Implementation examples
23 examples referencing Ticketing
- PS.L2-3.9.1[a]
Screening clears before the enclave group is granted, not after the start date
AO coverage. Addresses the Screen Individuals objective: individuals are screened before access to systems containing CUI is authorized. Screening standard. A written standard defines what screening…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MA.L2-3.7.1[a]
Maintenance calendar driven by the asset inventory, not by what breaks
AO coverage. Addresses the Perform Maintenance objective: system maintenance is performed on organizational systems. Driven by inventory. Every asset in the inventory carries a maintenance profile:…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IR.L2-3.6.3[a]
Two tabletops and one live containment drill a year, with findings that close
AO coverage. Addresses the Incident Response Testing objective: the incident response capability is tested. Annual test plan. Three exercises a year, scheduled in January so calendars are held: a…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CA.L2-3.12.2[a] [b] [c]
Every POA&M item carries an owner, a funding line, and a closure test
AO coverage. Addresses all Operational Plan of Action objectives: identifying the deficiencies and vulnerabilities to address, developing the plan, and implementing it. Identifying deficiencies. Four…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CA.L2-3.12.1[a] [b]
A third of the practices every quarter, tested rather than attested
AO coverage. Addresses both Security Control Assessment objectives: defining the assessment frequency and assessing controls at that frequency to determine effectiveness. Defined frequency. The…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 1 - AT.L2-3.2.2[a] [b] [c]
Security duty matrix: every named role has a training plan and a due date
AO coverage. Addresses all Role-based Training objectives: defining security duties, assigning them to named people, and training those people to perform them. Defining duties. A duty matrix lists…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.4[a]
Definitions update automatically within hours; stale-definition devices lose CUI access
AO coverage. Addresses the single Update Malicious Code Protection objective across every location designated for malicious code protection. Automatic by default. Signature and intelligence updates…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.3[a] [b] [c]
One advisory intake queue with a written response-action catalog and a named owner
AO coverage. Addresses all three Security Alerts & Advisories objectives: response actions are identified, advisories are monitored, and actions are taken. Response-action catalog [a]. Six outcomes…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.1[a] [b] [c] [d] [e] [f]
Written SLAs by severity, with scans that open tickets and a POA&M for the misses
AO coverage. Addresses all six Flaw Remediation objectives: the time frames for identifying, reporting, and correcting flaws are each specified, and each is met in practice. Time to identify,…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal88% · 2 - SC.L2-3.13.6[a] [b]
Default-deny rulebases north-south and east-west, with exceptions that expire
AO coverage. Addresses both Network Communication By Exception objectives: deny by default, allow by exception. Deny by default [a]. Every rulebase ends in an explicit deny-all-and-log rule, and the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.9[a] [b] [c]
Self-service catalog for approved software; everything else shows up in the weekly diff
AO coverage. Addresses all three User-installed Software objectives: an installation policy is established [a], installation is controlled per that policy [b], and installation is monitored [c].…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.7[a] [b] [c] [d] [e] [f] [g] [h] [i] [j] [k] [l] [m] [n] [o]
Five lists, one review: essential programs, functions, ports, protocols, and services
AO coverage. Addresses all fifteen Nonessential Functionality objectives by treating the five categories separately — for each of programs, functions, ports, protocols, and services we define what is…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.4[a]
A one-page security impact analysis that has to name what could go wrong
AO coverage. Addresses the single Security Impact Analysis objective: the security impact of a change is analyzed before implementation. The analysis [a]. No change to an in-scope system leaves the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.3[a] [b] [c] [d]
Intended change versus actual change: reconciling tickets against what the tools logged
AO coverage. Addresses all four System Change Management objectives: changes are tracked [a], reviewed [b], approved or disapproved [c], and logged [d]. Tracking [a]. Every change to an in-scope…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.4[a] [b] [c]
Logging failures page the on-call instead of landing in an unread inbox
AO coverage. Addresses all three Audit Failure Alerting objectives: who is alerted, which failure types generate an alert, and that the alert actually reaches those people. Who is alerted [a].…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.3[a] [b] [c]
Quarterly logged-event review that actually changes the catalog
AO coverage. Addresses all three Event Review objectives: a review process with defined timing, review of the logged event types against it, and updates resulting from that review. Defined process…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.9[a]
Single-use 60-minute reset credential; the session cannot continue without a permanent one
AO coverage. Addresses the single Temporary Passwords objective: an immediate change to a permanent credential is required when a temporary one is used to log on. Reset path. The help desk issues a…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.6[a] [b]
35-day inactivity disable for people, 90 with owner sign-off for service identities
AO coverage. Addresses both Identifier Handling objectives: the inactivity period is defined, and identifiers are disabled after it. Defined periods. Interactive human accounts: 35 days without a…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.22[a] [b] [c] [d] [e]
Public site and social: CUI review gate before publish
AO coverage. Addresses all Control Public Information objectives for CUI posted or processed on public systems. Process. Anything destined for the public website, social media, or public careers…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.21[a] [b] [c]
No org USB on home PCs; portable media only on managed endpoints
AO coverage. Addresses all Portable Storage Use objectives regarding external systems. Limit. Portable storage that may hold CUI is org-issued, hardware-encrypted, and only mountable on managed…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet