Implementation examples
110 examples
- CM.L2-3.4.6[a] [b]
Role-shaped images: each server role ships only the packages that role needs
AO coverage. Addresses both Least Functionality objectives: essential capabilities are defined per role, and systems are configured to provide only those. Defining essential capabilities [a]. Each…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.5[a] [b] [e] [f] [g] [h]
Only the deployment pipeline can write to production; humans hold review rights
AO coverage. Claims the logical access restriction objectives [e] defined, [f] documented, [g] approved, and [h] enforced, plus [a] and [b] — physical restrictions are defined and documented for the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.4[a]
A one-page security impact analysis that has to name what could go wrong
AO coverage. Addresses the single Security Impact Analysis objective: the security impact of a change is analyzed before implementation. The analysis [a]. No change to an in-scope system leaves the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.3[a] [b] [c] [d]
Intended change versus actual change: reconciling tickets against what the tools logged
AO coverage. Addresses all four System Change Management objectives: changes are tracked [a], reviewed [b], approved or disapproved [c], and logged [d]. Tracking [a]. Every change to an in-scope…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.1[a] [b] [c] [d] [e] [f]
Baselines as code and one inventory of record, including firmware and the documents
AO coverage. Addresses all six System Baselining objectives: baseline established [a] and covering hardware, software, firmware, and documentation [b]; baseline maintained across the life cycle [c];…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 1 - AU.L2-3.3.9[a] [b]
Two named log administrators; analysts and engineers get read-only search
AO coverage. Addresses both Audit Management objectives: the subset of privileged users allowed to manage audit logging functionality is defined, and management is limited to that subset. Defined…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.8[a] [b] [c] [d] [e] [f]
Write-once archive in a separate account so a log admin cannot erase their own trail
AO coverage. Addresses all six Audit Protection objectives: audit information protected from unauthorized access [a], modification [b], and deletion [c], and the logging tools themselves protected…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.7[a] [b] [c]
Two internal stratum-2 servers as the only time source; drift over 500 ms opens a ticket
AO coverage. Addresses all three Authoritative Time Source objectives: internal clocks generate the timestamps, an authoritative source is specified, and clocks are compared and synchronized to it.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.6[a] [b]
Saved searches and a scoped assessor report instead of multi-gigabyte CSV dumps
AO coverage. Addresses both Reduction & Reporting objectives: an audit record reduction capability supporting on-demand analysis, and a report generation capability supporting on-demand reporting.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.5[a] [b]
One investigation timeline across identity, endpoint, network, and file-server events
AO coverage. Addresses both Audit Correlation objectives: the review, analysis, and reporting processes are defined, and those processes are correlated across sources rather than run independently.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.4[a] [b] [c]
Logging failures page the on-call instead of landing in an unread inbox
AO coverage. Addresses all three Audit Failure Alerting objectives: who is alerted, which failure types generate an alert, and that the alert actually reaches those people. Who is alerted [a].…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.3[a] [b] [c]
Quarterly logged-event review that actually changes the catalog
AO coverage. Addresses all three Event Review objectives: a review process with defined timing, review of the logged event types against it, and updates resulting from that review. Defined process…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.2[a] [b]
Retiring the shared itadmin account so every action names a human
AO coverage. Addresses both User Accountability objectives: the record content needed to trace actions to a user is defined, and created records actually contain it. Defined record content [a]. For…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.11[a]
Masked entry on every surface, including kiosks, scanners, and the mirrored conference display
AO coverage. Addresses the single Obscure Feedback objective across the authentication surfaces enumerated below. Surfaces in scope. Workstation and kiosk logon, virtual desktop sign-in, internal web…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.10[a] [b]
Salted hashes at rest, no cleartext protocols on the wire, and a CI check against logging secrets
AO coverage. Addresses both Cryptographically-protected Passwords objectives — storage and transit — for the directories, applications, and network devices in scope. Storage. The directory stores…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.9[a]
Single-use 60-minute reset credential; the session cannot continue without a permanent one
AO coverage. Addresses the single Temporary Passwords objective: an immediate change to a permanent credential is required when a temporary one is used to log on. Reset path. The help desk issues a…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.8[a] [b]
24 remembered generations, one-day minimum age, and random vault secrets for shared accounts
AO coverage. Addresses both Password Reuse objectives: the number of generations is specified, and reuse is prevented across them. Specified generations. 24 for domain and IdP accounts, matching the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.7[a] [b] [c]
Passphrase floor with a program-name banned list; character-change only where the DC sees it
AO coverage. Claims [a] (complexity requirements defined), [b] (change-of-character requirements defined), and [c] (complexity enforced when new passwords are created). Objective [d]…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.6[a] [b]
35-day inactivity disable for people, 90 with owner sign-off for service identities
AO coverage. Addresses both Identifier Handling objectives: the inactivity period is defined, and identifiers are disabled after it. Defined periods. Interactive human accounts: 35 days without a…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.5[a] [b]
24-month identifier hold, with mail aliases reserved permanently
AO coverage. Addresses both Identifier Reuse objectives: the non-reuse period is defined, and reuse is prevented within it. Defined period. Account identifiers (UPN, sAMAccountName, MES user ID, and…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet