Level 2 Assessment Guide: Difference between revisions

From CMMC Toolkit Wiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 78: Line 78:
|-
|-
|[[Practice_AC.L2-3.1.3_Details|More Practice Details...]]
|[[Practice_AC.L2-3.1.3_Details|More Practice Details...]]
|}
==== AC.L2-3.1.4 – Separation of Duties ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] the duties of individuals requiring separation are defined;
: [b] responsibilities for duties that require separation are assigned to separate individuals; and
: [c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.
|-
|[[Practice_AC.L2-3.1.4_Details|More Practice Details...]]
|}
==== AC.L2-3.1.5 – Least Privilege ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Employ the principle of least privilege, including for specific security functions and privileged accounts.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] privileged accounts are identified;
: [b] access to privileged accounts is authorized in accordance with the principle of least privilege;
: [c] security functions are identified; and
: [d] access to security functions is authorized in accordance with the principle of least privilege.
|-
|[[Practice_AC.L2-3.1.5_Details|More Practice Details...]]
|}
==== AC.L2-3.1.6 – Non-Privileged Account Use ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Use non-privileged accounts or roles when accessing nonsecurity functions.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] nonsecurity functions are identified; and
: [b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions.
|-
|[[Practice_AC.L2-3.1.6_Details|More Practice Details...]]
|}
==== AC.L2-3.1.7 – Privileged Functions ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] privileged functions are defined;
: [b] non-privileged users are defined;
: [c] non-privileged users are prevented from executing privileged functions; and
: [d] the execution of privileged functions is captured in audit logs.
|-
|[[Practice_AC.L2-3.1.7_Details|More Practice Details...]]
|}
==== AC.L2-3.1.8 – Unsuccessful Logon Attempts ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Limit unsuccessful logon attempts.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] the means of limiting unsuccessful logon attempts is defined; and
: [b] the defined means of limiting unsuccessful logon attempts is implemented.
|-
|[[Practice_AC.L2-3.1.8_Details|More Practice Details...]]
|}
==== AC.L2-3.1.9 – Privacy & Security Notices ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Provide privacy and security notices consistent with applicable CUI rules.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category; and
: [b] privacy and security notices are displayed.
|-
|[[Practice_AC.L2-3.1.9_Details|More Practice Details...]]
|}
==== AC.L2-3.1.10 – Session Lock ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] the period of inactivity after which the system initiates a session lock is defined;
: [b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and
: [c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.
|-
|[[Practice_AC.L2-3.1.10_Details|More Practice Details...]]
|}
==== AC.L2-3.1.11 – Session Termination ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Terminate (automatically) a user session after a defined condition.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] conditions requiring a user session to terminate are defined; and
: [b] a user session is automatically terminated after any of the defined conditions
|-
|[[Practice_AC.L2-3.1.11_Details|More Practice Details...]]
|}
==== AC.L2-3.1.12 – Control Remote Access ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Monitor and control remote access sessions.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] remote access sessions are permitted;
: [b] the types of permitted remote access are identified;
: [c] remote access sessions are controlled; and
: [d] remote access sessions are monitored.
|-
|[[Practice_AC.L2-3.1.12_Details|More Practice Details...]]
|}
==== AC.L2-3.1.13 – Remote Access Confidentiality ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified; and
: [b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.
|-
|[[Practice_AC.L2-3.1.13_Details|More Practice Details...]]
|}
==== AC.L2-3.1.14 – Remote Access Routing ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Route remote access via managed access control points.
|-
|'''ASSESSMENT OBJECTIVES'''
Determine if:
[a] managed access control points are identified and implemented; and
[b] remote access is routed through managed network access control points.
|-
|[[Practice_AC.L2-3.1.14_Details|More Practice Details...]]
|}
==== AC.L2-3.1.15 – Privileged Remote Access ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Authorize remote execution of privileged commands and remote access to security-relevant information.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] privileged commands authorized for remote execution are identified;
: [b] security-relevant information authorized to be accessed remotely is identified;
: [c] the execution of the identified privileged commands via remote access is authorized; and
: [d] access to the identified security-relevant information via remote access is authorized.
|-
|[[Practice_AC.L2-3.1.15_Details|More Practice Details...]]
|}
==== AC.L2-3.1.16 – Wireless Access Authorization ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Authorize wireless access prior to allowing such connections.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] wireless access points are identified; and
: [b] wireless access is authorized prior to allowing such connections.
|-
|[[Practice_AC.L2-3.1.16_Details|More Practice Details...]]
|}
==== AC.L2-3.1.17 – Wireless Access Protection ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Protect wireless access using authentication and encryption.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] wireless access to the system is protected using authentication; and
: [b] wireless access to the system is protected using encryption.
|-
|[[Practice_AC.L2-3.1.17_Details|More Practice Details...]]
|}
==== AC.L2-3.1.18 – Mobile Device Connection ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Control connection of mobile devices.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] mobile devices that process, store, or transmit CUI are identified;
: [b] mobile device connections are authorized; and
: [c] mobile device connections are monitored and logged.
|-
|[[Practice_AC.L2-3.1.18_Details|More Practice Details...]]
|}
==== AC.L2-3.1.19 – Encrypt CUI on Mobile ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Encrypt CUI on mobile devices and mobile computing platforms.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified; and
: [b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.
|-
|[[Practice_AC.L2-3.1.19_Details|More Practice Details...]]
|}
==== AC.L2-3.1.21 – Portable Storage Use ====
{|class="wikitable"
|'''SECURITY REQUIREMENT'''
Limit use of portable storage devices on external systems.
|-
|'''ASSESSMENT OBJECTIVES'''
: [a] the use of portable storage devices containing CUI on external systems is identified and documented;
: [b] limits on the use of portable storage devices containing CUI on external systems are defined; and
: [c] the use of portable storage devices containing CUI on external systems is limited as defined.
|-
|[[Practice_AC.L2-3.1.21_Details|More Practice Details...]]
|}
|}


Revision as of 00:59, 22 February 2022

Source of Reference: The official CMMC Level 2 Assessment Guide from the Office of the Under Secretary of Defense Acquisition & Sustainment.

For inquiries and reporting errors on this wiki, please contact us. Thank you.

Access Control (AC)

Level 1 AC Practices

AC.L1-3.1.1 - Authorized Access Control

SECURITY REQUIREMENT

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

ASSESSMENT OBJECTIVES
[a] authorized users are identified;
[b] processes acting on behalf of authorized users are identified;
[c] devices (and other systems) authorized to connect to the system are identified;
[d] system access is limited to authorized users;
[e] system access is limited to processes acting on behalf of authorized users; and
[f] system access is limited to authorized devices (including other systems).
More Practice Details...

AC.L1-3.1.2 - Transaction & Function Control

SECURITY REQUIREMENT

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

ASSESSMENT OBJECTIVES
[a] the types of transactions and functions that authorized users are permitted to execute are defined; and
[b] system access is limited to the defined types of transactions and functions for authorized users.
More Practice Details...

AC.L1-3.1.20 - External Connections

SECURITY REQUIREMENT

Verify and control/limit connections to and use of external information systems.

ASSESSMENT OBJECTIVES
[a] connections to external systems are identified;
[b] the use of external systems is identified;
[c] connections to external systems are verified;
[d] the use of external systems is verified;
[e] connections to external systems are controlled/limited; and
[f] the use of external systems is controlled/limited.
More Practice Details...

AC.L1-3.1.22 - Control Public Information

SECURITY REQUIREMENT

Control information posted or processed on publicly accessible information systems.

ASSESSMENT OBJECTIVES
[a] individuals authorized to post or process information on publicly accessible systems are identified;
[b] procedures to ensure FCI is not posted or processed on publicly accessible systems are identified;
[c] a review process is in place prior to posting of any content to publicly accessible systems;
[d] content on publicly accessible systems is reviewed to ensure that it does not include FCI; and
[e] mechanisms are in place to remove and address improper posting of FCI.
More Practice Details...

Level 2 AC Practices

AC.L2-3.1.3 – Control CUI Flow

SECURITY REQUIREMENT

Control the flow of CUI in accordance with approved authorizations.

ASSESSMENT OBJECTIVES
[a] information flow control policies are defined;
[b] methods and enforcement mechanisms for controlling the flow of CUI are defined;
[c] designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified;
[d] authorizations for controlling the flow of CUI are defined; and
[e] approved authorizations for controlling the flow of CUI are enforced.
More Practice Details...

AC.L2-3.1.4 – Separation of Duties

SECURITY REQUIREMENT

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

ASSESSMENT OBJECTIVES
[a] the duties of individuals requiring separation are defined;
[b] responsibilities for duties that require separation are assigned to separate individuals; and
[c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.
More Practice Details...

AC.L2-3.1.5 – Least Privilege

SECURITY REQUIREMENT

Employ the principle of least privilege, including for specific security functions and privileged accounts.

ASSESSMENT OBJECTIVES
[a] privileged accounts are identified;
[b] access to privileged accounts is authorized in accordance with the principle of least privilege;
[c] security functions are identified; and
[d] access to security functions is authorized in accordance with the principle of least privilege.
More Practice Details...

AC.L2-3.1.6 – Non-Privileged Account Use

SECURITY REQUIREMENT

Use non-privileged accounts or roles when accessing nonsecurity functions.

ASSESSMENT OBJECTIVES
[a] nonsecurity functions are identified; and
[b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions.
More Practice Details...

AC.L2-3.1.7 – Privileged Functions

SECURITY REQUIREMENT

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

ASSESSMENT OBJECTIVES
[a] privileged functions are defined;
[b] non-privileged users are defined;
[c] non-privileged users are prevented from executing privileged functions; and
[d] the execution of privileged functions is captured in audit logs.
More Practice Details...

AC.L2-3.1.8 – Unsuccessful Logon Attempts

SECURITY REQUIREMENT

Limit unsuccessful logon attempts.

ASSESSMENT OBJECTIVES
[a] the means of limiting unsuccessful logon attempts is defined; and
[b] the defined means of limiting unsuccessful logon attempts is implemented.
More Practice Details...

AC.L2-3.1.9 – Privacy & Security Notices

SECURITY REQUIREMENT

Provide privacy and security notices consistent with applicable CUI rules.

ASSESSMENT OBJECTIVES
[a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category; and
[b] privacy and security notices are displayed.
More Practice Details...

AC.L2-3.1.10 – Session Lock

SECURITY REQUIREMENT

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

ASSESSMENT OBJECTIVES
[a] the period of inactivity after which the system initiates a session lock is defined;
[b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and
[c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.
More Practice Details...

AC.L2-3.1.11 – Session Termination

SECURITY REQUIREMENT

Terminate (automatically) a user session after a defined condition.

ASSESSMENT OBJECTIVES
[a] conditions requiring a user session to terminate are defined; and
[b] a user session is automatically terminated after any of the defined conditions
More Practice Details...

AC.L2-3.1.12 – Control Remote Access

SECURITY REQUIREMENT

Monitor and control remote access sessions.

ASSESSMENT OBJECTIVES
[a] remote access sessions are permitted;
[b] the types of permitted remote access are identified;
[c] remote access sessions are controlled; and
[d] remote access sessions are monitored.
More Practice Details...

AC.L2-3.1.13 – Remote Access Confidentiality

SECURITY REQUIREMENT

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

ASSESSMENT OBJECTIVES
[a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified; and
[b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.
More Practice Details...

AC.L2-3.1.14 – Remote Access Routing

SECURITY REQUIREMENT

Route remote access via managed access control points.

ASSESSMENT OBJECTIVES

Determine if: [a] managed access control points are identified and implemented; and [b] remote access is routed through managed network access control points.

More Practice Details...

AC.L2-3.1.15 – Privileged Remote Access

SECURITY REQUIREMENT

Authorize remote execution of privileged commands and remote access to security-relevant information.

ASSESSMENT OBJECTIVES
[a] privileged commands authorized for remote execution are identified;
[b] security-relevant information authorized to be accessed remotely is identified;
[c] the execution of the identified privileged commands via remote access is authorized; and
[d] access to the identified security-relevant information via remote access is authorized.
More Practice Details...

AC.L2-3.1.16 – Wireless Access Authorization

SECURITY REQUIREMENT

Authorize wireless access prior to allowing such connections.

ASSESSMENT OBJECTIVES
[a] wireless access points are identified; and
[b] wireless access is authorized prior to allowing such connections.
More Practice Details...

AC.L2-3.1.17 – Wireless Access Protection

SECURITY REQUIREMENT

Protect wireless access using authentication and encryption.

ASSESSMENT OBJECTIVES
[a] wireless access to the system is protected using authentication; and
[b] wireless access to the system is protected using encryption.
More Practice Details...

AC.L2-3.1.18 – Mobile Device Connection

SECURITY REQUIREMENT

Control connection of mobile devices.

ASSESSMENT OBJECTIVES
[a] mobile devices that process, store, or transmit CUI are identified;
[b] mobile device connections are authorized; and
[c] mobile device connections are monitored and logged.
More Practice Details...

AC.L2-3.1.19 – Encrypt CUI on Mobile

SECURITY REQUIREMENT

Encrypt CUI on mobile devices and mobile computing platforms.

ASSESSMENT OBJECTIVES
[a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified; and
[b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.
More Practice Details...

AC.L2-3.1.21 – Portable Storage Use

SECURITY REQUIREMENT

Limit use of portable storage devices on external systems.

ASSESSMENT OBJECTIVES
[a] the use of portable storage devices containing CUI on external systems is identified and documented;
[b] limits on the use of portable storage devices containing CUI on external systems are defined; and
[c] the use of portable storage devices containing CUI on external systems is limited as defined.
More Practice Details...

Awareness and Training (AT)

Level 2 AT Practices

Audit and Accountability (AU)

Level 2 AU Practices

Configuration Management (CM)

Level 2 CM Practices

Identification and Authentication (IA)

Level 1 IA Practices

Level 2 IA Practices

Incident Response (IR)

Level 2 IR Practices

Maintenance (MA)

Level 2 MA Practices

Media Protection (MP)

Level 1 MP Practices

Level 2 MP Practices

Personnel Security (PS)

Level 2 PS Practices

Physical Protection (PE)

Level 1 PE Practices

Level 2 PE Practices

Risk Assessment (RA)

Level 2 RA Practices

Security Assessment (CA)

Level 2 CA Practices

System and Communications Protection (SC)

Level 1 SC Practices

Level 2 SC Practices

System and Information Integrity (SI)

Level 1 SI Practices

Level 2 SI Practices

Retrieved from "https://cmmcwiki.org/index.php?title=Level_2_Assessment_Guide&oldid=50"