Implementation examples
Contested
Examples where reviewers currently disagree, or the meets/does-not-meet split is close.
- AC.L2-3.1.5Contested3 verdictsJust-in-time admin roles; standing privilege only for break-glass
- IA.L2-3.5.3Above the line3 verdictsSmart card at the rack, RADIUS-gated MFA for VDI and VPN
- AC.L2-3.1.1Contested3 verdictsEnclave allow-list: users, service principals, and compliant devices only
110 examples
- RA.L2-3.11.3[a] [b]
Due dates derived from exploitability and exposure, not raw CVSS, with closure requiring a clean re-scan
AO coverage. Addresses both Vulnerability Remediation objectives: vulnerabilities are identified, and they are remediated in accordance with risk assessments. The second half is the point of this…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - RA.L2-3.11.2[a] [b] [c] [d] [e]
Separate schedules for hosts and for applications, with a KEV addition forcing a scan inside 48 hours
AO coverage. Addresses all five Vulnerability Scan objectives: the scan frequency is defined; systems are scanned at that frequency; applications are scanned at that frequency; systems are scanned…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - RA.L2-3.11.1[a] [b]
Annual risk assessment on the budget calendar, plus a written trigger list for out-of-cycle re-scoring
AO coverage. Addresses both Risk Assessments objectives: the frequency to assess risk to operations, assets, and individuals is defined, and the assessment is actually performed at that frequency for…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 1 - PS.L2-3.9.2[a] [b] [c]
Same-day deprovisioning on exit; transfers re-baseline access instead of adding to it
AO coverage. Addresses all Personnel Actions objectives: an established policy and process for terminating access and credentials with personnel actions, termination of access consistent with those…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - PS.L2-3.9.1[a]
Screening clears before the enclave group is granted, not after the start date
AO coverage. Addresses the Screen Individuals objective: individuals are screened before access to systems containing CUI is authorized. Screening standard. A written standard defines what screening…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - PE.L2-3.10.6[a] [b]
Home-office rules for CUI: privacy screen, locked drawer, and no printing
AO coverage. Addresses both Alternative Work Site objectives: safeguarding measures for CUI at alternate work sites are defined, and they are enforced. Defining the measures. A short addendum to the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - PE.L2-3.10.5[a] [b] [c]
Every badge, brass key, and door PIN has an owner in one register
AO coverage. Addresses all Manage Physical Access objectives: physical access devices are identified, controlled, and managed. Identified. One register lists every physical access device: each badge…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - PE.L2-3.10.4[a]
Badge reads and the paper lobby log kept a year — and actually read
AO coverage. Addresses the Physical Access Logs objective: audit logs of physical access are maintained. What is logged. Every badge read on every controlled door — grants and denials — with the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - PE.L2-3.10.3[a] [b]
Colored badge, named escort, and no unaccompanied minutes in engineering
AO coverage. Addresses both Escort Visitors objectives: visitors are escorted, and visitor activity is monitored. Who is a visitor. Anyone without a permanent badge for the zone they are entering:…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - PE.L2-3.10.2[a] [b] [c]
Cameras on the doors, sensors in the closet, alerts to the same on-call as IT
AO coverage. Claims objectives [a], [b], and [c] — protecting the physical facility, protecting the support infrastructure, and monitoring the facility. Out of scope for this example: [d] (monitoring…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - PE.L2-3.10.1[a] [b] [c] [d]
Three badge zones: office, engineering, and the server room are separate grants
AO coverage. Addresses all Limit Physical Access objectives: identifying who is authorized, and limiting physical access to systems, to equipment, and to the operating environments that house them.…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 1 - MP.L2-3.8.9[a]
Backups encrypted with our own keys, with one immutable copy the domain cannot delete
AO coverage. Addresses the Protect Backups objective: the confidentiality of backup CUI is protected at storage locations. Encryption everywhere it rests. Backup jobs encrypt at the source before…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.8[a]
No identifiable owner, no port: found drives go in the amnesty bin
AO coverage. Addresses the Shared Media objective: use of portable storage devices is prohibited when the device has no identifiable owner. What identifiable owner means here. A portable storage…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.7[a]
Removable storage denied by default; two documented workflows get an allow-list
AO coverage. Addresses the Removable Media objective: the use of removable media on system components is controlled. Default deny. Mass storage class devices are blocked on all managed endpoints.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.6[a]
Hardware-encrypted drives only; the courier never carries a plaintext disk
AO coverage. Addresses the Portable Storage Encryption objective: the confidentiality of CUI on digital media during transport is protected by cryptographic mechanisms. We rely on cryptography rather…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.5[a] [b]
Chain-of-custody form rides along with every drive that leaves the building
AO coverage. Addresses both Media Accountability objectives: controlling access to media containing CUI, and maintaining accountability for that media during transport outside controlled areas.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.4[a] [b]
Marking happens at creation: label templates, document headers, drive faceplates
AO coverage. Addresses both Media Markings objectives: media containing CUI is marked with the applicable CUI markings and with distribution limitations. Marking at creation, not at audit. Templates…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.2[a]
Only the enclave roster can open the cabinet or mount an encrypted drive
AO coverage. Addresses the Media Access objective: access to CUI on system media is limited to authorized users. One authoritative roster. The enclave roster — the same identity group that gates…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.1[a] [b] [c] [d]
Locked drawer for paper, locked cabinet for drives, two-lock server room
AO coverage. Addresses all Media Protection objectives — physical control and secure storage, for both paper and digital media containing CUI. Paper: physical control. Printed CUI is generated only…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 1 - MA.L2-3.7.6[a]
Uncleared technicians are badge-escorted and screen-watched for the entire visit
AO coverage. Addresses the Maintenance Personnel objective: maintenance personnel without required access authorization are supervised during maintenance activities. Who needs an escort. The…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet