Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• CFG-04_A01 a current baseline configuration for systems, applications and services is developed and documented.
  Assessment rigor: 1
  Origin: 171A_3.4.1[a] 171A_3.4.2[a] 53A_R5_CM-02a.[01]
• CFG-04_A02 the baseline configuration includes hardware, software, firmware and documentation.
  Assessment rigor: 1
  Origin: 171A_3.4.1[b]
• CFG-04_A03 security configuration settings for information technology products employed in the system are enforced.
  Assessment rigor: 1
  Origin: 171A_3.4.2[b] 53A_R5_CM-06b.
• CFG-04_A04 the baseline configuration is maintained (reviewed / updated) throughout the system development life cycle under configuration control.
  Assessment rigor: 1
  Origin: 171A_3.4.1[c] 53A_R5_CM-02a.[02]
• CFG-04_A05 configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using organization-defined common secure configurations.
  Assessment rigor: 1
  Origin: 53A_R5_CM-06a.
• CFG-04_A06 thresholds to which attack surfaces are to be reduced are defined.
  Assessment rigor: 2
  Origin: 53A_R5_SA-15(05)_ODP
• CFG-04_A07 the developer of the system, system component or system service is required to reduce attack surfaces to organization-defined thresholds.
  Assessment rigor: 2
  Origin: 53A_R5_SA-15(05)
• CFG-04_A08 a control baseline for the system is selected.
  Assessment rigor: 3
  Origin: 53A_R5_PL-10
• CFG-04_A09 approved authorizations are enforced for controlling the flow of CUI within the system.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.01.03[01]
• CFG-04_A10 configuration requirements are established for each type of wireless access to the system.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.16.a[03]
• CFG-04_A11 wireless networking capabilities not intended for use are disabled prior to issuance and deployment.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.16.c
• CFG-04_A12 configuration requirements are established for mobile devices.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.01.18.a[02]
• CFG-04_A13 audit logging tools are protected from unauthorized access, modification, and deletion.
  Assessment rigor: 2
  Origin: 171A_3.3.8[d] 171A_3.3.8[e] 171A_3.3.8[f] 171A_R3_A.03.03.08.a[02]
• CFG-04_A14 a current baseline configuration of the system is developed.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.04.01.a[01]
• CFG-04_A15 a current baseline configuration of the system is maintained under configuration control.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.04.01.a[02]
• CFG-04_A16 the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are established and documented: <A.03.04.02.ODP[01]: configuration settings>.
  Defined parameters: Apply the appropriate use of common security configurations available from the National Institute of Standards and Technology’s National Checklist Program (NCP) website (https://ncp.nist.gov/repository) and prevent remote devices from simultaneously establishing nonremote connections with organizational systems and communicating via some other unauthorized connection to resources in external networks. Document any deviations from the published standard or source document.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.02.a[01]
• CFG-04_A17 the following configuration settings for the system are implemented: <A.03.04.02.ODP[01]: configuration settings>.
  Defined parameters: Apply the appropriate use of common security configurations available from the National Institute of Standards and Technology’s National Checklist Program (NCP) website (https://ncp.nist.gov/repository) and prevent remote devices from simultaneously establishing nonremote connections with organizational systems and communicating via some other unauthorized connection to resources in external networks. Document any deviations from the published standard or source document.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.02.a[02]
• CFG-04_A18 functions to be prohibited or restricted are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.04.06.ODP[01]
• CFG-04_A19 ports to be prohibited or restricted are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.04.06.ODP[02]
• CFG-04_A20 protocols to be prohibited or restricted are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.04.06.ODP[03]
• CFG-04_A21 connections to be prohibited or restricted are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.04.06.ODP[04]
• CFG-04_A22 services to be prohibited or restricted are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.04.06.ODP[05]
• CFG-04_A23 the use of the following functions is prohibited or restricted: <A.03.04.06.ODP[01]: functions>.
  Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.06.b[01]
• CFG-04_A24 the use of the following ports is prohibited or restricted: <A.03.04.06.ODP[02]: ports>.
  Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.06.b[02]
• CFG-04_A25 the use of the following protocols is prohibited or restricted: <A.03.04.06.ODP[03]: protocols>.
  Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.06.b[03]
• CFG-04_A26 the use of the following connections is prohibited or restricted: <A.03.04.06.ODP[04]: connections>.
  Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.06.b[04]
• CFG-04_A27 the use of the following services is prohibited or restricted: <A.03.04.06.ODP[05]: services>.
  Defined parameters: Guidance: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection and prevention systems, and endpoint protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.06.b[05]
• CFG-04_A28 replay-resistant authentication mechanisms for access to privileged accounts are implemented.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.05.04[01]
• CFG-04_A29 replay-resistant authentication mechanisms for access to non-privileged accounts are implemented.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.05.04[02]
• CFG-04_A30 passwords are only transmitted over cryptographically protected channels.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.05.07.c
• CFG-04_A31 passwords are stored in a cryptographically protected form.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.05.07.d
• CFG-04_A32 a new password is selected upon first use after account recovery.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.05.07.e
• CFG-04_A33 organization-defined composition and complexity rules for passwords are enforced.
  Defined parameters: no fewer than 12 characters
  Assessment rigor: 3
  Origin: SCF Created
• CFG-04_A34 replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.07.05.b[02]
• CFG-04_A35 the following composition and complexity rules for passwords are enforced: <A.03.05.07.ODP[02]: rules>.
  Defined parameters: SDP values: (1) Must have a minimum length of 16 characters. (2) Contains a string of characters that does not include the user’s account name or full name.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.05.07.f

Kwistjonijiet marbuta

• Secure Controls Framework -

  The Secure Controls Framework® (SCF)

  "The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
  
  The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
  
  Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
  
  The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/ 

  Terms & Conditions

  The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.