NIST SP 800-171r2 - Implementation Guide

Configure Active Directory account lifecycle management

Server Manager > Tools > Active Directory Users and Computers > Create OUs: _Employees, _Contractors, _Service-Accounts, _Disabled. For each new hire: right-click _Employees > New > User > set 'User must change password at next logon'. For terminations: disable account immediately, move to _Disabled OU, remove all group memberships. Set Description field to 'Disabled YYYY-MM-DD - [reason]'. After 90 days, delete account.

Conduct quarterly account access reviews

Every 90 days: run PowerShell 'Get-ADUser -Filter * -Properties LastLogonDate,Enabled,MemberOf | Export-Csv -Path C:\AuditReports\AccountReview-$(Get-Date -Format yyyyMMdd).csv'. In Entra admin center (https://entra.microsoft.com) > Identity > Users > All Users > filter by 'Sign-in activity' > export to CSV. Compare against current HR roster. Disable any accounts not matched to active employees within 5 business days. Document reviewer name, review date, and actions taken in the review spreadsheet.

Enforce Entra ID access reviews for cloud applications

Entra admin center (https://entra.microsoft.com) > Identity Governance > Access Reviews > New access review > Scope: All users > Reviewers: Group owners and managers > Frequency: Quarterly > Auto-apply results: Yes > If reviewer doesn't respond: Remove access. Enable email notifications to reviewers.

Quarterly AD Account Review Report

Export CSV of all AD accounts with last logon date, enabled status, and group memberships. Include reviewer sign-off sheet showing who reviewed, date, and actions taken for each discrepancy.

New Hire / Termination Account Processing Records

Screenshot of help desk tickets or HR system records showing account creation within 1 business day of hire and account disable within 4 hours of termination notification.

Entra ID Access Review Completion

Screenshot from Entra admin center > Identity Governance > Access Reviews showing completed review cycle with approval/denial counts.

Configure NTFS and share permissions using AD security groups

Create AD security groups per department: SG-Finance-Read, SG-Finance-Modify, SG-HR-Read, SG-HR-Modify, etc. On file server: right-click shared folder > Properties > Security tab > Advanced > Disable inheritance > Convert inherited permissions to explicit. Remove 'Users' and 'Authenticated Users' groups. Add only the appropriate SG- groups with Modify or Read & Execute. Share permissions: Authenticated Users = Change (NTFS controls actual access). Never assign permissions to individual user accounts.

Enforce SharePoint and OneDrive access controls

SharePoint admin center (https://admin.microsoft.com > SharePoint) > Sites > Active sites > select site > Permissions > Site owners: department manager only. Site members: department AD security group. Sharing settings: Only people in your organization. Policies > Sharing > set to 'Least permissive' (existing guests). For CUI document libraries: Library settings > Versioning > Require content approval = Yes.

Configure Conditional Access policies for application access

Entra admin center (https://entra.microsoft.com) > Protection > Conditional Access > New Policy: Name 'Require compliant device for CUI apps'. Users: All users (exclude break-glass account). Target resources: Select specific apps containing CUI (SharePoint, custom LOB apps). Conditions: Client apps = Browser, Mobile apps and desktop clients. Grant: Require device to be marked as compliant AND Require MFA. Session: Sign-in frequency = 12 hours.

File Server Permission Report

Run 'icacls D:\Shares\CUI_Data /T /C > C:\AuditReports\NTFS_Permissions.txt'. Export should show only AD security groups - no individual user accounts.

SharePoint Site Permissions Export

Screenshot of each CUI-containing SharePoint site's permission page showing group-based access only. Include sharing settings showing 'Only people in your organization'.

Conditional Access Policy Configuration

Screenshot of each Conditional Access policy showing assignments, conditions, and grant controls. Export policy via PowerShell: Get-MgIdentityConditionalAccessPolicy | ConvertTo-Json.

Configure firewall zones and inter-zone policies

Firewall admin console > Zones > Create zones: CUI-Servers, User-Workstations, DMZ, Guest-WiFi, Management. Access Rules > Default: deny all inter-zone traffic. Add explicit rules: User-Workstations -> CUI-Servers: Allow TCP 443, 445 (file shares), 1433 (SQL if needed). CUI-Servers -> Internet: Deny all (or allow only specific update URLs via FQDN objects). Guest-WiFi -> Any internal zone: Deny all. Management -> Any: Allow (admin access only from management VLAN). Enable logging on all inter-zone rules.

Configure VLAN segmentation on switches

Switch management console > VLANs > Create: VLAN 10 (CUI-Servers, 10.10.10.0/24), VLAN 20 (Workstations, 10.10.20.0/24), VLAN 30 (Guest, 10.10.30.0/24), VLAN 40 (Management, 10.10.40.0/24), VLAN 50 (Printers/IoT, 10.10.50.0/24). Assign switch ports to VLANs. Configure trunk ports to firewall with all VLANs tagged. Firewall acts as inter-VLAN router - no L3 routing on switches.

Enable Microsoft 365 Data Loss Prevention (DLP) policies

Microsoft Purview compliance portal (https://compliance.microsoft.com) > Data loss prevention > Policies > Create policy > Template: U.S. Controlled Unclassified Information (CUI). Locations: Exchange email, SharePoint sites, OneDrive accounts, Teams chat. Policy tip: 'This content may contain CUI - verify recipient is authorized.' Action: Block external sharing, notify user and compliance officer. Enable incident reports to compliance mailbox.

Firewall Rule Export

Export all firewall rules to PDF or CSV. Must show default-deny between zones and explicit allow rules with source/destination zones, ports, and logging enabled.

VLAN Configuration Documentation

Network diagram showing VLAN topology with subnet assignments. Include switch configuration exports showing VLAN assignments per port.

DLP Policy Configuration and Incident Report

Screenshot of DLP policy settings in Purview. Include sample DLP incident report showing policy matches and actions taken.

Implement separate admin and standard user accounts

For each IT staff member, create TWO accounts: 1) Standard account (jsmith) in _Employees OU - for email, web browsing, daily work. 2) Admin account (adm-jsmith) in _Admins OU - for server management, AD changes, GPO edits. Admin accounts: no mailbox, no internet access (via proxy policy), no remote email. Never add admin accounts to 'Domain Admins' directly - use tiered admin groups: T0-Admins (DC/AD), T1-Admins (servers), T2-Admins (workstations).

Define separation of duties matrix

Create document: 'Separation of Duties Matrix'. Must include: 1) System admin cannot approve their own access requests. 2) Person who submits purchase orders cannot approve payments. 3) Person who develops code cannot deploy to production alone. 4) Person who manages backups cannot be sole person with restore access. 5) Security log reviewer cannot be the same person whose actions are being reviewed. Map each duty pair to specific roles/personnel. Review annually.

AD Admin Account Inventory

PowerShell: Get-ADGroupMember 'Domain Admins','T0-Admins','T1-Admins','T2-Admins' | Select Name,SamAccountName,Enabled. Show that each admin account maps to a standard user account and is in the correct tier group.

Separation of Duties Matrix Document

Signed document showing incompatible duty pairs, assigned personnel for each duty, and annual review signature and date.

Remove local administrator rights from standard users

Group Policy Management Console > Create GPO: 'Workstation-RemoveLocalAdmin'. Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups > Add Group: 'Administrators'. Members: DOMAIN\Domain Admins, DOMAIN\T2-Admins only. This removes any other accounts from the local Administrators group on every GPO refresh. Link GPO to Workstations OU. Run 'gpupdate /force' on test workstation to verify.

Deploy Microsoft LAPS for emergency local admin access

Download Windows LAPS (built into Windows 11 23H2+). In AD: Update-LapsADSchema (run as Schema Admin). Set-LapsADComputerSelfPermission -Identity 'Workstations-OU'. Set-LapsADReadPasswordPermission -Identity 'Workstations-OU' -AllowedPrincipals 'T2-Admins'. GPO: Computer Configuration > Policies > Administrative Templates > System > LAPS > Configure password backup directory = Active Directory. Password complexity: Large letters + small letters + numbers + specials. Password length: 20. Password age: 30 days.

Restrict standard user software installation

GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Software Restriction Policies > Create new policy > Security level: Disallowed (default). Additional Rules > Add path rules for allowed directories: C:\Windows\*, C:\Program Files\*, C:\Program Files (x86)\*. Alternatively, use AppLocker: Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker > Configure rule enforcement > Executable rules: Enforce.

Local Administrators Group Membership Report

Run on sample workstations: 'net localgroup administrators'. Screenshot showing only Domain Admins and T2-Admins - no standard user accounts.

LAPS Configuration Verification

Screenshot of LAPS GPO settings. Run 'Get-LapsADPassword -Identity WS001 -AsPlainText' to verify rotation is working (show that password exists, not the password itself).

GPO Report for Restricted Groups

Run 'gpresult /r' on a workstation. Show Restricted Groups policy applied. Export GPO report as HTML from GPMC.

Implement Privileged Access Management with tiered admin model

Create tiered admin groups in AD: T0-Admins: Domain Controllers, AD, PKI, DHCP/DNS (2-3 people max). T1-Admins: Member servers, applications, databases. T2-Admins: Workstations, printers, local admin. Deny T2 accounts logon rights to servers via GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Deny log on locally: add T2-Admins. Deny T1 accounts logon to domain controllers similarly.

Enable Entra ID Privileged Identity Management (PIM)

Entra admin center (https://entra.microsoft.com) > Identity Governance > Privileged Identity Management > Azure AD roles > Settings > Global Administrator: Activation maximum duration = 2 hours, Require MFA on activation = Yes, Require justification = Yes, Require approval = Yes (set approver to Security team lead). Assign eligible roles (not active) to admin users. Exchange Administrator, SharePoint Administrator: same settings, 4-hour max.

Tiered Admin Group Membership Report

PowerShell: Get-ADGroupMember T0-Admins,T1-Admins,T2-Admins | Select Name,SamAccountName. Verify no user appears in multiple tiers. Verify total T0 count <= 3.

PIM Role Activation Logs

Entra admin center > Identity Governance > PIM > Azure AD roles > Audit. Export 90 days of activation history showing justification, approval, and duration for each privileged role activation.

Implement role-based access control (RBAC) across all systems

Create AD security groups mapped to business roles: SG-Finance-Users, SG-HR-Users, SG-Engineering-Users, SG-Exec-Users. Create a Role-to-Permission Matrix document mapping each role to: file shares, applications, SharePoint sites, printers, VPN access. Configure each application to use AD group membership for authorization. Never grant access to individual accounts - always through group membership.

Disable unnecessary Windows services and features

GPO: Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Set the following to Disabled: Remote Registry, Windows Remote Management (if not using), Xbox services, Fax, Bluetooth Support Service (on servers). Server Manager > Manage > Remove Roles and Features > remove unused roles (e.g., Print Server if not needed, IIS if not hosting).

Role-to-Permission Matrix

Spreadsheet mapping each business role to specific AD groups, file shares, applications, and permission levels. Include annual review date and approver signature.

Disabled Services Configuration

GPO report showing System Services configuration. Run 'Get-Service | Where-Object {$_.StartType -eq "Disabled"} | Select Name,DisplayName' on sample server and workstation.

Configure AD account lockout policy

Group Policy Management Console > Default Domain Policy > Edit > Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy > Account lockout threshold: 5 invalid logon attempts. Account lockout duration: 30 minutes. Reset account lockout counter after: 30 minutes.

Configure Entra ID Smart Lockout

Entra admin center (https://entra.microsoft.com) > Protection > Authentication methods > Password protection > Lockout threshold: 5. Lockout duration in seconds: 60. Custom smart lockout: Enable custom banned password list. Add company name, product names, and common variations to banned list.

Configure failed logon alerting

On domain controllers, ensure audit policy via GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Logon/Logoff > Audit Logon: Success, Failure. Audit Account Lockout: Success, Failure. In SIEM/M365 Defender: create alert rule for Event ID 4740 (Account Lockout) - notify security team when any account is locked out.

Account Lockout Policy GPO Settings

Screenshot of Default Domain Policy > Account Lockout Policy showing threshold = 5, duration = 30 min, reset = 30 min.

Entra ID Smart Lockout Configuration

Screenshot of Entra ID > Protection > Authentication methods > Password protection showing lockout threshold and custom banned password list.

Account Lockout Event Logs

Sample Event ID 4740 entries from domain controller Security log showing lockout events. Include SIEM alert rule configuration showing notification to security team.

Configure Windows logon banner via GPO

GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon: Message title for users attempting to log on = 'AUTHORIZED USE ONLY'. Interactive logon: Message text for users attempting to log on = 'This system is for authorized use only. All activity is monitored and recorded. Unauthorized access or use may result in disciplinary action and/or criminal prosecution. By continuing to use this system, you consent to monitoring.' Link GPO to all computer OUs.

Configure M365 terms of use

Entra admin center (https://entra.microsoft.com) > Identity Governance > Terms of use > New terms > Upload PDF with acceptable use policy text. Require users to accept: Yes. Frequency: Annual re-acceptance. Create Conditional Access policy: Protection > Conditional Access > New Policy > All users > All cloud apps > Grant: Require terms of use acceptance.

Logon Banner GPO Screenshot

Screenshot of GPO setting showing logon message title and text. Also screenshot of actual logon banner displayed on a workstation.

M365 Terms of Use Acceptance Report

Entra admin center > Identity Governance > Terms of use > [policy name] > View acceptance report. Export showing user acceptance dates.

Configure workstation screen lock timeout via GPO

GPO: Computer Configuration > Policies > Administrative Templates > Control Panel > Personalization > Enable screen saver = Enabled. Screen saver timeout = 900 (15 minutes). Password protect the screen saver = Enabled. Also set: User Configuration > Policies > Administrative Templates > Control Panel > Personalization > same three settings (belt and suspenders). Link GPO to all Workstation and Server OUs.

Configure session lock for M365 and web apps

Entra admin center > Protection > Conditional Access > New Policy > Name: 'Session Lock 15min'. Users: All users. Target resources: All cloud apps. Session controls: Sign-in frequency = 1 hour (forces re-auth). Persistent browser session: Never persistent.

Screen Lock GPO Configuration

Screenshot of GPO settings showing screen saver timeout = 900, password protect = Enabled. Also run 'gpresult /r' on sample workstation to verify policy applied.

Conditional Access Session Controls

Screenshot of Conditional Access policy showing sign-in frequency and persistent browser session settings.

Configure idle session termination for Remote Desktop

GPO: Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits > Set time limit for active but idle Remote Desktop Services sessions = 30 minutes. Set time limit for disconnected sessions = 60 minutes. End session when time limits are reached = Enabled.

Configure VPN session timeouts

Firewall admin console > VPN > SSL-VPN Settings > Idle timeout: 30 minutes. Session timeout: 8 hours (max work day). Force re-authentication after timeout. For site-to-site VPN: enable Dead Peer Detection (DPD) interval = 30 seconds, retry = 3, action = restart.

RDP Session Timeout GPO

Screenshot of GPO settings for Remote Desktop Session Time Limits showing idle = 30 min, disconnected = 60 min.

VPN Timeout Configuration

Screenshot of VPN configuration page showing idle timeout = 30 min and session timeout = 8 hours.

Configure SSL-VPN with MFA for remote access

Firewall admin console > VPN > SSL-VPN > Create portal for CUI users. Authentication: LDAP to Active Directory + SAML to Entra ID (for MFA). Entra admin center > Protection > Conditional Access > New Policy: Name 'MFA for VPN'. Users: All users. Target resources: VPN enterprise application. Grant: Require MFA + Require compliant device. Firewall > VPN > SSL-VPN Settings > Restrict to TLS 1.2 minimum. Tunnel mode: Full tunnel (all traffic through corporate firewall).

Document authorized remote access methods

Create policy document: 'Remote Access Policy'. Must include: 1) Only company-approved VPN client is authorized for remote access. 2) MFA is required for all remote connections. 3) Split tunneling is prohibited for CUI systems. 4) Remote access from personal devices requires Intune enrollment. 5) Remote access privileges are revoked upon role change or termination. Require employee signature acknowledging the policy.

VPN Configuration with MFA

Screenshot of VPN portal configuration showing SAML authentication to Entra ID. Screenshot of Conditional Access policy requiring MFA for VPN app.

Remote Access Policy with Signatures

Signed Remote Access Policy document. Include sample employee acknowledgment form with signature and date.

VPN Connection Logs

Sample VPN connection logs showing successful connections with MFA verification. Export from firewall: VPN > Monitor > SSL-VPN sessions.

Enforce full-tunnel VPN for CUI access

Firewall admin console > VPN > SSL-VPN Portals > CUI-Portal > Tunnel mode: Full tunnel. Split tunneling: Disabled. Route all traffic (0.0.0.0/0) through VPN tunnel. This ensures all traffic from remote users passes through corporate firewall for inspection, logging, and DLP enforcement. Verify by connecting via VPN and running 'tracert 8.8.8.8' - first hop should be corporate firewall, not home router.

Configure routing controls for managed network connections

Firewall admin console > Network > Routing > Default route: 0.0.0.0/0 -> WAN interface (internet). Internal routes: Only advertise routes to authorized subnets. Enable reverse path forwarding (RPF) check: Network > Interfaces > [each interface] > Enable Reverse Path Forwarding. This prevents IP spoofing and ensures packets are routed through authorized paths.

VPN Full-Tunnel Configuration

Screenshot of VPN portal settings showing split tunnel disabled and full-tunnel route 0.0.0.0/0. Include tracert output from VPN client showing corporate firewall as first hop.

Firewall Routing Table

Export firewall routing table showing authorized routes only. Show RPF check enabled on all interfaces.

Configure WPA3-Enterprise WiFi with RADIUS authentication

Wireless controller > Create SSID: 'Corporate-CUI'. Security: WPA3-Enterprise (or WPA2-Enterprise minimum). Authentication: 802.1X with RADIUS. RADIUS server: Windows NPS or FreeRADIUS. On NPS: Add RADIUS client (wireless AP IP, shared secret). Create Connection Request Policy: Conditions = NAS Port Type: Wireless. Create Network Policy: Conditions = Windows Group: Domain Computers + Domain Users. Grant access, EAP type: PEAP-MSCHAPv2 (or EAP-TLS for certificate-based). VLAN assignment: Tag authorized users to CUI VLAN.

Configure guest WiFi isolation

Wireless controller > Create SSID: 'Guest'. Security: WPA3-Personal with captive portal. VLAN: Guest VLAN (10.10.30.0/24). Firewall > Access Rules: Guest VLAN -> Any internal = DENY ALL. Guest VLAN -> Internet = Allow (with content filtering). Enable client isolation (AP setting) to prevent guest-to-guest communication.

Wireless Security Configuration

Screenshot of wireless controller showing Corporate SSID with WPA3-Enterprise, 802.1X authentication, and RADIUS server configured.

NPS/RADIUS Policy Configuration

Screenshot of NPS Network Policy showing conditions (Windows Group, NAS Port Type) and settings (EAP type, VLAN assignment). Export NPS configuration: netsh nps export filename=nps_config.xml.

Guest WiFi Isolation Rules

Firewall rules showing Guest VLAN denied from all internal subnets. Wireless controller showing client isolation enabled.

Enforce 802.1X with EAP-TLS or PEAP-MSCHAPv2

For EAP-TLS (strongest): Deploy AD Certificate Services. Certificate Templates Console > Duplicate 'Workstation Authentication' > Name: 'WiFi-Computer-Cert'. Auto-enroll via GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Services Client - Auto-Enrollment > Enabled. On NPS: Network Policy > EAP type: Smart Card or other certificate (EAP-TLS). For PEAP-MSCHAPv2 (simpler): NPS > Network Policy > EAP type: PEAP > Inner method: EAP-MSCHAPv2. Require server certificate validation.

Disable weak wireless encryption protocols

Wireless controller > Global settings > Disable WEP: Remove all WEP-configured SSIDs. Disable WPA (TKIP only): Ensure no SSID uses WPA-TKIP. Minimum: WPA2-AES (CCMP) for all SSIDs. Preferred: WPA3-SAE (personal) or WPA3-Enterprise (802.1X). Disable WPS (Wi-Fi Protected Setup) on all access points - known vulnerability to brute-force attacks.

Wireless Authentication Configuration

Screenshot of NPS policy showing EAP-TLS or PEAP-MSCHAPv2 configuration. If EAP-TLS: screenshot of auto-enrollment GPO and certificate template.

Wireless Encryption Settings

Screenshot of each SSID configuration showing WPA2-AES or WPA3 encryption. Verify no SSIDs using WEP, TKIP, or open authentication.

Enroll mobile devices in Microsoft Intune MDM

Microsoft Intune admin center (https://intune.microsoft.com) > Devices > Enrollment > Enrollment restrictions > Default: Block personal devices (or allow with MAM-only for BYOD). Create device compliance policy: Devices > Compliance > Create policy > Windows/iOS/Android > Settings: Require encryption = Yes. Minimum OS version = latest-1. Require password: minimum 6 characters, complex. Block jailbroken/rooted devices = Yes. Actions for non-compliance: Mark non-compliant after 1 day, send email notification, block access after 3 days.

Configure Conditional Access for mobile CUI access

Entra admin center > Protection > Conditional Access > New Policy > Name: 'Mobile CUI Access'. Users: All users. Target resources: Exchange Online, SharePoint Online, Teams. Conditions: Device platforms = iOS, Android. Grant: Require device to be marked as compliant + Require approved client app. This ensures only Intune-enrolled, compliant devices using approved apps can access CUI.

Intune Device Compliance Policy

Screenshot of Intune compliance policy settings showing encryption, OS version, password complexity, and jailbreak detection requirements.

Intune Device Inventory

Export from Intune > Devices > All devices showing compliance status of all enrolled devices. Flag any non-compliant devices and remediation status.

Configure firewall rules restricting external system connections

Firewall admin console > Access Rules > WAN to LAN > Default rule: DENY ALL inbound traffic. Create explicit allow rules only for required inbound services: VPN (UDP 443 or 4500/500 for IPsec) to VPN interface only. SMTP (TCP 25) to mail server only (if hosting email on-prem). No direct RDP (3389) from internet - must use VPN first. LAN to WAN: Allow HTTP/HTTPS (80/443) for workstations. CUI-Servers to WAN: DENY ALL (or whitelist specific update URLs). Enable GeoIP blocking: Block all countries except US (or business-relevant countries).

Monitor and log all external connections

Firewall > Logging > Enable logging for all Allow and Deny rules. Forward logs to SIEM via syslog (UDP/TCP 514 or TLS 6514). In SIEM: Create alert for any outbound connection from CUI-Servers zone to internet. Create alert for inbound connections bypassing VPN. Weekly review: Export top 100 external destinations by traffic volume - verify all are business-justified.

Firewall Rule Export - Inbound

Complete export of all WAN-to-LAN and WAN-to-DMZ rules. Verify default deny is in place and only required services have allow rules.

External Connection Review Log

Weekly report from firewall/SIEM showing top external destinations. Include reviewer notes confirming each connection is business-justified.

Control access to external cloud services via Conditional Access

Entra admin center > Protection > Conditional Access > New Policy > Name: 'Block unapproved cloud services'. Users: All users. Target resources: All cloud apps > Exclude: approved apps (M365, CRM, etc.). Grant: Block access. On firewall: Create URL/application filter to block categories: File sharing (Dropbox, Google Drive personal), Social media (from CUI workstations), Webmail (personal email services).

Maintain approved external system inventory

Create and maintain 'Approved External Systems Register'. Include: 1) System name and URL. 2) Business justification. 3) Data classification allowed (CUI/non-CUI). 4) Authentication method (SSO, separate credentials). 5) Contract/BAA/NDA status. 6) Last security review date. Review quarterly. Require management approval for new external system additions.

Conditional Access Block Policy

Screenshot of Conditional Access policy blocking unapproved cloud apps. Include list of excluded (approved) applications.

Approved External Systems Register

Current register with all approved external systems, justification, data classification, and last review date. Include management approval signatures.

Review and control publicly accessible content

Identify all publicly accessible systems: company website, public SharePoint sites, public file shares, FTP servers, cloud storage shared links. For each: verify no CUI is publicly accessible. SharePoint admin center > Sites > Active sites > filter 'External sharing' = On > review each site for CUI content. Web server: review all published content for CUI indicators. Run quarterly scan of all public-facing URLs for sensitive data patterns.

Establish content review process before public posting

Create policy: 'Public Content Review Procedure'. Must include: 1) All content intended for public access must be reviewed by designated authority before posting. 2) Reviewer must verify no CUI, PII, or proprietary data is included. 3) Approval must be documented (email, ticket, signed form). 4) Content must be reviewed for metadata (document properties, EXIF data, hidden text). Assign designated content reviewer for each public-facing system.

Public Content Inventory and Review

List of all publicly accessible systems and content. Include quarterly review results confirming no CUI is publicly exposed.

Content Review Approval Records

Sample approval records (emails, tickets) showing content was reviewed and approved before public posting.

Define and enforce BYOD and external system connection policy

Entra admin center > Protection > Conditional Access > New Policy > Name: 'External Device Controls'. Users: All users. Conditions: Filter for devices > Property: deviceTrustType != Domain Joined AND complianceStatus != Compliant. Grant: Block access (or require app protection policy for BYOD). For approved BYOD: Intune > App protection policies > Create policy > Require PIN, encrypt app data, block copy/paste to unmanaged apps, wipe corporate data on unenrollment.

Document external system connection agreements

For any external system connecting to your network (vendor VPN, MSP remote access, partner file share), create an Interconnection Security Agreement (ISA) documenting: 1) Connected organizations and POCs. 2) Purpose and data flows. 3) Security controls on both sides. 4) Incident notification procedures. 5) Termination conditions. Review ISAs annually.

Conditional Access External Device Policy

Screenshot of Conditional Access policy blocking or restricting non-compliant/non-domain devices.

Interconnection Security Agreements

Signed ISAs for all external system connections (MSP, vendors, partners). Include annual review dates.

Block USB storage devices via GPO

GPO: Computer Configuration > Policies > Administrative Templates > System > Removable Storage Access > All Removable Storage classes: Deny all access = Enabled. Alternatively, for granular control: Removable Disks: Deny write access = Enabled. Removable Disks: Deny read access = Enabled. CD and DVD: Deny write access = Enabled. WPD Devices (phones/tablets): Deny read/write access = Enabled. Link GPO to all Workstation and Server OUs.

Configure Intune device restriction for USB on managed devices

Intune admin center > Devices > Configuration > Create profile > Windows 10 and later > Device restrictions > General > Removable storage: Block. USB connection: Block. For exceptions (approved encrypted USB drives): Create allow list by hardware ID of approved devices. Defender for Endpoint > Device control > Removable storage access control > Create policy: Deny all except specific hardware IDs.

USB Block GPO Settings

Screenshot of GPO Removable Storage Access settings showing all classes denied. Run 'gpresult /r' on sample workstation to verify policy applied.

USB Block Verification Test

Screenshot showing USB drive insertion on managed workstation resulting in 'Access Denied' error. Test with both standard USB and phone connection.

Implement content review and approval workflow for public information

SharePoint CUI document library > Library settings > Versioning settings > Require content approval = Yes. Create SharePoint approval workflow: Settings > Automate > Power Automate > When an item is created > Send approval to Content Review group > If approved: set approval status to Approved. If rejected: notify submitter. For website updates: require ticket with manager approval before any public content changes. Designate a 'Public Information Officer' responsible for reviewing all public-facing content.

Conduct periodic scans for unauthorized public content

Monthly: Microsoft Purview > DLP > Activity explorer > Filter by: Externally shared content containing sensitive info types. Review all matches - verify each is authorized. Quarterly: Google your company name + filetype:pdf/doc/xls to check for leaked documents on the internet. Use Shodan.io to verify no internal services are accidentally exposed to the internet.

Content Approval Workflow

Screenshot of SharePoint content approval settings and Power Automate workflow. Include sample approval record.

Public Content Scan Results

Monthly DLP report showing externally shared content review. Quarterly internet scan results confirming no CUI exposure.

Deploy security awareness training platform

Select training platform (KnowBe4, Proofpoint Security Awareness, or M365 Attack Simulation). Configure annual training campaign: Admin portal > Training > Create Campaign > Assign to: All employees. Due date: 30 days from assignment. Modules must cover: Phishing identification, password best practices, social engineering, physical security, CUI handling, incident reporting procedures, acceptable use policy. Minimum: 45-minute annual training + quarterly 15-minute refreshers. Track completion. Employees who fail to complete within deadline: escalate to manager, then block system access after 45 days.

Conduct monthly phishing simulations

M365 Defender portal (https://security.microsoft.com) > Email & collaboration > Attack simulation training > Simulations > Launch a simulation > Technique: Credential harvest or Link in attachment. Target: All users (randomize timing over 5-day window). Frequency: Monthly (vary template each month). For users who fail: auto-assign remediation training module. Track metrics: click rate, report rate, repeat offenders.

Security Awareness Training Completion Report

Export from training platform showing all employees, completion status, completion date, and score. Must show > 95% completion rate.

Phishing Simulation Results (Last 12 Months)

Monthly phishing simulation reports showing click rates, report rates, and trend over time. Include remediation training assignment for failures.

Training Policy with CUI Handling Module

Training policy document specifying required modules, frequency, deadlines, and consequences for non-completion. Include CUI-specific handling procedures module outline.

Develop role-based security training for IT and privileged users

Identify roles requiring specialized training: 1) System administrators - secure configuration, patch management, incident handling. 2) Developers - OWASP Top 10, secure coding, code review. 3) Help desk - social engineering resistance, ticket-based access requests only. 4) Executives - BEC scams, whaling, authority impersonation. 5) CUI handlers - marking, storage, transmission, destruction procedures. Assign role-specific training modules annually. Track completion separately from general awareness.

Document and track training requirements by role

Create 'Training Requirements Matrix' mapping each role to required modules: All employees: Annual general awareness + quarterly phishing sim. IT admins: + Secure admin practices, incident response procedures. Developers: + OWASP secure coding, code review procedures. Managers: + Access review responsibilities, termination procedures. New hires: Complete all assigned training within first 5 business days before CUI access.

Training Requirements Matrix

Document mapping each role to required training modules, frequency, and completion deadlines.

Role-Based Training Completion Records

Export from training platform filtered by role showing specialized training completion. IT admin training, developer training, CUI handler training tracked separately.

Implement insider threat awareness training

Add insider threat module to annual security awareness training. Must cover: 1) Types of insider threats (malicious, negligent, compromised). 2) Behavioral indicators: unusual working hours, excessive data downloads, expressed dissatisfaction, requests for access beyond job scope. 3) Reporting procedures: who to report to (manager, HR, security), how to report (anonymous hotline, email, in person). 4) Non-retaliation policy for good-faith reports. 5) Case studies of real insider incidents (use sanitized examples). Assign to all employees annually.

Establish insider threat reporting channel

Create anonymous reporting mechanism: Option A: Dedicated email alias (security-report@company.com) monitored by security team. Option B: Anonymous web form (e.g., via Microsoft Forms with anonymous submission). Option C: Third-party hotline service. Post reporting instructions in common areas and on intranet. Include in new hire orientation packet. Document response procedures: who receives reports, investigation steps, escalation path.

Insider Threat Training Module Content

Course outline or slides for insider threat training module showing coverage of indicators, reporting procedures, and non-retaliation policy.

Training Completion Records - Insider Threat

Export from training platform showing insider threat module completion by all employees with dates.

Configure Windows Advanced Audit Policy on all systems

GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Logon: Audit Credential Validation = Success, Failure. Account Management: Audit User Account Management = Success, Failure. Audit Security Group Management = Success, Failure. Detailed Tracking: Audit Process Creation = Success. Logon/Logoff: Audit Logon = Success, Failure. Audit Special Logon = Success. Object Access: Audit File System = Success, Failure (on CUI folders). Policy Change: Audit Policy Change = Success, Failure. Privilege Use: Audit Sensitive Privilege Use = Success, Failure. System: Audit Security State Change = Success. Link GPO to all computer OUs.

Enable M365 unified audit logging

Microsoft Purview compliance portal (https://compliance.microsoft.com) > Audit > verify 'Auditing' status is ON. If not: Search > Turn on auditing. Verify these activities are logged: File accessed, File modified, File deleted, File shared, Permission changed, Mailbox accessed by non-owner, Admin role changes, User login, Password changes. Set retention: Audit (Standard) = 180 days. Audit (Premium) = 1 year (E5 license). Enable mailbox auditing: Set-OrganizationConfig -AuditDisabled $false.

Configure SIEM or centralized log collection

Option A - M365 Defender: Already included with E5. Verify all connectors active at security.microsoft.com > Settings > Microsoft 365 Defender. Option B - Azure Sentinel: Create Log Analytics workspace > Install connectors: Windows Security Events, Microsoft 365, Azure AD, Office 365. Option C - Managed SOC: Provide SIEM vendor with syslog feed (firewall, servers) and M365 API access for cloud logs. Verify: all event sources (DCs, member servers, workstations, firewall, M365) are forwarding logs to central collection point.

Windows Audit Policy GPO Export

Export GPO report (HTML or XML) from GPMC showing Advanced Audit Policy Configuration. Run 'auditpol /get /category:*' on domain controller to verify applied settings.

M365 Audit Status Verification

Screenshot of Purview Audit page showing auditing is ON. Run 'Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled' showing True.

SIEM/Log Collection Dashboard

Screenshot of SIEM dashboard showing all event sources connected and actively sending logs. Include event volume metrics to prove active collection.

Ensure audit logs link actions to individual users

Enforce unique individual accounts - prohibit shared accounts: 1) Audit AD for shared/generic accounts: Get-ADUser -Filter {Description -like '*shared*' -or Description -like '*generic*'}. 2) For service accounts that multiple people access: implement a PAM solution or use 'Run As' with individual admin accounts to maintain attribution. 3) Configure 'Process Creation' auditing with command line logging: GPO > Computer Configuration > Administrative Templates > System > Audit Process Creation > Include command line in process creation events = Enabled. 4) Enable PowerShell Script Block Logging: GPO > Administrative Templates > Windows Components > Windows PowerShell > Turn on Script Block Logging = Enabled.

No Shared Account Verification

PowerShell report: Get-ADUser -Filter * -Properties Description | Where {$_.Description -match 'shared|generic|service'} showing no unauthorized shared accounts. All service accounts documented.

Audit Log Sample Showing Individual Attribution

Sample Windows Security Event Log entries (Event IDs 4624, 4663, 4688) showing individual usernames on all actions. Sample M365 audit log entry showing individual user on file access.

Review and correlate audit logs regularly

Establish log review schedule: Daily: Review SIEM/Defender alerts dashboard - investigate all high/critical alerts within 4 hours. Weekly: Review failed logon reports, account lockouts, privilege escalation events, after-hours access patterns. Monthly: Review admin account usage, VPN access patterns, DLP policy matches, external sharing activity. Create review checklist documenting what was reviewed, by whom, findings, and actions taken. Sign and date each review.

Create automated SIEM alert rules for critical events

Create alert rules for: 1) Multiple failed logons from same source (>10 in 5 min) - brute force indicator. 2) Account lockout on privileged account - immediate alert. 3) New admin role assignment - immediate alert to security. 4) Logon from unusual location (impossible travel) - Entra ID Identity Protection handles this. 5) Bulk file download or deletion - DLP + alert rule. 6) Firewall: traffic from CUI zone to known malicious IPs - use threat intelligence feed. 7) After-hours privileged access - alert on admin logon outside 7am-7pm.

Log Review Checklist (Completed)

Completed daily/weekly/monthly log review checklists signed and dated. Include any findings and remediation actions taken.

SIEM Alert Rules Configuration

Screenshot of all configured alert rules in SIEM showing trigger conditions, severity, and notification targets.

Generate alerts on audit logging process failures

Configure monitoring for audit system health: 1) Windows Event Log: Monitor for Event ID 1108 (event log service error) and Event ID 4719 (system audit policy was changed). Create SIEM alert for both. 2) SIEM agent health: Configure heartbeat monitoring - alert if any agent stops sending logs for >15 minutes. 3) Disk space monitoring on log collection servers: alert at 80% disk utilization. 4) M365: Alert if audit logging is disabled: Create Activity alert in Purview > Alerts > Activity: 'Set-AdminAuditLogConfig' with parameter 'UnifiedAuditLogIngestionEnabled=False'.

Audit Failure Alert Configuration

Screenshot of SIEM alert rules for audit log failures (agent offline, disk space, audit policy change). Show notification recipients.

Audit System Health Dashboard

Screenshot of monitoring dashboard showing all log sources with heartbeat status (green/red). All sources should show active/green.

Correlate audit records across multiple sources

In SIEM (Sentinel/Splunk/managed SOC): 1) Normalize log formats: ensure all sources use consistent timestamps (UTC), consistent username format (DOMAIN\user or UPN). 2) Create correlation rules: Rule A: VPN logon from IP X + file access on CUI server within 5 minutes = normal CUI access (log for audit trail). Rule B: Failed logon on AD + successful logon on VPN from different country within 1 hour = compromised account alert. Rule C: USB block event on workstation + DLP policy match on email within 30 minutes from same user = data exfiltration attempt. 3) Maintain correlation rule playbook documenting each rule's purpose and response procedure.

SIEM Correlation Rules

Export or screenshot of all correlation rules configured in SIEM. Include rule description, data sources correlated, trigger conditions, and response actions.

Correlated Alert Investigation Sample

Sample correlated alert showing multiple log sources combined to identify a security event. Include investigation notes and resolution.

Implement log reduction and reporting

Configure SIEM dashboards and scheduled reports: 1) Executive dashboard: total alerts by severity (last 30 days), trend graphs, top alert types. 2) Security operations dashboard: open alerts, mean time to acknowledge, mean time to resolve, alert volume by source. 3) Compliance dashboard: audit log coverage (% of systems logging), failed logon trends, privilege usage trends. 4) Schedule weekly PDF report emailed to security manager and CISO. 5) On-demand report capability for specific date ranges and event types.

SIEM Dashboard Screenshots

Screenshots of executive, security operations, and compliance dashboards showing active monitoring and reporting.

Sample Weekly Security Report

PDF of scheduled weekly security report showing alert summary, investigation actions, and trends.

Synchronize all system clocks using NTP

Domain controllers sync to external NTP source: On PDC emulator DC: w32tm /config /manualpeerlist:'time.nist.gov,0x1 time-a-g.nist.gov,0x1' /syncfromflags:manual /reliable:yes /update. All domain-joined computers automatically sync to DC (default AD behavior - verify not overridden). Non-domain devices (firewall, switches, APs): configure NTP to point to DC IP. Firewall admin console > System > Time > NTP Server: DC IP address. Verify: 'w32tm /query /status' on all Windows systems should show Source = DC. Maximum allowed drift: 5 minutes (Kerberos default).

NTP Configuration Verification

Run 'w32tm /query /status' on DC (showing external NTP source), member server, and workstation (showing DC as source). Include firewall NTP configuration screenshot.

Time Synchronization Check

Run 'w32tm /stripchart /computer:time.nist.gov /samples:5' on PDC showing offset < 1 second. Screenshot of firewall system time matching DC time.

Protect audit logs from unauthorized modification

1) Restrict Security log access via GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Manage auditing and security log = Administrators only. 2) Set maximum Security log size: GPO > Computer Configuration > Policies > Windows Settings > Security Settings > Event Log > Maximum Security log size = 4194304 KB (4 GB). Retention method: Archive the log when full (do not overwrite). 3) Forward logs to SIEM immediately - even if local logs are tampered, SIEM copy is preserved. 4) SIEM storage: write-once storage or separate account permissions (admins who manage systems cannot delete SIEM data).

Event Log GPO Configuration

Screenshot of GPO showing log size limits, retention method, and access restrictions. Show 'Manage auditing and security log' user rights assignment.

SIEM Access Controls

Screenshot of SIEM user roles showing that system administrators cannot delete audit data. Only dedicated security/SIEM admins have delete permissions.

Configure audit log retention for minimum 1 year

1) SIEM retention: Configure data retention policy to minimum 1 year (3 years preferred for CMMC). SIEM admin > Settings > Data Retention > 365 days minimum. 2) M365 Audit: Purview > Audit > Audit retention policies > Create policy: All activities, All users, Retention: 1 year (E5) or 180 days (E3 - upgrade or archive). 3) Windows Event Logs: archived logs forwarded to SIEM satisfy retention. 4) Backup: Include SIEM database in Veeam backup schedule - daily incremental, weekly full, retain for 1 year.

SIEM Data Retention Policy

Screenshot of SIEM retention configuration showing 1-year minimum. If using managed SOC, provide SOC vendor's data retention statement from contract.

M365 Audit Retention Policy

Screenshot of Purview Audit retention policy showing duration. If E3 license limits to 180 days, document the SIEM as long-term archive.

Backup Policy Covering Audit Logs

Veeam backup job configuration showing SIEM server included with 1-year retention policy.

Conduct periodic security assessments

Conduct annual self-assessment using NIST SP 800-171A (assessment procedures): 1) For each of the 110 controls: document implementation status (Implemented, Partially Implemented, Not Implemented, Not Applicable). 2) For each implemented control: verify with evidence (screenshots, configs, policies). 3) For partially/not implemented: document gap and add to POA&M. 4) Calculate SPRS score (Supplier Performance Risk System): Start at 110. Subtract weighted points for each unmet control. 5) Enter SPRS score in SPRS portal (https://www.sprs.csd.disa.mil/). 6) Engage third-party assessor for independent assessment before CMMC certification. 7) Use assessment results to update risk register and POA&M.

Self-Assessment Results

Complete 110-control assessment showing implementation status for each control. Include SPRS score calculation worksheet.

SPRS Score Submission

Screenshot of SPRS portal showing current score submission.

Develop and maintain a Plan of Action and Milestones (POA&M)

Create POA&M document/spreadsheet with columns: 1) Item ID. 2) Related NIST 800-171 control(s). 3) Weakness description. 4) Risk level (Critical/High/Medium/Low). 5) Responsible party. 6) Remediation plan. 7) Milestones with dates. 8) Estimated completion date. 9) Actual completion date. 10) Status. 11) Resources required (cost, tools, personnel). Population: from self-assessment gaps (3.12.1), vulnerability scans (3.11.2), audit findings, incident post-mortems. Review POA&M monthly. Present to management quarterly. Close items only with verification evidence.

Current POA&M

Complete POA&M with all open items. Show recently closed items with completion evidence. Include milestone tracking.

POA&M Review Meeting Minutes

Minutes from quarterly POA&M review meeting showing attendees, status updates, new items, and management decisions.

Monitor security controls on an ongoing basis

Establish continuous monitoring program: 1) Automated: vulnerability scans (weekly), EDR alerts (real-time), SIEM alerts (real-time), compliance scans (CIS-CAT monthly), patch compliance (weekly from WSUS/Intune). 2) Manual: access reviews (quarterly), policy reviews (annual), configuration audits (quarterly), physical security walks (monthly). 3) Document monitoring schedule in 'Continuous Monitoring Plan'. 4) Track findings from all monitoring activities - feed into POA&M and risk register. 5) Report monitoring status to management quarterly.

Continuous Monitoring Plan

Document describing all automated and manual monitoring activities, frequencies, responsible parties, and reporting schedule.

Monitoring Activity Evidence (Last Quarter)

Compiled evidence from last quarter: vulnerability scan reports, access review results, compliance scan results, patch compliance reports.

Develop and maintain a System Security Plan (SSP)

Create System Security Plan (SSP) document. Required sections: 1) System identification: system name, purpose, owner, authorizing official. 2) System boundary: network diagram, all CUI systems listed by hostname, IP, function. 3) System environment: physical location, network architecture, data flows. 4) System interconnections: all external connections (internet, vendor VPN, cloud services). 5) For each of the 110 NIST 800-171 controls: Implementation status (Implemented/Partial/Not Implemented). Description of how the control is implemented (or planned). Responsible party. 6) Roles and responsibilities. 7) SSP approval: management signature and date. 8) Review and update annually or after significant system changes.

System Security Plan (SSP)

Complete SSP document with all required sections. Include system boundary diagram, control implementation descriptions, and management approval signature.

SSP Review and Update Record

Change log showing SSP review dates and updates. Include version history and reviewer signatures.

Establish and maintain system baseline configurations

1) Download CIS Benchmarks (free for personal use at cisecurity.org): CIS Microsoft Windows 11 Enterprise, CIS Microsoft Windows Server 2022, CIS Microsoft 365 Foundations. 2) Import CIS GPO templates: Download CIS GPO Build Kit > GPMC > Import Settings from CIS template into new GPO: 'Baseline-Workstation-CIS-L1'. 3) Document deviations: create spreadsheet listing each CIS control, current setting, CIS recommended setting, and justification for any deviation. 4) Link baseline GPOs to appropriate OUs. 5) Quarterly: re-run CIS-CAT Lite scanner to verify compliance against baseline.

Maintain hardware and software inventory as part of baseline

Intune admin center > Devices > All devices > export hardware inventory. For on-prem: SCCM or use PowerShell: Get-ADComputer -Filter * -Properties OperatingSystem,OperatingSystemVersion | Export-Csv C:\AuditReports\HardwareInventory.csv. Software inventory: Get-WmiObject -Class Win32_Product | Select Name,Version | Export-Csv C:\AuditReports\SoftwareInventory-$env:COMPUTERNAME.csv. Maintain approved software list - any software not on the list must be justified and approved.

CIS Benchmark Compliance Scan Results

CIS-CAT Lite scan report for sample workstation and server showing baseline compliance percentage and specific non-compliant items with justification.

Baseline Configuration GPO Export

HTML export of baseline GPO from GPMC. Include deviation log spreadsheet documenting any settings that differ from CIS/STIG recommendation.

Hardware and Software Inventory

Current hardware inventory (all endpoints) and approved software list. Include last update date.

Implement configuration change control process

Create 'Configuration Change Control Procedure' document. Must include: 1) All changes to CUI systems require a change request (CR) ticket. 2) CR must include: description of change, systems affected, risk assessment, rollback plan, testing plan, requested date/time. 3) Changes categorized: Standard (pre-approved, low-risk), Normal (requires CAB approval), Emergency (requires post-implementation review within 48 hours). 4) Change Advisory Board (CAB): IT manager + security representative + system owner. 5) All changes documented: before state, after state, who made the change, when. 6) Review implemented changes monthly for unauthorized modifications.

Configure GPO change tracking

1) Enable Advanced Audit Policy on DCs: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > DS Access > Audit Directory Service Changes = Success. 2) Monitor Event ID 5136 (directory object modified) for GPO changes. 3) Create SIEM alert for any GPO modification outside of change windows. 4) Use GPMC > right-click domain > Search > Changed GPOs in last 7 days to review changes. 5) Back up GPOs weekly: Backup-GPO -All -Path C:\GPOBackups\$(Get-Date -Format yyyyMMdd).

Change Control Procedure Document

Signed Configuration Change Control Procedure with categories, approval workflow, CAB membership, and review schedule.

Sample Change Request Records

3-5 recent change request tickets showing full lifecycle: request, approval, implementation, verification, closure.

GPO Change Audit Logs

Event ID 5136 entries from DC showing GPO modifications. Verify each maps to an approved change request.

Track and control changes to CUI system configurations

1) Deploy File Integrity Monitoring (FIM) on CUI servers: Windows Defender for Endpoint: Settings > General > Advanced Features > Enable file integrity monitoring. Or deploy Wazuh/OSSEC agent with syscheck for FIM. Monitor directories: C:\Windows\System32\, C:\Program Files\, registry keys: HKLM\SOFTWARE\, HKLM\SYSTEM\. 2) Alert on changes outside of change windows. 3) Record baseline file hashes after each approved change. 4) Quarterly: compare current state against baseline - investigate any drift.

FIM Configuration and Alerts

Screenshot of FIM configuration showing monitored directories and registry keys. Include sample alert for detected change.

Configuration Drift Report

Quarterly configuration drift report comparing current state to baseline. Include investigation results for any unauthorized changes.

Analyze security impact of changes before implementation

Add security impact analysis section to every change request form: 1) Does this change modify access controls? (Y/N - if Y, detail changes). 2) Does this change modify firewall rules? (Y/N - if Y, detail changes). 3) Does this change introduce new software? (Y/N - if Y, provide vendor security assessment). 4) Does this change affect CUI data storage or transmission? (Y/N - if Y, detail impact). 5) Risk rating: Low/Medium/High based on answers above. Security representative on CAB must review and approve all Medium/High changes.

Change Request with Security Impact Analysis

3-5 sample change requests showing completed security impact analysis section. Include security representative's approval for Medium/High changes.

Define and enforce access restrictions for configuration changes

1) Restrict who can edit GPOs: Delegate GPO editing to T0-Admins only. GPMC > right-click GPO > Delegation > ensure only T0-Admins have Edit access. 2) Restrict local admin accounts (see 3.1.5 LAPS deployment). 3) Restrict access to server consoles: GPO: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Allow log on locally: Administrators, T1-Admins (for servers), T0-Admins (for DCs). 4) Restrict PowerShell: GPO > Administrative Templates > Windows Components > Windows PowerShell > Turn on Script Block Logging, enable Constrained Language Mode for non-admins.

GPO Delegation Report

Screenshot of GPO Delegation tab for key GPOs showing only authorized admin groups have Edit permissions.

Server Logon Restrictions GPO

Screenshot of User Rights Assignment showing 'Allow log on locally' restricted to appropriate admin tiers per server role.

Configure software allowlisting / application control

GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker > Executable Rules: Right-click > Create Default Rules (allows Windows and Program Files). Right-click > Create New Rule: Deny > Everyone > Publisher/Path for specific blocked apps. Enforcement mode: Start with 'Audit only' for 30 days to identify legitimate apps. After 30 days: switch to 'Enforce'. Review AppLocker event log (Applications and Services Logs > Microsoft > Windows > AppLocker) weekly for blocked application attempts. Maintain 'Approved Software List' document - any new software requires change request.

Restrict unauthorized software installation

GPO: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Installer > Disable Windows Installer = Enabled (Always). Prohibit User Install = Enabled. This prevents standard users from running MSI installers. For Intune-managed devices: Devices > Configuration > Create profile > Device restrictions > App Store: Block (or allow only Company Portal).

AppLocker Policy Configuration

Export AppLocker policy: Get-AppLockerPolicy -Effective -Xml | Out-File C:\AuditReports\AppLocker.xml. Screenshot of GPMC AppLocker rules.

Approved Software List

Document listing all approved software with version, business justification, and approval date. Include change request references for recent additions.

Restrict and disable nonessential programs, functions, ports, and protocols

1) Disable unnecessary Windows services via GPO (see 3.1.7). 2) Remove unnecessary server roles: Server Manager > Manage > Remove Roles and Features. 3) Disable unnecessary protocols: GPO > Computer Configuration > Administrative Templates > Network > DNS Client > Turn off multicast name resolution (LLMNR) = Enabled. Disable NetBIOS over TCP/IP: Network adapter > Properties > TCP/IPv4 > Advanced > WINS > Disable NetBIOS over TCP/IP. Disable SMBv1: Set-SmbServerConfiguration -EnableSMB1Protocol $false. 4) Host-based firewall: GPO > Computer Configuration > Windows Settings > Windows Defender Firewall > Inbound Rules: Block by default, allow only required ports.

Conduct port and service audit

Run Nessus 'Basic Network Scan' against all CUI subnets. Review results for: unnecessary open ports, unneeded services, outdated protocols. Alternatively, use PowerShell on each server: Get-NetTCPConnection -State Listen | Select LocalAddress,LocalPort,OwningProcess | ForEach-Object { $proc = Get-Process -Id $_.OwningProcess; [PSCustomObject]@{Port=$_.LocalPort; Process=$proc.ProcessName} } | Sort Port. Document all listening ports and justify each one. Disable any unjustified service.

Port and Service Audit Report

Nessus scan results or PowerShell port audit output for all CUI systems. Each open port must have a documented justification.

Disabled Protocols Verification

Verification that SMBv1, LLMNR, and NetBIOS are disabled. Run: Get-SmbServerConfiguration | Select EnableSMB1Protocol (should be False). Show GPO settings for LLMNR disable.

Configure application deny-by-exception (blocklisting)

In addition to AppLocker allowlisting (3.4.6), configure EDR application blocking: CrowdStrike Falcon console > Configuration > Prevention Policy > Custom IOC > Add indicators for known unwanted applications: Remote access tools (TeamViewer, AnyDesk, LogMeIn) unless approved. Torrenting applications (BitTorrent, uTorrent). Cryptocurrency miners. Unapproved cloud storage clients (Dropbox, personal Google Drive). SentinelOne: Sentinels > Blocklist > add hashes of unwanted applications. Defender for Endpoint: Settings > Indicators > File hashes > Add.

Application Blocklist Configuration

Screenshot of EDR blocklist showing blocked applications. Include AppLocker deny rules for unauthorized software categories.

Blocked Application Attempt Logs

Sample EDR or AppLocker logs showing attempts to run blocked applications were denied.

Control and monitor user-installed software

1) Prevent user-installed software (see 3.4.6 - Windows Installer restrictions). 2) For approved self-service: Intune Company Portal > add approved apps that users can self-install. 3) Monitor for unauthorized installations: Weekly: Intune > Apps > Monitor > Discovered apps. Review new applications. SCCM: Monitoring > Software Inventory. GPO: Enable Software Restriction Policies audit mode to log all executed software. 4) Uninstall any unauthorized software found. Document in incident ticket.

User-Installed Software Discovery Report

Intune Discovered Apps report or SCCM Software Inventory showing all installed software across managed devices. Flag any unapproved software.

Software Installation Restriction Verification

Screenshot showing standard user attempting to install an MSI file and being blocked by policy.

Enforce unique user identification for all system access

1) User naming convention: first.last (or flast) - document in IT procedures manual. 2) Prohibit shared accounts: audit AD monthly for accounts used by multiple people. 3) Service accounts: use Managed Service Accounts (MSA) or Group MSA (gMSA) for services. PowerShell: New-ADServiceAccount -Name 'svc-SQLAgent' -DNSHostName 'sql01.domain.com' -PrincipalsAllowedToRetrieveManagedPassword 'SQL-Servers'. 4) Each person has exactly one standard account and (if needed) one admin account. 5) Former employee accounts disabled within 4 hours, never reassigned.

Identify and authenticate all devices on the network

1) All workstations and servers must be domain-joined. Computer naming convention: WS-[location]-[number] for workstations, SV-[role]-[number] for servers. 2) Deploy 802.1X on wired network (if NAC available): Switch > per-port 802.1X > RADIUS to NPS > machine certificate authentication. 3) If no NAC: disable unused switch ports, enable MAC address filtering as compensating control. 4) Maintain device inventory with serial numbers, MACs, assigned users.

AD User Account Audit

PowerShell: Get-ADUser -Filter * -Properties Created,LastLogonDate,Enabled | Export-Csv. Verify unique accounts, no shared accounts, naming convention followed.

Device Inventory with Domain Join Status

Get-ADComputer -Filter * -Properties IPv4Address,OperatingSystem,Created | Export-Csv. Cross-reference with physical asset inventory.

Authenticate users, processes, and devices before granting access

1) All systems must authenticate against AD (Kerberos) or Entra ID (SAML/OAuth). No local-account-only systems allowed in CUI scope. 2) Service-to-service authentication: use gMSA or certificate-based auth, never embedded passwords. 3) API authentication: OAuth 2.0 with client credentials flow. No API keys in code. 4) For network devices (switches, APs): enable RADIUS authentication. No default passwords on any device - change all defaults during initial setup. 5) Verify: attempt to access any CUI system without authentication - must be denied.

Authentication Method Inventory

Table listing every system in CUI scope with its authentication method (AD, Entra, RADIUS, certificate). Verify no systems use local-only accounts for production access.

Default Password Removal Verification

Checklist showing default credentials were changed on all network devices, appliances, and applications during deployment.

Enforce multi-factor authentication for all users

Entra admin center (https://entra.microsoft.com) > Protection > Conditional Access > New Policy: Name 'Require MFA - All Users'. Users: All users (exclude 1 break-glass account - document separately). Target resources: All cloud apps. Grant: Require multifactor authentication. Preferred MFA methods (strongest to weakest): 1) FIDO2 security key (best). 2) Microsoft Authenticator push notification. 3) Microsoft Authenticator TOTP. 4) SMS (weakest - avoid if possible). Entra ID > Security > Authentication methods > Policies > Disable SMS and Voice call methods if all users can use Authenticator app. Register all users: Entra ID > Security > Authentication methods > Registration campaign = Enabled.

Configure MFA for on-premises and VPN access

For VPN with MFA: Install Azure MFA NPS Extension on NPS server. This adds Entra MFA to RADIUS authentication flow. Download from: aka.ms/npsmfa. Configure with Entra tenant ID. Firewall VPN: Change RADIUS authentication to point to NPS with MFA extension. For RDP to servers: Deploy Azure MFA NPS Extension or use Windows Hello for Business. Test: VPN login should prompt for MFA after password.

Conditional Access MFA Policy

Screenshot of Conditional Access policy requiring MFA for all users and all cloud apps. Include authentication methods policy showing preferred methods.

MFA Registration Status

Entra ID > Security > Authentication methods > User registration details. Export showing all users have MFA methods registered. Flag any users without MFA.

VPN MFA Verification

Screenshot of VPN connection flow showing MFA prompt after password entry. Include NPS configuration showing MFA extension installed.

Use replay-resistant authentication mechanisms

1) Kerberos (AD default): Already replay-resistant via timestamps in ticket requests. Ensure Kerberos max ticket lifetime: GPO > Default Domain Policy > Computer Configuration > Windows Settings > Security Settings > Account Policies > Kerberos Policy > Maximum lifetime for user ticket = 10 hours. Maximum lifetime for service ticket = 600 minutes. 2) Disable NTLM where possible: GPO > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Network security: Restrict NTLM: NTLM authentication in this domain = Deny all. (Test in audit mode first: 'Audit all' for 30 days). 3) For web apps: use OAuth 2.0 with PKCE (proof key for code exchange) - nonce and state parameters prevent replay attacks.

Kerberos Policy Settings

Screenshot of Default Domain Policy Kerberos settings showing ticket lifetimes. Show NTLM restriction policy (or audit-mode plan with timeline to enforce).

NTLM Audit Log

If NTLM still enabled: show audit log of NTLM usage (Event ID 4624 with LogonType and AuthenticationPackage) to identify remaining NTLM dependencies for migration.

Prevent reuse of identifiers (user and device names)

1) Never reassign a username to a new employee - create a new unique identifier. Example: if jsmith leaves and John Smith Jr. is hired, use jsmith2 or jrsmith. 2) Disabled accounts: retain in _Disabled OU for 90 days minimum (audit trail), then delete. Never re-enable a deleted account's name for a different person. 3) Computer names: when recycling hardware, rename the computer object. Old: WS-NYC-042 (assigned to jsmith) -> delete computer account. New deployment: WS-NYC-042 can be reused but document the reassignment. 4) Document identifier reuse policy in IT procedures manual.

Identifier Reuse Policy

Policy document stating identifiers are never reassigned to different individuals. Include examples of naming convention.

Disabled Accounts Inventory

Get-ADUser -SearchBase 'OU=_Disabled,DC=domain,DC=com' -Filter * -Properties WhenChanged | Export-Csv. Show accounts pending deletion with disable dates.

Disable identifiers after defined period of inactivity

Create PowerShell script to disable inactive accounts: $InactiveDays = 30; $CutoffDate = (Get-Date).AddDays(-$InactiveDays); Search-ADAccount -UsersOnly -AccountInactive -TimeSpan $InactiveDays | Where-Object {$_.Enabled -eq $true -and $_.DistinguishedName -notlike '*_Service-Accounts*'} | ForEach-Object { Disable-ADAccount $_; Move-ADObject $_ -TargetPath 'OU=_Disabled,...'; Set-ADUser $_ -Description "Auto-disabled $(Get-Date -Format yyyy-MM-dd) - 30 day inactivity" }. Schedule as Task Scheduler job: daily at 2 AM, run as gMSA service account. Send email report of disabled accounts to IT manager.

Inactive Account Auto-Disable Script

PowerShell script content and Task Scheduler configuration showing daily execution. Include recent execution log showing accounts auto-disabled.

Inactive Account Report

Email report generated by auto-disable script showing which accounts were disabled. Verify with Get-ADUser query of _Disabled OU showing recent auto-disables.

Enforce password complexity and minimum length requirements

GPO: Default Domain Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy > Minimum password length: 14 characters (NIST 800-63B recommends 8 minimum, but CMMC assessors expect 14+). Password must meet complexity requirements: Enabled (uppercase, lowercase, number, special character - at least 3 of 4 categories). Minimum password age: 1 day (prevents rapid cycling). Maximum password age: 60 days (or 365 days if using MFA for all access). Enforce password history: 24 passwords remembered. Store passwords using reversible encryption: Disabled.

Configure Entra ID password protection

Entra admin center > Protection > Authentication methods > Password protection > Custom banned passwords: Add company name, product names, city name, season+year patterns (Winter2025, Summer2026). Enable password protection for Windows Server Active Directory: Yes. Mode: Enforced. Deploy Azure AD Password Protection proxy and DC agent: Download from Microsoft, install proxy on 2 member servers, install DC agent on all domain controllers. This blocks common/weak passwords even on-premises.

Password Policy GPO Settings

Screenshot of Default Domain Policy > Password Policy showing length = 14, complexity = Enabled, history = 24.

Entra ID Password Protection Configuration

Screenshot of Entra ID Password Protection showing custom banned password list and enforcement mode. Show DC agent installation status.

Prevent password reuse for defined number of generations

GPO: Default Domain Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy > Enforce password history: 24 passwords remembered. Minimum password age: 1 day. These two settings together prevent a user from rapidly cycling through 24 passwords to get back to their original password. With 1-day minimum age, it would take 24 days to cycle - effectively preventing reuse.

Password History GPO Setting

Screenshot of Password Policy showing history = 24, minimum age = 1 day. Verify with 'net accounts /domain' command output.

Allow temporary passwords only for initial system logon

When creating new accounts in AD: always check 'User must change password at next logon'. For password resets: Reset password > check 'User must change password at next logon'. Never give a temporary password that persists beyond the first logon. Help desk procedure: generate random temporary password (use PowerShell or password manager), communicate via secure channel (in person, phone - never email), user must change immediately upon first use. Temporary password expiration: cannot be set in AD natively - rely on 'must change at next logon' flag.

Password Reset Procedure Document

IT procedure document for password resets showing requirement to set 'must change at next logon'. Include secure communication requirements for temporary passwords.

Sample New Account with Force Change Flag

Screenshot of AD user properties for recently created account showing 'User must change password at next logon' is checked.

Store and transmit only cryptographically-protected passwords

1) Verify AD stores passwords as hashes (default - never enable reversible encryption): GPO > Password Policy > Store passwords using reversible encryption = Disabled. 2) Disable WDigest authentication (cleartext in memory): GPO > Computer Configuration > Administrative Templates > MS Security Guide > WDigest Authentication = Disabled. Or registry: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential = 0. 3) Enforce TLS for all web applications - no HTTP-only login pages. 4) LDAP signing: GPO > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Domain controller: LDAP server signing requirements = Require signing.

Password Storage and Transmission Configuration

GPO showing reversible encryption disabled, WDigest disabled, LDAP signing required. Verify with registry check on sample server.

Web Application TLS Verification

Screenshot of each CUI-accessible web application showing HTTPS with valid certificate. Verify no HTTP-only login pages using browser developer tools.

Obscure authentication feedback (password masking)

1) Windows logon: password field shows dots/asterisks by default - verify no GPO or registry change has enabled 'Show password' permanently. 2) Web applications: verify password input fields use type='password' HTML attribute. 3) Error messages: configure applications to show generic error: 'Invalid username or password' - never indicate which one is wrong. 4) Lockout messages: 'Your account has been locked' - do not specify lockout threshold or duration. 5) MFA prompts: do not reveal which MFA method is registered.

Login Error Message Verification

Screenshot of login page with incorrect username showing generic error. Screenshot with incorrect password showing same generic error. Verify messages are identical.

Password Field Masking Verification

Screenshot of login pages (Windows, web apps, VPN client) showing password fields are masked with dots/asterisks.

Develop and maintain an Incident Response Plan

Create 'Incident Response Plan' document. Must include: 1) Purpose and scope (all CUI systems and data). 2) Incident categories: Malware, Unauthorized access, Data breach/loss, Phishing, Insider threat, Denial of service, Physical breach. 3) Severity levels: Critical (CUI exposed, active breach), High (potential CUI impact), Medium (no CUI impact but security event), Low (informational). 4) Roles and responsibilities: Incident Commander (IT Manager), Technical Lead (Sr. Sysadmin), Communications (designated spokesperson), Legal/Compliance liaison. 5) Contact list: internal team, external (legal counsel, cyber insurance, FBI field office, CISA, managed SOC provider). 6) Phases: Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident Review. 7) Communication procedures: internal escalation, customer notification, DoD notification (72 hours for CUI incidents per DFARS 252.204-7012). 8) Evidence preservation procedures. Review and update annually.

Define incident reporting procedures

All employees must know how to report a security incident: 1) Primary: email security@company.com or call IT help desk. 2) After hours: call IT manager cell phone (documented in plan). 3) For phishing: use 'Report Message' button in Outlook (deployed via M365 admin). 4) Include in annual security awareness training. 5) Post reporting instructions on intranet and in break rooms. 6) No retaliation for good-faith reports.

Incident Response Plan

Complete IRP document with all required sections. Show annual review date and management signature. Include contact list (can redact phone numbers for assessor).

Incident Report Form Template

Standard incident report form used by security team. Include fields for: date/time, reporter, description, systems affected, CUI impact, actions taken.

Employee Reporting Instructions

Screenshot of intranet page or poster showing how to report security incidents. Include 'Report Message' button configuration in Outlook.

Track and document security incidents

Use ticketing system (ServiceNow, Jira, or even a dedicated SharePoint list) for incident tracking: 1) Create 'Security Incident' ticket type with required fields: Incident ID (auto-generated), date/time detected, date/time reported, reporter, category, severity, affected systems, CUI involved (Y/N), description, containment actions, eradication actions, recovery actions, root cause, lessons learned, status, assigned to. 2) All incidents must have a ticket - even false positives (mark as 'false positive - closed'). 3) Update ticket at each phase of incident response. 4) Close ticket only after post-incident review is complete. 5) Retain incident records for minimum 3 years.

Incident Tracking System

Screenshot of incident tracking system showing ticket fields and sample closed incidents. Include at least one sample with full lifecycle documented.

Incident Report Log (Last 12 Months)

Summary table of all security incidents in past 12 months: date, category, severity, CUI impact, resolution, days to close. Even if zero incidents - document that.

Test incident response capabilities

Conduct annual tabletop exercise (TTX): 1) Schedule 2-hour session with all IR team members. 2) Scenario: ransomware attack on file server containing CUI. Walk through each IRP phase: - Detection: How was it detected? (EDR alert, user report, SIEM) - Analysis: How do you determine scope? (Which systems, which data?) - Containment: Isolate affected systems - how? (Network isolation, disable accounts) - Eradication: Remove malware - how? (EDR remediation, rebuild from image) - Recovery: Restore from backup - what's the RPO/RTO? - Notification: Who gets notified? DoD 72-hour requirement for CUI. 3) Document findings: what worked, what needs improvement. 4) Update IRP based on findings within 30 days. 5) Consider additional scenarios: phishing compromise, insider data theft, cloud account takeover.

Tabletop Exercise After-Action Report

After-action report from most recent TTX including: scenario description, participants, decisions made, gaps identified, remediation actions with due dates.

IRP Update Record

Change log showing IRP was updated based on TTX findings. Include before/after for specific sections that changed.

Implement regular system maintenance and patching

Option A - WSUS: Install WSUS role on member server. WSUS Console > Options > Products and Classifications: select Windows 11, Windows Server 2022, Office, .NET. Classifications: Critical, Security, Update Rollups. GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates = Auto download and schedule install. Schedule: Tuesday night (Patch Tuesday + 1 week for testing). Option B - Intune: Devices > Windows > Update rings for Windows 10 and later > Create profile: Deferral period = 7 days (test), Deadline = 14 days. Option C - SCCM: Software Updates > Create ADR (Automatic Deployment Rule). Critical patches: test within 7 days, deploy within 14 days. Third-party patches: use Ninite Pro, Patch My PC, or manual update schedule.

Document maintenance activities

Create maintenance log for all system maintenance activities: 1) Scheduled patching: document date, systems patched, patches applied, any failures. 2) Hardware maintenance: document date, technician, work performed, parts replaced. 3) Software updates: document application, old version, new version, tested by whom. 4) Emergency maintenance: document justification for emergency, approver, actions taken. All maintenance must follow change control process (3.4.2).

WSUS/Intune Patch Compliance Report

WSUS: Reports > Computers > Summary (show > 90% patched). Intune: Reports > Windows updates > show ring compliance. Include list of any systems not up to date with justification.

Maintenance Activity Log

Log of all maintenance activities for past 90 days including: date, type, systems, description, technician, change ticket reference.

Control system maintenance tools and media

1) Maintain approved maintenance tools list: Windows Admin Tools, RSAT, SysInternals, PowerShell, manufacturer diagnostic tools. 2) USB boot media (Windows PE, Linux live): store in locked cabinet in server room. Log check-in/check-out. 3) Remote maintenance tools: only approve corporate VPN + RDP or approved RMM tool (ConnectWise, Datto). Block unauthorized tools (TeamViewer personal, AnyDesk). 4) After maintenance with external media: scan with EDR before reconnecting to network. 5) Vendor-provided maintenance laptops: must not be connected to CUI network without approval.

Approved Maintenance Tools List

Document listing all approved maintenance tools and media. Include storage location for physical media and check-out log.

Media Check-Out Log

Physical media check-out/check-in log showing who used what media, when, for what purpose.

Sanitize equipment removed for off-site maintenance

Before any CUI system leaves the premises for repair: 1) If possible, remove and retain the hard drive/SSD - send hardware only without storage. 2) If storage must go with equipment: use NIST 800-88 media sanitization: For HDD: DBAN (Darik's Boot And Nuke) - 1 pass overwrite minimum. For SSD: manufacturer secure erase (Samsung Magician, Intel SSD Toolbox). For NVMe: 'nvme format /dev/nvmeXn1 --ses=1' (crypto erase). 3) Document sanitization: device serial, method used, verified by, date. 4) If sanitization not possible: do not send device for external repair. Use warranty depot repair with NDA or replace the device.

Media Sanitization Log

Log of all equipment sent for repair showing: device, serial number, sanitization method, verification, date, technician name.

Media Sanitization Procedure

Written procedure aligned with NIST 800-88 for clearing, purging, and destroying media before disposal or repair.

Check maintenance media for malicious code before use

Before using any external media for maintenance: 1) Insert USB/CD on a standalone scanning workstation (not connected to CUI network). 2) Run full EDR scan: right-click drive > Scan with [CrowdStrike/Defender/SentinelOne]. 3) If clean: approve for use. If malware found: quarantine media, do not use. 4) For downloaded tools: verify hash against vendor-published hash before executing. PowerShell: Get-FileHash -Algorithm SHA256 -Path .\tool.exe | Format-List. Compare to vendor's website SHA256. 5) Document scan results in maintenance log.

Media Scan Procedure and Results

Procedure document for scanning maintenance media. Include sample scan results log showing media was scanned before use.

Require MFA for nonlocal maintenance sessions

All remote maintenance must go through VPN with MFA (see 3.1.12 and 3.5.3): 1) Vendor remote access: create time-limited VPN account with MFA. Enable for maintenance window only, disable immediately after. 2) MSP/managed service access: require MFA on all remote connections. Verify with MSP that their technicians use individual accounts (not shared). 3) RDP: require MFA via NPS Extension or Duo Authentication for Windows Logon. 4) No direct internet-facing management ports - all remote access through VPN.

Remote Maintenance MFA Configuration

Show VPN MFA policy. Include vendor account management process (time-limited accounts with MFA).

Remote Maintenance Session Log

VPN connection logs showing remote maintenance sessions with MFA verification. Include vendor session logs with start/end times.

Supervise maintenance activities of personnel without authorized access

When an unauthorized person must perform maintenance (vendor technician, building contractor): 1) Physical: escort vendor at all times in server room. Authorized employee must be present. Sign visitor log: name, company, date, time in, time out, purpose, escort name. 2) Remote: observe vendor's screen during remote maintenance session. Use screen sharing (Teams meeting) where vendor shares their screen while working. Record the session if possible. 3) Vendor must sign NDA before accessing any CUI systems. 4) After vendor maintenance: review audit logs for the maintenance period. Verify no unauthorized actions were taken.

Vendor Maintenance Log

Log entries for all vendor maintenance sessions showing: vendor name, escort, date/time, purpose, activities performed, post-maintenance log review completion.

Vendor NDA on File

Signed NDA from each vendor who has accessed CUI systems. Include date signed and expiration.

Protect CUI media (digital and physical) during storage and transport

1) Digital media: all CUI stored on encrypted volumes (see 3.8.6 BitLocker). 2) Removable media with CUI (if approved): use hardware-encrypted USB drives only (IronKey, Apricorn Aegis - FIPS 140-2 validated). 3) Physical CUI documents: store in locked filing cabinet in access-controlled area. 4) Transport: CUI documents in sealed envelopes marked 'CUI'. Digital media in locked bag. Never leave CUI unattended during transport. 5) Backup tapes/drives: store in fireproof safe or off-site vault. 6) Label all CUI media: physical labels on tapes, external drives. Electronic labels: folder names include 'CUI' designation.

Media Protection Policy

Policy document covering digital and physical CUI media handling, storage, transport, and labeling requirements.

Physical Media Storage Verification

Photo of locked filing cabinet, server room access controls, and backup media safe. Include access log for media storage area.

Restrict access to CUI on digital and physical media

1) Digital: NTFS/share permissions restrict CUI folders to authorized groups only (see 3.1.2). 2) Removable media: USB blocked by default (see 3.1.21). Approved encrypted USBs: limit to specific users via Defender for Endpoint device control. 3) Backup media: Veeam encryption enabled, restore requires Veeam console access (restricted to T1-Admins). 4) Physical documents: locked cabinets, key held by department manager. 5) Server room: badge access only, limited to IT staff and facilities.

Digital Media Access Restrictions

NTFS permissions on CUI folders (see 3.1.2 evidence). USB block policy (see 3.1.21). Veeam encryption configuration showing encryption enabled.

Physical Media Access Controls

Photo of locked cabinet, badge reader on server room door, key log for filing cabinets.

Sanitize or destroy CUI media before disposal or reuse

Follow NIST SP 800-88 Rev 1 Guidelines for Media Sanitization: 1) Clear (for reuse within organization): HDD: single-pass overwrite. SSD: manufacturer secure erase. 2) Purge (for reuse outside organization): HDD: DBAN or degausser. SSD: crypto erase (ATA Secure Erase Enhanced). 3) Destroy (for disposal): HDD/SSD: physical shredding by certified vendor (e.g., Iron Mountain). Paper: cross-cut shredder (DIN Level P-4 minimum). Optical media: physically shred or use media shredder. 4) Document each sanitization: device serial, method, date, technician, witness. 5) Obtain certificate of destruction from shredding vendor.

Media Sanitization Procedure

Written procedure aligned with NIST 800-88 for Clear, Purge, and Destroy. Include decision matrix for when each method applies.

Certificates of Destruction

Certificates from media destruction vendor for all destroyed media. Internal sanitization log for reused media showing method and verification.

Mark CUI media with required markings

1) Digital documents: add header 'CUI' or 'CONTROLLED' to all CUI documents. In Word: Insert > Header > type 'CUI' or 'CONTROLLED UNCLASSIFIED INFORMATION'. If CUI category known: 'CUI // SP-CTI' (Controlled Technical Information) or 'CUI // SP-EXPT' (Export Controlled). 2) Email: add 'CUI' to subject line prefix for emails containing CUI. Configure Outlook sensitivity labels: M365 Compliance > Information Protection > Labels > Create label: 'CUI' with header/footer marking. 3) Physical media: use CUI label stickers on backup tapes, drives, folders. 4) Server rooms/cabinets containing CUI: label doors 'Contains CUI'.

CUI Marking Examples

Sample CUI-marked document showing header. Sample email with CUI sensitivity label. Photo of labeled media and cabinet.

Sensitivity Label Configuration

M365 Compliance > Information Protection > Labels showing CUI label with auto-header/footer settings.

Control access to CUI media and maintain accountability

1) Create media inventory tracking all CUI media: Serial number, type (HDD, USB, tape, paper), location, custodian, CUI category. 2) Check-out process: media custodian logs check-out with: date, person, purpose, expected return date. 3) Check-in: verify media returned intact, log return date. 4) Quarterly audit: physical count all CUI media against inventory. Report any discrepancies as security incident. 5) Media in transit: use tracking numbers (FedEx, UPS). Never use standard USPS for CUI media.

CUI Media Inventory

Current inventory of all CUI media showing serial, type, location, custodian. Include quarterly audit results.

Media Check-Out/Check-In Log

Log showing recent media movements with check-out and check-in records.

Implement BitLocker full-disk encryption on all CUI systems

GPO: Computer Configuration > Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Require additional authentication at startup = Enabled (allow TPM). Choose drive encryption method: XTS-AES 256-bit. Fixed Data Drives: Deny write access to drives not protected by BitLocker = Enabled. Store BitLocker recovery keys in Active Directory: Computer Configuration > Policies > Administrative Templates > Windows Components > BitLocker > Store BitLocker recovery information in AD DS = Enabled. Or Intune: Endpoint security > Disk encryption > Create profile > BitLocker > Encrypt = Yes, Key rotation = Enabled. Recovery keys stored in Entra ID automatically. Verify: 'manage-bde -status' on each workstation should show 'Fully Encrypted'.

Encrypt backup media

Veeam Backup & Replication console > Backup Infrastructure > Backup Repositories > right-click > Properties > Repository > Enable inline data deduplication: Yes. For each backup job: Edit job > Storage > Advanced > Storage > Enable backup file encryption: Yes. Password: use strong passphrase stored in password manager. Verify: examine .vbk file - should show encrypted header. For backup copy to offsite: also encrypt with different password.

BitLocker GPO Configuration

Screenshot of BitLocker GPO settings. Run 'manage-bde -status' on sample workstation and server showing 'Fully Encrypted' and 'XTS-AES 256'.

BitLocker Compliance Report

Intune: Reports > Endpoint security > Encryption showing all devices encrypted. Or AD: Get-ADComputer -Filter * -Properties msTPM-OwnerInformation showing TPM and recovery key backup.

Veeam Encryption Configuration

Screenshot of Veeam backup job showing encryption enabled. Verify by attempting to import backup on different Veeam server - should prompt for password.

Control removable media use on CUI systems

Primary: Block all removable media (see 3.1.21). If exceptions required: Defender for Endpoint admin center > Device control > Removable storage access control > Create policy: Default: Deny all removable storage. Exception: Allow approved encrypted USB drives (by hardware ID). Approved devices: IronKey D300S, Apricorn Aegis 3NX (FIPS 140-2). Get hardware IDs from device manager when drive is connected. Only issue approved drives to users with documented business need. Audit: run device control report monthly - review any blocked or allowed device access.

Removable Media Policy and Exceptions

Screenshot of Defender for Endpoint device control policy showing default deny and approved device exceptions with hardware IDs.

Removable Media Usage Report

Monthly device control report showing all removable media access attempts (blocked and allowed). Verify allowed devices match approved list.

Prohibit use of portable storage devices without identifiable owner

1) All approved portable storage devices must be registered in IT inventory: Serial number, make/model, assigned to (specific employee), date issued, encryption verified. 2) Label each device with asset tag. 3) Lost/stolen devices: report as security incident within 1 hour. If device contained CUI: trigger data breach procedures. 4) Returned devices (employee transfer/termination): wipe per NIST 800-88 and re-register. 5) Found/unknown USB drives: NEVER plug into any corporate system. Train employees in awareness training to turn in found drives to IT (may be malicious).

Portable Storage Device Inventory

Inventory of all approved portable storage devices showing serial, assigned owner, encryption status, and asset tag.

Lost Device Incident Records

Any records of lost or stolen portable storage devices. If none: document that no incidents have occurred. Include awareness training material about found USB drives.

Protect confidentiality of backup CUI at storage locations

1) On-site backups: Veeam encryption enabled (see 3.8.6). Backup storage in server room (access-controlled). 2) Off-site/cloud backups: Veeam Cloud Connect or Wasabi/AWS S3 with AES-256 encryption at rest. Enable TLS 1.2 for data in transit. 3) Cloud storage bucket: private ACL (no public access), IAM policy restricting access to backup service account only. 4) 3-2-1 rule: 3 copies, 2 different media types, 1 offsite. All copies encrypted. 5) Backup restoration test: quarterly, restore sample CUI files from backup to verify data integrity and test recovery procedure.

Backup Encryption Configuration

Veeam job settings showing encryption enabled. Cloud storage configuration showing encryption at rest and private ACL.

Backup Restoration Test Results

Quarterly backup restoration test report showing: date, files restored, integrity verified, time to restore, any issues encountered.

Restrict physical access to CUI systems to authorized individuals

1) Server room/IT closet: install badge reader (HID, Brivo, Openpath) or cipher lock. Restrict access to IT staff only. 2) If badge system: configure access schedule (IT staff: 24/7, cleaning: escorted only). 3) If key lock: maintain key log - issue numbered keys to authorized personnel only. 4) Workstation areas with CUI: if in open office, ensure clean desk policy and screen lock when unattended. If dedicated CUI room: badge access required. 5) Post 'AUTHORIZED PERSONNEL ONLY' signage on server room and CUI areas. 6) Review access list quarterly - remove former employees and role changes.

Implement camera systems for CUI areas

Install security cameras covering: 1) Server room entrance (interior and exterior). 2) Building entrance/exit. 3) Any dedicated CUI processing area. Camera specifications: 1080p minimum, IR night vision, 30 fps. Storage: NVR with 30-day minimum retention (90 days preferred). Access to footage: restricted to security manager and building manager. Review footage only upon security incident or suspected unauthorized access.

Physical Access Control System Configuration

Screenshot of badge system access groups showing who has server room access. Include photo of badge reader installed on server room door.

Camera System Coverage

Screenshot of camera system dashboard showing cameras covering server room and building entrances. Include retention settings showing 30+ day storage.

Protect and monitor physical facility and support infrastructure

1) Server room environmental controls: Temperature monitoring: 64-75°F (18-24°C). Install temperature sensor with email alert. Humidity monitoring: 40-60% RH. UPS: minimum 15-minute runtime. Test quarterly. Connect servers and network equipment. Surge protection on all CUI systems. 2) Fire suppression: server room should have clean-agent fire suppression (FM-200) or at minimum dry-chemical extinguisher rated for electronics (Class C). 3) Water: no water pipes above server equipment. If unavoidable, install water sensor. 4) Power: dedicated circuit for server room. Generator backup if available.

Environmental Monitoring Configuration

Screenshot of temperature/humidity monitoring system showing current readings and alert thresholds. Include UPS runtime test results.

Fire Suppression and Safety Equipment

Photo of fire extinguisher in server room (with current inspection tag), smoke detector, and water sensor (if applicable).

Escort visitors and maintain visitor access logs

1) Visitor policy: all visitors must sign in at reception. Visitor log fields: name, company, date, time in, time out, purpose, host employee. 2) Issue visitor badge: visually distinct from employee badges (different color). 3) Visitors escorted at all times in areas containing CUI systems. 4) Visitors may not access server room without IT manager approval AND escort. 5) At check-out: collect visitor badge, record time out. 6) Retain visitor logs for minimum 1 year. 7) Review visitor logs monthly for anomalies.

Visitor Sign-In Log

Sample visitor log pages showing completed entries. Include photo of visitor badge (different from employee badge).

Visitor Policy Document

Written visitor policy including escort requirements, badge procedures, and CUI area restrictions.

Maintain physical access audit logs

1) Badge system: retains all access events (entry, exit, denied access) automatically. Configure retention: minimum 1 year. Export capability: CSV/PDF of all access events by date range and door. 2) If key-based: maintain manual access log at server room door. Log fields: name, date, time in, time out, purpose. 3) Camera footage: retained 30-90 days (corroborates badge/log data). 4) Review access logs monthly: look for off-hours access, frequent short-duration entries, denied access attempts. 5) Correlate badge access with AD logon events for anomaly detection (badge swipe at building vs. VPN logon from different location at same time).

Physical Access Log Export

30-day export of server room badge access events. Highlight any off-hours access or denied attempts. Include review notes and sign-off.

Physical Access Log Review Record

Monthly physical access review showing: reviewer name, date, findings, actions taken.

Control and manage physical access devices (keys, badges, combinations)

1) Badge management: badge system admin creates/disables badges. New badge request requires manager and IT manager approval. 2) Key management: maintain key log: key number, assigned to, date issued, date returned. Keys stored in locked key cabinet when not issued. 3) Combinations: cipher lock combinations changed quarterly AND when any authorized person is terminated or transferred. 4) Lost badge/key: report immediately, disable badge, re-key if necessary. Treat as potential security incident. 5) Inventory: quarterly count of all issued badges/keys against log. Report discrepancies.

Badge/Key Inventory and Issuance Log

Current inventory of all issued physical access devices. Include quarterly audit results reconciling physical count to log.

Lost Badge/Key Incident Records

Records of any lost or stolen physical access devices. Include response actions taken (badge disabled, lock changed, etc.).

Implement alternate work site security controls

For remote work / work-from-home with CUI access: 1) Remote work agreement: employee signs acknowledging security responsibilities. 2) Home workspace requirements: private area (not shared/public space), locked when unattended, no unauthorized individuals can view CUI. 3) Technical controls: company laptop with BitLocker, VPN required for all CUI access, Intune-compliant device, EDR installed. 4) Prohibited: printing CUI at home (unless approved secure printer), accessing CUI from personal devices, storing CUI on personal cloud storage. 5) WiFi: WPA2/WPA3 personal minimum. Recommend against public WiFi (VPN compensates but not ideal).

Remote Work Security Agreement

Signed remote work security agreement template and sample completed agreements. Include home workspace security requirements.

Remote Worker Device Compliance Report

Intune compliance report filtered by remote workers showing BitLocker enabled, EDR active, compliant status.

Screen individuals prior to authorizing access to CUI systems

Before granting CUI system access to any individual: 1) Background check: criminal history, employment verification, education verification. Use service: GoodHire, Checkr, Sterling, or equivalent. 2) For contractors/vendors: verify company due diligence and require individual background check or accept vendor's existing screening certification. 3) NDA: signed before any system access. 4) CUI awareness training: completed before access (see 3.2.1). 5) Access request form: manager-approved, documenting specific systems and CUI access needed. 6) Retain screening records per company retention policy (typically 7 years after separation). 7) Re-screening: when employee transfers to higher CUI access level.

Background Check Policy and Completion Records

Personnel screening policy document. Background check completion certificates (can redact details - just show check was completed for each employee with CUI access).

NDA on File for CUI-Access Personnel

Signed NDAs for all personnel with CUI access. Include list mapping employees to NDA dates.

Implement termination and transfer procedures for access revocation

Create 'Employee Termination and Transfer IT Checklist': TERMINATION (complete within 4 hours of HR notification): 1) Disable AD account. 2) Disable Entra ID account. 3) Revoke VPN access. 4) Revoke all application access (CRM, ERP, custom apps). 5) Forward email to manager (if authorized) or disable mailbox. 6) Wipe Intune-managed devices (corporate wipe). 7) Collect physical items: laptop, phone, badge, keys, USB drives. 8) Change shared credentials if employee had access (admin passwords, WiFi PSK, vendor portals). 9) Move AD account to _Disabled OU. TRANSFER: 1) Remove old role group memberships. 2) Add new role groups. 3) Revoke old application access. 4) Provision new application access. 5) Log the transfer in access review records.

Termination Checklist (Completed Samples)

3-5 completed termination checklists showing all steps were performed. Include timestamp of AD account disable relative to HR notification (should be < 4 hours).

Transfer Access Change Records

Sample transfer records showing old access removed and new access granted per new role. Include manager approval.

Conduct annual risk assessment

Conduct annual risk assessment following NIST SP 800-30 methodology: 1) System characterization: identify all CUI systems, data flows, and boundaries. 2) Threat identification: internal (insider), external (nation-state, criminal), environmental (fire, flood, power), technical (hardware failure). 3) Vulnerability identification: use vulnerability scan results (Nessus), configuration audit results (CIS-CAT), and penetration test findings. 4) Risk determination: Likelihood (Low/Medium/High) x Impact (Low/Medium/High) = Risk Level. 5) Risk response: Accept, Mitigate, Transfer, Avoid for each identified risk. 6) Document in Risk Register: risk ID, description, likelihood, impact, risk level, response, owner, due date, status. 7) Present to management for review and sign-off. 8) Update POA&M with any mitigation actions.

Annual Risk Assessment Report

Complete risk assessment report including system characterization, threat analysis, vulnerability analysis, risk determination matrix, and risk response decisions. Management sign-off.

Risk Register

Current risk register showing all identified risks with likelihood, impact, response strategy, owner, and status. Include POA&M cross-references for mitigation actions.

Conduct regular vulnerability scanning

Deploy vulnerability scanner: Option A - Nessus Professional: Install Nessus on management VLAN server. Scans > New Scan > Basic Network Scan > Targets: all CUI subnets. Credentials: provide AD admin credentials for authenticated scanning. Schedule: weekly (automated). Option B - Qualys: Install Qualys scanner appliance. Configure scan schedule. Option C - Microsoft Defender Vulnerability Management (built into Defender for Endpoint): Already scanning managed devices. Portal > Vulnerability management > Dashboard. For any scanner: Critical vulnerabilities: remediate within 15 days. High: 30 days. Medium: 90 days. Low: 180 days or accept risk with justification. Re-scan after patching to verify remediation.

Vulnerability Scan Results (Last 30 Days)

Latest vulnerability scan report showing scanned hosts, vulnerability counts by severity, and trend from previous scans. Include remediation timelines.

Vulnerability Remediation Tracking

Tracking spreadsheet or tool showing: vulnerability, affected systems, severity, date found, remediation deadline, actual remediation date, verification scan date.

Scan Configuration

Scanner configuration showing targets (all CUI subnets), credentials configured for authenticated scanning, and weekly schedule.

Remediate vulnerabilities in accordance with risk assessments

1) After each vulnerability scan, triage results: Create ticket for each Critical and High vulnerability. Batch Medium/Low into monthly remediation sprint. 2) For each vulnerability ticket: Assign to system owner. Set due date per severity (see 3.11.2 timelines). Document remediation plan (patch, config change, compensating control, risk accept). 3) Risk acceptance: for vulnerabilities that cannot be remediated, document in risk register with: justification, compensating controls, management sign-off, review date (re-evaluate quarterly). 4) Track POA&M: all open vulnerabilities are POA&M items until resolved. 5) Monthly vulnerability management review meeting with stakeholders.

Vulnerability Remediation Records

Sample tickets showing vulnerability remediation lifecycle: discovery, assignment, remediation, verification scan. Include any risk acceptance records with management sign-off.

POA&M with Vulnerability Items

POA&M showing open vulnerability findings with severity, owner, remediation plan, and milestone dates.

Monitor and protect communications at system boundaries

Firewall admin console: 1) Enable stateful packet inspection on all interfaces. 2) Enable IDS/IPS: Security Services > Intrusion Prevention > Enable IPS on WAN and DMZ interfaces. Signature updates: automatic daily. Action: Prevent (block and log). 3) Enable gateway antivirus: scan all inbound HTTP, SMTP, FTP traffic. 4) Enable application control: block unauthorized applications (P2P, TOR, etc.). 5) Enable geo-IP filtering: block countries not needed for business. 6) Default deny: all traffic not explicitly allowed is blocked (verify with last rule = deny all).

Implement email security at the boundary

M365 Exchange admin center > Mail flow > Rules: 1) External email warning: prepend '[EXTERNAL]' to subject of inbound email from outside org. 2) Block executable attachments: reject messages with .exe, .bat, .ps1, .vbs, .js, .scr, .com. 3) Enable Safe Attachments (Defender for Office 365): Security.microsoft.com > Policies > Threat policies > Safe Attachments > Enable Dynamic Delivery or Block. 4) Enable Safe Links: Threat policies > Safe Links > Check URLs on click, apply to internal messages. 5) Anti-phishing policy: Impersonation protection for executives and partners.

Firewall Security Services Configuration

Screenshot of IPS, gateway AV, application control, and geo-IP filtering enabled on firewall. Show signature update status.

Email Security Configuration

Screenshots of Safe Attachments, Safe Links, anti-phishing policies in M365 Defender. Include external email warning rule.

Employ architectural designs to promote effective security

1) Network segmentation: CUI systems on dedicated VLAN (see 3.1.3). 2) DMZ for public-facing services: web server, email relay in DMZ subnet. Firewall: Internet <-> DMZ (restricted ports) <-> Internal (restricted ports). 3) Management plane separation: dedicated management VLAN for admin access to switches, firewall, servers. Block management traffic from user VLAN. 4) Zero trust principles: verify then trust. MFA + device compliance + network location for access decisions (Conditional Access implements this). 5) Defense in depth: firewall + IPS + EDR + DLP + encryption at every layer. 6) Document architecture in network diagram included in SSP.

Network Architecture Diagram

Network diagram showing segmentation: CUI VLAN, user VLAN, DMZ, management VLAN, guest VLAN. Show firewall between each zone.

Defense-in-Depth Security Layers

Document showing all security layers: perimeter (firewall), network (IPS, segmentation), host (EDR, patch), application (MFA, DLP), data (encryption).

Separate user functionality from system management functionality

1) Separate admin accounts from user accounts (see 3.1.4). 2) Privileged Access Workstations (PAW): dedicated workstation for admin tasks. PAW does not browse internet, check email, or run standard user apps. PAW connected to management VLAN. GPO for PAW OU: block internet access (proxy exception), disable USB, restrict logon to T0-Admins only. 3) If PAW not feasible: use RDP jump server in management VLAN. Admin logs into jump server via RDP (with MFA) to perform admin tasks. Never admin directly from user workstation. 4) Separate admin browser profiles: if admins must use same workstation, use separate browser profile for admin portal access.

Admin Account Separation Verification

AD report showing separate admin accounts (adm- prefix). GPO or Conditional Access restricting admin portal access to management network.

PAW or Jump Server Configuration

If PAW: screenshot of PAW GPO settings (no internet, restricted logon). If jump server: screenshot of jump server access configuration with MFA.

Prevent unauthorized and unintended information transfer via shared resources

1) Disable clipboard sharing in RDP sessions for non-admin connections: GPO: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection > Do not allow clipboard redirection = Enabled. Do not allow drive redirection = Enabled. 2) For shared workstations: configure separate user profiles. Enable disk quotas: GPO > Computer Configuration > Administrative Templates > System > Disk Quotas > Enable disk quotas = Enabled. 3) Clear pagefile at shutdown: GPO > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Shutdown: Clear virtual memory pagefile = Enabled.

RDP Redirection Restrictions

Screenshot of GPO showing clipboard and drive redirection disabled for RDP sessions.

Pagefile Clearing Configuration

Screenshot of GPO setting 'Shutdown: Clear virtual memory pagefile = Enabled'.

Implement network segmentation for publicly accessible systems

1) Create DMZ subnet on firewall: separate interface or VLAN. Example: DMZ VLAN 60, subnet 10.10.60.0/24. 2) Place all public-facing servers in DMZ: web server, email relay, VPN concentrator. 3) Firewall rules: Internet -> DMZ: Allow only required ports (80, 443 for web; 25 for SMTP relay). DMZ -> Internal CUI: Deny all direct access. DMZ -> Internal: Allow only specific, required connections (e.g., DMZ web server -> internal database on specific port). Internal -> DMZ: Allow management access from management VLAN only. 4) No CUI stored in DMZ - DMZ systems connect to internal CUI systems through firewall-controlled API calls.

DMZ Network Configuration

Firewall configuration showing DMZ interface/VLAN, subnet assignment, and inter-zone rules. Show default deny between DMZ and internal networks.

DMZ System Inventory

List of all systems in DMZ with business justification for public exposure. Verify no CUI systems are in DMZ.

Deny network traffic by default and allow by exception

1) Perimeter firewall: verify last rule in each zone pair is 'DENY ALL' with logging. Firewall admin console > Access Rules > verify bottom rule per direction is deny-all. 2) Host-based firewall (Windows Defender Firewall with Advanced Security): GPO: Computer Configuration > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security > Domain Profile: Firewall state = On. Inbound connections: Block. Outbound: Allow. Private Profile: same settings. Public Profile: same settings (more restrictive). 3) Create specific inbound allow rules only for required services: Servers: allow specific management ports from management VLAN. Workstations: allow only RDP from help desk subnet (if needed).

Perimeter Firewall Default Deny Rule

Screenshot of firewall rules showing explicit deny-all as final rule for each zone pair. Show deny-all rule hit counts (should be non-zero, proving it's active).

Host-Based Firewall GPO

Screenshot of Windows Defender Firewall GPO showing 'Block' for inbound connections on all profiles.

Prevent remote devices from establishing split tunneling

See 3.1.13 - enforce full-tunnel VPN for all remote CUI access. Additional controls: 1) VPN client configuration: disable option for users to choose split/full tunnel. Force full-tunnel in client profile (not user-configurable). FortiClient: VPN > SSL-VPN > Tunnel mode: Full tunnel (managed by EMS policy). GlobalProtect: Portal configuration > Agent > Tunnel mode = Full Tunnel. 2) Detect split tunneling violations: on VPN server, monitor for clients with routes that bypass the tunnel. Alert on any client with default route NOT through VPN.

VPN Client Profile - Full Tunnel Enforced

Screenshot of VPN management console showing forced full-tunnel configuration. Show that users cannot override to split-tunnel.

Implement cryptographic mechanisms to prevent unauthorized disclosure during transmission

1) TLS 1.2 minimum for all web traffic: IIS: Server Manager > IIS > Sites > Bindings > HTTPS with TLS 1.2/1.3 certificate. Disable TLS 1.0, 1.1, SSL 3.0 via registry or IIS Crypto tool. 2) Enforce HTTPS: HSTS header on all web servers: Strict-Transport-Security: max-age=31536000; includeSubDomains. 3) Email encryption: M365 message encryption or S/MIME for CUI emails. Purview > Information Protection > Sensitivity labels > Encrypt option. 4) Internal traffic: enable SMB encryption for file shares: Set-SmbServerConfiguration -EncryptData $true -RejectUnencryptedAccess $true. 5) RDP: GPO > Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Security > Require use of specific security layer = SSL. Set client connection encryption level = High.

TLS Configuration Verification

SSL Labs scan (ssllabs.com) results for public web server showing A/A+ rating. Internal: run 'nmap --script ssl-enum-ciphers -p 443 target' showing TLS 1.2+ only.

SMB Encryption Configuration

Run 'Get-SmbServerConfiguration | Select EncryptData,RejectUnencryptedAccess' on file servers showing both True.

Terminate network connections at session end or after inactivity

1) VPN: idle timeout 30 min, session timeout 8 hours (see 3.1.11). 2) Firewall: TCP session timeout = 3600 seconds (1 hour). UDP session timeout = 60 seconds. 3) RDP: idle timeout 30 min, disconnect after idle, end session when time limits reached (see 3.1.11). 4) Web applications: session timeout 30 min idle, force re-auth. Configure in web app settings or reverse proxy. 5) Conditional Access: sign-in frequency (see 3.1.10).

Network Session Timeout Configuration

Firewall session timeout settings. VPN idle/session timeout settings. RDP GPO timeout settings.

Establish and manage cryptographic keys

1) Deploy AD Certificate Services (AD CS) for internal certificate management: Install Root CA (offline recommended for high security, or online for SMB simplicity). Configure certificate templates for: server auth, client auth, code signing, email encryption. 2) Key length minimums: RSA 2048-bit (4096 preferred), ECDSA P-256 or higher. 3) Certificate lifecycle: monitor expiration dates. Set up CA to email notifications 60, 30, 14 days before expiry. 4) BitLocker recovery keys: stored in AD (backed up with AD backups). 5) Backup encryption keys (Veeam): store passphrase in password manager (separate from backup system). Document key recovery procedure. 6) TLS certificates (public): use reputable CA (DigiCert, Let's Encrypt). Auto-renewal where possible.

Certificate Authority Configuration

Screenshot of AD CS console showing CA configuration, certificate templates, and issued certificates. Show key length meets minimums.

Key Management Procedure

Document describing how cryptographic keys are generated, stored, distributed, rotated, and destroyed. Include BitLocker recovery key storage location and Veeam encryption key management.

Employ FIPS-validated cryptography

1) Enable FIPS-compliant mode on Windows: GPO: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > System cryptography: Use FIPS-compliant algorithms = Enabled. NOTE: This can break some applications. Test thoroughly before broad deployment. 2) Verify encryption algorithms in use are FIPS 140-2 validated: AES (128, 192, 256) - FIPS validated. SHA-256, SHA-384, SHA-512 - FIPS validated. RSA 2048+ - FIPS validated. NOT FIPS: DES, 3DES (deprecated), MD5, RC4. 3) BitLocker with TPM: uses FIPS-validated AES. 4) VPN: ensure cipher suite uses AES-256 + SHA-256 (check firewall IPsec/IKE settings).

FIPS Mode GPO Configuration

Screenshot of GPO showing 'Use FIPS-compliant algorithms' = Enabled. Or document explaining why FIPS mode is not enabled with compensating controls.

Encryption Algorithm Inventory

Table listing all encryption in use: BitLocker (AES-256, FIPS), VPN (AES-256, FIPS), TLS (AES-256-GCM, FIPS), backup encryption (AES-256, FIPS). Show FIPS validation status for each.

Prohibit remote activation of collaborative computing devices

1) Webcams: GPO > Computer Configuration > Administrative Templates > Windows Components > Camera > Allow Use of Camera = Disabled (on systems where camera is not needed). Or physical webcam covers on all laptops (provide to all employees). 2) Microphones: default mute state. Only enable during authorized meetings. For conference rooms: physical disconnect switch for mic and camera. 3) Smart speakers (Alexa, Google): prohibited in CUI areas. 4) Conference room systems (Teams Room, Zoom Room): disable always-on listening. Require button press to activate. No auto-answer.

Camera/Microphone Policy and GPO

Screenshot of GPO disabling camera on applicable systems. Photo showing webcam covers deployed on laptops. Conference room device configuration showing no auto-answer.

Control and protect mobile code execution

1) Browser security: deploy Microsoft Edge as managed browser via Intune. Configure via GPO: Computer Configuration > Administrative Templates > Microsoft Edge > Content settings > Default JavaScript setting = Allowed (but block on untrusted sites). Block plugins: Flash = Disabled (EOL). Java applets = Disabled. SmartScreen: Enabled. 2) Macro security: GPO > User Configuration > Administrative Templates > Microsoft Office > Security Settings > VBA Macro Notification Settings = Disable all macros with notification. Block macros from running in Office files from the internet = Enabled. 3) PowerShell: Constrained Language Mode for non-admins. Script execution policy: AllSigned (only signed scripts execute).

Browser Security GPO Settings

Screenshot of Edge GPO showing SmartScreen enabled, plugins disabled, managed browser configuration.

Office Macro Security GPO

Screenshot of GPO showing macro notification settings and 'Block macros from internet' enabled.

Control Voice over IP (VoIP) technology

1) If using on-prem VoIP: place VoIP phones on dedicated voice VLAN. VLAN 70, subnet 10.10.70.0/24. Firewall: voice VLAN only communicates with SIP server and PSTN gateway. No internet access from voice VLAN (unless cloud PBX). 2) If using Microsoft Teams Phone: already encrypted via M365 TLS/SRTP. Verify: Teams admin center > Voice > ensure SRTP is required. 3) Enforce Teams meeting security: lobby enabled, restrict who can present, disable anonymous join for internal meetings. 4) Recording notification: automatic notification when meeting is recorded. 5) Do not discuss CUI in unencrypted phone calls (PSTN landlines). Use Teams or encrypted VoIP for CUI discussions.

VoIP Network Segmentation

If on-prem VoIP: VLAN configuration and firewall rules for voice VLAN. If Teams Phone: screenshot of Teams admin center showing SRTP configuration.

Teams Meeting Security Settings

Teams admin center meeting policies showing lobby, anonymous join, and recording notification settings.

Protect authenticity of communications sessions

1) DNSSEC: enable DNSSEC on public DNS zones (work with registrar/hosting provider). Internal DNS (AD DNS): not DNSSEC by default - compensate with AD-integrated zones (only domain controllers can update). 2) Email authentication: configure SPF, DKIM, and DMARC for company domain: SPF: TXT record 'v=spf1 include:spf.protection.outlook.com -all'. DKIM: enable in M365 > Defender > Email authentication > DKIM. DMARC: TXT record '_dmarc' 'v=DMARC1; p=reject; rua=mailto:dmarc@company.com'. 3) TLS certificates: use trusted CA certificates on all web servers. Verify certificate chain validity. 4) Code signing: sign all internal PowerShell scripts and executables.

Email Authentication Configuration

DNS records showing SPF, DKIM, and DMARC configuration. Use dmarcian.com or mxtoolbox.com to verify all three are properly configured.

TLS Certificate Inventory

List of all TLS certificates in use showing CA, expiration date, key length, and systems where deployed.

Protect CUI at rest with encryption

1) Full-disk encryption: BitLocker on all workstations and servers (see 3.8.6). 2) Database encryption: SQL Server Transparent Data Encryption (TDE): SQL Management Studio > Database > Properties > Options > Encryption = On. Or: CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_256; ALTER DATABASE [CUI_DB] SET ENCRYPTION ON; 3) Cloud storage: SharePoint/OneDrive - encrypted at rest by default (Microsoft-managed keys). For additional control: M365 Customer Key (requires E5). 4) File-level encryption for highly sensitive CUI: Microsoft Purview sensitivity labels with encryption (recipient must authenticate). 5) Backup encryption: see 3.8.6 (Veeam encryption).

Data-at-Rest Encryption Inventory

Table showing all CUI storage locations and encryption method: workstations (BitLocker), servers (BitLocker), database (TDE), cloud (M365 default), backups (Veeam AES-256).

SQL Server TDE Configuration

Run 'SELECT db_name(database_id), encryption_state FROM sys.dm_database_encryption_keys' showing CUI database encrypted.

Identify and remediate system flaws in a timely manner

See 3.7.1 for detailed patching implementation. Additional controls: 1) Patch compliance tracking: Intune > Reports > Windows updates > show devices not yet updated. WSUS > Reports > Update Status Summary. 2) Patch timeline requirements (align with CMMC): Critical/zero-day: 48 hours (emergency patch). High: 14 days. Medium: 30 days. Low: 90 days. 3) Third-party patching: deploy Patch My PC or Ninite Pro integrated with SCCM/Intune. Covers: Chrome, Firefox, Adobe Reader, Java, Zoom, 7-Zip, etc. 4) Application patching: track vendor security advisories for all CUI-scope applications. Subscribe to vendor security mailing lists.

Patch Compliance Report

Current WSUS/Intune patch compliance report showing percentage of systems up to date. Flag any systems overdue with remediation plan.

Patching Procedure and SLAs

Patching procedure document with defined SLAs by severity. Include emergency patching procedure for zero-day vulnerabilities.

Deploy and manage endpoint detection and response (EDR)

Deploy EDR on ALL CUI systems (servers and workstations): Option A - CrowdStrike Falcon: Install Falcon sensor via GPO or SCCM. Falcon console > Sensor Management > verify all CUI systems have sensor installed and connected. Prevention policy: all detections = Kill Process + Quarantine. Option B - SentinelOne: Deploy agent via package. Sentinels > verify coverage. Policy: Detect and Protect (auto-kill, quarantine, rollback). Option C - Defender for Endpoint: Already on Windows 11 Pro/Enterprise. Enable via Intune: Endpoint security > Endpoint detection and response > Create profile > Sample sharing: All, Cloud protection: Enabled. For all: verify daily definition updates. Enable tamper protection (users/malware cannot disable EDR).

Configure real-time scanning and scheduled scans

1) Real-time protection: verify enabled on all endpoints. GPO (for Defender): Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection > Turn on real-time protection = Enabled. 2) Weekly full system scan: Defender: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Scan > Scheduled scan type = Full scan. Scan schedule day = Saturday. Time = 2:00 AM. 3) Scan all removable media on insertion: Scan > Scan removable drives during full scan = Enabled.

EDR Deployment Coverage Report

EDR console showing all CUI systems with agent installed, connected, and up-to-date. Flag any systems without EDR coverage.

EDR Policy Configuration

Screenshot of EDR prevention/protection policy showing: auto-kill, quarantine, tamper protection enabled, real-time protection on.

Malware Detection Report (Last 30 Days)

EDR detection report for past 30 days showing any detections, actions taken (quarantined, killed), and investigation results.

Monitor and act on security alerts and advisories

1) Subscribe to security advisory sources: CISA Alerts: us-cert.cisa.gov/ncas (sign up for email alerts). Microsoft Security Response Center: msrc.microsoft.com. Vendor advisories: for all CUI-scope hardware and software vendors. 2) When advisory received: triage within 24 hours. If applicable to your environment: create vulnerability ticket and track per 3.11.3. If critical: initiate emergency patch process. 3) SIEM alerts: see 3.3.3 for alert review schedule. 4) EDR alerts: investigate immediately for Critical/High. Medium/Low: investigate within 24 hours.

Security Advisory Subscription Verification

Screenshots of CISA alert subscriptions, Microsoft Security bulletin subscription, and vendor advisory subscriptions.

Advisory Triage Records

Records showing recent security advisories received, triage decisions (applicable/not applicable), and actions taken for applicable advisories.

Update malicious code protection mechanisms and definitions

1) Automatic definition updates: GPO (Defender): Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates > Define the number of days before spyware definitions are considered out of date = 1. Check for the latest virus and spyware definitions before running a scheduled scan = Enabled. 2) CrowdStrike/SentinelOne: cloud-based - updates automatically via cloud connection. Verify sensor version is current in EDR console. 3) Monitor for update failures: SIEM alert if any endpoint hasn't updated definitions in >24 hours. 4) Perform definition update verification: Defender: (Get-MpComputerStatus).AntivirusSignatureLastUpdated should be within 24 hours.

Definition Update Status

EDR console or Intune report showing definition/signature update dates for all endpoints. Verify all within 24 hours of current.

Update Policy Configuration

GPO or Intune policy showing automatic definition update configuration. Include alert rule for stale definitions.

Perform periodic and real-time scanning for malicious code

1) Real-time scanning: enabled on all endpoints (see 3.14.2). 2) Scheduled full scan: weekly on all endpoints (see 3.14.2). 3) On-demand scanning: scan all files downloaded from external sources. Windows Defender: right-click > Scan with Microsoft Defender. 4) Email scanning: M365 Safe Attachments scans all inbound email attachments (see 3.13.1). 5) Web traffic scanning: firewall gateway AV scans HTTP/HTTPS downloads. 6) File server scanning: real-time scanning on file servers hosting CUI data.

Real-Time and Scheduled Scan Configuration

GPO showing real-time protection enabled and scheduled scan configuration. EDR console showing real-time protection status across all endpoints.

Scan Completion Report

Recent scheduled scan completion results from sample endpoints showing scan completed successfully and items scanned count.

Monitor organizational systems for unauthorized access and anomalies

1) SIEM monitoring: see 3.3.1 and 3.3.3 for log collection and alert rules. Key detection rules: brute force, lateral movement, privilege escalation, data exfiltration, C2 communication. 2) EDR behavioral detection: CrowdStrike/SentinelOne/Defender detect anomalous behavior (fileless malware, credential dumping, living-off-the-land attacks). Verify behavioral detection is enabled in EDR policy. 3) Entra ID Identity Protection: Entra admin center > Protection > Identity Protection > Risk policies > User risk policy: High risk = Block. Sign-in risk policy: Medium and above = Require MFA. 4) Network anomaly detection: firewall IPS + threat intelligence feeds.

SIEM Detection Rules

Screenshot of SIEM correlation/detection rules covering: brute force, lateral movement, privilege escalation, data exfiltration.

Entra ID Identity Protection Configuration

Screenshot of Entra Identity Protection risk policies showing user risk = Block (High), sign-in risk = Require MFA (Medium+).

Identify unauthorized use of organizational systems

1) Unauthorized device detection: Nessus network scan: compare discovered hosts against asset inventory. Flag any IP addresses not in inventory. If NAC deployed: 802.1X blocks unauthorized devices from network. If no NAC: weekly scan + DHCP lease review. 2) Unauthorized software: Intune > Apps > Discovered apps - compare against approved list. 3) Unauthorized access: review Entra ID > Sign-in logs for unusual activity: off-hours access, impossible travel, unfamiliar locations. 4) Unauthorized admin activity: alert on any use of Domain Admins or T0-Admins accounts outside of change windows. 5) Document all findings as potential security incidents.

Unauthorized Device Detection Scan

Network scan results compared against asset inventory. Show any unauthorized devices discovered and remediation actions taken.

Unauthorized Software Discovery Report

Intune Discovered Apps report highlighting any unapproved software found on managed devices. Include remediation actions.