Implementation examples
110 examples
- MA.L2-3.7.5[a] [b]
Vendor remote sessions: MFA to get in, watched throughout, torn down at hang-up
AO coverage. Addresses both Nonlocal Maintenance objectives: multifactor authentication to establish sessions over external network connections, and termination of those sessions when the work is…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MA.L2-3.7.4[a]
Vendor diagnostic media is scanned on an isolated kiosk before it touches anything
AO coverage. Addresses the Media Inspection objective: media containing diagnostic and test programs is checked for malicious code before use on systems that process, store, or transmit CUI. Intake…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MA.L2-3.7.3[a]
Nothing goes out for RMA until the disk is pulled or cryptographically erased
AO coverage. Addresses the Equipment Sanitization objective: equipment removed from organizational spaces for off-site maintenance is sanitized of CUI first. Trigger. Any ticket whose resolution…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MA.L2-3.7.2[a] [b] [c] [d]
Approved tool register, no personal laptops on the plant floor, escorted OEM techs
AO coverage. Addresses all System Maintenance Control objectives — controls over the tools, techniques, mechanisms, and personnel used to conduct maintenance. Tools. A register lists the maintenance…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MA.L2-3.7.1[a]
Maintenance calendar driven by the asset inventory, not by what breaks
AO coverage. Addresses the Perform Maintenance objective: system maintenance is performed on organizational systems. Driven by inventory. Every asset in the inventory carries a maintenance profile:…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IR.L2-3.6.3[a]
Two tabletops and one live containment drill a year, with findings that close
AO coverage. Addresses the Incident Response Testing objective: the incident response capability is tested. Annual test plan. Three exercises a year, scheduled in January so calendars are held: a…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IR.L2-3.6.2[a] [b] [c] [d] [e] [f]
One case record drives internal escalation and the 72-hour external report
AO coverage. Addresses all Incident Reporting objectives: tracking and documenting incidents, identifying both the external authorities and the internal officials to notify, and actually notifying…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IR.L2-3.6.1[a] [b] [c] [d] [e] [f] [g]
Six-phase runbook with a severity ladder on-call can follow at 2 a.m.
AO coverage. Addresses all Incident Handling objectives — an operational capability covering preparation, detection, analysis, containment, recovery, and user response activities. Preparation. A…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal88% · 2 - CA.L2-3.12.4[a] [b] [c] [e] [f] [g] [h]
SSP kept in version control: boundary diagram, per-practice narrative, quarterly refresh
AO coverage. Claims objectives [a], [b], [c], [e], [f], [g], and [h]. Out of scope for this example: [d] (identifying requirements approved as non-applicable) — this OSC's authorizing official has…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CA.L2-3.12.3[a]
Eighteen continuous-monitoring signals that fail loudly instead of silently
AO coverage. Addresses the Security Control Monitoring objective: security controls are monitored on an ongoing basis to confirm they remain effective. What ongoing means here. Point-in-time…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CA.L2-3.12.2[a] [b] [c]
Every POA&M item carries an owner, a funding line, and a closure test
AO coverage. Addresses all Operational Plan of Action objectives: identifying the deficiencies and vulnerabilities to address, developing the plan, and implementing it. Identifying deficiencies. Four…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CA.L2-3.12.1[a] [b]
A third of the practices every quarter, tested rather than attested
AO coverage. Addresses both Security Control Assessment objectives: defining the assessment frequency and assessing controls at that frequency to determine effectiveness. Defined frequency. The…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 1 - AT.L2-3.2.3[a] [b]
Insider-threat indicators taught alongside a no-blame reporting path
AO coverage. Addresses both Insider Threat Awareness objectives: identifying potential indicators and delivering training on recognizing and reporting them to managers and employees. Identified…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AT.L2-3.2.2[a] [b] [c]
Security duty matrix: every named role has a training plan and a due date
AO coverage. Addresses all Role-based Training objectives: defining security duties, assigning them to named people, and training those people to perform them. Defining duties. A duty matrix lists…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AT.L2-3.2.1[a] [b] [c] [d]
Three audiences, three risk briefings: shop floor, engineers, IT admins
AO coverage. Addresses all Role-based Risk Awareness objectives: identifying the risks, identifying the governing policies, and making all three audiences aware of both. Identified risks. Security…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.7[a] [b]
Write down what authorized use looks like, then alert on what falls outside it
AO coverage. Addresses both Identify Unauthorized Use objectives: authorized use of the system is defined, and unauthorized use is identified. Defining authorized use [a]. This is the objective most…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.6[a] [b] [c]
Inbound, outbound, and off-network telemetry with business-hours triage and on-call paging
AO coverage. Addresses all three Monitor Communications for Attacks objectives: the system is monitored, inbound traffic is monitored, and outbound traffic is monitored. System monitoring [a]. EDR…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.5[a] [b] [c]
Weekly full scans plus real-time scanning of every externally sourced file
AO coverage. Addresses all three System & File Scanning objectives: the scan frequency is defined, periodic scans happen at that frequency, and files from external sources are scanned in real time.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.4[a]
Definitions update automatically within hours; stale-definition devices lose CUI access
AO coverage. Addresses the single Update Malicious Code Protection objective across every location designated for malicious code protection. Automatic by default. Signature and intelligence updates…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.3[a] [b] [c]
One advisory intake queue with a written response-action catalog and a named owner
AO coverage. Addresses all three Security Alerts & Advisories objectives: response actions are identified, advisories are monitored, and actions are taken. Response-action catalog [a]. Six outcomes…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet