Catalog

Controls & assessment objectives

Every control is stored with its full statement and each published assessment objective, quoted verbatim from the source document. Examples and verdicts hang off the objectives, not off a vague summary.

22 controls

AC.L2-3.1.1AC · Access ControlLevel 2CMMC L2
Authorized Access Control [CUI Data]
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- 6objectives
- 1examples
- 0threads
AC.L2-3.1.2AC · Access ControlLevel 2CMMC L2
Transaction & Function Control
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.3AC · Access ControlLevel 2CMMC L2
Control CUI Flow
Control the flow of CUI in accordance with approved authorizations.
- 5objectives
- 1examples
- 0threads
AC.L2-3.1.4AC · Access ControlLevel 2CMMC L2
Separation of Duties
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- 3objectives
- 1examples
- 0threads
AC.L2-3.1.5AC · Access ControlLevel 2CMMC L2
Least Privilege
Employ the principle of least privilege, including for specific security functions and privileged accounts.
- 4objectives
- 1examples
- 0threads
AC.L2-3.1.6AC · Access ControlLevel 2CMMC L2
Non-privileged Account Use
Use non-privileged accounts or roles when accessing nonsecurity functions.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.7AC · Access ControlLevel 2CMMC L2
Privileged Functions
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- 4objectives
- 1examples
- 0threads
AC.L2-3.1.8AC · Access ControlLevel 2CMMC L2
Unsuccessful Logon Attempts
Limit unsuccessful logon attempts.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.9AC · Access ControlLevel 2CMMC L2
Privacy & Security Notices
Provide privacy and security notices consistent with applicable CUI rules.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.10AC · Access ControlLevel 2CMMC L2
Session Lock
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
- 3objectives
- 1examples
- 0threads
AC.L2-3.1.11AC · Access ControlLevel 2CMMC L2
Session Termination
Terminate (automatically) a user session after a defined condition.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.12AC · Access ControlLevel 2CMMC L2
Control Remote Access
Monitor and control remote access sessions.
- 4objectives
- 1examples
- 0threads
AC.L2-3.1.13AC · Access ControlLevel 2CMMC L2
Remote Access Confidentiality
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.14AC · Access ControlLevel 2CMMC L2
Remote Access Routing
Route remote access via managed access control points.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.15AC · Access ControlLevel 2CMMC L2
Privileged Remote Access
Authorize remote execution of privileged commands and remote access to security-relevant information.
- 4objectives
- 1examples
- 0threads
AC.L2-3.1.16AC · Access ControlLevel 2CMMC L2
Wireless Access Authorization
Authorize wireless access prior to allowing such connections.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.17AC · Access ControlLevel 2CMMC L2
Wireless Access Protection
Protect wireless access using authentication and encryption.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.18AC · Access ControlLevel 2CMMC L2
Mobile Device Connection
Control connection of mobile devices.
- 3objectives
- 1examples
- 0threads
AC.L2-3.1.19AC · Access ControlLevel 2CMMC L2
Encrypt CUI on Mobile
Encrypt CUI on mobile devices and mobile computing platforms.
- 2objectives
- 1examples
- 0threads
AC.L2-3.1.20AC · Access ControlLevel 2CMMC L2
External Connections [CUI Data]
Verify and control/limit connections to and use of external systems.
- 6objectives
- 1examples
- 0threads
AC.L2-3.1.21AC · Access ControlLevel 2CMMC L2
Portable Storage Use
Limit use of portable storage devices on external systems.
- 3objectives
- 1examples
- 0threads
AC.L2-3.1.22AC · Access ControlLevel 2CMMC L2
Control Public Information [CUI Data]
Control CUI posted or processed on publicly accessible systems.
- 5objectives
- 1examples
- 0threads