Implementation examples
110 examples
- IA.L2-3.5.3[a] [b] [c] [d]
Smart card at the rack, RADIUS-gated MFA for VDI and VPN
AO coverage. Addresses all four Multifactor Authentication objectives: privileged accounts identified [a], MFA for local access to privileged accounts [b], MFA for network access to privileged…
ControlVerdict Corpus@cv-corpusJul 31, 2026Above the line75% · 3 - IA.L2-3.5.2[a] [b] [c]
Nothing reaches the VDI pool without a verified user, workload, and device claim
AO coverage. Addresses all three Authentication objectives — user, process, and device verification as a prerequisite to access. Factor strength for those authentications is described in the…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 2 - IA.L2-3.5.1[a] [b] [c]
One naming standard for people, svc- identities, and device records
AO coverage. Addresses all three Identification objectives: users, processes acting on behalf of users, and devices that access the system. Users. Person accounts follow with a numeric suffix on…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal88% · 2 - AC.L2-3.1.22[a] [b] [c] [d] [e]
Public site and social: CUI review gate before publish
AO coverage. Addresses all Control Public Information objectives for CUI posted or processed on public systems. Process. Anything destined for the public website, social media, or public careers…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.21[a] [b] [c]
No org USB on home PCs; portable media only on managed endpoints
AO coverage. Addresses all Portable Storage Use objectives regarding external systems. Limit. Portable storage that may hold CUI is org-issued, hardware-encrypted, and only mountable on managed…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.20[a] [b] [c] [d] [e]
External system connections via CASB allow-list and reviewed integrations
AO coverage. Claims objectives [a]–[e] for verifying and limiting connections to external systems that handle CUI. Objective [f] (limit use of portable storage on external systems) is covered under…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.19[a] [b]
Encrypt CUI containers on phones; no local unmarked copies
AO coverage. Addresses both Encrypt CUI on Mobile objectives. Encryption. CUI is opened only in managed apps with encryption-at-rest for app data. Save-as to unmanaged local storage is blocked.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.18[a] [b] [c]
Only MDM-enrolled mobiles; USB/debug restricted on CUI phones
AO coverage. Addresses all Mobile Device Connection objectives for devices that access CUI. Control connection. CUI mail/files require Intune enrollment or app-protection policy. Jailbroken/rooted…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.17[a] [b]
WPA2/3-Enterprise with certs; no PSK on CUI-capable SSIDs
AO coverage. Addresses both Wireless Access Protection objectives. Authentication + encryption. Corp SSID uses WPA2/3-Enterprise with RADIUS. PSK SSIDs are forbidden for any VLAN that can reach CUI.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.16[a] [b]
Corporate WLAN allow-list; guest SSID has no enclave route
AO coverage. Addresses both Wireless Access Authorization objectives. Authorize prior to connect. Corporate SSID requires device certificate or 802.1X user/machine auth via ISE. Unknown devices land…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.15[a] [b] [c] [d]
Privileged remote admin only via PAW with ticketed authorization
AO coverage. Addresses all Privileged Remote Access objectives. Authorize. Remote privileged commands require (1) eligible privileged role activation with ticket ID and (2) landing on a PAW/jump that…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.14[a] [b]
All remote paths land on managed VPN or IdP — no direct RDP to enclave
AO coverage. Addresses both Remote Access Routing objectives. Control points. Internet users reach CUI only via (1) IdP SSO to SaaS or (2) full-tunnel VPN into the lab VRF. Edge firewall denies…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.13[a] [b]
TLS 1.2+ and approved ciphers on every remote access path
AO coverage. Addresses both Remote Access Confidentiality objectives. Identified mechanisms. Remote paths use TLS 1.2+ (SaaS/IdP) or IPsec/IKE suites approved on the crypto inventory (VPN). TLS…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.11[a] [b]
Idle and max session lifetimes on VPN and SSO
AO coverage. Addresses both Session Termination objectives. VPN. Idle disconnect ≤12 hours; absolute session lifetime forces re-auth. Concurrent sessions limited to one unless ticketed. SSO. IdP…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.10[a] [b] [c]
Screen lock ≤15 minutes with pattern-hiding on CUI endpoints
AO coverage. Addresses all Session Lock objectives for in-scope endpoints. Windows. Intune profile: idle lock at 15 minutes or less, password/PIN required to resume, lock screen does not preview CUI…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.9[a] [b]
CUI rules banner before enclave session and on shared workstations
AO coverage. Addresses both Privacy & Security Notices objectives for CUI rules. Notices. Before first daily access to enclave apps, users accept an IdP Terms of Use stating CUI handling rules,…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.8[a] [b]
Smart lockout on IdP and VPN; no endless password spray
AO coverage. Addresses both Unsuccessful Logon Attempts objectives. Thresholds. IdP smart lockout after repeated failures (org baseline: lock after sustained failures within a window, with…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.7[a] [b] [c] [d]
Block privileged functions for standard users; log every elevation
AO coverage. Addresses all Privileged Functions objectives (prevent + capture). Prevent. Standard users cannot activate Global Admin, User Admin, or enclave storage admin roles. Those roles are…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.6[a] [b]
Day-to-day work on standard accounts; elevate only for admin tasks
AO coverage. Addresses both Non-privileged Account Use objectives. Standard accounts. Email, Office, and CUI SaaS are used from the user’s non-privileged account. Local admin rights are removed from…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.4[a] [b] [c]
No single person both approves and provisions enclave access
AO coverage. Addresses all Separation of Duties objectives for enclave IAM and privileged IT functions. Conflicting duties. Documented pairs that must not be held by one person: (1) access approver…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet