NIST SP 800-172Ar3 ipd: Assessing Enhanced Security Requirements for Controlled Unclassified Information

Withdrawn Draft Warning Notice The attached draft document has been withdrawn and is provided solely for historical purposes. It has been followed by the document identified below. Withdrawal Date May 13, 2026 Original Release Date September 29, 2025

The attached draft document is followed by: Stage Final Series/Number NIST SP 800-172Ar3 Title Assessing Enhanced Security Requirements for Controlled Unclassified Information Publication Date May 2026 DOI https://doi.org/10.6028/NIST.SP.800-172Ar3 CSRC URL https://csrc.nist.gov/pubs/sp/800/172/a/r3/final Additional Information

NIST Special Publication 800 NIST SP 800-172Ar3 ipd

Assessing Enhanced Security Requirements for Controlled Unclassified Information Initial Public Draft Ron Ross Victoria Pillitteri

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172Ar3.ipd

NIST Special Publication 800 NIST SP 800-172Ar3 ipd

Assessing Enhanced Security Requirements for Controlled Unclassified Information Initial Public Draft Ron Ross Victoria Pillitteri

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-172Ar3.ipd

September 2025

U.S. Department of Commerce Howard Lutnick, Secretary National Institute of Standards and Technology Craig Burkhardt, Acting Under Secretary of Commerce for Standards and Technology and Acting NIST Director

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283 [1]. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130 [2]. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax How to Cite this NIST Technical Series Publication: Ross R, Pillitteri V (2025) Assessing Enhanced Security Requirements for Controlled Unclassified Information. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800172Ar3 ipd. https://doi.org/10.6028/NIST.SP.800-172Ar3.ipd Author ORCID iDs Ron Ross: 0000-0002-1099-9757 Victoria Pillitteri: 0000-0002-7446-7506

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

Public Comment Period September 29, 2025 – November 14, 2025 January 16, 2026 Submit Comments 800-171comments@list.nist.gov National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 All comments submitted during the public comment period will be posted to the NIST Protecting Controlled Unclassified Information Project page. with contact information redacted. All technical content will be posted as submitted, so commenters should not include information they do not wish to be posted (e.g., personal or business information). Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/172/A/r3/ipd, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1

Abstract

2 3 4 5 6 7 8 9 10 11 12

The protection of controlled unclassified information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication provides federal agencies with assessment procedures for the security requirements in NIST SP 800-172. The assessment procedures are flexible and can be tailored to the needs of federal agencies and assessors. Security requirement assessments can be conducted as (1) self-assessments; (2) independent, third-party assessments; or (3) government-sponsored assessments. The assessments can be conducted with varying degrees of rigor based on federal agency-defined depth and coverage attributes. The findings and evidence produced during the assessments can be used to facilitate risk-based decisions by organizations related to the security requirements.

13

Keywords

14 15 16

assessment; assessment procedure; assurance; enhanced security requirement; enhanced security requirement assessment; controlled unclassified information; Executive Order 13556; nonfederal organization; nonfederal system; security assessment.

17

Reports on Computer Systems Technology

18 19 20 21 22 23 24 25 26 27

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

i

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

28

Audience

29 30

This publication serves a diverse group of individuals and organizations in the public and private sectors, including individuals with:

31 32 33

•

System development life cycle responsibilities (e.g., program managers, mission/business owners, information owners/stewards, system designers and developers, system/security engineers, systems integrators)

34

•

Acquisition or procurement responsibilities (e.g., contracting officers)

35 36 37

•

System, security, or risk management and oversight responsibilities (e.g., authorizing officials, chief information officers, chief information security officers, system owners, information security managers)

38 39

•

Security assessment and monitoring responsibilities (e.g., auditors, system evaluators, assessors, independent verifiers/validators, analysts)

40

The above roles and responsibilities can be viewed from two perspectives:

41 42

•

Federal perspective: The entity establishing and conveying security assessment requirements in contractual vehicles or other types of agreements

43 44

•

Nonfederal perspective: The entity responding to and complying with the security assessment requirements set forth in contracts or agreements

ii

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

45

Note to Reviewers

46 47

The following significant changes have been made in the initial public draft (ipd) of SP 800172Ar3 (Revision 3):

48

•

The restructuring of the assessment procedure syntax to align with SP 800-53A [5]

49 50

•

The addition of assessment procedures for the new and revised enhanced security requirements in draft SP 800-172r3 [3]

51 52

•

The addition of a references section to provide source assessment procedures from SP 800-53A [5]

53 54

•

A one-time change to the publication version number to align with SP 800-172, Revision 3 [3]

55 56

NIST is specifically interested in comments, feedback, and recommendations on the following topics:

57

•

The alignment of the assessment procedures to SP 800-53A [5]

58 59

•

The ease-of-use of the assessment procedures in conducting assessments of the CUI enhanced security requirements

60

•

The usefulness of the information in supplementary Appendices C, D, and E

61 62 63 64

Reviewers are encouraged to comment on all or parts of SP 800-172Ar3 ipd. NIST requests that all comments be submitted to 800-171comments@list.nist.gov by 11:59 p.m. Eastern Standard Time (EST) on November 14, 2025. Commenters are encouraged to use the comment template provided with the document announcement.

65 66 67

Comments received in response to this request will be posted on the Protecting CUI project site after the due date. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed.

iii

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

68

Call for Patent Claims

69 70 71 72 73 74 75

This public review includes a call for information on essential patent claims (claims whose use would be required for compliance with the guidance or requirements in this Information Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be directly stated in this ITL Publication or by reference to another publication. This call also includes disclosure, where known, of the existence of pending U.S. or foreign patent applications relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents.

76 77

ITL may require from the patent holder, or a party authorized to make assurances on its behalf, in written or electronic form, either:

78 79

a) assurance in the form of a general disclaimer to the effect that such party does not hold and does not currently intend holding any essential patent claim(s); or

80 81 82

b) assurance that a license to such essential patent claim(s) will be made available to applicants desiring to utilize the license for the purpose of complying with the guidance or requirements in this ITL draft publication either:

83 84

i.

under reasonable terms and conditions that are demonstrably free of any unfair discrimination; or

85 86

ii.

without compensation and under reasonable terms and conditions that are demonstrably free of any unfair discrimination.

87 88 89 90 91

Such assurance shall indicate that the patent holder (or third party authorized to make assurances on its behalf) will include in any documents transferring ownership of patents subject to the assurance, provisions sufficient to ensure that the commitments in the assurance are binding on the transferee, and that the transferee will similarly include appropriate provisions in the event of future transfers with the goal of binding each successor-in-interest.

92 93

The assurance shall also indicate that it is intended to be binding on successors-in-interest regardless of whether such provisions are included in the relevant transfer documents.

94

Such statements should be addressed to: 800-171comments@list.nist.gov

iv

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

95

Table of Contents

96

1. Introduction ...................................................................................................................................1

97 98 99

2. The Fundamentals ..........................................................................................................................3

100 101 102

3. The Procedures ..............................................................................................................................7

103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120

References.......................................................................................................................................92

121

Appendix A. Acronyms .....................................................................................................................93

122

Appendix B. Glossary .......................................................................................................................94

123

Appendix C. Summary of Enhanced Security Requirements ...............................................................96

124

Appendix D. Security Requirement Assessments ............................................................................. 100

125

Appendix E. Organization-Defined Parameters ............................................................................... 104

126

Appendix F. Change Log ................................................................................................................. 112

v

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

127

List of Tables

128

Table 1. Enhanced security requirement families ................................................................................3

129

Table 2. Enhanced security requirements..........................................................................................96

130

Table 3. Summary of assessment preparation phase ....................................................................... 101

131

Table 4. Summary of assessment plan development phase ............................................................. 102

132

Table 5. Summary of assessment execution phase .......................................................................... 103

133

Table 6. Summary of assessment analysis, documentation, and reporting phase ............................. 103

134

Table 7. Organization-defined parameters ...................................................................................... 104

135

vi

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

136

Acknowledgments

137 138 139 140 141 142

The authors gratefully acknowledge and appreciate the contributions from individuals and organizations in the public and private sectors whose constructive comments improved the overall quality, thoroughness, and usefulness of this publication. The authors also wish to thank the NIST technical editing and production staff — Jim Foti, Jeff Brewer, Eduardo Takamura, Jeremy Licata, Isabel Van Wyk, and Cristina Ritfeld — for their outstanding support in preparing this document for publication.

vii

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

143

1. Introduction

144 145

The security assessment process gathers information and produces evidence to determine the effectiveness of security requirements by:

146

•

Identifying potential problems or shortfalls in security and risk management programs

147 148

•

Identifying security weaknesses and deficiencies in systems and the environments in which those systems operate

149

•

Prioritizing risk mitigation decisions and activities

150 151

•

Confirming that identified security weaknesses and deficiencies in the system and environment of operation have been addressed

152 153

•

Supporting continuous monitoring activities and providing information security situational awareness

154

1.1. Purpose and Applicability

155 156 157 158 159 160 161 162 163

The purpose of this publication is to provide procedures for assessing the security requirements in NIST Special Publication (SP) 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information [3]. Organizations can use the assessment procedures to generate evidence that the security requirements have been satisfied. The scope of the security assessments conducted using the procedures described in this publication is guided and informed by the system security plans for systems that process, store, or transmit CUI. The assessment procedures offer the flexibility to customize assessments based on organizational policies and requirements, known threat and vulnerability information, system and platform dependencies, operational considerations, and tolerance for risk. 1

164

1.2. Organization of This Publication

165

The remainder of this special publication is organized as follows:

166 167 168 169 170

•

Section 2 describes the fundamental concepts associated with assessments of security requirements, including assessment procedures, methods, objects, and assurance cases that can be created using the evidence produced during assessments. This section mirrors the material included SP 800-171A, Sec. 2, with minor updates to reflect the enhanced security requirements and assessment procedures.

171 172 173

•

Section 3 provides assessment procedures for the security requirements in SP 800-172 [3], including assessment objectives and potential assessment methods and objects for each procedure.

174 1 The term risk refers to risks to organizational operations (i.e., mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation. See SP 800-39 [4] for additional information on organizational risk management and risk tolerance.

1

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

175 176

Assessing Enhanced Security Requirements for CUI

The following sections provide additional information to support the assessment of security requirements for the protection of CUI:

177

•

References

178

•

Appendix A: Acronyms

179

•

Appendix B: Glossary

180

•

Appendix C: Summary of Enhanced Security Requirements

181

•

Appendix D: Security Requirement Assessments

182

•

Appendix E: Organization-Defined Parameters

183

•

Appendix F: Change Log

184

The contents of this publication can be used for many different assessment-related purposes to determine organizational compliance with the security requirements. The broad range of potential assessment methods and objects listed in this publication does not necessarily reflect and should not be directly associated with actual compliance or noncompliance. Rather, the selection of specific potential assessment methods and objects from the list provided can help generate a picture of overall compliance with the security requirements. There is no expectation about the number of methods or objects needed to determine compliance with the security requirements. Moreover, the entire list of potential assessment objects should not be viewed as required artifacts needed to determine compliance. Organizations have the flexibility to determine the specific methods and objects that provide sufficient evidence to support claims of compliance.

2

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

185

2. The Fundamentals

186 187 188 189 190 191

The process used by organizations and assessors to assess the security requirements in SP 800172 [3] includes (1) preparing for the assessment, (2) developing a security assessment plan, (3) conducting the assessment, and (4) documenting, analyzing, and reporting the assessment results. The remainder of this section describes the structure and content of the procedures used to assess the security requirements and the importance of assurance cases in providing the evidence necessary to determine compliance with the requirements.

192

2.1. Assessment Procedures

193 194

The enhanced security requirements in SP 800-172 [3] are organized into 17 families, as illustrated in Table 1.

195

Table 1. Enhanced security requirement families Access Control

Maintenance

Security Assessment and Monitoring

Awareness and Training

Media Protection

System and Communications Protection

Audit and Accountability

Personnel Security

System and Information Integrity

Configuration Management

Physical Protection

Planning

Identification and Authentication

Risk Assessment

System and Services Acquisition

Incident Response

Supply Chain Risk Management

196 197 198

The assessment procedures in Sec. 3 are grouped by similar family designations to ensure the completeness and consistency of assessments. The procedures have been derived from and are sourced to the assessment procedures in SP 800-53A [5].

199 200 201 202 203 204 205

An assessment procedure consists of an assessment objective and a set of potential assessment methods and objects that can be used to conduct the assessment. Each potential assessment objective includes a determination statement related to the security requirement. If there is an organization-defined parameter (ODP) in the security requirement, then the assessment objective begins with a determination statement related to the definition of the ODP. The determination statements are linked to the content of the security requirements to help ensure traceability of the assessment results to the requirements.

206 207 208 209 210 211

Assessment objects identify the specific items being assessed and can include specifications, mechanisms, activities, and individuals. Specifications are the documented artifacts 2 (e.g., plans, policies, procedures, requirements, functional and assurance specifications, design documentation, architectures) associated with a system. Mechanisms are the hardware, software, and firmware safeguards implemented within a system. Activities are the protectionrelated actions supporting a system that involve people (e.g., conducting system backup

2 Artifacts may be in formats other than documents (e.g., databases; Governance, Risk, and Compliance [GRC] tools; Open Security Controls

Assessment Language [OSCAL]).

3

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

212 213

operations, exercising an incident response plan, monitoring network traffic). Individuals are the people applying the specifications, mechanisms, or activities described above.

214 215 216 217 218 219 220 221 222 223

Assessment methods define the nature and extent of the assessor’s actions and are used to facilitate understanding, achieve clarification, or obtain evidence. The assessment methods include examine, interview, and test. The examine method is the process of reviewing, studying, inspecting, or analyzing assessment objects. The interview method is the process of holding discussions with individuals or groups about assessment objects. The test method is the process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior. Assessment methods include attributes of depth and coverage, which define the rigor, scope, and level of effort for the assessment as well as the degree of assurance that the security requirements have been satisfied. See SP 800-53A, Appendix D [5].

224

The structure and content of an assessment procedure are provided in the example below.

225

03.01.01E Dual Authorization

Security Requirement Name

226

ASSESSMENT OBJECTIVE

227

Determine if:

228 229

A.03.01.01E.ODP[01]: privileged commands and/or other actions requiring dual authorization are defined.

230 231

A.03.01.01E: dual authorization is enforced for <A.03.01.01E.ODP[01]: privileged commands and/or other actions>.

232

POTENTIAL ASSESSMENT METHODS AND OBJECTS

233

Examine

234 235 236 237 238

[SELECT FROM: Access control policy; procedures addressing access enforcement and dual authorization; system design documentation; system configuration settings and associated documentation; list of actions requiring dual authorization; list of privileged commands requiring dual authorization; list of approved authorizations (user privileges); system security plan; other relevant documents or records].

239 240 241

Interview [SELECT FROM: Personnel with access enforcement responsibilities; system/network administrators; system personnel with information security responsibilities].

242

Test

243

[SELECT FROM: Dual authorization mechanisms implementing access control policy].

244

REFERENCES

245

Source Assessment Procedures: AC-03(02)

Determination Statement for Security Requirement

4

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

246 247 248 249 250 251 252 253 254

Determination statements have alphanumeric identifiers. Each determination statement begins with the letter “A” to indicate that it is part of an assessment procedure. The next sequence of numbers followed by the letter “E” indicates the enhanced security requirement identifier from SP 800-172 [3] (and the specific control item if it is a multi-part requirement) that is the target of the assessment. Organization-defined parameters are indicated by the letters “ODP.” If there are multiple ODPs in the determination statement, the ODP number is indicated in a square bracket (e.g., A.03.01.04E.ODP[01]). Square brackets are also used to denote when an assessment procedure further decomposes a requirement into more granular determination statements (e.g., A.03.10.03E.a[01], A.03.10.03E.a[02], A.03.10.03E.a[03], A.03.10.03E.a[04]).

255 256 257 258 259 260 261 262

The application of an assessment procedure to a security requirement produces assessment results or findings. The findings are compiled and used as evidence to determine whether the security requirement has been satisfied or other than satisfied. A finding of satisfied indicates that the assessment objective has been met, producing a fully acceptable result. A finding of other than satisfied indicates that there are potential anomalies that may need to be addressed by the organization. A finding of other than satisfied may also indicate that the assessor was unable to obtain sufficient information to make the specific determination called for in the determination statement.

263

2.2. Assurance Cases

264 265 266 267 268 269 270 271 272 273 274

Building an effective assurance case to determine compliance with security requirements involves compiling evidence from a variety of sources and conducting different types of activities during an assessment. An assurance case is a body of evidence organized into an argument demonstrating that some claim about a system is true. For security assessments conducted using the procedures in this publication, that claim is “compliance” with the security requirements in SP 800-172 [3]. Assessors obtain evidence during security assessments to allow designated officials3 to make objective determinations about compliance with the security requirements. The evidence needed to make such determinations can be obtained from various sources, including independent, third-party assessments or other types of assessments, depending on the needs of the organization establishing the requirements and the organization conducting the assessments.

275 276 277 278 279 280 281

For example, many technical security requirements are satisfied by security capabilities that are built into commercial information technology products and systems. Product assessments are typically conducted by independent, third-party testing organizations.4 These assessments examine the security functions of products and established configuration settings. Assessments can also be conducted to demonstrate compliance with industry, national, or international security standards as well as developer and vendor claims. Since many information technology products are assessed by commercial testing organizations and then subsequently deployed in A designated official is either internal or external to a nonfederal organization and has the responsibility to determine organizational compliance with the security requirements. 4 Examples of third-party testing organizations include Common Criteria Testing Laboratories that evaluate IT products in accordance with ISO/IEC 15408 [6] and Cryptographic Module Validation Program Testing Laboratories that evaluate cryptographic modules in accordance with Federal Information Processing Standards (FIPS) 140 [7]. 3

5

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

282 283

hundreds of thousands of systems, these types of assessments can be carried out at a greater level of depth and provide deeper insights into the security capabilities of the products.

284 285 286 287 288 289

The evidence needed to determine compliance with the security requirements is obtained by assessing the implementation of the safeguards and countermeasures selected to satisfy the requirements. Assessors can build on previously developed materials that started with the specification of the information security needs of the organization and were further improved during the design, development, and implementation of the system. These materials provide the initial evidence for an assurance case.

290 291 292 293 294 295 296 297 298

Assessments can be conducted by system developers, system integrators, auditors, system owners, or the security staffs of organizations. The assessors or assessment teams bring available information about the system together, such as the results of component product assessments. The assessors can conduct additional system-level assessments using the assessment methods and procedures contained in this publication and the implementation information provided by the nonfederal organization in its system security plan. Assessments can be used to compile and evaluate the evidence needed by organizations to help determine the effectiveness of the safeguards implemented to protect CUI, the actions needed to mitigate security risks to the organization, and compliance with the security requirements. The assessment procedures in this publication are based on and sourced to the assessment procedures in SP 800-53A [5]. For additional information and guidance on preparing for security assessments, developing assessment plans, conducting assessments, and analyzing assessment report results, consult SP 800-53A [5].

299

6

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

300

3. The Procedures

301 302 303 304 305 306

This section provides assessment procedures for the security requirements defined in SP 800172 [3]. Organizations that conduct security requirement assessments can develop their security assessment plans by using the information provided in the assessment procedures and selecting the specific POTENTIAL ASSESSMENT METHODS AND OBJECTS that meet the organization’s needs. Organizations also have flexibility in defining the level of rigor and detail associated with the assessment based on the assurance requirements of the organization.

307

3.1. Access Control

308

03.01.01E Dual Authorization

309

ASSESSMENT OBJECTIVE

310

Determine if:

311 312

A.03.01.01E.ODP[01]: privileged commands and/or other actions requiring dual authorization are defined.

313 314

A.03.01.01E: dual authorization is enforced for <A.03.01.01E.ODP[01]: privileged commands and/or other actions>.

315

POTENTIAL ASSESSMENT METHODS AND OBJECTS

316

Examine

317 318 319 320 321

[SELECT FROM: Access control policy; procedures addressing access enforcement and dual authorization; system design documentation; system configuration settings and associated documentation; list of actions requiring dual authorization; list of privileged commands requiring dual authorization; list of approved authorizations (user privileges); system security plan; other relevant documents or records].

322

Interview

323 324 325

[SELECT FROM: Personnel with access enforcement responsibilities; system/network administrators; system developers; personnel with information security responsibilities].

326

Test

327

[SELECT FROM: Dual authorization mechanisms implementing access control policy].

328

REFERENCES

329

Source Assessment Procedures: AC-03(02)

7

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

330

Assessing Enhanced Security Requirements for CUI

03.01.02E Non-Organizationally Owned Systems - Restricted Use

331

ASSESSMENT OBJECTIVE

332

Determine if:

333 334

A.03.01.02E.ODP[01]: restrictions on the use of non-organizationally owned systems or system components to process, store, or transmit CUI are defined.

335 336 337

A.03.01.02E: the use of non-organizationally owned systems or system components to process, store, or transmit CUI is restricted using <A.03.01.02E.ODP[01]: restrictions>.

338

POTENTIAL ASSESSMENT METHODS AND OBJECTS

339

Examine

340 341 342 343 344

[SELECT FROM: Access control policy; procedures addressing the use of external systems; system design documentation; system configuration settings and associated documentation; system connection or processing agreements; account management documents; system audit records; other relevant documents or records].

345

Interview

346 347 348 349

[SELECT FROM: Personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices; system/network administrators; personnel with information security responsibilities].

350

Test

351 352

[SELECT FROM: Mechanisms implementing restrictions on the use of nonorganizationally owned systems, components, or devices].

353

REFERENCES

354

Source Assessment Procedures: AC-20(03)

355 356 357

03.01.03E Withdrawn Addressed by 03.01.09E, 03.01.10E, and 03.01.03. 03.01.04E Concurrent Session Control

358

ASSESSMENT OBJECTIVE

359

Determine if:

360 361

A.03.01.04E.ODP[01]: accounts and/or account types for which to limit the number of concurrent sessions is defined.

8

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

362 363

A.03.01.04E.ODP[02]: the number of concurrent sessions to be allowed for each account and/or account type is defined.

364 365

A.03.01.04E: the number of concurrent sessions for each <A.03.01.04E.ODP[01]: account and/or account types> is limited to <A.03.01.04E.ODP[02]: number>.

366

POTENTIAL ASSESSMENT METHODS AND OBJECTS

367

Examine

368 369 370 371

[SELECT FROM: Access control policy; procedures addressing concurrent session control; system design documentation; system configuration settings and associated documentation; security plan; system security plan; other relevant documents or records].

372

Interview

373 374

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

375

Test

376 377

[SELECT FROM: Mechanisms implementing access control policy for concurrent session control].

378

REFERENCES

379

Source Assessment Procedures: AC-10

380

03.01.05E Remote Access Monitoring and Control

381

ASSESSMENT OBJECTIVE

382

Determine if:

383 384

A.03.01.05E[01]: automated mechanisms are employed to monitor remote access methods.

385 386

A.03.01.05E[02]: automated mechanisms are employed to control remote access methods.

387

POTENTIAL ASSESSMENT METHODS AND OBJECTS

388

Examine

389 390 391 392

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system design documentation; system configuration settings and associated documentation; system audit records; system monitoring records; system security plan; other relevant documents or records].

9

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

393

Interview

394 395

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

396

Test

397 398

[SELECT FROM: Automated mechanisms monitoring and controlling remote access methods].

399

REFERENCES

400

Source Assessment Procedures: AC-17(01)

401

03.01.06E Protection of Remote Access Mechanism Information

402

ASSESSMENT OBJECTIVE

403

Determine if:

404 405

A.03.01.06E: information about remote access mechanisms is protected from unauthorized use and disclosure.

406

POTENTIAL ASSESSMENT METHODS AND OBJECTS

407

Examine

408 409

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system security plan; other relevant documents or records].

410

Interview

411 412 413

[SELECT FROM: Personnel with responsibilities for implementing or monitoring remote access to the system; system users with knowledge of information about remote access mechanisms; personnel with information security responsibilities].

414

REFERENCES

415

Source Assessment Procedures: AC-17(06)

416

03.01.07E Automated Audit Actions for Account Management

417

ASSESSMENT OBJECTIVE

418

Determine if:

419

A.03.01.07E[01]: automated mechanisms are used to audit account creation actions.

420 421

A.03.01.07E[02]: automated mechanisms are used to audit account modification actions.

422 423

A.03.01.07E[03]: automated mechanisms are used to audit account enabling actions.

10

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

424 425

A.03.01.07E[04]: automated mechanisms are used to audit account disabling actions.

426

A.03.01.07E[05]: automated mechanisms are used to audit account removal actions.

427

POTENTIAL ASSESSMENT METHODS AND OBJECTS

428

Examine

429 430 431 432 433

[SELECT FROM: Access control policy; procedures addressing account management; system design documentation; system configuration settings and associated documentation; notifications or alerts of account creation, modification, enabling, disabling, and removal actions; system audit records; system security plan; other relevant documents or records].

434

Interview

435 436 437

[SELECT FROM: Personnel with account management responsibilities; system/network administrators; personnel with information security responsibilities].

438

Test

439 440

[SELECT FROM: Automated mechanisms implementing account management functions].

441

REFERENCES

442

Source Assessment Procedures: AC-02(04)

443

03.01.08E Account Monitoring for Atypical Usage

444

ASSESSMENT OBJECTIVE

445

Determine if:

446 447

A.03.01.08E.ODP[01]: atypical usage for which to monitor system accounts is defined.

448

A.03.01.08E.ODP[02]: personnel or roles to report atypical usage are defined.

449 450

A.03.01.08E.a: system accounts are monitored for <A.03.01.08E.ODP[01]: atypical usage>.

451 452

A.03.01.08E.b: atypical usage of system accounts is reported to <A.03.01.08E.ODP[02]: personnel or roles>.

453

POTENTIAL ASSESSMENT METHODS AND OBJECTS

454

Examine

455 456

[SELECT FROM: Access control policy; procedures addressing account management; system design documentation; system configuration settings and associated

11

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

457 458

documentation; system monitoring records; system audit records; audit tracking and monitoring reports; system security plan; other relevant documents or records].

459

Interview

460 461 462

[SELECT FROM: Personnel with account management responsibilities; system/network administrators; personnel with information security responsibilities].

463

Test

464

[SELECT FROM: Mechanisms implementing account management functions].

465

REFERENCES

466

Source Assessment Procedure: AC-02(12)

467

03.01.09E Attribute-Based Access Control

468

ASSESSMENT OBJECTIVE

469

Determine if:

470

A.03.01.09E.ODP[01]: attributes to assume access permissions are defined.

471 472

A.03.01.09E.a[01]: the attribute-based access control policy is enforced over defined subjects.

473 474

A.03.01.09E.a[02]: the attribute-based access control policy is enforced over defined objects.

475

A.03.01.09E.b: access is controlled based upon <A.03.01.09E.ODP[01]: attributes>.

476

POTENTIAL ASSESSMENT METHODS AND OBJECTS

477

Examine

478 479 480 481 482

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies; system audit records; system security plan; other relevant documents or records].

483

Interview

484 485

[SELECT FROM: Personnel with access enforcement responsibilities; system/network administrators; personnel with information security responsibilities].

486

Test

487

[SELECT FROM: Mechanisms implementing access enforcement functions].

488

REFERENCES

12

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

489

Assessing Enhanced Security Requirements for CUI

Source Assessment Procedures: AC-03(13)

490

03.01.10E Object Security Attributes

491

ASSESSMENT OBJECTIVE

492

Determine if:

493 494

A.03.01.10E.ODP[01]: security attributes to be associated with information, source, and destination objects are defined.

495 496

A.03.01.10E.ODP[02]: information objects to be associated with information security attributes are defined.

497 498

A.03.01.10E.ODP[03]: source objects to be associated with information security attributes are defined.

499 500

A.03.01.10E.ODP[04]: destination objects to be associated with information security attributes are defined.

501 502

A.03.01.10E.ODP[05]: information flow control policies as a basis for the enforcement of flow control decisions are defined.

503 504 505 506 507

A.03.01.10E: <A.03.01.10E.ODP[01]: security attributes> associated with <A.03.01.10E.ODP[02]: information objects>, <A.03.01.10E.ODP[03]: source objects>, and <A.03.01.10E.ODP[04]: destination objects> are used to enforce <A.03.01.10E.ODP[05]: information flow control policies> as a basis for flow control decisions.

508

POTENTIAL ASSESSMENT METHODS AND OBJECTS

509

Examine

510 511 512 513 514

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of security attributes and associated source and destination objects; system audit records; system security plan; other relevant documents or records].

515

Interview

516 517

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

518

Test

519

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

520

REFERENCES

521

Source Assessment Procedure: AC-04(01)

13

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

522

Assessing Enhanced Security Requirements for CUI

03.01.11E Role-Based Access Control

523

ASSESSMENT OBJECTIVE

524

Determine if:

525

A.03.01.11E.ODP[01]: roles and users authorized to assume such roles are defined.

526 527

A.03.01.11E.a: a role-based access control policy over defined subjects and objects is enforced.

528 529

A.03.01.11E.b: access is controlled based upon <A.03.01.11E.ODP[01] roles and authorized users>.

530

POTENTIAL ASSESSMENT METHODS AND OBJECTS

531

Examine

532 533 534 535 536

[SELECT FROM: Access control policy; role-based access control policies; procedures addressing access enforcement; system design documentation; system configuration settings and associated documentation; list of roles, users, and associated privileges required to control system access; system audit records; system security plan; other relevant documents or records].

537

Interview

538 539 540

[SELECT FROM: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

541

Test

542

[SELECT FROM: Mechanisms implementing role-based access control policy].

543

REFERENCES

544

Source Assessment Procedure: AC-03(07)

545

03.01.12E Physical or Logical Separation of CUI Flows

546

ASSESSMENT OBJECTIVE

547

Determine if:

548 549

A.03.01.12E.ODP[01]: mechanisms and/or techniques to separate CUI flows are defined.

550 551

A.03.01.12E: CUI flows are logically or physically separated using <A.03.01.12E.ODP[01] mechanisms and/or techniques>.

552

POTENTIAL ASSESSMENT METHODS AND OBJECTS

553

Examine

554

[SELECT FROM: Information flow enforcement policy; information flow control 14

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

555 556 557 558 559

policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of required separation of information flows by information types; list of mechanisms and/or techniques used to logically or physically separate information flows; system audit records; system security plan; other relevant documents or records].

560

Interview

561 562 563

[SELECT FROM: Organizational personnel with information flow enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

564

Test

565 566

[SELECT FROM: Mechanisms implementing information flow enforcement functions].

567

REFERENCES

568

Source Assessment Procedure: AC-04(21)

569

03.01.13E Metadata

570

ASSESSMENT OBJECTIVE

571

Determine if:

572 573

A.03.01.13E.ODP[01]: metadata on which to base enforcement of information flow control is defined.

574 575

A.03.01.13E: information flow control based on <A.03.01.13E.ODP[01]: metadata> is enforced.

576

POTENTIAL ASSESSMENT METHODS AND OBJECTS

577

Examine

578 579 580 581

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

582

Interview

583 584

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

585

Test

586

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

587

REFERENCES

588

Source Assessment Procedure: AC-04(06)

15

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

589

Assessing Enhanced Security Requirements for CUI

03.01.14E Security Policy Filters

590

ASSESSMENT OBJECTIVE

591

Determine if:

592

A.03.01.14E.ODP[01]: security policy filters are defined.

593

A.03.01.14E.ODP[02]: information flows are defined.

594 595 596

A.03.01.14E.ODP[03]: one or more of the following PARAMETER VALUES is/are selected: {Block; Strip; Modify; Quarantine} in response to a filter processing failure.

597 598

A.03.01.14E.ODP[04]: security policy addressing a filter processing failure is defined.

599 600 601

A.03.01.14E.a: information flow control is enforced using <A.03.01.14E.ODP[01] security policy filters> as a basis for flow control decisions for <A.03.01.14E.ODP[02] information flows>.

602 603

A.03.01.14E.b: <A.03.01.14E.ODP[03]: SELECTED PARAMETER VALUE(S)> data after a filter processing failure in accordance with <A.03.01.14E.ODP[04] security policy>.

604

POTENTIAL ASSESSMENT METHODS AND OBJECTS

605

Examine

606 607 608 609 610

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of security policy filters regulating flow control decisions; system audit records; system security plan; other relevant documents or records].

611

Interview

612 613

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

614

Test

615 616

[SELECT FROM: Mechanisms implementing information flow enforcement policy; security policy filters].

617

REFERENCES

618

Source Assessment Procedure: AC-04(08)

619

03.01.15E Data Type Identifiers

620

ASSESSMENT OBJECTIVE

621

Determine if:

622

A.03.01.15E.ODP[01]: data type identifiers are defined. 16

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

623 624 625

A.03.01.15E: when transferring information between security domains, <A.03.01.15E.ODP[01]: data type identifiers> are used to validate data that is essential for information flow decisions.

626

POTENTIAL ASSESSMENT METHODS AND OBJECTS

627

Examine

628 629 630 631

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of data type identifiers; system audit records; system security plan; other relevant documents or records].

632

Interview

633 634

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developers].

635

Test

636

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

637

REFERENCES

638

Source Assessment Procedure: AC-04(12)

639

03.01.16E Decomposition Into Policy-Relevant Subcomponents

640

ASSESSMENT OBJECTIVE

641

Determine if:

642 643

A.03.01.16E.ODP[01]: policy-relevant subcomponents into which to decompose CUI for submission to policy enforcement mechanisms are defined.

644 645 646

A.03.01.16E: when transferring information between different security domains, CUI is decomposed into <A.03.01.16E.ODP[01]: policy-relevant subcomponents> for submission to policy enforcement mechanisms

647

POTENTIAL ASSESSMENT METHODS AND OBJECTS

648

Examine

649 650 651 652

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

653

Interview

654 655

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

656

Test

17

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

657

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

658

REFERENCES

659

Source Assessment Procedure: AC-04(13)

660

03.01.17E Detection of Unsanctioned CUI

661

ASSESSMENT OBJECTIVE

662

Determine if:

663

A.03.01.17E.ODP[01]: unsanctioned CUI to be detected is defined.

664 665

A.03.01.17E.ODP[02]: a security policy that prohibits the transfer of unsanctioned information is defined.

666 667 668

A.03.01.17E.a: when transferring information between different security domains, information is examined for the presence of <A.03.01.17E.ODP[01] unsanctioned information>.

669 670

A.03.01.17E.b: the transfer of CUI defined in 03.01.17E.a is prohibited in accordance with <A.03.01.17E.ODP[02] security policy>.

671

POTENTIAL ASSESSMENT METHODS AND OBJECTS

672

Examine

673 674 675 676 677

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of unsanctioned information types and associated information; system audit records; system security plan; other relevant documents or records].

678

Interview

679 680

[SELECT FROM: Organizational personnel with information security responsibilities; system developers].

681

Test

682

[SELECT FROM: Mechanisms implementing information flow enforcement policy].

683

REFERENCES

684

Source Assessment Procedure: AC-04(15)

685

3.2. Awareness and Training

686

03.02.01E Advanced Literacy and Awareness Training

687

ASSESSMENT OBJECTIVE

18

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

688

Determine if:

689

A.03.02.01E.ODP[01]: indicators of malicious code are defined.

690 691

A.03.02.01E.ODP[02]: the frequency at which to update security literacy training content is defined.

692 693

A.03.02.01E.ODP[03]: events which cause security literacy training content to be updated are defined.

694 695

A.03.02.01E.a.01: security literacy training on the advanced persistent threat is provided.

696 697 698

A.03.02.01E.a.02: security literacy training on recognizing suspicious communications and anomalous behavior in systems using <A.03.02.01E.ODP[01]: indicators of malicious code> is provided.

699 700

A.03.02.01E.a.03: security literacy training on the cyber threat environment is provided.

701 702

A.03.02.01E.b: security literacy training content is updated <A.03.02.01E.ODP[02]: frequency> and following <A.03.02.01E.ODP[03]: events>.

703

POTENTIAL ASSESSMENT METHODS AND OBJECTS

704

Examine

705 706 707 708

[SELECT FROM: System security plan; security literacy and awareness training policy; procedures addressing security literacy and awareness training implementation; security literacy and awareness training curriculum; security literacy and awareness training materials; other relevant documents or records].

709

Interview

710 711 712

[SELECT FROM: Personnel who receive security literacy and awareness training; personnel with responsibilities for security literacy and awareness training; personnel with information security responsibilities].

713

REFERENCES

714

Source Assessment Procedures: AT-02(04), AT-02(05), AT-02(06)

715

03.02.02E Literacy and Awareness Training Practical Exercises

716

ASSESSMENT OBJECTIVE

717

Determine if:

718 719

A.03.02.02E: practical exercises in literacy training that simulate events and incidents are provided.

720

POTENTIAL ASSESSMENT METHODS AND OBJECTS

19

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

721

Examine

722 723 724 725

[SELECT FROM: System security plan; security literacy and awareness training policy; procedures addressing security literacy and awareness training implementation; security awareness training curriculum; security awareness training materials; other relevant documents or records].

726

Interview

727 728 729

[SELECT FROM: Personnel who receive security literacy and awareness training; personnel with responsibilities for security awareness training; personnel with information security responsibilities].

730

Test

731 732

[SELECT FROM: Mechanisms implementing cyber-attack simulations in practical exercises].

733

REFERENCES

734

Source Assessment Procedures: AT-02(01)

735

03.02.03E Literacy and Awareness Training Feedback

736

ASSESSMENT OBJECTIVE

737

Determine if:

738 739

A.03.02.03E.ODP[01]: personnel to whom feedback on organizational training results will be provided are assigned.

740 741

A.03.02.03E: feedback on organizational training results is provided to <A.03.02.03E.ODP[01]: personnel>.

742

POTENTIAL ASSESSMENT METHODS AND OBJECTS

743

Examine

744 745 746

[SELECT FROM: Security awareness training policy; procedures addressing security literacy and awareness training records; security literacy and awareness training records; security plan; other relevant documents or records].

747

Interview

748 749

[SELECT FROM: Personnel with security and awareness training record retention responsibilities].

750

Test

751 752

[SELECT FROM: Mechanisms supporting the management of security literacy and awareness training records].

753

REFERENCES

20

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

754

Assessing Enhanced Security Requirements for CUI

Source Assessment Procedures: AT-06

755

03.02.04E Anti-Counterfeit Training

756

ASSESSMENT OBJECTIVE

757

Determine if:

758 759

A.03.02.04E.ODP[01]: personnel or roles requiring training to detect counterfeit system components are defined.

760 761

A.03.02.04E: <A.03.02.04E.ODP[01]: personnel or roles> are trained to detect counterfeit system components.

762

POTENTIAL ASSESSMENT METHODS AND OBJECTS

763

Examine

764 765 766 767 768 769 770

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; anti-counterfeit plan; anti-counterfeit policy and procedures; media disposal policy; media protection policy; incident response policy; training materials addressing counterfeit system components; training records on the detection and prevention of counterfeit components entering the system; system security plan; other relevant documents or records].

771

Interview

772 773 774

[SELECT FROM: Personnel with information security responsibilities; personnel with supply chain risk management responsibilities; personnel with responsibilities for anti-counterfeit policies, procedures, and training].

775

Test

776

[SELECT FROM: Processes for anti-counterfeit training].

777

REFERENCES

778

Source Assessment Procedures: SR-11(01)

779

3.3. Audit and Accountability

780

03.03.01E Audit Record Storage in Separate Environment

781

ASSESSMENT OBJECTIVE

782

Determine if:

783 784 785

A.03.03.01E: audit records are stored in a repository that is part of a physically different system or system component than the system or component being audited. 21

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

786

POTENTIAL ASSESSMENT METHODS AND OBJECTS

787

Examine

788 789 790 791 792

[SELECT FROM: Audit and accountability policy; system security plan; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; system or media storing backups of system audit records; system audit records; other relevant documents or records].

793

Interview

794 795 796

[SELECT FROM: Personnel with audit and accountability responsibilities; personnel with information security responsibilities; system/network administrators; system developers].

797

Test

798

[SELECT FROM: Mechanisms implementing the backing up of audit records].

799

REFERENCES

800

Source Assessment Procedures: AU-09(02)

801

03.03.02E Real-Time Alerts for Audit Processing Failures

802

ASSESSMENT OBJECTIVE

803

Determine if:

804 805

A.03.03.02E.ODP[01]: real-time period requiring alerts when audit failure events (defined in A.03.03.02E.ODP[03]) occur is defined.

806 807

A.03.03.02E.ODP[02]: personnel, roles, and/or locations to be alerted in real time when audit failure events (defined in A.03.03.02E.ODP[03]) occur are defined.

808 809

A.03.03.02E.ODP[03]: audit logging failure events requiring real-time alerts are defined.

810 811 812

A.03.03.02E: an alert is provided within <A.03.03.02E.ODP[01]: real-time period> to <A.03.03.02E.ODP[02]: personnel, roles, and/or locations> when <A.03.03.02E.ODP[03]: audit logging failure events> occur.

813

POTENTIAL ASSESSMENT METHODS AND OBJECTS

814

Examine

815 816 817 818

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentation; system security plan; system configuration settings and associated documentation; system audit records; other relevant documents or records].

819

Interview 22

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

820 821 822

[SELECT FROM: Personnel with audit and accountability responsibilities; personnel with information security responsibilities; system/network administrators; system developers].

823

REFERENCES

824

Source Assessment Procedures: AU-05(02)

825

03.03.03E Dual Authorization for Audit Information and Actions

826

ASSESSMENT OBJECTIVE

827

Determine if:

828 829

A.03.03.03E.ODP[01]: one or more of the following PARAMETER VALUES is/are selected: {movement; deletion}.

830 831

A.03.03.03E.ODP[02]: audit information for which dual authorization is to be enforced is defined.

832 833

A.03.03.03E: dual authorization is enforced for the <A.03.03.03E.ODP[01]: SELECTED PARAMETER VALUE(S)> of <A.03.03.03E.ODP[02]: audit information>.

834

POTENTIAL ASSESSMENT METHODS AND OBJECTS

835

Examine

836 837 838 839 840

[SELECT FROM: Audit and accountability policy; system security plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; access authorizations; system audit records; other relevant documents or records].

841

Interview

842 843

[SELECT FROM: Personnel with audit and accountability responsibilities; personnel with information security responsibilities; system/network administrators].

844

Test

845

[SELECT FROM: Mechanisms implementing the enforcement of dual authorization].

846

REFERENCES

847

Source Assessment Procedures: AU-09(05)

848

03.03.04E Integrated Analysis of Audit Records

849

ASSESSMENT OBJECTIVE

850

Determine if:

23

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

851 852 853 854

A.03.03.04E.ODP[01]: one or more of the following PARAMETER VALUES is/are selected: {vulnerability scanning information; performance data; system monitoring information; <A.03.03.04E.ODP[02] data or information collected from other sources>}.

855 856

A.03.03.04E.ODP[02]: data or information collected from other sources to be analyzed is defined (if selected).

857 858 859

A.03.03.04E: analysis of audit records is integrated with analysis of <A.03.03.04E.ODP[01]: SELECTED PARAMETER VALUE(S)> to further enhance the ability to identify inappropriate or unusual activity.

860

POTENTIAL ASSESSMENT METHODS AND OBJECTS

861

Examine

862 863 864 865 866 867

[SELECT FROM: Audit and accountability policy; system security plan; procedures addressing audit review, analysis, and reporting; system design documentation; system configuration settings and associated documentation; integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information and associated documentation; other relevant documents or records].

868

Interview

869 870

[SELECT FROM: Personnel with audit review, analysis, and reporting responsibilities; personnel with information security responsibilities].

871

Test

872 873

[SELECT FROM: Mechanisms implementing the capability to integrate analysis of audit records with analysis of data or information sources].

874

REFERENCES

875

Source Assessment Procedures: AU-06(05)

876

3.4. Configuration Management

877

03.04.01E Withdrawn

878 879 880

Addressed by 03.04.08E, 03.14.04E, 03.17.03E, 03.17.04E, 03.17.05E, 03.04.01 (SP 800-171), 03.04.03 (SP 800-171), and 03.04.10 (SP 800-171). 03.04.02E Automated Unauthorized Component Detection

881

ASSESSMENT OBJECTIVE

882

Determine if:

24

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

883 884

A.03.04.02E.ODP[01]: automated mechanisms used to detect the presence of unauthorized or misconfigured system components are defined.

885 886 887 888

A.03.04.02E.ODP[02]: one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized or misconfigured system components; isolate unauthorized or misconfigured system components; notify <A.03.04.02E.ODP[03] personnel or roles>.

889 890

A.03.04.02E.ODP[03]: personnel or roles to be notified when unauthorized or misconfigured system components are detected are defined (if selected).

891 892

A.03.04.02E.a: the presence of unauthorized or misconfigured system components is detected using <A.03.04.02E.ODP[01]: automated mechanisms>.

893 894 895

A.03.04.02E.b: one or more of the following actions is/are taken when unauthorized or misconfigured system components are detected: <A.03.04.02E.ODP[02]: SELECTED PARAMETER VALUE(S)>.

896

POTENTIAL ASSESSMENT METHODS AND OBJECTS

897

Examine

898 899 900 901 902 903 904

[SELECT FROM: Configuration management policy; procedures addressing system component inventory and configuration settings; configuration management plan; system configuration settings and associated documentation; system component inventory; system design documentation; change control records; common secure configuration checklists; alerts or notifications of unauthorized components within the system; system monitoring records; system maintenance records; system audit records; system security plan; other relevant documents or records].

905

Interview

906 907 908 909 910

[SELECT FROM: Personnel with component inventory and security configuration management responsibilities; personnel with responsibilities for managing automated mechanisms implementing unauthorized system component detection; personnel with information security responsibilities; system/network administrators; system developers].

911

Test

912 913 914 915 916 917 918

[SELECT FROM: Processes for the detection of unauthorized or misconfigured system components; automated processes for taking action when unauthorized or misconfigured system components are detected; automated mechanisms supporting and/or implementing the detection of unauthorized or misconfigured system components; automated mechanisms supporting and/or implementing actions taken when unauthorized or misconfigured system components are detected].

25

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

919

REFERENCES

920

Source Assessment Procedure: CM-06(01), CM-6(02), CM-08(03)

921

03.04.03E Automated Maintenance of System Component Inventory

922

ASSESSMENT OBJECTIVE

923

Determine if:

924 925

A.03.04.03E.ODP[01]: automated mechanisms used to maintain the currency of the system component inventory are defined.

926 927

A.03.04.03E.ODP[02]: automated mechanisms used to maintain the completeness of the system component inventory are defined.

928 929

A.03.04.03E.ODP[03]: automated mechanisms used to maintain the accuracy of the system component inventory are defined.

930 931

A.03.04.03E.ODP[04]: automated mechanisms used to maintain the availability of the system component inventory are defined.

932 933

A.03.04.03E[01]: <A.03.04.03E.ODP[01]: automated mechanisms> are used to maintain the currency of the system component inventory.

934 935

A.03.04.03E[02]: <A.03.04.03E.ODP[02]: automated mechanisms> are used to maintain the completeness of the system component inventory.

936 937

A.03.04.03E[03]: <A.03.04.03E.ODP[03]: automated mechanisms> are used to maintain the accuracy of the system component inventory.

938 939

A.03.04.03E[04]: <A.03.04.03E.ODP[04]: automated mechanisms> are used to maintain the availability of the system component inventory.

940

POTENTIAL ASSESSMENT METHODS AND OBJECTS

941

Examine

942 943 944 945 946

[SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system design documentation; system component inventory; change control records; system maintenance records; system audit records; other relevant documents or records].

947

Interview

948 949 950

[SELECT FROM: Personnel with component inventory management responsibilities; personnel with information security responsibilities; system developers; system/network administrators].

951

Test

952

[SELECT FROM: Processes for maintaining the system component inventory;

26

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

953 954

automated mechanisms supporting and/or implementing the system component inventory].

955

REFERENCES

956

Source Assessment Procedures: CM-08(02)

957

03.04.04E Automation Support for Baseline Configuration

958

ASSESSMENT OBJECTIVE

959

Determine if:

960 961

A.03.04.04E.ODP[01]: automated mechanisms for maintaining the baseline configuration of the system are defined.

962 963

A.03.04.04E[01]: the currency of the baseline configuration of the system is maintained using <A.03.04.04E.ODP[01]: automated mechanisms>.

964 965

A.03.04.04E[02]: the completeness of the baseline configuration of the system is maintained using <A.03.04.04E.ODP[01]: automated mechanisms>.

966 967

A.03.04.04E[03]: the accuracy of the baseline configuration of the system is maintained using <A.03.04.04E.ODP[01]: automated mechanisms>.

968 969

A.03.04.04E[04]: the availability of the baseline configuration of the system is maintained using <A.03.04.04E.ODP[01]: automated mechanisms>.

970

POTENTIAL ASSESSMENT METHODS AND OBJECTS

971

Examine

972 973 974 975 976 977

[SELECT FROM: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; system component inventory; configuration change control records; system security plan; other relevant documents or records].

978

Interview

979 980 981

[SELECT FROM: Personnel with configuration management responsibilities; personnel with information security responsibilities; system/network administrators].

982

Test

983 984

[SELECT FROM: Processes for managing baseline configurations; automated mechanisms implementing baseline configuration maintenance].

985

REFERENCES

986

Source Assessment Procedures: CM-02(02) 27

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

987

Assessing Enhanced Security Requirements for CUI

03.04.05E Dual Authorization for System Changes

988

ASSESSMENT OBJECTIVE

989

Determine if:

990 991

A.03.04.05E.ODP[01]: system components requiring dual authorization for changes are defined.

992 993

A.03.04.05E.ODP[02]: system-level information requiring dual authorization for changes is defined.

994 995

A.03.04.05E[01]: dual authorization for implementing changes to <A.03.04.05E.ODP[01]: system components> is enforced.

996 997

A.03.04.05E[02]: dual authorization for implementing changes to <A.03.04.05E.ODP[02]: system-level information> is enforced.

998

POTENTIAL ASSESSMENT METHODS AND OBJECTS

999

Examine

1000 1001 1002 1003 1004 1005

[SELECT FROM: Configuration management policy; procedures addressing access restrictions for changes to the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; change control records; system audit records; system component inventory; system information types; system security plan; other relevant documents or records].

1006

Interview

1007 1008 1009

[SELECT FROM: Personnel with dual authorization enforcement responsibilities for implementing system changes; personnel with information security responsibilities; system/network administrators].

1010

Test

1011 1012

[SELECT FROM: Processes for managing access restrictions to change; mechanisms implementing dual authorization enforcement].

1013

REFERENCES

1014

Source Assessment Procedures: CM-05(04)

1015

03.04.06E Retention of Previous Configurations

1016

ASSESSMENT OBJECTIVE

1017

Determine if:

28

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1018 1019

A.03.04.06E.ODP[01]: the number of previous baseline configuration versions to be retained is defined.

1020 1021

A.03.04.06E: <A.03.04.06E.ODP[01]: number> previous versions of baseline configurations of the system are retained to support rollback.

1022

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1023

Examine

1024 1025 1026 1027 1028

[SELECT FROM: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system architecture and configuration documentation; system configuration settings and associated documentation; copies of previous baseline configuration versions; system security plan; other relevant documents or records].

1029

Interview

1030 1031 1032

[SELECT FROM: Personnel with configuration management responsibilities; personnel with information security responsibilities; system/network administrators].

1033

Test

1034

[SELECT FROM: Processes for managing baseline configurations].

1035

REFERENCES

1036

Source Assessment Procedures: CM-02(03)

1037

03.04.07E Testing, Validation, and Documentation of Changes

1038

ASSESSMENT OBJECTIVE

1039

Determine if:

1040 1041

A.03.04.07E[01]: changes to the system are tested before finalizing the implementation of the changes.

1042 1043

A.03.04.07E[02]: changes to the system are validated before finalizing the implementation of the changes.

1044 1045

A.03.04.07E[03]: changes to the system are documented before finalizing the implementation of the changes.

1046

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1047

Examine

1048 1049 1050 1051

[SELECT FROM: Configuration management policy; configuration management plan; procedures addressing system configuration change control; system architecture and configuration documentation; system design documentation; test records; system configuration settings and associated documentation; validation records; 29

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1052 1053

change control records; system audit records; system security plan; other relevant documents or records].

1054

Interview

1055 1056 1057

[SELECT FROM: Personnel with configuration change control responsibilities; personnel with information security responsibilities; members of change control board or similar; system/network administrators; system developers].

1058

Test

1059 1060

[SELECT FROM: Processes for configuration change control; mechanisms supporting and/or implementing, testing, validating, and documenting system changes].

1061

REFERENCES

1062

Source Assessment Procedures: CM-03(02)

1063

03.04.08E Centralized Repository

1064

ASSESSMENT OBJECTIVE

1065

Determine if:

1066 1067

A.03.04.08E: a centralized repository for the inventory of system components is provided.

1068

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1069

Examine

1070 1071 1072 1073 1074

[SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system design documentation; system security plan; system component inventory; system configuration settings and associated documentation; change control records; system security plan; other relevant documents or records].

1075

Interview

1076 1077

[SELECT FROM: Organizational personnel with component inventory management responsibilities; organizational personnel with security responsibilities].

1078

Test

1079 1080 1081

[SELECT FROM: Organizational processes for managing the system component inventory; mechanisms supporting and/or implementing system component inventory].

1082

REFERENCES

1083

Source Assessment Procedures: CM-08(07)

1084

3.5. Identification and Authentication 30

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

1085

Assessing Enhanced Security Requirements for CUI

03.05.01E Cryptographic Bidirectional Authentication

1086

ASSESSMENT OBJECTIVE

1087

Determine if:

1088 1089 1090

A.03.05.01E.ODP[01]: devices and/or types of devices requiring the use of cryptographically based bidirectional authentication to authenticate before establishing a system connection are defined.

1091 1092 1093

A.03.05.01E: <A.03.05.01E.ODP[01]: devices and/or types of devices> are authenticated before establishing a system connection using bidirectional authentication that is cryptographically based.

1094

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1095

Examine

1096 1097 1098 1099 1100

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing device identification and authentication; system design documentation; configuration settings and associated documentation; list of devices requiring unique identification and authentication; device connection reports; other relevant documents or records].

1101

Interview

1102 1103 1104

[SELECT FROM: Personnel with operational responsibilities for device identification and authentication; personnel with information security responsibilities; system/network administrators; system developers].

1105

Test

1106 1107

[SELECT FROM: Mechanisms supporting and/or implementing device authentication capabilities; cryptographically based bidirectional authentication mechanisms].

1108

REFERENCES

1109

Source Assessment Procedures: IA-03(01)

1110

03.05.02E Password Managers

1111

ASSESSMENT OBJECTIVE

1112

Determine if:

1113 1114

A.03.05.02E.ODP[01]: password managers employed for generating and managing passwords are defined.

1115 1116

A.03.05.02E: <A.03.05.02E.ODP[01]: password managers> are employed to generate and manage passwords.

1117

POTENTIAL ASSESSMENT METHODS AND OBJECTS

31

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1118

Examine

1119 1120 1121 1122 1123

[SELECT FROM: Identification and authentication policy; procedures addressing identifier management; system security plan; system design documentation; mechanisms providing dynamic binding of identifiers and authenticators; system configuration settings and associated documentation; system audit records; other relevant documents or records].

1124

Interview

1125 1126 1127

[SELECT FROM: Personnel with identification and authentication management responsibilities; personnel with information security responsibilities; system/network administrators].

1128

Test

1129 1130 1131

[SELECT FROM: Mechanisms supporting and/or implementing account management capabilities; mechanisms supporting and/or implementing identification and authentication management capabilities for the system].

1132

REFERENCES

1133

Source Assessment Procedures: IA-05(18)

1134

03.05.03E Device Attestation

1135

ASSESSMENT OBJECTIVE

1136

Determine if:

1137 1138

A.03.05.03E.ODP[01]: the configuration management process employed to handle device identification and authentication based on attestation is defined.

1139 1140

A.03.05.03E: device identification and authentication are handled based on attestation by <A.03.05.02E.ODP[01]: configuration management process>.

1141

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1142

Examine

1143 1144 1145 1146 1147 1148

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing device identification and authentication; procedures addressing device configuration management; system design documentation; system configuration settings and associated documentation; configuration management records; change control records; system audit records; other relevant documents or records].

32

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1149

Interview

1150 1151 1152

[SELECT FROM: Personnel with operational responsibilities for device identification and authentication; personnel with information security responsibilities; system/network administrators].

1153

Test

1154 1155 1156 1157

[SELECT FROM: Mechanisms supporting and/or implementing device identification and authentication capabilities; mechanisms supporting and/or implementing configuration management; cryptographic mechanisms supporting device attestation].

1158

REFERENCES

1159

Source Assessment Procedures: IA-03(04)

1160

03.05.04E No Embedded Unencrypted Static Authenticators

1161

ASSESSMENT OBJECTIVE

1162

Determine if:

1163 1164

A.03.05.04E: unencrypted static authenticators are not embedded in applications or other forms of static storage.

1165

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1166

Examine

1167 1168 1169 1170 1171

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing authenticator management; system design documentation; system configuration settings and associated documentation; logical access scripts; application code reviews for detecting unencrypted static authenticators; other relevant documents or records].

1172

Interview

1173 1174 1175

[SELECT FROM: Personnel with authenticator management responsibilities; personnel with information security responsibilities; system/network administrators; system developers].

1176

Test

1177 1178 1179

[SELECT FROM: Mechanisms supporting and/or implementing authenticator management capabilities; mechanisms implementing authentication in applications].

1180

REFERENCES

1181

Source Assessment Procedures: IA-05(07)

33

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1182

03.05.05E Expiration of Cached Authenticators

1183

ASSESSMENT OBJECTIVE

1184

Determine if:

1185 1186

A.03.05.05E.ODP[01]: the time period after which the use of cached authenticators is prohibited is defined.

1187 1188

A.03.05.05E: the use of cached authenticators is prohibited after <A.03.05.05E.ODP[01]: time period>.

1189

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1190

Examine

1191 1192 1193 1194

[SELECT FROM: Identification and authentication policy; procedures addressing authenticator management; system security plan; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records].

1195

Interview

1196 1197 1198

[SELECT FROM: Personnel with authenticator management responsibilities; personnel with information security responsibilities; system/network administrators; system developers].

1199

Test

1200 1201

[SELECT FROM: Mechanisms supporting and/or implementing authenticator management capabilities].

1202

REFERENCES

1203

Source Assessment Procedures: IA-05(13)

1204

03.05.06E Identity Proofing

1205

ASSESSMENT OBJECTIVE

1206

Determine if:

1207 1208 1209

A.03.05.06E.a: users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity-proofed.

1210

A.03.05.06E.b: user identities are resolved to a unique individual.

1211

A.03.05.06E.c[01]: identity evidence is collected.

1212

A.03.05.06E.c[02]: identity evidence is validated.

1213

A.03.05.06E.c[03]: identity evidence is verified.

34

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1214

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1215

Examine

1216 1217

[SELECT FROM: Identification and authentication policy; procedures addressing identity proofing; system security plan; other relevant documents or records].

1218

Interview

1219 1220 1221

[SELECT FROM: Personnel with system operations responsibilities; personnel with information security responsibilities; system/network administrators; system developers; personnel with identification and authentication responsibilities].

1222

Test

1223 1224

[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities].

1225

REFERENCES

1226

Source Assessment Procedure: IA-12

1227

03.05.07E Identity Providers and Authorization Servers

1228

ASSESSMENT OBJECTIVE

1229

Determine if:

1230

A.03.05.07E.ODP[01]: an identification and authentication policy is defined.

1231 1232

A.03.05.07E.ODP[02]: mechanisms supporting authentication and authorization decisions are defined.

1233 1234 1235 1236

A.03.05.07E[01]: identity providers are employed to manage user, device, and nonperson entity identities, attributes, and access rights supporting authentication decisions in accordance with <A.03.05.07E.ODP[01]: policy> using <A.03.05.07E.ODP[02]: mechanisms>.

1237 1238 1239 1240

A.03.05.07E[02]: identity providers are employed to manage user, device, and nonperson entity identities, attributes, and access rights supporting authorization decisions in accordance with <A.03.05.07E.ODP[01]: policy> using <A.03.05.07E.ODP[02]: mechanisms>.

1241 1242 1243 1244

A.03.05.07E[03]: authorization servers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with <A.03.05.07E.ODP[01]: policy> using <A.03.05.07E.ODP[02]: mechanisms>.

1245 1246 1247 1248

A.03.05.07E[02]: authorization servers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authorization decisions in accordance with <A.03.05.07E.ODP[01]: policy> using <A.03.05.07E.ODP[02]: mechanisms>.

35

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1249

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1250

Examine

1251 1252 1253 1254

[SELECT FROM: Identification and authentication policy; procedures addressing user and device identification and authentication; system security plan; system design documentation; system configuration settings and associated documentation; other relevant documents or records].

1255

Interview

1256 1257 1258 1259

[SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; organizational personnel with account management responsibilities; system developers].

1260

Test

1261 1262

[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities and access rights].

1263

REFERENCES

1264

Source Assessment Procedure: IA-13

1265

3.6. Incident Response

1266

03.06.01E Security Operations Center

1267

ASSESSMENT OBJECTIVE

1268

Determine if:

1269

A.03.06.01E[01]: a security operations center is established.

1270

A.03.06.01E[02]: a security operations center is maintained.

1271

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1272

Examine

1273 1274 1275 1276 1277

[SELECT FROM: Incident response policy; contingency planning policy; procedures addressing incident handling; procedures addressing the security operations center operations; mechanisms supporting dynamic response capabilities; system security plan; contingency plan; incident response plan; other relevant documents or records].

36

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1278

Interview

1279 1280 1281

[SELECT FROM: Personnel with incident handling responsibilities; personnel with information security responsibilities; security operations center personnel; personnel with contingency planning responsibilities].

1282

Test

1283 1284 1285

[SELECT FROM: Mechanisms that support and/or implement the security operations center capability; mechanisms that support and/or implement the incident handling process].

1286

REFERENCES

1287

Source Assessment Procedures: IR-04(14)

1288

03.06.02E Integrated Incident Response Team

1289

ASSESSMENT OBJECTIVE

1290

Determine if:

1291 1292

A.03.06.02E.ODP[01]: the time period within which an integrated incident response team can be deployed is defined.

1293

A.03.06.02E[01]: an integrated incident response team is established.

1294

A.03.06.02E[02]: an integrated incident response team is maintained.

1295 1296

A.03.06.02E[03]: the integrated incident response team can be deployed to any location identified by the organization in <A.03.06.02E.ODP[01]: time period>.

1297

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1298

Examine

1299 1300 1301

[SELECT FROM: Incident response policy; procedures addressing incident handling; procedures addressing incident response planning; incident response plan; system security plan; other relevant documents or records].

1302

Interview

1303 1304 1305

[SELECT FROM: Personnel with incident handling responsibilities; personnel with information security responsibilities; members of the integrated incident response team].

1306

REFERENCES

1307

Source Assessment Procedures: IR-04(11)

1308

03.06.03E Behavior Analysis

37

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1309

ASSESSMENT OBJECTIVE

1310

Determine if:

1311 1312

A.03.06.03E.ODP[01]: environments or resources that may contain or be related to anomalous or suspected adversarial behavior are defined.

1313 1314

A.03.06.03E: anomalous or suspected adversarial behavior in or related to <A.03.06.03E.ODP[01]: environments or resources> is analyzed.

1315

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1316

Examine

1317 1318 1319 1320 1321 1322 1323

[SELECT FROM: Incident response policy; procedures addressing system monitoring tools and techniques; incident response plan; system monitoring logs or records; system monitoring tools and techniques documentation; system configuration settings and associated documentation; system security plan; system component inventory; network diagram; system protocols documentation; list of acceptable thresholds for false positives and false negatives; other relevant documents or records].

1324

Interview

1325 1326

[SELECT FROM: Personnel with information security responsibilities; system/network administrators].

1327

Test

1328

[SELECT FROM: Processes for detecting anomalous behavior].

1329

REFERENCES

1330

Source Assessment Procedures: IR-04(13)

1331

03.06.04E Automated Tracking, Data Collection, and Analysis for Incident Monitoring

1332

ASSESSMENT OBJECTIVE

1333

Determine if:

1334

A.03.06.04E.ODP[01]: automated mechanisms used to track incidents are defined.

1335 1336

A.03.06.04E.ODP[02]: automated mechanisms used to collect incident information are defined.

1337 1338

A.03.06.04E.ODP[03]: automated mechanisms used to analyze incident information are defined.

1339 1340

A.03.06.04E[01]: incidents are tracked using <A.03.06.04E.ODP[01]: automated mechanisms>.

1341 1342

A.03.06.04E[02]: incident information is collected using <A.03.06.04E.ODP[02]: automated mechanisms>. 38

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1343 1344

A.03.06.04E[03]: incident information is analyzed using <A.03.06.04E.ODP[03]: automated mechanisms>.

1345

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1346

Examine

1347 1348 1349

[SELECT FROM: Incident response policy; procedures addressing incident monitoring; incident response records and documentation; system security plan; incident response plan; other relevant documents or records].

1350

Interview

1351 1352

[SELECT FROM: Personnel with incident monitoring responsibilities; personnel with information security responsibilities].

1353

Test

1354 1355 1356

[SELECT FROM: Incident monitoring capability for the organization; automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents].

1357

REFERENCES

1358

Source Assessment Procedures: IR-05(01)

1359

3.7. Maintenance

1360

03.07.01E Software Updates and Patches for Maintenance Tools

1361

ASSESSMENT OBJECTIVE

1362

Determine if:

1363 1364

A.03.07.01E: maintenance tools are inspected to ensure that the latest software updates and patches are installed.

1365

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1366

Examine

1367 1368 1369 1370

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentation; list of personnel authorized to use maintenance tools; maintenance tool usage records; maintenance records; system security plan; other relevant documents or records].

1371

Interview

1372 1373

[SELECT FROM: Personnel with system maintenance responsibilities; personnel with information security responsibilities].

1374

Test

39

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1375 1376 1377 1378

[SELECT FROM: Processes for inspecting maintenance tools; processes for maintenance tool updates; mechanisms supporting and/or implementing the inspection of maintenance tools; mechanisms supporting and/or implementing maintenance tool updates].

1379

REFERENCES

1380

Source Assessment Procedures: MA-03(06)

1381

3.8. Media Protection

1382

03.08.01E Dual Authorization for Media Sanitization

1383

ASSESSMENT OBJECTIVE

1384

Determine if:

1385 1386

A.03.08.01E.ODP[01]: system media containing CUI to be sanitized requiring dual authorization is defined.

1387 1388

A.03.08.01E: dual authorization for the sanitization of <A.03.08.01E.ODP[01]: system media> is enforced.

1389

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1390

Examine

1391 1392 1393 1394 1395

[SELECT FROM: System media protection policy; procedures addressing media sanitization and disposal; dual authorization policy and procedures; list of system media requiring dual authorization for sanitization; authorization records; media sanitization records; audit records; system security plan; other relevant documents or records].

1396

Interview

1397 1398

[SELECT FROM: Personnel with system media sanitization responsibilities; personnel with information security responsibilities; system/network administrators].

1399

Test

1400 1401 1402

[SELECT FROM: Processes requiring dual authorization for media sanitization; mechanisms supporting and/or implementing media sanitization; mechanisms supporting and/or implementing dual authorization].

1403

REFERENCES

1404

Source Assessment Procedures: MP-06(07)

40

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

1405

Assessing Enhanced Security Requirements for CUI

03.08.02E Dual Authorization for System Backup Deletion and Destruction

1406

ASSESSMENT OBJECTIVE

1407

Determine if:

1408 1409

A.03.08.02E.ODP[01]: system backup information for which to enforce dual authorization in order to delete or destroy is defined.

1410 1411

A.03.08.02E: dual authorization for the deletion or destruction of <A.03.08.02E.ODP[01]: system backup information> is enforced.

1412

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1413

Examine

1414 1415 1416 1417 1418

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system design documentation; system configuration settings and associated documentation; system-generated list of dual authorization credentials or rules; logs or records of the deletion or destruction of backup information; system security plan; other relevant documents or records]

1419

Interview

1420 1421

[SELECT FROM: Personnel with system backup responsibilities; personnel with information security responsibilities].

1422

Test

1423 1424 1425

[SELECT FROM: Mechanisms supporting and/or implementing dual authorization; mechanisms supporting and/or implementing the deletion and/or destruction of backup information].

1426

REFERENCES

1427

Source Assessment Procedures: CP-09(07)

1428

03.08.03E Testing System Backups for Reliability and Integrity

1429

ASSESSMENT OBJECTIVE

1430

Determine if:

1431 1432

A.03.08.03E.ODP[01]: the frequency at which to test backup information for media reliability is defined.

1433 1434

A.03.08.03E.ODP[02]: the frequency at which to test backup information for information integrity is defined.

1435 1436

A.03.08.03E[01]: backup information is tested <A.03.08.03E.ODP[01]: frequency> to verify media reliability.

1437

A.03.08.03E[02]: backup information is tested <A.03.08.03E.ODP[02]: frequency> to

41

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1438

verify information integrity.

1439

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1440

Examine

1441 1442 1443 1444

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system backup test results; contingency plan test documentation; contingency plan test results; system security plan; other relevant documents or records].

1445

Interview

1446 1447

[SELECT FROM: Personnel with system backup responsibilities; personnel with information security responsibilities].

1448

Test

1449 1450

[SELECT FROM: Processes for conducting system backups; mechanisms supporting and/or implementing system backups].

1451

REFERENCES

1452

Source Assessment Procedures: CP-09(01)

1453

03.08.04E System Recovery and Reconstitution

1454

ASSESSMENT OBJECTIVE

1455

Determine if:

1456 1457

A.03.08.04E.ODP[01]: a time period consistent with recovery time and recovery point objectives for the recovery of the system is determined.

1458 1459

A.03.08.04E.ODP[02]: a time period consistent with recovery time and recovery point objectives for the reconstitution of the system is determined.

1460 1461

A.03.08.04E[01]: the recovery of the system to a known state is provided within <A.03.08.07E.ODP[01]: time period> after a disruption, compromise, or failure.

1462 1463 1464

A.03.08.04E[02]: the reconstitution of the system to a known state is provided within <A.03.08.07E.ODP[02]: time period> after a disruption, compromise, or failure.

1465

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1466

Examine

42

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1467 1468 1469 1470 1471

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system backup test results; contingency plan test results; contingency plan test documentation; redundant secondary system for system backups; locations of redundant secondary backup systems; system security plan; other relevant documents or records].

1472

Interview

1473 1474 1475

[SELECT FROM: Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities; organizational personnel with information security responsibilities].

1476

Test

1477 1478 1479

[SELECT FROM: Organizational processes implementing system recovery and reconstitution operations; mechanisms supporting and/or implementing system recovery and reconstitution operations].

1480

REFERENCES

1481

Source Assessment Procedures: CP-10

1482

3.9. Personnel Security

1483

03.09.01E Withdrawn

1484 1485 1486 1487

Addressed by 03.09.01. 03.09.02E Withdrawn Addressed by 03.01.01 and 03.09.01. 03.09.03E Access Agreements

1488

ASSESSMENT OBJECTIVE

1489

Determine if:

1490 1491

A.03.09.03E.ODP[01]: the frequency at which to review and update access agreements is defined.

1492 1493

A.03.09.03E.ODP[02]: the frequency at which to re-sign access agreements to maintain access systems processing, storing, or transmitting CUI is defined.

1494 1495

A.03.09.03E.a: access agreements are developed and documented for systems processing, storing, or transmitting CUI.

1496 1497

A.03.09.03E.b[01]: access agreements are reviewed <A.03.09.03E.ODP[01]: frequency>.

43

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1498 1499

A.03.09.03E.b[02]: access agreements are updated <A.03.09.03E.ODP[01]: frequency>.

1500 1501 1502

A.03.09.03E.c.01: individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access.

1503 1504 1505

A.03.09.03E.c.02: individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or <A.03.09.03E.ODP[02]: frequency>.

1506

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1507

Examine

1508 1509 1510 1511 1512 1513

[SELECT FROM: Personnel security policy; personnel security procedures; procedures addressing access agreements for systems processing, storing, or transmitting CUI; access control policy; access control procedures; access agreements (including nondisclosure agreements, acceptable use agreements, rules of behavior, and conflictof-interest agreements); documentation of access agreement reviews, updates, and re-signing; system security plan; other relevant documents or records].

1514

Interview

1515 1516 1517

[SELECT FROM: Personnel with personnel security responsibilities; personnel who have signed and/or resigned access agreements; personnel with information security responsibilities].

1518

Test

1519 1520

[SELECT FROM: Processes for reviewing, updating, and re-signing access agreements; mechanisms supporting reviewing, updating, and re-signing of access agreements].

1521

REFERENCES

1522

Source Assessment Procedures: PS-06

1523

03.09.04E Citizenship Requirements

1524

ASSESSMENT OBJECTIVE

1525

Determine if:

1526 1527

A.03.09.04E.ODP[01]: citizenship requirements to be met by individuals to access a system processing, storing, or transmitting CUI are defined.

1528 1529

A.03.09.04E: individuals accessing a system processing, storing, or transmitting CUI meet <A.03.09.04E.ODP[01] citizenship requirements>.

1530

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1531

Examine 44

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1532 1533 1534 1535

[SELECT FROM: Personnel security policy; access control policy, procedures addressing personnel screening; records of screened personnel; screening criteria; records of access authorizations; system security plan; other relevant documents or records].

1536

Interview

1537 1538

[SELECT FROM: Personnel with personnel security responsibilities; personnel with information security responsibilities].

1539

Test

1540 1541

[SELECT FROM: Processes for ensuring valid access authorizations for accessing CUI and systems requiring citizenship; processes for additional personnel screening].

1542

REFERENCES

1543

Source Assessment Procedures: PS-03(04)

1544

3.10. Physical Protection

1545

03.10.01E Intrusion Alarms and Surveillance Equipment

1546

ASSESSMENT OBJECTIVE

1547

Determine if:

1548 1549

A.03.10.01E[01]: physical access to the facility where the system resides is monitored using physical intrusion alarms.

1550 1551

A.03.10.01E[02]: physical access to the facility where the system resides is monitored using physical surveillance equipment.

1552

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1553

Examine

1554 1555 1556 1557

[SELECT FROM: Physical and environmental protection policy; procedures addressing physical access monitoring; physical access monitoring records; physical access log reviews; physical access logs or records; system security plan; other relevant documents or records].

1558

Interview

1559 1560 1561

[SELECT FROM: Personnel with physical access monitoring responsibilities; personnel with incident response responsibilities; personnel with information security responsibilities].

1562

Test

1563 1564

[SELECT FROM: Processes for monitoring physical intrusion alarms and surveillance equipment; mechanisms supporting and/or implementing physical intrusion alarms 45

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1565 1566

and surveillance equipment; mechanisms supporting and/or implementing physical access monitoring].

1567

REFERENCES

1568

Source Assessment Procedures: PE-06(01)

1569

03.10.02E Delivery and Removal of System Components

1570

ASSESSMENT OBJECTIVE

1571

Determine if:

1572 1573

A.03.10.02E.ODP[01]: the types of system components to be authorized and controlled when entering the facility are defined.

1574 1575

A.03.10.02E.ODP[02]: the types of system components to be authorized and controlled when exiting the facility are defined.

1576 1577

A.03.10.02E.a[01]: <A.03.10.02E.ODP[01]: types of system components> are authorized when entering the facility.

1578 1579

A.03.10.02E.a[02]: <A.03.10.02E.ODP[01]: types of system components> are controlled when entering the facility.

1580 1581

A.03.10.02E.a[03]: <A.03.10.02E.ODP[02]: types of system components> are authorized when exiting the facility.

1582 1583

A.03.10.02E.a[04]: <A.03.10.02E.ODP[02]: types of system components> are controlled when exiting the facility.

1584 1585

A.03.10.02E.b: records of the system components entering and exiting the facility are maintained.

1586

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1587

Examine

1588 1589 1590 1591

[SELECT FROM: Physical and environmental protection policy; procedures addressing the delivery and removal of system components from the facility; facility housing the system; records of items entering and exiting the facility; system security plan; other relevant documents or records].

1592

Interview

1593 1594 1595

[SELECT FROM: Personnel with responsibilities for controlling system components entering and exiting the facility; personnel with information security responsibilities].

1596

Test

1597 1598

[SELECT FROM: Process for authorizing, monitoring, and controlling system-related items entering and exiting the facility; mechanisms supporting and/or implementing, 46

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1599 1600

authorizing, monitoring, and controlling system components entering and exiting the facility].

1601

REFERENCES

1602

Source Assessment Procedures: PE-16

1603

3.11. Risk Assessment

1604

03.11.01E Threat Awareness Program

1605

ASSESSMENT OBJECTIVE

1606

Determine if:

1607 1608

A.03.11.01E: a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.

1609

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1610

Examine

1611 1612 1613 1614

[SELECT FROM: Information security program plan; threat awareness program policy; threat awareness program procedures; risk assessment results relevant to threat awareness; documentation about the cross-organization information-sharing capability; other relevant documents or records].

1615

Interview

1616 1617 1618 1619 1620

[SELECT FROM: Personnel with information security program planning and plan implementation responsibilities; personnel responsible for the threat awareness program; personnel responsible for the cross-organization information-sharing capability; personnel with information security responsibilities; external personnel with whom threat awareness information is shared by the organization].

1621

Test

1622 1623 1624 1625 1626

[SELECT FROM: Processes for implementing the threat awareness program; processes for implementing the cross-organization information-sharing capability; mechanisms supporting and/or implementing the threat awareness program; mechanisms supporting and/or implementing the cross-organization informationsharing capability].

1627

REFERENCES

1628

Source Assessment Procedures: PM-16

1629 1630

03.11.02E Threat Hunting ASSESSMENT OBJECTIVE 47

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1631

Determine if:

1632 1633

A.03.11.02E.ODP[01]: the frequency at which to employ the threat-hunting capability is defined.

1634 1635

A.03.11.02E.a.01[01]: a cyber threat capability is established to search for indicators of compromise in organizational systems.

1636 1637

A.03.11.02E.a.01[02]: a cyber threat capability is maintained to search for indicators of compromise in organizational systems.

1638 1639

A.03.11.02E.a.02[01]: a cyber threat capability is established to detect, track, and disrupt threats that evade existing safeguards.

1640 1641

A.03.11.02E.a.02[02]: a cyber threat capability is maintained to detect, track, and disrupt threats that evade existing safeguards.

1642 1643

A.03.11.02E.b: the threat-hunting capability is employed<A.03.11.02E.ODP[01]: frequency>.

1644

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1645

Examine

1646 1647 1648

[SELECT FROM: Risk assessment policy; assessment reports; audit records and/or event logs; threat-hunting capability; system security plan; other relevant documents or records].

1649

Interview

1650 1651

[SELECT FROM: Personnel with threat-hunting responsibilities; system/network administrators; personnel with information security responsibilities].

1652

Test

1653 1654

[SELECT FROM: Processes for assessments and audits; mechanisms or tools supporting and/or implementing threat-hunting capabilities].

1655

REFERENCES

1656

Source Assessment Procedures: RA-10

48

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1657

03.11.03E Predictive Cyber Analytics

1658

ASSESSMENT OBJECTIVE

1659

Determine if:

1660 1661

A.03.11.03E.ODP[01]: advanced automation capabilities to predict and identify risks are defined.

1662 1663

A.03.11.03E.ODP[02]: systems or system components in which advanced automation and analytics capabilities are to be employed are defined.

1664 1665

A.03.11.03E.ODP[03]: advanced analytics capabilities to predict and identify risks are defined.

1666 1667 1668

A.03.11.03E[01]: <A.03.11.03E.ODP[01]: advanced automation capabilities> are employed to predict and identify risks to <A.03.11.03E.ODP[02]: systems or system components>.

1669 1670 1671

A.03.11.03E[02]: <A.03.11.03E.ODP[03]: advanced analytics capabilities> are employed to predict and identify risks to <A.03.11.03E.ODP[02]: systems or system components>.

1672

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1673

Examine

1674 1675 1676 1677

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing organizational assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; risk reports; system security plan; other relevant documents or records].

1678

Interview

1679 1680

[SELECT FROM: Personnel with risk assessment responsibilities; personnel with information security responsibilities].

1681

Test

1682 1683 1684

[SELECT FROM: Processes for risk assessment; mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment].

1685

REFERENCES

1686

Source Assessment Procedures: RA-03(04)

1687 1688 1689

03.11.04E Withdrawn Addressed by 03.15.01E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), and 03.15.02 (SP 800-171).

49

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

1690 1691 1692 1693 1694 1695 1696 1697 1698

Assessing Enhanced Security Requirements for CUI

03.11.05E Withdrawn Addressed by 03.11.01E, 03.11.03E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), 03.12.01 (SP 800-171), and 03.12.03 (SP 800-171). 03.11.06E Withdrawn Addressed by 03.12.03E, 03.11.01 (SP 800-171), 03.11.04 (SP 800-171), 03.12.01 (SP 800-171), 03.12.03 (SP 800-171), and 03.17.03 (SP 800-171). 03.11.07E Withdrawn Addressed by 03.17.01 (SP 800-171). 03.11.08E Dynamic Threat Awareness

1699

ASSESSMENT OBJECTIVE

1700

Determine if:

1701 1702

A.03.11.08E.ODP[01]: the means to determine the current cyber threat environment on an ongoing basis are defined.

1703 1704

A.03.11.08E: the current cyber threat environment is determined on an ongoing basis using <A.03.11.08E.ODP[01]: means>.

1705

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1706

Examine

1707 1708 1709 1710

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing organizational assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; risk reports; system security plan; other relevant documents or records].

1711

Interview

1712 1713

[SELECT FROM: Personnel with risk assessment responsibilities; personnel with information security responsibilities].

1714

Test

1715 1716 1717

[SELECT FROM: Processes for risk assessment; mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment].

1718

REFERENCES

1719

Source Assessment Procedures: RA-03(03)

50

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1720

03.11.09E Indicators of Compromise

1721

ASSESSMENT OBJECTIVE

1722

Determine if:

1723

A.03.11.09E.ODP[01]: sources that provide indicators of compromise are defined.

1724 1725

A.03.11.09E.ODP[02]: personnel or roles to whom indicators of compromise are to be distributed are defined.

1726 1727

A.03.11.09E[01]: indicators of compromise provided by <A.03.11.09E.ODP[01]: sources> are discovered.

1728 1729

A.03.11.09E[02]: indicators of compromise provided by <A.03.11.09E.ODP[01]: sources> are collected.

1730 1731

A.03.11.09E[03]: indicators of compromise provided by <A.03.11.09E.ODP[01]: sources> are distributed to <A.03.11.09E.ODP[02]: personnel or roles>.

1732

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1733

Examine

1734 1735 1736 1737 1738 1739

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system monitoring; system design documentation; system monitoring tools and techniques documentation; system configuration settings and associated documentation; system monitoring logs or records; system audit records; system security plan; other relevant documents or records].

1740

Interview

1741 1742 1743

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers; personnel installing, configuring, and/or maintaining the system; personnel responsible for monitoring system hosts].

1744

Test

1745 1746 1747 1748 1749

[SELECT FROM: Processes for system monitoring; processes for the discovery, collection, distribution, and use of indicators of compromise; mechanisms supporting and/or implementing a system monitoring capability; mechanisms supporting and/or implementing the discovery, collection, distribution, and use of indicators of compromise].

1750

REFERENCES

1751

Source Assessment Procedures: SI-04(24)

51

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

1752

Assessing Enhanced Security Requirements for CUI

03.11.10E Criticality Analysis

1753

ASSESSMENT OBJECTIVE

1754

Determine if:

1755 1756

A.03.11.10E.ODP[01]: systems, system components, or system services to be analyzed for criticality are defined.

1757 1758

A.03.11.10E.ODP[02]: decision points in the system development life cycle when a criticality analysis is to be performed are defined.

1759 1760 1761

A.03.11.10E: critical system components and functions are identified by performing a criticality analysis for <A.03.11.10E.ODP[01]: systems, system components, or system services> at <A.03.11.10E.ODP[02]: decision points>.

1762

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1763

Examine

1764 1765 1766 1767

[SELECT FROM: Risk assessment policy; assessment reports; criticality analysis and/or finalized criticality for each component and/or subcomponent; audit records and/or event logs; analysis reports; system security plan; other relevant documents or records].

1768

Interview

1769 1770 1771

[SELECT FROM: Personnel with assessment and auditing responsibilities; personnel with criticality analysis responsibilities; system/network administrators; personnel with information security responsibilities].

1772

Test

1773 1774

[SELECT FROM: Processes for assessments and audits; mechanisms and/or tools supporting and/or implementing assessments and auditing].

1775

REFERENCES

1776

Source Assessment Procedures: RA-09

1777

03.11.11E Discoverable Information

1778

ASSESSMENT OBJECTIVE

1779

Determine if:

1780 1781

A.03.11.11E.ODP[01]: corrective actions to be taken if information about the system is discoverable are defined.

1782

A.03.11.11E[01]: discoverable information about the system is identified.

1783 1784

A.03.11.11E[02]: <A.03.11.11E.ODP[01]: corrective actions> are taken when information about the system is confirmed as discoverable.

52

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1785

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1786

Examine

1787 1788 1789 1790

[SELECT FROM: Procedures addressing vulnerability scanning; assessment report; penetration test results; vulnerability scanning results; risk assessment report; records of corrective actions taken on discoverable information; incident response records; audit records; system security plan; other relevant documents or records].

1791

Interview

1792 1793 1794 1795

[SELECT FROM: Personnel with vulnerability scanning and/or penetration testing responsibilities; personnel with vulnerability scan analysis responsibilities; personnel responsible for risk response; personnel responsible for incident management and response; personnel with information security responsibilities].

1796

Test

1797 1798 1799 1800 1801

[SELECT FROM: Processes for vulnerability scanning; processes for risk response; processes for incident management and response; mechanisms and/or tools supporting and/or implementing vulnerability scanning; mechanisms supporting and/or implementing risk response; mechanisms supporting and/or implementing incident management and response].

1802

REFERENCES

1803

Source Assessment Procedures: RA-05(04)

1804

03.11.12E Automated Means for Sharing Threat Intelligence

1805

ASSESSMENT OBJECTIVE

1806

Determine if:

1807 1808

A.03.11.12E: automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.

1809

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1810

Examine

1811 1812 1813 1814

[SELECT FROM: Information security program plan; threat awareness program policy; threat awareness program procedures; risk assessment results related to threat awareness; documentation about the cross-organization information-sharing capability; other relevant documents or records].

53

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1815

Interview

1816 1817 1818 1819 1820

[SELECT FROM: Personnel with information security program planning and plan implementation responsibilities; personnel responsible for the threat awareness program; personnel responsible for the cross-organization information-sharing capability; personnel with information security responsibilities; external personnel with whom threat awareness information is shared by the organization].

1821

Test

1822 1823 1824 1825 1826

[SELECT FROM: Processes for implementing the threat awareness program; processes for implementing the cross-organization information-sharing capability; automated mechanisms supporting and/or implementing the threat awareness program; automated mechanisms supporting and/or implementing the crossorganization information-sharing capability].

1827

REFERENCES

1828

Source Assessment Procedures: PM-16(01)

1829

3.12. Security Assessment and Monitoring

1830

03.12.01E Penetration Testing

1831

ASSESSMENT OBJECTIVE

1832

Determine if:

1833 1834

A.03.12.01E.ODP[01]: the frequency at which to conduct penetration testing on systems or system components is defined.

1835 1836

A.03.12.01E.ODP[02]: systems or system components on which penetration testing is to be conducted are defined.

1837 1838

A.03.12.01E: penetration testing is conducted <A.03.12.01E.ODP[01]: frequency> on <A.03.12.01E.ODP[02]: systems or system components>.

1839

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1840

Examine

1841 1842 1843 1844

[SELECT FROM: Assessment and monitoring policy; procedures addressing penetration testing; assessment plan; system security plan; penetration test rules of engagement; penetration test report; assessment report; assessment evidence; other relevant documents or records].

1845

Interview

1846 1847

[SELECT FROM: Personnel with assessment responsibilities; personnel with information security responsibilities; system/network administrators].

54

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1848

Test

1849

[SELECT FROM: Mechanisms supporting penetration testing].

1850

REFERENCES

1851

Source Assessment Procedures: CA-08

1852

03.12.02E Independent Assessors

1853

ASSESSMENT OBJECTIVE

1854

Determine if:

1855 1856

A.03.12.02E: independent assessors or assessment teams are used to conduct security requirement assessments.

1857

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1858

Examine

1859 1860 1861

[SELECT FROM: Assessment and monitoring policy; procedures addressing assessments; previous assessment plan; previous assessment report; plan of action and milestones; system security plan; other relevant documents or records].

1862

Interview

1863 1864

[SELECT FROM: Personnel with assessment responsibilities; personnel with information security responsibilities].

1865

REFERENCES

1866

Source Assessment Procedures: CA-02(01)

1867

03.12.03E Risk Monitoring

1868

ASSESSMENT OBJECTIVE

1869

Determine if:

1870 1871

A.03.12.03E[01]: risk monitoring is an integral part of the continuous monitoring strategy.

1872

A.03.12.03E[02]: effectiveness monitoring is included in risk monitoring.

1873

A.03.12.03E[03]: compliance monitoring is included in risk monitoring.

1874

A.03.12.03E[04]: change monitoring is included in risk monitoring.

1875

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1876

Examine

1877

[SELECT FROM: Assessment and monitoring policy; organizational continuous 55

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1878 1879 1880 1881

monitoring strategy; system-level continuous monitoring strategy; procedures addressing continuous monitoring of system; assessment report; plan of action and milestones; system monitoring records; impact analyses; status reports; system security plan; other relevant documents or records].

1882

Interview

1883 1884

[SELECT FROM: Personnel with continuous monitoring responsibilities; personnel with information security responsibilities].

1885

Test

1886

[SELECT FROM: Mechanisms supporting risk monitoring].

1887

REFERENCES

1888

Source Assessment Procedures: CA-07(04)

1889

03.12.04E Internal System Connections

1890

ASSESSMENT OBJECTIVE

1891

Determine if:

1892 1893

A.03.12.04E.ODP[01]: system components or classes of components requiring internal connections to the system are defined.

1894 1895

A.03.12.04E.ODP[02]: conditions requiring the termination of internal connections are defined.

1896 1897

A.03.12.04E.ODP[03]: the frequency at which to review the continued need for each internal connection is defined.

1898 1899

A.03.12.04E.a: internal connections of <A.03.12.04E.ODP[01]: system components or classes of components> to the system are authorized.

1900 1901

A.03.12.04E.b[01]: for each internal connection, the interface characteristics are documented.

1902 1903

A.03.12.04E.b[02]: for each internal connection, the security requirements are documented.

1904 1905

A.03.12.04E.b[03]: for each internal connection, the nature of the information communicated is documented.

1906 1907

A.03.12.04E.c: internal system connections are terminated after <A.03.12.04E.ODP[02]: conditions>.

1908 1909

A.03.12.04E.d: the continued need for each internal connection is reviewed <A.03.12.04E.ODP[03]: frequency>.

1910

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1911

Examine 56

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1912 1913 1914 1915 1916 1917

[SELECT FROM: Assessment and monitoring policy; access control policy; procedures addressing system connections; system and communications protection policy; system design documentation; system audit records; list of components or classes of components authorized as internal system connections; system security plan; system configuration settings and associated documentation; assessment report; other relevant documents or records].

1918

Interview

1919 1920 1921

[SELECT FROM: Personnel with responsibilities for developing, implementing, or authorizing internal system connections; personnel with information security and responsibilities].

1922

Test

1923

[SELECT FROM: Mechanisms supporting internal system connections].

1924

REFERENCES

1925

Source Assessment Procedures: CA-09

1926

3.13. System and Communications Protection

1927

03.13.01E Heterogeneity

1928

ASSESSMENT OBJECTIVE

1929

Determine if:

1930 1931

A.03.13.01E.ODP[01]: system components requiring a diverse set of information technologies to be employed in the implementation of the system are defined.

1932 1933

A.03.13.01E: a diverse set of information technologies is employed for <A.03.13.01E.ODP[01]: system components> in the implementation of the system.

1934

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1935

Examine

1936 1937 1938 1939 1940

[SELECT FROM: System and communications protection policy; system design documentation; system configuration settings and associated documentation; list of technologies deployed in the system; acquisition documentation; acquisition contracts for system components or services; system security plan; other relevant documents or records].

1941

Interview

1942 1943 1944

[SELECT FROM: System/network administrators; personnel with information security responsibilities; personnel with system acquisition, development, and implementation responsibilities].

57

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

1945

Test

1946 1947

[SELECT FROM: Mechanisms supporting and/or implementing the use of a diverse set of information technologies].

1948

REFERENCES

1949

Source Assessment Procedures: SC-29

1950

03.13.02E Randomness

1951

ASSESSMENT OBJECTIVE

1952

Determine if:

1953 1954

A.03.13.02E.ODP[01]: the techniques employedd to introduce randomness into organizational operations and assets are defined.

1955 1956

A.03.13.02E: <A.03.13.02E.ODP[01]: techniques> are employed to introduce randomness into organizational operations and assets.

1957

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1958

Examine

1959 1960 1961 1962 1963 1964

[SELECT FROM: System and communications protection policy; procedures addressing concealment and misdirection techniques for the system; system design documentation; system configuration settings and associated documentation; system architecture; list of techniques to be used to introduce randomness into organizational operations and assets; system audit records; system security plan; other relevant documents or records].

1965

Interview

1966 1967 1968

[SELECT FROM: System/network administrators; personnel with the responsibility to implement concealment and misdirection techniques for systems; personnel with information security responsibilities].

1969

Test

1970 1971

[SELECT FROM: Mechanisms supporting and/or implementing randomness as a concealment and misdirection technique].

1972

REFERENCES

1973

Source Assessment Procedures: SC-30(02)

58

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

1974

Assessing Enhanced Security Requirements for CUI

03.13.03E Concealment and Misdirection

1975

ASSESSMENT OBJECTIVE

1976

Determine if:

1977 1978

A.03.13.03E.ODP[01]: the concealment and misdirection techniques employed to mislead adversaries potentially targeting systems are defined.

1979 1980

A.03.13.03E: <A.03.13.03E.ODP[01]: concealment and misdirection techniques> are used to mislead adversaries.

1981

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1982

Examine

1983 1984 1985 1986 1987 1988

[SELECT FROM: System and communications protection policy; procedures addressing concealment and misdirection techniques for the system; system design documentation; system configuration settings and associated documentation; system architecture; list of concealment and misdirection techniques to be used for organizational systems; system audit records; system security plan; other relevant documents or records].

1989

Interview

1990 1991 1992

[SELECT FROM: System/network administrators; personnel with information security responsibilities; personnel with the responsibility to implement concealment and misdirection techniques for systems].

1993

Test

1994 1995

[SELECT FROM: Mechanisms supporting and/or implementing concealment and misdirection techniques].

1996

REFERENCES

1997

Source Assessment Procedures: SC-30

1998

03.13.04E Isolation of System Components

1999

ASSESSMENT OBJECTIVE

2000

Determine if:

2001 2002

A.03.13.04E.ODP[01]: system components to be isolated by boundary protection mechanisms are defined.

2003 2004

A.03.13.04E: boundary protection mechanisms are employed to isolate <A.03.13.04E.ODP[01]: system components>.

2005

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2006

Examine 59

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2007 2008 2009 2010 2011

[SELECT FROM: System and communications protection policy; procedures addressing boundary protection; system design documentation; system hardware and software; enterprise architecture documentation; system architecture; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

2012

Interview

2013 2014

[SELECT FROM: System/network administrators; personnel with information security responsibilities; personnel with boundary protection responsibilities].

2015

Test

2016 2017

[SELECT FROM: Mechanisms supporting and/or implementing the capability to separate system components].

2018

REFERENCES

2019

Source Assessment Procedures: SC-07(21)

2020

03.13.05E Change Processing and Storage Locations

2021

ASSESSMENT OBJECTIVE

2022

Determine if:

2023 2024

A.03.13.05E.ODP[01]: processing and/or storage locations to be changed are defined.

2025 2026

A.03.13.05E.ODP[02]: one of the following PARAMETER VALUES is selected: {<A.03.13.05E.ODP[03] time frequency>; at random time intervals}.

2027 2028

A.03.13.05E.ODP[03]: the time frequency at which to change the location of processing and/or storage is defined (if selected).

2029 2030

A.03.13.05E: the location of <A.03.13.05E.ODP[01]: processing and/or storage> is changed <A.03.13.05E.ODP[02]: SELECTED PARAMETER VALUE>.

2031

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2032

Examine

2033 2034 2035 2036 2037 2038

[SELECT FROM: System and communications protection policy; configuration management policy and procedures; procedures addressing concealment and misdirection techniques for the system; list of processing and/or storage locations to be changed at organizational time intervals; change control records; configuration management records; system audit records; system security plan; other relevant documents or records].

60

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2039

Interview

2040 2041 2042

[SELECT FROM: System/network administrators; personnel with information security responsibilities; personnel with the responsibility to change processing and/or storage locations].

2043

Test

2044 2045

[SELECT FROM: Mechanisms supporting and/or implementing changing processing and/or storage locations].

2046

REFERENCES

2047

Source Assessment Procedures: SC-30(03)

2048

03.13.06E Platform-Independent Applications

2049

ASSESSMENT OBJECTIVE

2050

Determine if:

2051 2052

A.03.13.06E.ODP[01]: platform-independent applications to be included within organizational systems are defined.

2053 2054

A.03.13.06E: <A.03.13.06E.ODP[01]: platform-independent applications> are implemented within organizational systems.

2055

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2056

Examine

2057 2058 2059 2060 2061

[SELECT FROM: System and communications protection policy; procedures addressing platform-independent applications; system design documentation; system configuration settings and associated documentation; list of platformindependent applications; system audit records; system security plan; other relevant documents or records].

2062

Interview

2063 2064

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

2065

Test

2066 2067

[SELECT FROM: Mechanisms supporting and/or implementing platform-independent applications].

2068

REFERENCES

2069

Source Assessment Procedures: SC-27

2070

03.13.07E Virtualization Techniques

61

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2071

ASSESSMENT OBJECTIVE

2072

Determine if:

2073 2074

A.03.13.07E.ODP[01]: the frequency at which to change the diversity of operating systems and applications deployed using virtualization techniques is defined.

2075 2076 2077

A.03.13.07E: virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed <A.03.13.07E.ODP[01]: frequency>.

2078

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2079

Examine

2080 2081 2082 2083 2084 2085

[SELECT FROM: System and communications protection policy; configuration management policy and procedures; system design documentation; system configuration settings and associated documentation; system architecture; list of operating systems and applications deployed using virtualization techniques; change control records; configuration management records; system audit records; system security plan; other relevant documents or records].

2086

Interview

2087 2088 2089

[SELECT FROM: System/network administrators; personnel with information security responsibilities; personnel with responsibilities for implementing approved virtualization techniques to the system].

2090

Test

2091 2092 2093

[SELECT FROM: Mechanisms supporting and/or implementing the use of a diverse set of information technologies; mechanisms supporting and/or implementing virtualization techniques].

2094

REFERENCES

2095

Source Assessment Procedures: SC-29(01)

2096

03.13.08E Decoys

62

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2097

ASSESSMENT OBJECTIVE

2098

Determine if:

2099 2100

A.03.13.08E[01]: components within organizational systems specifically designed to be the target of malicious attacks are included to detect such attacks.

2101 2102

A.03.13.08E[02]: components within organizational systems specifically designed to be the target of malicious attacks are included to deflect such attacks.

2103 2104

A.03.13.08E[03]: components within organizational systems specifically designed to be the target of malicious attacks are included to analyze such attacks.

2105

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2106

Examine

2107 2108 2109 2110

[SELECT FROM: System and communications protection policy; procedures addressing the use of decoys; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

2111

Interview

2112 2113

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers].

2114

Test

2115

[SELECT FROM: Mechanisms supporting and/or implementing decoys].

2116

REFERENCES

2117

Source Assessment Procedures: SC-26

2118

03.13.09E Isolation of Security Tools, Mechanisms, and Support Components

2119

ASSESSMENT OBJECTIVE

2120

Determine if:

2121 2122

A.03.13.09E.ODP[01]: information security tools, mechanisms, and support components to be isolated from other internal system components are defined.

2123 2124 2125 2126

A.03.13.09E: <A.03.13.09E.ODP[01]: information security tools, mechanisms, and support components> are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

2127

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2128

Examine

2129

[SELECT FROM: System and communications protection policy; procedures 63

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2130 2131 2132 2133 2134

addressing boundary protection; system design documentation; system hardware and software; system architecture; system configuration settings and associated documentation; list of security tools and support components to be isolated from other internal system components; system audit records; system security plan; other relevant documents or records].

2135

Interview

2136 2137

[SELECT FROM: System/network administrators; personnel with information security responsibilities; personnel with boundary protection responsibilities].

2138

Test

2139 2140

[SELECT FROM: Mechanisms supporting and/or implementing the isolation of information security tools, mechanisms, and support components].

2141

REFERENCES

2142

Source Assessment Procedures: SC-07(13)

2143

03.13.10E Separate Subnetworks

2144

ASSESSMENT OBJECTIVE

2145

Determine if:

2146 2147

A.03.13.10E: separate network addresses are implemented to connect to systems in different security domains.

2148

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2149

Examine

2150 2151 2152 2153 2154

[SELECT FROM: System and communications protection policy; procedures addressing boundary protection; system design documentation; system hardware and software; system architecture; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

2155

Interview

2156 2157 2158

[SELECT FROM: System/network administrators; personnel with information security responsibilities; system developers; personnel with boundary protection responsibilities].

2159

Test

2160 2161

[SELECT FROM: Mechanisms supporting and/or implementing separate network addresses or different subnets].

2162

REFERENCES

2163

Source Assessment Procedures: SC-07(22) 64

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2164

Assessing Enhanced Security Requirements for CUI

03.13.11E Thin Nodes

2165

ASSESSMENT OBJECTIVE

2166

Determine if:

2167 2168

A.03.13.11E.ODP[01]: system components to be implemented with minimal functionality and information storage are defined.

2169 2170

A.03.13.11E[01]: minimal functionality for <A.03.13.11E.ODP[01]: system components> is employed.

2171 2172

A.03.13.11E[02]: minimal information storage on <A.03.13.11E.ODP[01]: system components> is employed.

2173

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2174

Examine

2175 2176 2177 2178

[SELECT FROM: System and communications protection policy; procedures addressing use of thin nodes; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

2179

Interview

2180 2181

[SELECT FROM: System/network administrators; personnel with information security responsibilities].

2182

Test

2183

[SELECT FROM: Mechanisms supporting and/or implementing thin nodes].

2184

REFERENCES

2185

Source Assessment Procedures: SC-25

2186

03.13.12E Denial-of-Service Protection

2187

ASSESSMENT OBJECTIVE

2188

Determine if:

2189 2190

A.03.13.12E.ODP[01]: the types of denial-of-service events to be protected against or limited are defined.

2191 2192

A.03.13.12E.ODP[02]: one of the following PARAMETER VALUES is selected: {protected against; limited}.

2193 2194

A.03.13.12E.ODP[03]: the safeguards to prevent the denial-of-service objective by type of denial-of-service event are defined.

2195 2196

A.03.13.12E.a: the effects of <A.03.13.12E.ODP[01]: types of denial-of-service events> are <A.03.13.12E.ODP[02]: SELECTED PARAMETER VALUE>. 65

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2197 2198

A.03.13.12E.b: <A.03.13.12E.ODP[03]: safeguards> are employed to protect against or limit the effects of denial-of-service events.

2199

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2200

Examine

2201 2202 2203 2204 2205 2206 2207

[SELECT FROM: System and communications protection policy; procedures addressing denial-of-service protection; list of denial-of-service attacks requiring employment of security safeguards to protect against or limit effects of such attacks; system design documentation; list of security safeguards protecting against or limiting the effects of denial-of-service attacks; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

2208

Interview

2209 2210 2211

[SELECT FROM: System/network administrators; personnel with information security responsibilities; personnel with incident response responsibilities; system developers].

2212

Test

2213 2214

[SELECT FROM: Mechanisms protecting against or limiting the effects of denial-ofservice attacks].

2215

REFERENCES

2216

Source Assessment Procedure: SC-05

2217

03.13.13E Port and Input/Output Device Access

2218

ASSESSMENT OBJECTIVE

2219

Determine if:

2220 2221

A.03.13.13E.ODP[01]: connection ports or input/output devices to be disabled or removed are defined.

2222 2223

A.03.13.13E.ODP[02]: one of the following PARAMETER VALUES is selected: {physically; logically}.

2224 2225

A.03.13.13E.ODP[03]: systems or system components with connection ports or input/output devices to be disabled or removed are defined.

2226 2227 2228

A.03.13.13E: <A.03.13.13E.ODP[01]: connection ports or input/output devices> are <A.03.13.13E.ODP[02]: SELECTED PARAMETER VALUE> disabled or removed on <A.03.13.13E.ODP[03]: systems or system components>.

2229

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2230

Examine 66

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2231 2232 2233 2234 2235 2236

[SELECT FROM: System and communications protection policy; access control policy and procedures; procedures addressing port and input/output device access; system design documentation; system architecture; system configuration settings and associated documentation; systems or system components; list of connection ports or input/output devices to be physically disabled or removed on systems or system components; system security plan; other relevant documents or records].

2237

Interview

2238 2239

[SELECT FROM: System/network administrators; personnel with information security responsibilities; personnel installing, configuring, and/or maintaining the system].

2240

Test

2241 2242

[SELECT FROM: Mechanisms supporting and/or implementing the disabling of connection ports or input/output devices].

2243

REFERENCES

2244

Source Assessment Procedure: SC-41

2245

03.13.14E Detonation Chambers

2246

ASSESSMENT OBJECTIVE

2247

Determine if:

2248 2249

A.03.13.14E.ODP[01]: the system, system component, or location in which a detonation chamber capability is to be employed is defined.

2250 2251

A.03.13.14E: a detonation chamber capability is employed within the <A.03.13.14E.ODP[01]: system, system component, or location>.

2252

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2253

Examine

2254 2255 2256 2257

[SELECT FROM: System and communications protection policy; procedures addressing detonation chambers; system configuration settings and associated documentation; system audit records; system design documentation; system security plan; other relevant documents or records].

2258

Interview

2259 2260

[SELECT FROM: system/network administrators; personnel with information security responsibilities; personnel installing, configuring, and/or maintaining the system].

2261

Test

2262 2263

[SELECT FROM: Mechanisms supporting and/or implementing the detonation chamber capability].

2264

REFERENCES 67

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2265 2266

Assessing Enhanced Security Requirements for CUI

Source Assessment Procedures: SC-44 03.13.15E Separate Subnets to Isolate System Components and Functions

2267

ASSESSMENT OBJECTIVE

2268

Determine if:

2269 2270

A.03.13.15E.ODP[01]: one of the following PARAMETER VALUES is selected: {physically; logically}.

2271 2272

A.03.13.15E.ODP[02]: critical system components and functions to be isolated are defined.

2273 2274 2275

A.03.13.15E: subnetworks are separated <A.03.13.15E.ODP[01]: SELECTED PARAMETER VALUE> to isolate <A.03.13.15E.ODP[02]: critical system components and functions>.

2276

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2277

Examine

2278 2279 2280 2281 2282

[SELECT FROM: System and communications protection policy; procedures addressing boundary protection; system design documentation; system hardware and software; system architecture; system configuration settings and associated documentation; criticality analysis; system audit records; system security plan; other relevant documents or records].

2283

Interview

2284 2285 2286

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developer; organizational personnel with boundary protection responsibilities].

2287

Test

2288

[SELECT FROM: Mechanisms separating critical system components and functions].

2289

REFERENCES

2290

Source Assessment Procedures: SC-07(29)

2291

03.13.16E System Partitioning

2292

ASSESSMENT OBJECTIVE

2293

Determine if:

2294 2295 2296

A.03.13.16E.ODP[01]: system components to reside in separate physical or logical domains or environments based on circumstances for the physical or logical separation of components are defined.

68

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2297 2298

A.03.13.16E.ODP[02]: one of the following PARAMETER VALUES is selected: {physical; logical}.

2299 2300

A.03.13.16E.ODP[03]: circumstances for the physical or logical separation of components are defined.

2301 2302 2303

A.03.13.16E: the system is partitioned into <A.03.13.16E.ODP[01]: system components> residing in separate <A.03.13.16E.ODP[02]: SELECTED PARAMETER VALUE> domains or environments based on <A.03.13.16E.ODP[03]: circumstances>.

2304

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2305

Examine

2306 2307 2308 2309 2310

[SELECT FROM: System and communications protection policy; procedures addressing system partitioning; system design documentation; system configuration settings and associated documentation; system architecture; list of system physical domains (or environments); system facility diagrams; system network diagrams; system security plan; other relevant documents or records].

2311

Interview

2312 2313 2314

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; system developers/integrators].

2315

Test

2316 2317

[SELECT FROM: Mechanisms supporting and/or implementing the physical separation of system components].

2318

REFERENCES

2319

Source Assessment Procedures: SC-32

2320

3.14. System and Information Integrity

2321

03.14.01E Software, Firmware, and Information Integrity

2322

ASSESSMENT OBJECTIVE

2323

Determine if:

2324 2325

A.03.14.01E.ODP[01]: software requiring integrity verification tools to be used to detect unauthorized changes is defined.

2326 2327

A.03.14.01E.ODP[02]: firmware requiring integrity verification tools to be used to detect unauthorized changes is defined.

2328 2329

A.03.14.01E.ODP[03]: information requiring integrity verification tools to be used to detect unauthorized changes is defined.

2330

A.03.14.01E.ODP[04]: actions to be taken when unauthorized changes to software 69

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2331

are detected are defined.

2332 2333

A.03.14.01E.ODP[05]: actions to be taken when unauthorized changes to firmware are detected are defined.

2334 2335

A.03.14.01E.ODP[06]: actions to be taken when unauthorized changes to information are detected are defined.

2336 2337

A.03.14.01E.a[01]: integrity verification tools are employed to detect unauthorized changes to <A.03.14.01E.ODP[01]: software>.

2338 2339

A.03.14.01E.a[02]: integrity verification tools are employed to detect unauthorized changes to <A.03.14.01E.ODP[02]: firmware>.

2340 2341

A.03.14.01E.a[03]: integrity verification tools are employed to detect unauthorized changes to <A.03.14.01E.ODP[03]: information>.

2342 2343

A.03.14.01E.b[01]: <A.03.14.01E.ODP[04]: actions> are taken when unauthorized changes to software are detected.

2344 2345

A.03.14.01E.b[02]: <A.03.14.01E.ODP[05]: actions> are taken when unauthorized changes to firmware are detected.

2346 2347

A.03.14.01E.b[03]: <A.03.14.01E.ODP[06]: actions> are taken when unauthorized changes to information are detected.

2348

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2349

Examine

2350 2351 2352 2353 2354 2355 2356

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software, firmware, and information integrity; system configuration settings and associated documentation; integrity verification tools and associated documentation; records generated or triggered by system design documentation; integrity verification tools regarding unauthorized software, firmware, and information changes; system audit records; system security plan; other relevant documents or records].

2357

Interview

2358 2359 2360

[SELECT FROM: Personnel responsible for software, firmware, and/or information integrity; personnel with information security responsibilities; system/network administrators].

2361

Test

2362

[SELECT FROM: Software, firmware, and information integrity verification tools].

2363

REFERENCES

2364

Source Assessment Procedure: SI-07

70

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2365 2366 2367 2368 2369 2370

Assessing Enhanced Security Requirements for CUI

03.14.02E Withdrawn Addressed by 03.14.06 (SP 800-171). 03.14.03E Withdrawn Addressed by 03.15.01E, 03.13.16E, 03.12.01 (SP 800-171), 03.13.01 (SP 800-171), and 03.16.01 (SP 800-171). 03.14.04E Refresh From Trusted Sources

2371

ASSESSMENT OBJECTIVE

2372

Determine if:

2373 2374

A.03.14.04E.ODP[01]: trusted sources to obtain software and data for system component and service refreshes are defined.

2375 2376

A.03.13.14E: the software and data used during system component and service refreshes are obtained from <A.03.14.04E.ODP[01]: trusted sources>.

2377

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2378

Examine

2379 2380 2381 2382 2383

[SELECT FROM: System and information integrity policy; system and information integrity procedures; system design documentation; procedures addressing nonpersistence for system components; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

2384

Interview

2385 2386

[SELECT FROM: Personnel responsible for obtaining component and service refreshes from trusted sources; personnel with information security responsibilities].

2387

Test

2388 2389 2390

[SELECT FROM: Processes for defining and obtaining component and service refreshes from trusted sources; automated mechanisms supporting and/or implementing component and service refreshes].

2391

REFERENCES

2392

Source Assessment Procedures: SI-14(01)

71

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2393

Assessing Enhanced Security Requirements for CUI

03.14.05E Non-Persistent Information

2394

ASSESSMENT OBJECTIVE

2395

Determine if:

2396 2397 2398

A.03.14.05E.ODP[01]: one of the following PARAMETER VALUES is selected: {refresh <A.03.14.05E.ODP[02] information> <A.03.14.05E.ODP[03] frequency>; generate <A.03.14.05E.ODP[04] information> on demand}.

2399

A.03.14.05E.ODP[02]: the information to be refreshed is defined (if selected).

2400 2401

A.03.14.05E.ODP[03]: the frequency at which to refresh information is defined (if selected).

2402 2403

A.03.14.05E.ODP[04]: the information to be generated on demand is defined (if selected).

2404 2405

A.03.14.05E.a: <A.03.14.05E.ODP[01]: SELECTED PARAMETER VALUE> is performed.

2406

A.03.14.05E.b: information is deleted when no longer needed.

2407

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2408

Examine

2409 2410 2411 2412 2413

[SELECT FROM: System and information integrity policy; system and information integrity procedures; system security plan; procedures addressing non-persistence for system components; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records].

2414

Interview

2415 2416

[SELECT FROM: Personnel responsible for ensuring that information is and remains non-persistent; personnel with information security responsibilities].

2417

Test

2418 2419 2420

[SELECT FROM: Processes for ensuring that information is and remains nonpersistent; automated mechanisms supporting and/or implementing component and service refreshes].

2421

REFERENCES

2422

Source Assessment Procedure: SI-14(02)

2423 2424

03.14.06E Withdrawn Addressed by 03.11.02E and 03.11.09E.

72

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2425 2426 2427 2428

Assessing Enhanced Security Requirements for CUI

03.14.07E Withdrawn Addressed by 03.14.08E, 03.14.10E, 03.14.14E, , 03.17.03E, and 03.16.01 (SP 800171). 03.14.08E Integrity Checks

2429

ASSESSMENT OBJECTIVE

2430

Determine if:

2431 2432

A.03.14.08E.ODP[01]: software on which an integrity check is to be performed is defined.

2433 2434 2435

A.03.14.08E.ODP[02]: one or more of the following PARAMETER VALUES is/are selected: {at startup; at <A.03.14.08E.ODP[03] transitional states or securityrelevant events>; <A.03.14.08E.ODP[04] frequency>}.

2436 2437

A.03.14.08E.ODP[03]: transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected).

2438 2439

A.03.14.08E.ODP[04]: the frequency at which to perform an integrity check (on software) is defined (if selected).

2440 2441

A.03.14.08E.ODP[05]: firmware on which an integrity check is to be performed is defined.

2442 2443 2444

A.03.14.08E.ODP[06]: one or more of the following PARAMETER VALUES is/are selected: {at startup; at <A.03.14.08E.ODP[07] transitional states or securityrelevant events>; <A.03.14.08E.ODP[08] frequency>}.

2445 2446

A.03.14.08E.ODP[07]: transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected).

2447 2448

A.03.14.08E.ODP[08]: the frequency at which to perform an integrity check (on firmware) is defined (if selected).

2449 2450

A.03.14.08E.ODP[09]: information on which an integrity check is to be performed is defined.

2451 2452 2453

A.03.14.08E.ODP[10]: one or more of the following PARAMETER VALUES is/are selected: {at startup; at <A.03.14.08E.ODP[11] transitional states or securityrelevant events>; <A.03.14.08E.ODP[12] frequency>}.

2454 2455

A.03.14.08E.ODP[11]: transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected).

2456 2457

A.03.14.08E.ODP[12]: the frequency at which to perform an integrity check (of information) is defined (if selected).

2458 2459

A.03.14.08E[01]: an integrity check of <A.03.14.08E.ODP[01]: software> is performed <A.03.14.05E.ODP[02]: SELECTED PARAMETER VALUE(S)>.

73

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2460 2461

A.03.14.08E[02]: an integrity check of <A.03.14.08E.ODP[05]: firmware> is performed <A.03.14.08E.ODP[06]: SELECTED PARAMETER VALUE(S)>.

2462 2463

A.03.14.08E[03]: an integrity check of <A.03.14.08E.ODP[09]: information> is performed <A.03.14.08E.ODP[10]: SELECTED PARAMETER VALUE(S)>.

2464

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2465

Examine

2466 2467 2468 2469 2470 2471

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software, firmware, and information integrity testing; system design documentation; system configuration settings and associated documentation; system security plan; integrity verification tools and associated documentation; records of integrity scans; other relevant documents or records].

2472

Interview

2473 2474 2475

[SELECT FROM: Personnel responsible for software, firmware, and/or information integrity; personnel with information security responsibilities; system/network administrators; system developers].

2476

Test

2477

[SELECT FROM: Software, firmware, and information integrity verification tools].

2478

REFERENCES

2479

Source Assessment Procedure: SI-07(01)

2480

03.14.09E Cryptographic Protection

2481

ASSESSMENT OBJECTIVE

2482

Determine if:

2483 2484

A.03.14.09E[01]: cryptographic mechanisms are implemented to detect unauthorized changes to software.

2485 2486

A.03.14.09E[02]: cryptographic mechanisms are implemented to detect unauthorized changes to firmware.

2487 2488

A.03.14.09E[03]: cryptographic mechanisms are implemented to detect unauthorized changes to information.

2489

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2490

Examine

2491 2492 2493

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software, firmware, and information integrity; system design documentation; system configuration settings and 74

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2494 2495 2496 2497

associated documentation; system audit records; system security plan; cryptographic mechanisms and associated documentation; records of detected unauthorized changes to software, firmware, and information; other relevant documents or records].

2498

Interview

2499 2500 2501

[SELECT FROM: Personnel responsible for software, firmware, and/or information integrity; personnel with information security responsibilities; system/network administrators; system developers].

2502

Test

2503 2504 2505

[SELECT FROM: Software, firmware, and information integrity verification tools; cryptographic mechanisms implementing software, firmware, and information integrity].

2506

REFERENCES

2507

Source Assessment Procedures: SI-07(06)

2508

03.14.10E Protection of Boot Firmware

2509

ASSESSMENT OBJECTIVE

2510

Determine if:

2511 2512

A.03.14.10E.ODP[01]: mechanisms to be implemented to protect the integrity of boot firmware in system components are defined.

2513 2514

A.03.14.10E.ODP[02]: system components requiring mechanisms to protect the integrity of boot firmware are defined.

2515 2516

A.03.14.10E: <A.03.14.10E.ODP[01]: mechanisms> are implemented to protect the integrity of boot firmware in <A.03.14.10E.ODP[02]: system components>.

2517

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2518

Examine

2519 2520 2521 2522 2523 2524

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software, firmware, and information integrity; system design documentation; system configuration settings and associated documentation; system security plan; integrity verification tools and associated documentation; records of integrity verification scans; system audit records; other relevant documents or records].

2525

Interview

2526 2527 2528

[SELECT FROM: Personnel responsible for software, firmware, and/or information integrity; personnel with information security responsibilities; system/network administrators; system developer]. 75

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2529

Test

2530 2531 2532

[SELECT FROM: Software, firmware, and information integrity verification tools; mechanisms supporting and/or implementing protection of the integrity of boot firmware; safeguards implementing protection of the integrity of boot firmware].

2533

REFERENCES

2534

Source Assessment Procedures: SI-07(10)

2535

03.14.11E Integration of Detection and Response

2536

ASSESSMENT OBJECTIVE

2537

Determine if:

2538

A.03.14.11E.ODP[01]: security-relevant changes to the system are defined.

2539 2540

A.03.14.11E: the detection of <A.03.14.11E.ODP[01]: changes> are incorporated into the organizational incident response capability.

2541

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2542

Examine

2543 2544 2545 2546 2547

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software, firmware, and information integrity; procedures addressing incident response; system design documentation; system configuration settings and associated documentation; incident response records; audit records; system security plan; other relevant documents or records].

2548

Interview

2549 2550 2551

[SELECT FROM: Personnel responsible for software, firmware, and/or information integrity; personnel with information security responsibilities; personnel with incident response responsibilities].

2552

Test

2553 2554 2555 2556 2557

[SELECT FROM: Processes for incorporating the detection of unauthorized securityrelevant changes into the incident response capability; mechanisms supporting and/or implementing the incorporation of detection of unauthorized securityrelevant changes into the incident response capability; software, firmware, and information integrity verification tools].

2558

REFERENCES

2559

Source Assessment Procedures: SI-07(07)

76

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2560

Assessing Enhanced Security Requirements for CUI

03.14.12E Information Input Validation

2561

ASSESSMENT OBJECTIVE

2562

Determine if:

2563 2564

A.03.14.12E.ODP[01]: information inputs to the system requiring validity checks are defined.

2565 2566

A.03.14.12E: the validity of the <A.03.14.12E.ODP[01]: information inputs> is checked.

2567

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2568

Examine

2569 2570 2571 2572 2573 2574 2575

[SELECT FROM: System and information integrity policy; system and information integrity procedures; access control policy and procedures; separation of duties policy and procedures; procedures addressing information input validation; documentation for automated tools and applications to verify the validity of information; list of information inputs requiring validity checks; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

2576

Interview

2577 2578 2579

[SELECT FROM: Personnel responsible for information input validation; personnel with information security responsibilities; system/network administrators; system developers].

2580

Test

2581 2582

[SELECT FROM: Mechanisms supporting and/or implementing validity checks on information inputs].

2583

REFERENCES

2584

Source Assessment Procedures: SI-10

2585

03.14.13E Error Handling

2586

ASSESSMENT OBJECTIVE

2587

Determine if:

2588 2589

A.03.14.13E.ODP[01]: personnel or roles to whom error messages are to be revealed are defined.

2590 2591

A.03.14.13E.a: error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited.

2592 2593

A.03.14.13E.b: error messages are revealed only to <A.03.14.13E.ODP[01]: personnel or roles>. 77

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2594

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2595

Examine

2596 2597 2598 2599 2600

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing system error handling; system design documentation; system configuration settings and associated documentation; documentation providing the structure and content of error messages; system audit records; system security plan; other relevant documents or records].

2601

Interview

2602 2603 2604

[SELECT FROM: Personnel responsible for information input validation; personnel with information security responsibilities; system/network administrators; system developers].

2605

Test

2606 2607 2608

[SELECT FROM: Processes for error handling; automated mechanisms supporting and/or implementing error handling; automated mechanisms supporting and/or implementing the management of error messages].

2609

REFERENCES

2610

Source Assessment Procedure: SI-11

2611

03.14.14E Memory Protection

2612

ASSESSMENT OBJECTIVE

2613

Determine if:

2614 2615

A.03.14.14E.ODP[01]: safeguards to be implemented to protect the system memory from unauthorized code execution are defined.

2616 2617

A.03.14.14E: <A.03.14.14E.ODP[01]: safeguards> are implemented to protect the system memory from unauthorized code execution.

2618

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2619

Examine

2620 2621 2622 2623 2624 2625

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing memory protection for the system; system design documentation; system configuration settings and associated documentation; list of security safeguards protecting system memory from unauthorized code execution; system audit records; system security plan; other relevant documents or records].

78

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2626

Interview

2627 2628 2629

[SELECT FROM: Personnel responsible for memory protection; personnel with information security responsibilities; system/network administrators; system developers].

2630

Test

2631 2632

[SELECT FROM: Automated mechanisms supporting and/or implementing safeguards to protect the system memory from unauthorized code execution].

2633

REFERENCES

2634

Source Assessment Procedure: SI-16

2635

03.14.15E Non-Persistent System Components and Services

2636

ASSESSMENT OBJECTIVE

2637

Determine if:

2638 2639

A.03.14.15E.ODP[01]: non-persistent system components and services to be implemented are defined.

2640 2641

A.03.14.15E.ODP[02]: one or more of the following PARAMETER VALUES is/are selected: {upon end of session of use; <A.03.14.15E.ODP[03] frequency>}.

2642 2643

A.03.14.15E.ODP[03]: the frequency at which to terminate non-persistent components and services that are initiated in a known state is defined (if selected).

2644 2645

A.03.14.15E.a: <A.03.14.15E.ODP[01]: non-persistent system components and services> that are initiated in a known state are implemented.

2646 2647

A.03.14.15E.b: <A.03.14.15E.ODP[01]: non-persistent system components and services> that are initiated from a known state are implemented.

2648 2649

A.03.14.15E.c: <A.03.14.13E.ODP[01]: non-persistent system components and services> are terminated <A.03.14.15E.ODP[02]: SELECTED PARAMETER VALUE(S)>.

2650

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2651

Examine

2652 2653 2654 2655 2656

[SELECT FROM: System and information integrity policy; system and information integrity procedures; system design documentation; procedures addressing nonpersistence for system components; system security plan; system configuration settings and associated documentation; system audit records; other relevant documents or records].

2657

Interview

2658 2659

[SELECT FROM: Personnel responsible for non-persistence; personnel with information security responsibilities; system/network administrators; system 79

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2660

developers].

2661

Test

2662 2663

[SELECT FROM: Automated mechanisms supporting and/or implementing the initiation and termination of non-persistent components].

2664

REFERENCES

2665

Source Assessment Procedure: SI-14

2666

03.14.16E Tainting

2667

ASSESSMENT OBJECTIVE

2668

Determine if:

2669 2670

A.03.14.16E.ODP[01]: systems or system components with data or capabilities to be embedded are defined.

2671 2672 2673

A.03.14.16E: data or capabilities are embedded in <A.03.14.16E.ODP[01]: systems or system components> to determine if CUI has been exfiltrated or improperly removed from the organization.

2674

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2675

Examine

2676 2677 2678 2679 2680

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software and information integrity; system design documentation; system configuration settings and associated documentation; policy and procedures addressing the systems security engineering technique of deception; system security plan; other relevant documents or records].

2681

Interview

2682 2683 2684

[SELECT FROM: Personnel responsible for detecting tainted data; personnel with systems security engineering responsibilities; personnel with information security responsibilities].

2685

Test

2686 2687 2688

[SELECT FROM: Automated mechanisms for post-breach detection; decoys, traps, lures, and methods for deceiving adversaries; detection and notification mechanisms].

2689

REFERENCES

2690

Source Assessment Procedure: SI-20

80

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2691

03.14.17E System-Generated Alerts

2692

ASSESSMENT OBJECTIVE

2693

Determine if:

2694 2695

A.03.14.17E.ODP[01]: personnel or roles to be alerted when indications of compromise are defined.

2696

A.03.14.17E.ODP[02]: compromise indicators are defined.

2697 2698

A.03.14.17E: <A.03.14.17E.ODP[01]: personnel or roles> are alerted when systemgenerated <A.03.14.17E.ODP[02]: indicators of compromise> occur.

2699

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2700

Examine

2701 2702 2703 2704 2705 2706

[SELECT FROM: System and information integrity policy; system and information integrity procedures; system security plan; system audit records; procedures addressing system monitoring tools and techniques; system monitoring tools and techniques documentation; list of personnel selected to receive alerts; system configuration settings and associated documentation; documentation of alerts generated based on compromise indicators; other relevant documents or records].

2707

Interview

2708 2709 2710 2711 2712

[SELECT FROM: Personnel with information security responsibilities; system developers; personnel installing, configuring, and/or maintaining the system; personnel responsible for monitoring the system; personnel on the system alert notification list; personnel responsible for the intrusion detection system; system/network administrators].

2713

Test

2714 2715 2716 2717

[SELECT FROM: Processes for intrusion detection and system monitoring; mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities; mechanisms supporting and/or implementing alerts for compromise indicators].

2718

REFERENCES

2719

Source Assessment Procedure: SI-04(05)

81

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2720

Assessing Enhanced Security Requirements for CUI

03.14.18E Automated Organization-Generated Alerts

2721

ASSESSMENT OBJECTIVE

2722

Determine if:

2723 2724

A.03.14.18E.ODP[01]: personnel or roles to be alerted when indications of inappropriate or unusual activities with security implications occur are defined.

2725 2726

A.03.14.18E.ODP[02]: automated mechanisms used to alert personnel or roles are defined.

2727 2728

A.03.14.18E.ODP[03]: activities that trigger alerts to personnel or roles are defined.

2729 2730 2731

A.03.14.18E: <A.03.14.18E.ODP[01]: personnel or roles> are alerted using <A.03.14.18E.ODP[02]: automated mechanisms> when <A.03.14.18E.ODP[03]: activities> indicate inappropriate or unusual activities with security implications.

2732

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2733

Examine

2734 2735 2736 2737 2738 2739 2740 2741

[SELECT FROM: System and information integrity policy; system and information integrity procedures; system security plan; list of inappropriate or unusual activities with security implications that trigger alerts; suspicious activity reports; system monitoring tools and techniques documentation; system design documentation; procedures addressing system monitoring tools and techniques; alerts provided to security personnel; system configuration settings and associated documentation; system monitoring logs or records; system audit records; other relevant documents or records].

2742

Interview

2743 2744 2745 2746

[SELECT FROM: Personnel with information security responsibilities; system developers; personnel installing, configuring, and/or maintaining the system; personnel responsible for monitoring the system; personnel responsible for the intrusion detection system; system/network administrators].

2747

Test

2748 2749 2750 2751

[SELECT FROM: Processes for intrusion detection and system monitoring; automated mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities; automated mechanisms supporting and/or implementing automated alerts to security personnel].

2752

REFERENCES

2753

Source Assessment Procedure: SI-04(12)

82

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2754

3.15. Planning

2755

03.15.01E Security Architecture

Assessing Enhanced Security Requirements for CUI

2756

ASSESSMENT OBJECTIVE

2757

Determine if:

2758 2759

A.03.15.01E.ODP[01]: the frequency for reviewing and updating the security architecture to reflect changes in the enterprise architecture is defined.

2760 2761 2762

A.03.15.01E.a.01: a security architecture for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of CUI is developed.

2763 2764 2765

A.03.15.01E.a.02: a security architecture for the system that describes how the security architecture is integrated into and supports the enterprise architecture is developed.

2766 2767 2768

A.03.15.01E.a.03: a security architecture for the system that describes any assumptions about and dependencies on external systems and services is developed.

2769 2770

A.03.15.01E.b: the security architecture is reviewed and updated <A.03.15.01E.ODP[01]: frequency> to reflect changes in the enterprise architecture.

2771 2772 2773

A.03.15.01E.c: planned security architecture changes are reflected in system security plans, concept of operations, criticality analyses, organizational procedures, procurements, and acquisitions.

2774

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2775

Examine

2776 2777 2778 2779 2780 2781

[SELECT FROM: Security planning policy; procedures addressing information security architecture development; procedures addressing information security architecture reviews and updates; enterprise architecture documentation; information security architecture documentation; system security plan; security CONOPS for the system; records of information security architecture reviews and updates; other relevant documents or records].

2782

Interview

2783 2784 2785

[SELECT FROM: Personnel with security planning and plan implementation responsibilities; personnel with information security responsibilities; personnel with information security architecture development responsibilities].

2786

Test

2787 2788 2789

[SELECT FROM: Mechanisms supporting and/or implementing the development, review, and update of the information security architecture; processes for developing, reviewing, and updating the information security architecture]. 83

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2790

REFERENCES

2791

Source Assessment Procedures: PL-08

2792

03.15.02E Defense In Depth

2793

ASSESSMENT OBJECTIVE

2794

Determine if:

2795 2796

A.03.15.02E.ODP[01]: security requirements to be allocated to architectural layers and locations are defined.

2797

A.03.15.02E.ODP[02]: architectural layers and locations are defined.

2798 2799

A.03.15.02E.a: the security architecture for the system is designed using a defensein-depth approach.

2800 2801

A.03.15.02E.b: <A.03.15.02E.ODP[01]: security requirements> are allocated to <A.03.15.02E.ODP[02]: architectural layers and locations>.

2802 2803

A.03.15.02E.c: the security requirements allocated to the architectural layers and locations are coordinated and mutually reinforcing.

2804

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2805

Examine

2806 2807 2808 2809

[SELECT FROM: Security planning policy; procedures addressing information security architecture development; enterprise architecture documentation; information security architecture documentation; system security plan; security CONOPS for the system; other relevant documents or records].

2810

Interview

2811 2812 2813

[SELECT FROM: Personnel with information security responsibilities; personnel with information security architecture development responsibilities; personnel with security planning and plan implementation responsibilities].

2814

Test

2815 2816 2817

[SELECT FROM: Processes for designing the information security architecture; mechanisms supporting and/or implementing the design of the information security architecture].

2818

REFERENCES

2819

Source Assessment Procedures: PL-08(01)

84

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2820

Assessing Enhanced Security Requirements for CUI

03.15.03E Supplier Diversity

2821

ASSESSMENT OBJECTIVE

2822

Determine if:

2823 2824

A.03.15.03E.ODP[01]: safeguards to be allocated to architectural layers and locations are defined.

2825

A.03.15.03E.ODP[02]: architectural layers and locations are defined.

2826 2827 2828

A.03.15.03E: <A.03.15.03E.ODP[01]: safeguards> that are allocated to <A.03.15.03E.ODP[02]: architectural layers and locations> are obtained from different suppliers.

2829

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2830

Examine

2831 2832 2833 2834

[SELECT FROM: Security planning policy; procedures addressing information security architecture development; enterprise architecture documentation; information security architecture documentation; system security plan; security CONOPS for the system; IT acquisitions policy; other relevant documents or records].

2835

Interview

2836 2837 2838 2839

[SELECT FROM: Personnel with acquisition responsibilities personnel with information security responsibilities; personnel with security planning and plan implementation responsibilities; personnel with information security architecture development responsibilities].

2840

Test

2841 2842

[SELECT FROM: Processes for obtaining information security safeguards from different suppliers].

2843

REFERENCES

2844

Source Assessment Procedures: PL-08(02)

2845

3.16. System and Services Acquisition

2846

03.16.01E Specialization

2847

ASSESSMENT OBJECTIVE

2848

Determine if:

2849 2850

A.03.16.01E.ODP[01]: one or more of the following PARAMETER VALUES is/are selected: {design; modification; augmentation; reconfiguration}.

85

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2851 2852

A.03.16.01E.ODP[02]: systems or system components supporting mission-essential services or functions are defined.

2853 2854 2855 2856

A.03.16.01E: <A.03.16.01E.ODP[01]: SELECTED PARAMETER VALUE(S)> is/are employed to <A.03.16.01E.ODP[02]: systems or system components> supporting mission-essential services or functions to increase the trustworthiness in those systems or components.

2857

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2858

Examine

2859 2860 2861 2862 2863

[SELECT FROM: System and services acquisition policy; procedures addressing design modification, augmentation, or reconfiguration of systems or system components; documented evidence of design modification, augmentation, or reconfiguration; system security plan; supply chain risk management plan; other relevant documents or records].

2864

Interview

2865 2866 2867 2868

[SELECT FROM: Personnel with system and service acquisition responsibilities; personnel with information security responsibilities; personnel with security architecture responsibilities; personnel with configuration management responsibilities].

2869

Test

2870 2871 2872 2873

[SELECT FROM: Processes for the modification, design, augmentation, or reconfiguration of systems or system components; mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components].

2874

REFERENCES

2875

Source Assessment Procedure: SA-23

2876

3.17. Supply Chain Risk Management

2877

03.17.01E Notification Agreements

2878

ASSESSMENT OBJECTIVE

2879

Determine if:

2880 2881 2882

A.03.17.01E.ODP[01]: one or more of the following PARAMETER VALUES is/are selected: {notification of supply chain compromises; results of assessments or audits; provision of <A.03.17.01E.ODP[02]: information>}.

86

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2883 2884

A.03.17.01E.ODP[02]: information for which agreements and procedures are to be established is defined (if selected).

2885 2886 2887

A.03.17.01E: agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for <A.03.17.01E.ODP[01]: SELECTED PARAMETER VALUE(S)>.

2888

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2889

Examine

2890 2891 2892 2893 2894 2895

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; acquisition contracts for the system, system component, or system service; procedures addressing supply chain protection; acquisition documentation; service-level agreements; system security plan; inter-organizational agreements and procedures; other relevant documents or records].

2896

Interview

2897 2898 2899

[SELECT FROM: Personnel with system and service acquisition responsibilities; personnel with information security responsibilities; personnel with supply chain risk management responsibilities].

2900

Test

2901 2902

[SELECT FROM: Processes for establishing inter-organizational agreements and procedures with supply chain entities].

2903

REFERENCES

2904

Source Assessment Procedure: SR-08

2905

03.17.02E Inspection of Systems or Components

2906

ASSESSMENT OBJECTIVE

2907

Determine if:

2908 2909

A.03.17.02E.ODP[01]: systems or system components that require inspection are defined.

2910 2911 2912

A.03.17.02E.ODP[02]: one or more of the following PARAMETER VALUES is/are selected: {at random; <A.03.17.02E.ODP[03]: frequency>; upon <A.03.17.02E.ODP[04]: indications of the need for inspection>}.

2913 2914

A.03.17.02E.ODP[03]: the frequency at which to inspect systems or system components is defined (if selected).

2915 2916

A.03.17.02E.ODP[04]: indications of the need for an inspection of systems or system components are defined (if selected).

87

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2917 2918

A.03.17.02E: <A.03.17.02E.ODP[01]: systems or system components> are inspected <A.03.17.02E.ODP[02]: SELECTED PARAMETER VALUE(S)> to detect tampering.

2919

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2920

Examine

2921 2922 2923 2924 2925 2926

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; records of random inspections; inspection reports or results; assessment reports or results; acquisition documentation; acquisition contracts for the system, system component, or system service; inter-organizational agreements and procedures; system security plan; service-level agreements; other relevant documents or records].

2927

Interview

2928 2929 2930

[SELECT FROM: Personnel with system and services acquisition responsibilities; personnel with information security responsibilities; personnel with supply chain risk management responsibilities].

2931

Test

2932 2933

[SELECT FROM: Processes for establishing inter-organizational agreements and procedures with supply chain entities; processes to inspect for tampering].

2934

REFERENCES

2935

Source Assessment Procedure: SR-10

2936

03.17.03E Component Authenticity

2937

ASSESSMENT OBJECTIVE

2938

Determine if:

2939 2940 2941

A.03.17.03E.ODP[01]: one or more of the following PARAMETER VALUES is/are selected: {source of counterfeit component; <A.03.17.03E.ODP[02]: external reporting organizations>; <A.03.17.03E.ODP[03]: personnel or roles>}.

2942 2943

A.03.17.03E.ODP[02]: external reporting organizations to whom counterfeit system components are to be reported are defined (if selected).

2944 2945

A.03.17.03E.ODP[03]: personnel or roles to whom counterfeit system components are to be reported are defined (if selected).

2946

A.03.17.03E.a[01]: an anti-counterfeit policy is developed and implemented.

2947

A.03.17.03E.a[02]: anti-counterfeit procedures are developed and implemented.

2948 2949

A.03.17.03E.a[03]: the anti-counterfeit policy and procedures include the means to detect counterfeit components entering the system.

88

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

2950 2951

A.03.17.03E.a[04]: the anti-counterfeit policy and procedures include the means to prevent counterfeit components from entering the system.

2952 2953

A.03.17.03E.b: counterfeit system components are reported to <A.03.17.03E.ODP[01]: SELECTED PARAMETER VALUE(S)>.

2954

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2955

Examine

2956 2957 2958 2959 2960 2961 2962 2963 2964

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; anti-counterfeit plan; anti-counterfeit policy and procedures; media disposal policy; media protection policy; incident response policy; reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components; acquisition documentation; service-level agreements; acquisition contracts for the system, system component, or system service; inter-organizational agreements and procedures; records of reported counterfeit system components; system security plan; other relevant documents or records].

2965

Interview

2966 2967 2968 2969

[SELECT FROM: Personnel with system and service acquisition responsibilities; personnel with information security responsibilities; personnel with supply chain risk management responsibilities; personnel with responsibilities for anti-counterfeit policies, procedures, and reporting].

2970

Test

2971 2972 2973

[SELECT FROM: Processes for counterfeit prevention, detection, and reporting; mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting].

2974

REFERENCES

2975

Source Assessment Procedure: SR-11

2976

03.17.04E Provenance

2977

ASSESSMENT OBJECTIVE

2978

Determine if:

2979 2980

A.03.17.04E.ODP[01]: systems, system components, and associated CUI that require valid provenance are defined.

2981 2982

A.03.17.04E[01]: valid provenance is documented for <A.03.17.04E.ODP[01]: systems, system components, and associated CUI>.

2983 2984

A.03.17.04E[02]: valid provenance is monitored for <A.03.17.04E.ODP[01]: systems, system components, and associated CUI>.

89

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

2985 2986

Assessing Enhanced Security Requirements for CUI

A.03.17.04E[03]: valid provenance is maintained for <A.03.17.04E.ODP[01]: systems, system components, and associated CUI>.

2987 2988

POTENTIAL ASSESSMENT METHODS AND OBJECTS

2989

Examine

2990 2991 2992 2993 2994 2995 2996

[SELECT FROM: Supply chain risk management policy; supply chain risk management procedures; supply chain risk management plan; documentation of critical systems, critical system components, and associated data; documentation showing the history of ownership, custody, and location of and changes to critical systems or critical system components; system architecture; inter-organizational agreements and procedures; contracts; system security plan; other relevant documents or records].

2997

Interview

2998 2999 3000

[SELECT FROM: Organizational personnel with acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities].

3001

Test

3002 3003 3004

[SELECT FROM: Organizational processes for identifying the provenance of critical systems and critical system components; mechanisms used to document, monitor, or maintain provenance].

3005

REFERENCES

3006

Source Assessment Procedure: SR-04

3007

03.17.05E Supply Chain Integrity – Pedigree

3008

ASSESSMENT OBJECTIVE

3009

Determine if:

3010 3011

A.03.17.05E.ODP[01]: safeguards employed to ensure the integrity of the system and system component are defined.

3012 3013 3014 3015

A.03.17.05E.ODP[02]: an analysis method to be conducted to validate the internal composition and provenance of critical or mission-essential technologies, products, and services to ensure the integrity of the system and system component is defined.

3016 3017

A.03.17.05E[01]: <A.03.17.05E.ODP[01]: safeguards> are employed to ensure the integrity of the system and system components.

3018 3019

A.03.17.05E[02]: <A.03.17.05E.ODP[02]: analysis method> is conducted to ensure the integrity of the system and system components.

90

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3020

POTENTIAL ASSESSMENT METHODS AND OBJECTS

3021

Examine

3022 3023 3024 3025 3026 3027 3028

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; procedures addressing supply chain protection; bill of materials for critical systems or system components; acquisition documentation; software identification tags; manufacturer declarations of platform attributes (e.g., serial numbers, hardware component inventory) and measurements (e.g., firmware hashes) that are tightly bound to the hardware itself; system security plan; other relevant documents or records].

3029

Interview

3030 3031 3032

[[SELECT FROM: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities].

3033

Test

3034 3035 3036 3037 3038

[SELECT FROM: Organizational processes for identifying pedigree information; organizational processes to determine and validate the integrity of the internal composition of critical systems and critical system components; mechanisms to determine and validate the integrity of the internal composition of critical systems and critical system components].

3039

REFERENCES

3040

Source Assessment Procedure: SR-04(04)

91

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3041

References

3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071

[1] Federal Information Security Modernization Act (P.L. 113-283), December 2014. Available at https://www.govinfo.gov/app/details/PLAW-113publ283 [2] Office of Management and Budget Memorandum Circular A-130, Managing Information as a Strategic Resource, July 2016. Available at https://www.whitehouse.gov/wpcontent/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf [3] Ross RS, Pillitteri VY (2024) Enhanced Security Requirements for Protecting Controlled Unclassified Information. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-172r3 ipd. https://doi.org/10.6028/NIST.SP.800-172r3.ipd [4] Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: Organization, Mission, and Information System View. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-39. https://doi.org/10.6028/NIST.SP.800-39 [5] Joint Task Force (2022) Assessing Security and Privacy Controls in Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-53Ar5. https://doi.org/10.6028/NIST.SP.800-53Ar5 [6] International Organization for Standardization/International Electrotechnical Commission 15408-3:2017, Information technology — Security techniques — Evaluation criteria for IT security — Part 3: Security assurance requirements, April 2017. Available at https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf [7] National Institute of Standards and Technology (2019) Security Requirements for Cryptographic Modules. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) NIST FIPS 140-3. https://doi.org/10.6028/NIST.FIPS.140-3 [8] Committee on National Security Systems (2022) Committee on National Security Systems (CNSS) Glossary. (National Security Agency, Fort George G. Meade, MD), CNSS Instruction 4009. Available at https://www.cnss.gov/CNSS/issuances/Instructions.cfm [9] Executive Order 13556 (2010) Controlled Unclassified Information. (The White House, 2340 Washington, DC), DCPD-201000942, November 4, 2010. Available at https://www.govinfo.gov/app/details/DCPD-201000942

92

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

3072

Appendix A. Acronyms

3073 3074

CNSS Committee on National Security Systems

3075 3076

CUI Controlled Unclassified Information

3077 3078

FIPS Federal Information Processing Standards

3079 3080

FISMA Federal Information Security Modernization Act

3081 3082

FOIA Freedom of Information Act

3083 3084

ITL Information Technology Laboratory

3085 3086

GRC Governance, Risk, and Compliance

3087 3088

NIST National Institute of Standards and Technology

3089 3090

ODP Organization-Defined Parameter

3091 3092

OMB Office of Management and Budget

3093 3094

OSCAL Open Security Controls Assessment Language

Assessing Enhanced Security Requirements for CUI

93

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3095

Appendix B. Glossary

3096 3097 3098

Appendix B provides definitions for the terminology used in SP 800-172A. The definitions are consistent with the definitions contained in the Committee on National Security Systems (CNSS) Glossary [8] unless otherwise noted.

3099 3100 3101 3102

agency Any executive agency or department, military department, Federal Government corporation, Federal Governmentcontrolled corporation, or other establishment in the Executive Branch of the Federal Government, or any independent regulatory agency. [2]

3103 3104

assessment See security control assessment.

3105 3106

assessor See security control assessor.

3107 3108 3109 3110 3111

controlled unclassified information Information that law, regulation, or governmentwide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended. [9]

3112 3113 3114

information Any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, electronic, or audiovisual forms. [2]

3115 3116 3117

information system A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. [2]

3118 3119

nonfederal organization An entity that owns, operates, or maintains a nonfederal system.

3120 3121

nonfederal system A system that does not meet the criteria for a federal system.

3122 3123 3124 3125

risk A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically is a function of: (i) the adverse impact, or magnitude of harm, that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. [2]

3126 3127 3128 3129 3130

security A condition that results from the establishment and maintenance of protective measures that enable an organization to perform its mission or critical functions despite risks posed by threats to its use of systems. Protective measures may involve a combination of deterrence, avoidance, prevention, detection, recovery, and correction that should form part of the organization’s risk management approach. [8]

3131 3132

security assessment See security control assessment.

3133 3134 3135

security control The safeguards or countermeasures prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of the system and its information. [2]

94

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3136 3137 3138 3139

security control assessment The testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization. [2]

3140 3141

system See information system.

3142 3143 3144 3145

system security plan A document that describes how an organization meets or plans to meet the security requirements for a system. In particular, the system security plan describes the system boundary, the environment in which the system operates, how the security requirements are satisfied, and the relationships with or connections to other systems.

95

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3146

Appendix C. Summary of Enhanced Security Requirements

3147

Table 2 provides a consolidated list of the enhanced security requirements in SP 800-172 [3].

3148

Table 2. Enhanced security requirements REQUIREMENT NUMBER

ENHANCED SECURITY REQUIREMENT Access Control

03.01.01E 03.01.02E 03.01.03E 03.01.04E 03.01.05E 03.01.06E 03.01.07E 03.01.08E 03.01.09E 03.01.10E 03.01.11E 03.01.12E 03.01.13E 03.01.14E 03.01.15E 03.01.16E 03.01.17E 03.02.01E 03.02.02E 03.02.03E 03.02.04E 03.03.01E 03.03.02E 03.03.03E 03.03.04E 03.04.01E 03.04.02E 03.04.03E 03.04.04E 03.04.05E 03.04.06E 03.04.07E 03.04.08E

Dual Authorization Non-Organizationally Owned Systems Restricted Use Withdrawn Concurrent Session Control Remote Access Monitoring and Control Protection of Remote Access Mechanism Information Automated Audit Actions for Account Management Account Monitoring for Atypical Usage Attribute-Based Access Control Object Security Attributes Role-Based Access Control Physical or Logical Separation of CUI Flows Metadata Security Policy Filters Data Type Identifiers Decomposition Into Policy-Relevant Subcomponents Detection of Unsanctioned Information Awareness and Training Advanced Literacy and Awareness Training Literacy and Awareness Training Practical Exercises Literacy and Awareness Training Feedback Anti-Counterfeit Training Audit and Accountability Protection of Audit Record Storage in Separate Physical Systems or Components Real-Time Alerts for Audit Processing Failures Dual Authorization for Audit Information and Actions Integrated Analysis of Audit Records Configuration Management Withdrawn Automated Unauthorized Component Detection Automation Maintenance for System Component Inventory Automation Support for Baseline Configuration Dual Authorization for System Changes Retention of Previous Configurations Testing, Validation, and Documentation of Changes Centralized Repository

96

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 REQUIREMENT NUMBER 03.05.01E 03.05.02E 03.05.03E 03.05.04E 03.05.05E 03.05.06E 03.05.07E 03.06.01E 03.06.02E 03.06.03E 03.06.04E 03.07.01E 03.08.01E 03.08.02E 03.08.03E 03.08.04E 03.09.01E 03.09.02E 03.09.03E 03.09.04E 03.10.01E 03.10.02E 03.11.01E 03.11.02E 03.11.03E 03.11.04E 03.11.05E 03.11.06E 03.11.07E 03.11.08E 03.11.09E 03.11.10E 03.11.11E 03.11.12E

Assessing Enhanced Security Requirements for CUI

ENHANCED SECURITY REQUIREMENT Identification and Authentication Cryptographic Bidirectional Authentication Password Managers Device Attestation No Embedded Unencrypted Static Authenticators Expiration of Cached Authenticators Identity Proofing Identity Providers and Authentication Servers Incident Response Security Operations Center Integrated Incident Response Team Behavior Analysis Automated Tracking, Data Collection, and Analysis for Incident Reporting Maintenance Software Updates and Patches for Maintenance Tools Media Protection Dual Authorization for Media Sanitization Dual Authorization for System Backup Deletion and Destruction Testing System Backups for Reliability and Integrity System Recovery and Reconstitution Personnel Security Withdrawn Withdrawn Access Agreements Citizenship Requirements Physical Protection Intrusion Alarms and Surveillance Equipment Delivery and Removal of System Components Risk Assessment Threat Awareness Program Threat Hunting Predictive Cyber Analytics Withdrawn Withdrawn Withdrawn Withdrawn Dynamic Threat Awareness Indicators of Compromise Criticality Analysis Discoverable Information Automated Means for Sharing Threat Intelligence

97

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 REQUIREMENT NUMBER 03.12.01E 03.12.02E 03.12.03E 03.12.04E 03.13.01E 03.13.02E 03.13.03E 03.13.04E 03.13.05E 03.13.06E 03.13.07E 03.13.08E 03.13.09E 03.13.10E 03.13.11E 03.13.12E 03.13.13E 03.13.14E 03.14.15E 03.14.16E 03.14.01E 03.14.02E 03.14.03E 03.14.04E 03.14.05E 03.14.06E 03.14.07E 03.14.08E 03.14.09E 03.14.10E 03.14.11E 03.14.12E 03.14.13E 03.14.14E 03.14.15E 03.14.16E 03.14.17E 03.14.18E

Assessing Enhanced Security Requirements for CUI

ENHANCED SECURITY REQUIREMENT Security Assessment and Monitoring Penetration Testing Independent Assessors Risk Monitoring Internal System Connections System and Communications Protection Heterogeneity Randomness Concealment and Misdirection Isolation of System Components Change Processing and Storage Locations Platform-Independent Applications Virtualization Techniques Decoys Isolation of Security Tool, Mechanism, and Support Components Isolation Separate Subnetworks Thin Nodes Denial-of-Service Protection Port and Input/Output Device Access Detonation Chambers Separate Subnets to Isolate System Components and Functions System Partitioning System and Information Integrity Software, Firmware, and Information Integrity Withdrawn Withdrawn Refresh from Trusted Sources Non-Persistent Information Withdrawn Withdrawn Integrity Checks Cryptographic Protection Protection of Boot Firmware Integration of Detection and Response Information Input Validation Error Handling Memory Protection Non-Persistent System Components and Services Tainting System-Generated Alerts Automated Organization-Generated Alerts Planning 98

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 REQUIREMENT NUMBER 03.15.01E 03.15.02E 03.15.03E 03.16.01E

3149

03.17.01E 03.17.02E 03.17.03E 03.17.04E 03.17.05E

Assessing Enhanced Security Requirements for CUI

ENHANCED SECURITY REQUIREMENT Security Architecture Defense In Depth Supplier Diversity System and Services Acquisition Specialization Supply Chain Risk Management Notification Agreements Inspection of Systems or Components Component Authenticity Provenance Supply Chain Integrity – Pedigree

99

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3150

Appendix D. Security Requirement Assessments

3151 3152 3153

This appendix provides an overview of the process for assessing the security requirements in SP 800-172 [3]. The four-phase process is based on the methodology in SP 800-53A [5] 5 and includes:

3154

1. Preparing for assessments

3155

2. Developing assessment plans

3156

3. Conducting assessments

3157

4. Analyzing, documenting, and reporting assessment results

3158

D.1. Preparing for Assessments

3159 3160 3161 3162

Thorough preparation by the organization and assessors is an important aspect of conducting an effective assessment. Preparatory activities address a range of issues related to the cost, schedule, and conduct of the assessment. From an organizational perspective, preparing for an assessment includes the following activities:

3163 3164

•

Ensuring that appropriate policies that cover the assessment are in place and understood by affected organizational elements

3165 3166

•

Establishing the objective and scope of the assessment (i.e., the purpose of the assessment and what is being assessed)

3167 3168

•

Notifying appropriate organizational officials of the impending assessment and allocating the necessary resources to carry out the assessment

3169 3170

•

Establishing appropriate communication channels among organizational officials with an interest in the assessment

3171 3172

•

Establishing the time frame for completing the assessment and the key milestone decision points required by the organization

3173 3174

•

Identifying and selecting the assessors who will be responsible for conducting the assessment and considering issues of assessor independence

3175 3176 3177

•

Providing artifacts to the assessors (e.g., policies, procedures, plans, specifications, designs, records, administrator/operator manuals, information exchange agreements, system documentation, previous assessment results, legal requirements)

3178 3179 3180

•

Establishing a mechanism between the organization and the assessors to minimize ambiguities or misunderstandings about the security requirements, implementation issues, and deficiencies identified during the assessment

5 For additional detail and guidance, see SP 800-53A [5], Section 3.

100

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

3181

Assessing Enhanced Security Requirements for CUI

Assessors begin preparing for the assessment by:

3182 3183

•

Developing a general understanding of the organization’s operations and how the scope of the assessment supports those organizational operations

3184 3185

•

Understanding the structure of the system (i.e., the system architecture) and the security requirements being assessed

3186 3187

•

Meeting with organizational officials to ensure that there is a common understanding of the assessment objectives and the proposed rigor and scope of the assessment

3188 3189 3190

•

Obtaining the artifacts needed for the assessment (e.g., policies, procedures, plans, specifications, administrator/operator manuals, system documentation, information exchange agreements, designs, records, previous assessment results6)

3191

•

Establishing organizational points of contact to carry out the assessment

3192 3193

Table 3 provides a summary of the purpose and expected outcomes of the assessment preparation phase.

3194

Table 3. Summary of assessment preparation phase Address a range of issues pertaining to the cost, schedule, scope, and conduct of the assessment.

PURPOSE

OUTCOMES

The objective, scope, and time frame of the assessment are determined. Key organizational stakeholders are notified, and the necessary resources are allocated. Assessors are identified and selected. Artifacts are collected and provided to assessors. Mechanisms to minimize ambiguities and misunderstandings about the security requirements, implementation issues, and weaknesses/deficiencies identified during the assessment are established. • The organization’s operations, structure, objective, scope, and time frame of assessment are understood by assessors. • • • • •

3195

D.2. Developing Assessment Plans

3196 3197 3198

The assessment plan establishes the objectives for the security requirement assessment and a detailed roadmap of how to conduct the assessment based on the system security plan. The following steps are considered by assessors when developing an assessment plan:

3199 3200

•

Determine which security requirements are to be included in the assessment based on the contents of the system security plan and the purpose and scope of the assessment.

3201

•

Select the appropriate assessment procedures.

6 Previous assessment results that may be reused for the current assessment include Inspector General reports, audits, vulnerability scans, physical security inspections, developmental testing and evaluation, vendor flaw remediation activities, and ISO 15408 [6] evaluations.

101

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3202 3203 3204

•

Tailor the selected assessment procedures (i.e., select appropriate POTENTIAL ASSESSMENT METHODS AND OBJECTS, and assign depth and coverage attribute values). 7

3205 3206 3207

•

Optimize the assessment procedures to reduce the duplication of effort (e.g., sequence and consolidate assessment procedures) and provide a cost-effective assessment solution.

3208

•

Finalize the assessment plan, and obtain the necessary approvals to execute the plan.

3209 3210

Table 4 provides a summary of the purpose and expected outcomes of the assessment plan development phase.

3211

Table 4. Summary of assessment plan development phase Establish the objectives for the security requirement assessment and a detailed roadmap of how to conduct the assessment based on the system security plan.

PURPOSE

OUTCOMES

• • • •

Security requirements to be included in the assessment are determined. Assessment procedures are selected and tailored. Assessment procedures are optimized to reduce the duplication of effort. The assessment plan is finalized, and organizational approvals are obtained.

3212

D.3. Conducting Assessments

3213 3214 3215 3216 3217 3218

After the assessment plan is approved by the organization, the assessors execute the plan in accordance with the agreed-upon schedule. Assessment objectives are achieved by applying the designated assessment methods to selected assessment objects and compiling or producing the evidence necessary to make the determination associated with each assessment objective. Each determination statement contained within an assessment procedure executed by an assessor produces one of the following findings:

3219

•

3220 3221 3222 3223 3224 3225

Satisfied or

•

Other than satisfied

A finding of satisfied indicates that the assessment objective for the security requirement (or subset of the requirement) addressed by the determination statement has been met and produced an acceptable result. A finding of other than satisfied indicates that the assessment objective for the requirement has not been met and has produced an unacceptable result. A

7 In addition to selecting POTENTIAL ASSESSMENT METHODS AND OBJECTS, each assessment method (i.e., examine, interview, and test) is

associated with depth and coverage attributes. The attribute values identify the rigor (depth) and scope (coverage) of the assessment procedures executed by the assessor. The depth and coverage attribute values are associated with the assurance requirements specified by the organization. SP 800-53A [5], Appendix D provides additional guidance on depth and coverage attributes.

102

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3226 3227

finding of other than satisfied may also indicate that the assessor was unable to obtain sufficient information to make the determination called for in the determination statement.

3228 3229

Table 5 provides a summary of the purpose and expected outcomes of the assessment execution phase.

3230

Table 5. Summary of assessment execution phase

PURPOSE

Conduct the assessment in accordance with the assessment plan, and document the results in an assessment report.

OUTCOMES

• Security requirements are assessed in accordance with the assessment plan. • An assessment report that documents whether the security requirements have been satisfied is produced.

3231

D.4. Analyzing, Documenting, and Reporting Assessment Results

3232 3233 3234 3235 3236 3237 3238 3239

The assessment report includes information from assessors in the form of findings that are necessary to determine whether the requirements in SP 800-172 [3] have been satisfied. 8 The report conveys the results of the assessment to designated organizational officials. The report can also provide recommendations for correcting any deficiencies discovered during the assessment. Depending on the organization’s objective for the assessment, the assessment results can trigger a variety of risk response actions, including risk acceptance, risk mitigation, risk rejection, risk transfer, or risk sharing. The assessment results can also influence changes to the system security plan and plan of action and milestones.

3240 3241

Table 6 provides a summary of the purpose and expected outcomes of the assessment analysis, documentation, and reporting phase.

3242

Table 6. Summary of assessment analysis, documentation, and reporting phase

PURPOSE

OUTCOMES

Analyze the risks that result from the weaknesses and deficiencies identified during the assessment, and determine an approach to respond to those risks in accordance with organizational priorities. • Assessment findings are reviewed and analyzed. • Subsequent risk responses are initiated to manage risks. • The system security plan and plan of action and milestones are updated to reflect the results of the assessment and any subsequent risk response actions.

3243

8 SP 800-53A [5], Appendix E provides additional guidance on security assessment reports.

103

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3244

Appendix E. Organization-Defined Parameters

3245 3246 3247 3248

Table 7 lists the ODPs that are included in the assessment procedures in Sec. 3. The ODPs are listed sequentially by requirement family, beginning with the first requirement containing an ODP in the Access Control (AC) family and ending with the last requirement containing an ODP in the Supply Chain Risk Management (SR) family.

3249

Table 7. Organization-defined parameters ENHANCED SECURITY REQUIREMENT

ORGANIZATION-DEFINED PARAMETER

03.01.01E

A.03.01.01E.ODP[01]

03.01.02E

A.03.01.02E.ODP[01]

03.01.04E

A.03.01.04E.ODP[01]

03.01.04E

A.03.01.04E.ODP[02]

03.01.08E 03.01.08E 03.01.09E 03.01.10E

A.03.01.08E.ODP[01] A.03.01.08E.ODP[02] A.03.01.09E.ODP[01] A.03.01.10E.ODP[01]

03.01.10E

A.03.01.10E.ODP[02]

03.01.10E

A.03.01.10E.ODP[03]

03.01.10E

A.03.01.10E.ODP[04]

03.01.10E

A.03.01.10E.ODP[05]

03.01.11E 03.01.12E 03.01.13E 03.01.14E 03.01.14E 03.01.14E

A.03.01.11E.ODP[01] A.03.01.12E.ODP[01] A.03.01.13E.ODP[01] A.03.01.14E.ODP[01] A.03.01.14E.ODP[02] A.03.01.14E.ODP[03]

03.01.14E 03.01.15E 03.01.16E

A.03.01.14E.ODP[04] A.03.01.15E.ODP[01] A.03.01.16E.ODP[01]

privileged commands and/or other actions requiring dual authorization are defined. restrictions on the use of non-organizationally owned systems or system components to process, store, or transmit CUI are defined. accounts and/or account types for which to limit the number of concurrent sessions is defined. the number of concurrent sessions to be allowed for each account and/or account type is defined. atypical usage for which to monitor system accounts is defined. personnel or roles to report atypical usage are defined. attributes to assume access permissions are defined. security attributes to be associated with information, source, and destination objects are defined. information objects to be associated with information security attributes are defined. source objects to be associated with information security attributes are defined. destination objects to be associated with information security attributes are defined. information flow control policies as a basis for the enforcement of flow control decisions are defined. roles and users authorized to assume such roles are defined. mechanisms and/or techniques to separate CUI flows are defined. metadata that requires flow control is defined. security policy filers are defined. information flows are defined. one or more of the following PARAMETER VALUES is/are selected: {Block; Strip; Modify; Quarantine} in response to a filter processing failure. security policy addressing a filter processing failure is defined. data type identifiers are defined. policy-relevant subcomponents into which to decompose information for submission to policy enforcement mechanisms are defined.

104

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT

Assessing Enhanced Security Requirements for CUI

ORGANIZATION-DEFINED PARAMETER

03.01.17E 03.01.17E

A.03.01.17E.ODP[01] A.03.01.17E.ODP[02]

03.02.01E 03.02.01E

A.03.02.01E.ODP[01] A.03.02.01E.ODP[02]

03.02.01E

A.03.02.01E.ODP[03]

03.02.03E

A.03.02.03E.ODP[01]

03.02.04E

A.03.02.04E.ODP[01]

03.03.02E

A.03.03.02E.ODP[01]

03.03.02E

A.03.03.02E.ODP[02]

03.03.02E 03.03.03E

A.03.03.02E.ODP[03] A.03.03.03E.ODP[01]

03.03.03E

A.03.03.03E.ODP[02]

03.03.04E

A.03.03.04E.ODP[01]

03.03.04E

A.03.03.04E.ODP[02]

03.04.02E

A.03.04.02E.ODP[01]

03.04.02E

A.03.04.02E.ODP[02]

03.04.02E

A.03.04.02E.ODP[03]

03.04.03E

A.03.04.03E.ODP[01]

03.04.03E

A.03.04.03E.ODP[02]

03.04.03E

A.03.04.03E.ODP[03]

unsanctioned information to be detected is defined. a security policy that prohibits the transfer of such information is defined. indicators of malicious code are defined. the frequency at which to update security literacy training content is defined. events which cause security literacy training content to be updated are defined. personnel to whom feedback on organizational training results will be provided are assigned. personnel or roles requiring training to detect counterfeit system components are defined. real-time period requiring alerts when audit failure events (defined in A.03.03.02E.ODP[03]) occur is defined. personnel, roles, and/or locations to be alerted in real time when audit failure events (defined in A.03.03.02E.ODP[03]) occur are defined. audit logging failure events requiring real-time alerts are defined. one or more of the following PARAMETER VALUES is/are selected: {movement; deletion}. audit information for which dual authorization is to be enforced is defined. one or more of the following PARAMETER VALUES is/are selected: {vulnerability scanning information; performance data; system monitoring information; <A.03.03.04E.ODP[02] data/information collected from other sources>}. data or information collected from other sources to be analyzed is defined (if selected). automated mechanisms used to detect the presence of unauthorized or misconfigured system components are defined. one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized or misconfigured system components; isolate unauthorized or misconfigured system components; notify <A.03.04.02E.ODP[03] personnel or roles>. personnel or roles to be notified when unauthorized or misconfigured system components are detected are defined (if selected). automated mechanisms used to maintain the currency of the system component inventory are defined. automated mechanisms used to maintain the completeness of the system component inventory are defined. automated mechanisms used to maintain the accuracy of the system component inventory are defined.

105

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT

Assessing Enhanced Security Requirements for CUI

ORGANIZATION-DEFINED PARAMETER

03.04.03E

A.03.04.03E.ODP[04]

03.04.04E

A.03.04.04E.ODP[01]

03.04.04E

A.03.04.04E.ODP[02]

03.04.04E

A.03.04.04E.ODP[03]

03.04.04E

A.03.04.04E.ODP[04]

03.04.05E

A.03.04.05E.ODP[01]

03.04.05E

A.03.04.05E.ODP[02]

03.04.06E

A.03.04.06E.ODP[01]

03.05.01E

A.03.05.01E.ODP[01]

03.05.02E

A.03.05.02E.ODP[01]

03.05.03E

A.03.05.03E.ODP[01]

03.05.05E

A.03.05.05E.ODP[01]

03.05.07E 03.05.07E

A.03.05.07E.ODP[01] A.03.05.07E.ODP[02]

03.06.02E

A.03.06.02E.ODP[01]

03.06.03E

A.03.06.03E.ODP[01]

03.06.04E 03.06.04E

A.03.06.04E.ODP[01] A.03.06.04E.ODP[02]

03.06.04E

A.03.06.04E.ODP[03]

03.08.01E 03.08.02E

A.03.08.01E.ODP[01] A.03.08.02E.ODP[01]

03.08.03E

A.03.08.03E.ODP[01]

automated mechanisms used to maintain the availability of the system component inventory are defined. automated mechanisms used to maintain the currency of the baseline configuration of the system are defined. automated mechanisms used to maintain the completeness of the baseline configuration of the system are defined. automated mechanisms used to maintain the accuracy of the baseline configuration of the system are defined. automated mechanisms used to maintain the availability of the baseline configuration of the system are defined. system components requiring dual authorization for changes are defined. system-level information requiring dual authorization for changes is defined. the number of previous baseline configuration versions to be retained is defined. devices and/or types of devices requiring the use of cryptographically based bidirectional authentication to authenticate before establishing a system connection are defined. password managers employed for generating and managing passwords are defined. the configuration management process to be implemented to handle device identification and authentication based on attestation is defined. the time period after which the use of cached authenticators is prohibited is defined. an identification and authentication policy is defined. mechanisms supporting authentication and authorization decisions are defined. the time period within which an integrated incident response team can be deployed is defined. environments or resources that may contain or be related to anomalous or suspected adversarial behavior are defined. automated mechanisms used to track incidents are defined. automated mechanisms used to collect incident information are defined. automated mechanisms used to analyze incident information are defined. system media to be sanitized using dual authorization is defined. backup information for which to enforce dual authorization in order to delete or destroy is defined. the frequency at which to test backup information for media reliability is defined.

106

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT

Assessing Enhanced Security Requirements for CUI

ORGANIZATION-DEFINED PARAMETER

03.08.03E

A.03.08.03E.ODP[02]

03.08.04E

A.03.08.04E.ODP[01]

03.08.04E

A.03.08.04E.ODP[02]

03.09.03E

A.03.09.03E.ODP[01]

03.09.03E

A.03.09.03E.ODP[02]

03.09.04E

A.03.09.04E.ODP[01]

03.10.01E

A.03.10.01E.ODP[01]

03.10.02E

A.03.10.02E.ODP[01]

03.10.02E

A.03.10.02E.ODP[02]

03.11.02E

A.03.11.02E.ODP[01]

03.11.03E

A.03.11.03E.ODP[01]

03.11.03E

A.03.11.03E.ODP[02]

03.11.03E

A.03.11.03E.ODP[03]

03.11.08E

A.03.11.08E.ODP[01]

03.11.09E 03.11.09E

A.03.11.09E.ODP[01] A.03.11.09E.ODP[02]

03.11.10E

A.03.11.10E.ODP[01]

03.11.10E

A.03.11.10E.ODP[02]

03.11.11E

A.03.11.11E.ODP[01]

03.12.01E

A.03.12.01E.ODP[01]

03.12.01E

A.03.12.01E.ODP[02]

03.12.04E

A.03.12.04E.ODP[01]

the frequency at which to test backup information for information integrity is defined. a time period consistent with recovery time and recovery point objectives for the recovery of the system is determined. a time period consistent with recovery time and recovery point objectives for the reconstitution of the system is determined. the frequency at which to review and update access agreements is defined. the frequency at which to re-sign access agreements to maintain access systems processing, storing, or transmitting CUI is defined. Citizenship requirements to be met by individuals to access a system processing, storing, or transmitting CUI are defined. the time period for which to maintain visitor access records for the facility in which the system resides is defined. the types of system components to be authorized and controlled when entering the facility are defined. the types of system components to be authorized and controlled when exiting the facility are defined. the frequency at which to implement the threat-hunting capability is defined. advanced automation capabilities to predict and identify risks are defined. systems or system components in which advanced automation and analytics capabilities are to be employed are defined. advanced analytics capabilities to predict and identify risks are defined. the means to determine the current cyber threat environment on an ongoing basis are defined. sources that provide indicators of compromise are defined. personnel or roles to whom indicators of compromise are to be distributed are defined. systems, system components, or system services to be analyzed for criticality are defined. decision points in the system development life cycle when a criticality analysis is to be performed are defined. corrective actions to be taken if information about the system is discoverable are defined. the frequency at which to conduct penetration testing on systems or system components is defined. systems or system components on which penetration testing is to be conducted are defined. system components or classes of components requiring internal connections to the system are defined.

107

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT

Assessing Enhanced Security Requirements for CUI

ORGANIZATION-DEFINED PARAMETER

03.12.04E

A.03.12.04E.ODP[02]

03.12.04E

A.03.12.04E.ODP[03]

03.13.01E

A.03.13.01E.ODP[01]

03.13.02E

A.03.13.02E.ODP[01]

03.13.03E

A.03.13.03E.ODP[01]

03.13.04E

A.03.13.04E.ODP[01]

03.13.05E 03.13.05E

A.03.13.05E.ODP[01] A.03.13.05E.ODP[02]

03.13.05E

A.03.13.05E.ODP[03]

03.13.06E

A.03.13.06E.ODP[01]

03.13.07E

A.03.13.07E.ODP[01]

03.13.09E

A.03.13.09E.ODP[01]

03.13.11E

A.03.13.11E.ODP[01]

03.13.12E

A.03.13.12E.ODP[01]

03.13.12E

A.03.13.12E.ODP[02]

03.13.12E

A.03.13.12E.ODP[03]

03.13.13E

A.03.13.13E.ODP[01]

03.13.13E

A.03.13.13E.ODP[02]

03.13.13E

A.03.13.13E.ODP[03]

03.13.14E

A.03.13.14E.ODP[01]

03.13.15E

A.03.13.15E.ODP[01]

conditions requiring the termination of internal connections are defined. the frequency at which to review the continued need for each internal connection is defined. system components requiring a diverse set of information technologies to be used in the implementation of the system are defined. the techniques employed to introduce randomness into organizational operations and assets are defined. the concealment and misdirection techniques used to confuse and mislead adversaries potentially targeting systems are defined. system components to be isolated by boundary protection mechanisms are defined. processing and/or storage locations to be changed are defined. one of the following PARAMETER VALUES is selected: {<A.03.13.05E.ODP[03] frequency>; at random time intervals}. the frequency at which to change the location of processing and/or storage is defined (if selected). platform-independent applications to be included within organizational systems are defined. the frequency at which to change the diversity of operating systems and applications deployed using virtualization techniques is defined. information security tools, mechanisms, and support components to be isolated from other internal system components are defined. system components to be implemented with minimal functionality and information storage are defined. the types of denial-of-service events to be protected against or limited are defined. one of the following PARAMETER VALUES is selected: {protected against; limited}. the safeguards to prevent the denial-of-service objective by type of denial-of-service event are defined. connection ports or input/output devices to be disabled or removed are defined. one of the following PARAMETER VALUES is selected: {physically; logically}. systems or system components with connection ports or input/output devices to be disabled or removed are defined. the system, system component, or location in which a detonation chamber capability is to be employed is defined. one of the following PARAMETER VALUES is selected: {physically; logically}.

108

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT

Assessing Enhanced Security Requirements for CUI

ORGANIZATION-DEFINED PARAMETER

03.13.15E

A.03.13.15E.ODP[02]

03.13.16E

A.03.13.16E.ODP[01]

03.13.16E

A.03.13.16E.ODP[02]

03.13.16E

A.03.13.16E.ODP[03]

03.14.01E

A.03.14.01E.ODP[01]

03.14.01E

A.03.14.01E.ODP[02]

03.14.01E

A.03.14.01E.ODP[03]

03.14.01E

A.03.14.01E.ODP[04]

03.14.01E

A.03.14.01E.ODP[05]

03.14.01E

A.03.14.01E.ODP[06]

03.14.04E

A.03.14.04E.ODP[01]

03.14.05E

A.03.14.05E.ODP[01]

03.14.05E 03.14.05E

A.03.14.05E.ODP[02] A.03.14.05E.ODP[03]

03.14.05E

A.03.14.05E.ODP[04]

03.14.08E

A.03.14.08E.ODP[01]

03.14.08E

A.03.14.08E.ODP[02]

03.14.08E

A.03.14.08E.ODP[03]

03.14.08E

A.03.14.08E.ODP[04]

03.14.08E

A.03.14.08E.ODP[05]

critical system components and functions to be isolated are defined. system components to reside in separate physical or logical domains or environments based on circumstances for the physical or logical separation of components are defined. one of the following PARAMETER VALUES is selected: {physical; logical}. circumstances for the physical or logical separation of components are defined. software requiring integrity verification tools to be used to detect unauthorized changes is defined. firmware requiring integrity verification tools to be used to detect unauthorized changes is defined. information requiring integrity verification tools to be used to detect unauthorized changes is defined. actions to be taken when unauthorized changes to software are detected are defined. actions to be taken when unauthorized changes to firmware are detected are defined. actions to be taken when unauthorized changes to information are detected are defined. trusted sources to obtain software and data for system component and service refreshes are defined. one of the following PARAMETER VALUES is selected: {refresh <A.03.14.05E_ODP[02] information> <A.03.14.05E_ODP[03] frequency>; generate <A.03.14.05E_ODP[04] information>}. the information to be refreshed is defined (if selected). the frequency at which to refresh information is defined (if selected). the information to be generated on demand is defined (if selected). software on which an integrity check is to be performed is defined. one or more of the following PARAMETER VALUES is/are selected: {at startup; at <A.03.14.08E.ODP[03] transitional states or security-relevant events>; <A.03.14.08E.ODP[04] frequency>}. transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected). the frequency at which to perform an integrity check (on software) is defined (if selected). firmware on which an integrity check is to be performed is defined.

109

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT

Assessing Enhanced Security Requirements for CUI

ORGANIZATION-DEFINED PARAMETER

03.14.08E

A.03.14.08E.ODP[06]

03.14.08E

A.03.14.08E.ODP[07]

03.14.08E

A.03.14.08E.ODP[08]

03.14.08E

A.03.14.08E.ODP[09]

03.14.08E

A.03.14.08E.ODP[10]

03.14.08E

A.03.14.08E.ODP[11]

03.14.08E

A.03.14.08E.ODP[12]

03.14.10E

A.03.14.10E.ODP[01]

03.14.10E

A.03.14.10E.ODP[02]

03.14.11E 03.14.12E

A.03.14.11E.ODP[01] A.03.14.12E.ODP[01]

03.14.13E

A.03.14.13E.ODP[01]

03.14.14E

A.03.14.14E.ODP[01]

03.14.15E

A.03.14.15E.ODP[01]

03.14.15E

A.03.14.15E.ODP[02]

03.14.15E

A.03.14.15E.ODP[03]

03.14.16E

A.03.14.16E.ODP[01]

03.14.17E

A.03.14.17E.ODP[01]

03.14.17E 03.14.18E

A.03.14.17E.ODP[02] A.03.14.18E.ODP[01]

03.14.18E

A.03.14.18E.ODP[02]

03.14.18E

A.03.14.18E.ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {at startup; at <A.03.14.08E.ODP[07] transitional states or security-relevant events>; <A.03.14.08E.ODP[08] frequency>}. transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected). the frequency at which to perform an integrity check (on firmware) is defined (if selected). information on which an integrity check is to be performed is defined. one or more of the following PARAMETER VALUES is/are selected: {at startup; at <A.03.14.08E.ODP[11] transitional states or security-relevant events>; <A.03.14.08E.ODP[12] frequency>}. transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected). the frequency at which to perform an integrity check (of information) is defined (if selected). mechanisms to be implemented to protect the integrity of boot firmware in system components are defined. system components requiring mechanisms to protect the integrity of boot firmware are defined. security-relevant changes to the system are defined. information inputs to the system requiring validity checks are defined. personnel or roles to whom error messages are to be revealed are defined. safeguards to be implemented to protect the system memory from unauthorized code execution are defined. non-persistent system components and services to be implemented are defined. one or more of the following PARAMETER VALUES is/are selected: {upon end of session of use; <A.03.14.15E.ODP[03] frequency>}. the frequency at which to terminate non-persistent components and services that are initiated in a known state is defined (if selected). systems or system components with data or capabilities to be embedded are defined. personnel or roles to be alerted when indications of compromise or potential compromise occur are defined. compromise indicators are defined. personnel or roles to be alerted when indications of inappropriate or unusual activity with security implications occur are defined. automated mechanisms used to alert personnel or roles are defined. activities that trigger alerts to personnel or roles are defined.

110

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025 ENHANCED SECURITY REQUIREMENT

Assessing Enhanced Security Requirements for CUI

ORGANIZATION-DEFINED PARAMETER

03.15.01E

A.03.15.01E.ODP[01]

03.15.02E

A.03.15.02E.ODP[01]

03.15.02E 03.15.03E

A.03.15.02E.ODP[02] A.03.15.03E.ODP[01]

03.15.03E 03.16.01E

A.03.15.03E.ODP[02] A.03.16.01E.ODP[01]

03.16.01E

A.03.16.01E.ODP[02]

03.17.01E

A.03.17.01E.ODP[01]

03.17.01E

A.03.17.01E.ODP[02]

03.17.02E

A.03.17.02E.ODP[01]

03.17.02E

A.03.17.02E.ODP[02]

03.17.02E

A.03.17.02E.ODP[03]

03.17.02E

A.03.17.02E.ODP[04]

03.17.03E

A.03.17.03E.ODP[01]

03.17.03E

A.03.17.03E.ODP[02]

03.17.03E

A.03.17.03E.ODP[03]

03.17.04E

A.03.17.04E.ODP[01]

03.17.05E

A.03.17.05E.ODP[01]

03.17.05E

A.03.17.05E.ODP[02]

the frequency for reviewing and updating the security architecture to reflect changes in the enterprise architecture is defined. safeguards to be allocated to architectural layers and locations are defined. architectural layers and locations are defined. safeguards to be allocated to architectural layers and locations are defined. architectural layers and locations are defined. one or more of the following PARAMETER VALUES is/are selected: {design modification; augmentation; reconfiguration}. systems or system components supporting mission-essential services or functions are defined. one or more of the following PARAMETER VALUES is/are selected: {notification of supply chain compromises; results of assessments or audits; provision of <A.03.17.01E.ODP[02]: information>}. information for which agreements and procedures are to be established is defined (if selected). systems or system components that require inspection are defined. one or more of the following PARAMETER VALUES is/are selected: {at random; <A.03.17.02E.ODP[03]: frequency>; upon <A.03.17.02E.ODP[04]: indications of the need for inspection>}. the frequency at which to inspect systems or system components is defined (if selected). indications of the need for an inspection of systems or system components are defined (if selected). one or more of the following PARAMETER VALUES is/are selected: {source of counterfeit component; <A.03.17.03E.ODP[02]: external reporting organizations>; <A.03.17.03E.ODP[03]: personnel or roles>}. external reporting organizations to whom counterfeit system components are to be reported are defined (if selected). personnel or roles to whom counterfeit system components are to be reported are defined (if selected). systems, system components, and associated CUI that require valid provenance are defined. safeguards employed to ensure the integrity of the system and system component are defined. an analysis method to be conducted to validate the internal composition and provenance of critical or mission-essential technologies, products, and services to ensure the integrity of the system and system component is defined.

3250

111

NIST SP 800-172Ar3 ipd (Initial Public Draft) September 2025

Assessing Enhanced Security Requirements for CUI

3251

Appendix F. Change Log

3252

This publication incorporates the following changes from the original edition (March 15, 2022):

3253

•

The restructuring of the assessment procedure syntax to align with SP 800-53A [5]

3254 3255

•

The addition of assessment procedures for the new and revised enhanced security requirements in SP 800-172, Revision 3 [3]

3256 3257

•

The addition of a references section to provide source assessment procedures from SP 800-53A [5]

3258 3259

•

A one-time change to the publication version number to align with SP 800-172, Revision 3 [3]

3260

112

Related documents

• NIST SP 800-172Ar3: Assessing Enhanced Security Requirements for Controlled Unclassified Information#180568
• NIST SP 800-172r3: Enhanced Security Requirements for Protecting Controlled Unclassified Information#180569
• NIST SP 800-172: Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171#2921
• NIST SP 800-172r3 fpd: Enhanced Security Requirements for Protecting Controlled Unclassified Information#2924
• NIST SP 800-225: Fiscal Year 2022 Cybersecurity and Privacy Annual Report#2977