Implementation examples
110 examples
- SI.L2-3.14.2[a] [b]
Designated locations named on paper: endpoints, mail, portal uploads, and the build tier
AO coverage. Addresses both Malicious Code Protection objectives: the designated locations are identified, and protection is provided at each of them. Designated locations identified [a]. Rather than…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.1[a] [b] [c] [d] [e] [f]
Written SLAs by severity, with scans that open tickets and a POA&M for the misses
AO coverage. Addresses all six Flaw Remediation objectives: the time frames for identifying, reporting, and correcting flaws are each specified, and each is met in practice. Time to identify,…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal88% · 2 Encryption at rest everywhere CUI lands, with a written list of where that is
AO coverage. Addresses the single Data At Rest objective for every location where CUI is authorized to reside. Locations enumerated. The control is only as good as the list, so the list is explicit:…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yetBoth ends prove who they are: validated TLS for people, mutual TLS and pinned keys for machines
AO coverage. Addresses the single Communications Authenticity objective for the session types in scope: user-to-application, application-to-application, and administrative. User-to-application.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet- SC.L2-3.13.14[a] [b]
One sanctioned VoIP platform on a voice VLAN, with call records and toll-fraud alerting reviewed
AO coverage. Addresses both Voice Over Internet Protocol objectives: use of VoIP is controlled, and use of VoIP is monitored. Sanctioned platform. One cloud PBX is approved for business voice.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.13[a] [b]
Macro and script allow-listing, with execution telemetry landing in the SIEM
AO coverage. Addresses both Mobile Code objectives: use of mobile code is controlled, and use of mobile code is monitored. What counts as mobile code here. Office macros and add-ins, browser…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.12[a] [b] [c]
No remote activation of cameras or mics; visible indication required wherever CUI is discussed
AO coverage. Addresses all three Collaborative Device Control objectives: identifying the devices, providing indication of use, and prohibiting remote activation. Devices identified [a]. Laptop…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.10[a] [b]
Keys born in HSM-backed vaults; escrow, rotation, and revocation are all ticketed events
AO coverage. Addresses both Key Management objectives: keys are established and keys are managed wherever cryptography is employed. Key inventory. One register lists every key and certificate class…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.9[a] [b] [c]
Inactivity windows defined per connection type: 15 minutes for admin sessions, 12 hours for VPN
AO coverage. Addresses all three Connections Termination objectives: defining the inactivity period, terminating at end of session, and terminating after the defined inactivity period. Defined…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.8[a] [c]
Every CUI transmission path is cryptographically protected; no physical-safeguard alternative claimed
AO coverage. Claims objectives [a] and [c] — identifying the cryptographic mechanisms and implementing them for CUI in transit. Objective [b] (identify alternative physical safeguards) is not…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.7[a]
Always-on full tunnel with local LAN access and NIC bridging disabled in client policy
AO coverage. Addresses the single Split Tunneling objective for managed endpoints that can reach CUI. Client posture. The VPN profile is deployed by MDM, set to always-on with user-logon connect, and…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.6[a] [b]
Default-deny rulebases north-south and east-west, with exceptions that expire
AO coverage. Addresses both Network Communication By Exception objectives: deny by default, allow by exception. Deny by default [a]. Every rulebase ends in an explicit deny-all-and-log rule, and the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.5[a] [b]
Public web and file-drop portal in a separate cloud account with no route home
AO coverage. Addresses both Public-access System Separation objectives: identifying publicly accessible components and separating their subnetworks from internal networks. Publicly accessible…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.4[a]
Non-persistent VDI, per-user scratch space, and purged print spools between users
AO coverage. Addresses the single Shared Resource Control objective for the shared resources this organization actually operates. Shared resources enumerated. VDI pool desktops, hypervisor memory and…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.3[a] [b] [c]
Management interfaces unreachable from user devices; admin work happens on a separate plane
AO coverage. Addresses all three Role Separation objectives: identifying user functionality, identifying system management functionality, and separating the two. User functionality identified [a].…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.2[a] [c] [d] [f]
Reference architecture and landing-zone guardrails for an OSC that buys rather than builds
AO coverage. Claims objectives [a], [c], [d], and [f] — identifying and employing architectural designs and systems engineering principles. Objectives [b] and [e] (software development techniques)…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.1[a] [b] [c] [d] [e] [f] [g] [h]
Named external and internal boundaries, each with its own monitor/control/protect story
AO coverage. Addresses all eight Boundary Protection objectives: defining the external boundary and key internal boundaries, then monitoring, controlling, and protecting communications at each.…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal88% · 2 - CM.L2-3.4.9[a] [b] [c]
Self-service catalog for approved software; everything else shows up in the weekly diff
AO coverage. Addresses all three User-installed Software objectives: an installation policy is established [a], installation is controlled per that policy [b], and installation is monitored [c].…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.8[a] [b] [c]
Deny-all, permit-by-exception on CUI endpoints after 60 days in audit mode
AO coverage. Addresses all three Application Execution Policy objectives: the policy choice is specified [a], the software allowed to execute is specified [b], and allow-listing is implemented as…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.7[a] [b] [c] [d] [e] [f] [g] [h] [i] [j] [k] [l] [m] [n] [o]
Five lists, one review: essential programs, functions, ports, protocols, and services
AO coverage. Addresses all fifteen Nonessential Functionality objectives by treating the five categories separately — for each of programs, functions, ports, protocols, and services we define what is…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet