI only after verifying that the security requirements on the external systems as specified in the organization’s system security plans have been satisfied.

Assessment objective

the use of organization-controlled portable storage devices by authorized individuals on external systems is restricted.

Assessment objective

authorized individuals are permitted to use external systems to access the organizational system or to process, store, or transmit CUI only after retaining approved system connection or processing agreements with the organizational entity hosting the external systems.

Assessment method

• access control policy and procedures procedures for the use of external systems terms and conditions for the use of external systems external systems security requirements list of types of applications accessible from external systems system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for defining terms, conditions, and security requirements for the use of external systems personnel with information security responsibilities system administrators

Assessment method

• mechanisms for implementing or enforcing terms, conditions, and security requirements for the use of external systems

Statement

• a. Train authorized individuals to ensure that publicly accessible information does not contain CUI.

• b. Review the content on publicly accessible systems for CUI and remove such information, if discovered.

Guidance

In accordance with applicable laws, Executive Orders, directives, policies, regulations, standards, and guidelines, the public is not authorized to have access to nonpublic information, including CUI.

Assessment objective

authorized individuals are trained to ensure that publicly accessible information does not contain CUI.

Assessment objective

the content on publicly accessible systems is reviewed for CUI.

Assessment objective

CUI is removed from publicly accessible systems, if discovered.