Evidence Collection Approach - Revision history

David: /* SC.L2-3.13.12 – Collaborative Device Control */

2026-07-20T01:49:51Z

SC.L2-3.13.12 – Collaborative Device Control

← Older revision		Revision as of 01:49, 20 July 2026
Line 1,502:		Line 1,502:
	\| [b] collaborative computing devices provide indication to users of devices in use. \|\| Physical Review \|\| Physical inspection of device.		\| [b] collaborative computing devices provide indication to users of devices in use. \|\| Physical Review \|\| Physical inspection of device.
	\|-		\|-
	\| [c] remote activation of collaborative computing devices is prohibited. \|\| ~~Screen Share~~ \|\| Collaboration device configuration/console.		\| [c] remote activation of collaborative computing devices is prohibited. \|\| Artifact \|\| Collaboration device configuration/console.
	\|}		\|}

David: /* SC.L2-3.13.9 – Connections Termination */

2026-07-20T01:49:19Z

SC.L2-3.13.9 – Connections Termination

← Older revision		Revision as of 01:49, 20 July 2026
Line 1,463:		Line 1,463:
	\| [b] network connections associated with communications sessions are terminated at the end of the sessions. \|\| Screen Share \|\| VPN appliance/server logs, VPN configurations, web server configurations, firewall connection settings.		\| [b] network connections associated with communications sessions are terminated at the end of the sessions. \|\| Screen Share \|\| VPN appliance/server logs, VPN configurations, web server configurations, firewall connection settings.
	\|-		\|-
	\| [c] network connections associated with communications sessions are terminated after the defined period of inactivity. \|\| ~~Artifact~~ \|\| VPN appliance/server logs, VPN configurations, web server configurations, frewall connection settings.		\| [c] network connections associated with communications sessions are terminated after the defined period of inactivity. \|\| Screen Share \|\| VPN appliance/server logs, VPN configurations, web server configurations, frewall connection settings.
	\|}		\|}

David: /* SC.L2-3.13.8 – Data in Transit */

2026-07-20T01:49:09Z

SC.L2-3.13.8 – Data in Transit

← Older revision		Revision as of 01:49, 20 July 2026
Line 1,448:		Line 1,448:
	\| [b] alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified. \|\| Document \|\| SSP, physical security policy.		\| [b] alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified. \|\| Document \|\| SSP, physical security policy.
	\|-		\|-
	\| [c] either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission. \|\| ~~Screen Share~~ \|\| TLS settings, SSL settings, VPN/Wireless Access Points/Mobile Devices cryptographic settings, ODBC connector settings, SAN configuration, IPSec/MPLS, backup configuration, physical security.		\| [c] either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission. \|\| Artifact \|\| TLS settings, SSL settings, VPN/Wireless Access Points/Mobile Devices cryptographic settings, ODBC connector settings, SAN configuration, IPSec/MPLS, backup configuration, physical security.
	\|}		\|}

David: /* SC.L2-3.13.9 – Connections Termination */

2026-07-20T01:48:42Z

SC.L2-3.13.9 – Connections Termination

← Older revision		Revision as of 01:48, 20 July 2026
Line 1,463:		Line 1,463:
	\| [b] network connections associated with communications sessions are terminated at the end of the sessions. \|\| Screen Share \|\| VPN appliance/server logs, VPN configurations, web server configurations, firewall connection settings.		\| [b] network connections associated with communications sessions are terminated at the end of the sessions. \|\| Screen Share \|\| VPN appliance/server logs, VPN configurations, web server configurations, firewall connection settings.
	\|-		\|-
	\| [c] network connections associated with communications sessions are terminated after the defined period of inactivity. \|\| ~~Screen Share~~ \|\| VPN appliance/server logs, VPN configurations, web server configurations, frewall connection settings.		\| [c] network connections associated with communications sessions are terminated after the defined period of inactivity. \|\| Artifact \|\| VPN appliance/server logs, VPN configurations, web server configurations, frewall connection settings.
	\|}		\|}

David: /* IA.L2-3.5.6 – Identifier Handling */

2026-07-20T01:42:47Z

IA.L2-3.5.6 – Identifier Handling

← Older revision		Revision as of 01:42, 20 July 2026
Line 789:		Line 789:
	\| [a] a period of inactivity after which an identifier is disabled is defined. \|\| Document \|\| SSP, policy that defines the period of inactivity after which an identifier is disabled.		\| [a] a period of inactivity after which an identifier is disabled is defined. \|\| Document \|\| SSP, policy that defines the period of inactivity after which an identifier is disabled.
	\|-		\|-
	\| [b] identifiers are disabled after the defined period of inactivity. \|\| ~~Screen Share~~ \|\| Screen share AD or similar tool supporting directory-based identity-related services for disabled accounts (can be done by hand or script).		\| [b] identifiers are disabled after the defined period of inactivity. \|\| Artifact \|\| Screen share AD or similar tool supporting directory-based identity-related services for disabled accounts (can be done by hand or script).
	\|}		\|}

David: /* IA.L2-3.5.5 – Identifier Reuse */

2026-07-20T01:42:37Z

IA.L2-3.5.5 – Identifier Reuse

← Older revision		Revision as of 01:42, 20 July 2026
Line 776:		Line 776:
	\| [a] a period within which identifiers cannot be reused is defined. \|\| Document \|\| SSP, policies, or SOP that defines identifier reuse.		\| [a] a period within which identifiers cannot be reused is defined. \|\| Document \|\| SSP, policies, or SOP that defines identifier reuse.
	\|-		\|-
	\| [b] reuse of identifiers is prevented within the defined period. \|\| ~~Screen Share~~ \|\| Show the GPO setting/technical solution that enforces what is defined in policy/documentation (this can be automated or manual process; screen share/artifacts can be presented to satisfy this requirement.		\| [b] reuse of identifiers is prevented within the defined period. \|\| Artifact \|\| Show the GPO setting/technical solution that enforces what is defined in policy/documentation (this can be automated or manual process; screen share/artifacts can be presented to satisfy this requirement.
	\|}		\|}

David: /* IA.L2-3.5.3 – Multifactor Authentication */

2026-07-20T01:42:06Z

IA.L2-3.5.3 – Multifactor Authentication

← Older revision		Revision as of 01:42, 20 July 2026
Line 746:		Line 746:
	\| colspan="3" \| [[Practice_IA.L2-3.5.3_Details\|'''IA.L2-3.5.3''']] Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.		\| colspan="3" \| [[Practice_IA.L2-3.5.3_Details\|'''IA.L2-3.5.3''']] Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
	\|-		\|-
	\| [a] privileged accounts are identified. \|\| ~~Screen Share~~\|\| Based on what is defined in their documentation, request to see a sample of privileged users in AD OU group. Overlaps with 3.1.5. Screenshot/screen share to show implementation is enforced.		\| [a] privileged accounts are identified. \|\| Document \|\| Based on what is defined in their documentation, request to see a sample of privileged users in AD OU group. Overlaps with 3.1.5. Screenshot/screen share to show implementation is enforced.
	\|-		\|-
	\| [b] multifactor authentication is implemented for local access to privileged accounts. \|\| ~~Document~~ \|\| SSP, AUP, Policy, SOP that defines that MFA is needed for privileged local access.		\| [b] multifactor authentication is implemented for local access to privileged accounts. \|\| Screen Share \|\| SSP, AUP, Policy, SOP that defines that MFA is needed for privileged local access.
	\|-		\|-
	\| [c] multifactor authentication is implemented for network access to privileged accounts. \|\| Screen Share \|\| Within the MFA implementation mechanism, show that privileged users are forced to use MFA; Screenshot/Screen share to show implementation is enforced.		\| [c] multifactor authentication is implemented for network access to privileged accounts. \|\| Screen Share \|\| Within the MFA implementation mechanism, show that privileged users are forced to use MFA; Screenshot/Screen share to show implementation is enforced.

David: /* IA.L2-3.5.1 – Identification [CUI Data] */

2026-07-20T01:41:36Z

IA.L2-3.5.1 – Identification [CUI Data]

← Older revision		Revision as of 01:41, 20 July 2026
Line 718:		Line 718:
	\| [a] system users are identified. \|\| Document \|\| Based on what is defined in their documentation (SSP, AUP, Policy, SOP), request to see a sample of non-privileged/privileged users in AD OU group (overlaps with 3.1.1 and 3.1.5).		\| [a] system users are identified. \|\| Document \|\| Based on what is defined in their documentation (SSP, AUP, Policy, SOP), request to see a sample of non-privileged/privileged users in AD OU group (overlaps with 3.1.1 and 3.1.5).
	\|-		\|-
	\| [b] processes acting on behalf of users are identified. \|\| ~~Screen Share~~ \|\| Based on what is defined in their documentation (SSP, AUP, Policy, SOP), request to see a sample of service accounts in AD OU group (overlaps with 3.1.1 and 3.1.5).		\| [b] processes acting on behalf of users are identified. \|\| Document \|\| Based on what is defined in their documentation (SSP, AUP, Policy, SOP), request to see a sample of service accounts in AD OU group (overlaps with 3.1.1 and 3.1.5).
	\|-		\|-
	\| [c] devices accessing the system are identified. \|\| ~~Screen Share~~ \|\| Based on what is defined in their documentation (SSP, AUP, Policy, SOP), request to see a sample of domain-joined workstation & servers in AD OU group (overlaps with 3.1.1 and 3.1.5). For network devices, request screen share/artifact to show how they are identified on the enterprise network.		\| [c] devices accessing the system are identified. \|\| Document \|\| Based on what is defined in their documentation (SSP, AUP, Policy, SOP), request to see a sample of domain-joined workstation & servers in AD OU group (overlaps with 3.1.1 and 3.1.5). For network devices, request screen share/artifact to show how they are identified on the enterprise network.
	\|}		\|}

David: /* AU.L2-3.3.3 – Event Review */

2026-07-20T01:39:30Z

AU.L2-3.3.3 – Event Review

← Older revision		Revision as of 01:39, 20 July 2026
Line 442:		Line 442:
	\| [a] a process for determining when to review logged events is defined. \|\| Document \|\| SSP, policy, or documented process that shows frequency of when to review types of logged events.		\| [a] a process for determining when to review logged events is defined. \|\| Document \|\| SSP, policy, or documented process that shows frequency of when to review types of logged events.
	\|-		\|-
	\| [b] event types being logged are reviewed in accordance with the defined review process. \|\| ~~Document~~ \|\| Evidence through a documented method such as meeting minutes, CAB minutes, etc. of log sources and log events being logged at the defined frequency.		\| [b] event types being logged are reviewed in accordance with the defined review process. \|\| Artifact \|\| Evidence through a documented method such as meeting minutes, CAB minutes, etc. of log sources and log events being logged at the defined frequency.
	\|-		\|-
	\| [c] event types being logged are updated based on the review. \|\| Artifact \|\| Evidence of implementation based on the results of the review of logged events/sources through a ticket, meeting minutes, or screen share of the tool that shows changes implemented (finetuning).		\| [c] event types being logged are updated based on the review. \|\| Artifact \|\| Evidence of implementation based on the results of the review of logged events/sources through a ticket, meeting minutes, or screen share of the tool that shows changes implemented (finetuning).

David: /* AU.L2-3.3.3 – Event Review */

2026-07-20T01:39:11Z

AU.L2-3.3.3 – Event Review

← Older revision		Revision as of 01:39, 20 July 2026
Line 442:		Line 442:
	\| [a] a process for determining when to review logged events is defined. \|\| Document \|\| SSP, policy, or documented process that shows frequency of when to review types of logged events.		\| [a] a process for determining when to review logged events is defined. \|\| Document \|\| SSP, policy, or documented process that shows frequency of when to review types of logged events.
	\|-		\|-
	\| [b] event types being logged are reviewed in accordance with the defined review process. \|\| ~~Artifact~~ \|\| Evidence through a documented method such as meeting minutes, CAB minutes, etc. of log sources and log events being logged at the defined frequency.		\| [b] event types being logged are reviewed in accordance with the defined review process. \|\| Document \|\| Evidence through a documented method such as meeting minutes, CAB minutes, etc. of log sources and log events being logged at the defined frequency.
	\|-		\|-
	\| [c] event types being logged are updated based on the review. \|\| Artifact \|\| Evidence of implementation based on the results of the review of logged events/sources through a ticket, meeting minutes, or screen share of the tool that shows changes implemented (finetuning).		\| [c] event types being logged are updated based on the review. \|\| Artifact \|\| Evidence of implementation based on the results of the review of logged events/sources through a ticket, meeting minutes, or screen share of the tool that shows changes implemented (finetuning).