NIST SP 800-171 Rev 3: the evidence behind every control

97 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

03.01 AC (Access Control)

03.01.01Account Management hard 03.01.02Access Enforcement moderate 03.01.03Information Flow Enforcement easy 03.01.04Separation of Duties hard 03.01.05Least Privilege moderate 03.01.06Least Privilege - Privileged Accounts moderate 03.01.07Least Privilege - Privileged Functions easy 03.01.08Unsuccessful Logon Attempts hard 03.01.09System Use Notification moderate 03.01.10Device Lock easy 03.01.11Session Termination easy 03.01.12Remote Access easy 03.01.16Wireless Access hard 03.01.18Access Control for Mobile Devices moderate 03.01.20Use of External Systems hard 03.01.22Publicly Accessible Content hard

03.02 AT (Awareness and Training)

03.02.01Literacy Training and Awareness moderate 03.02.02Role-Based Training hard

03.03 AU (Audit and Accountability)

03.03.01Event Logging moderate 03.03.02Audit Record Content easy 03.03.03Audit Record Generation moderate 03.03.04Response to Audit Logging Process Failures easy 03.03.05Audit Record Review, Analysis, and Reporting moderate 03.03.06Audit Record Reduction and Report Generation easy 03.03.07Time Stamps easy 03.03.08Protection of Audit Information easy

03.04 CM (Configuration Management)

03.04.01Baseline Configuration hard 03.04.02Configuration Settings easy 03.04.03Configuration Change Control moderate 03.04.04Impact Analyses hard 03.04.05Access Restrictions for Change hard 03.04.06Least Functionality moderate 03.04.08Authorized Software - Allow by Exception moderate 03.04.10System Component Inventory easy 03.04.11Information Location hard 03.04.12System and Component Configuration for High-Risk Areas hard

03.05 IA (Identification and Authentication)

03.05.01User Identification and Authentication easy 03.05.02Device Identification and Authentication moderate 03.05.03Multi-Factor Authentication easy 03.05.04Replay-Resistant Authentication easy 03.05.05Identifier Management hard 03.05.07Password Management hard 03.05.11Authentication Feedback hard 03.05.12Authenticator Management moderate

03.06 IR (Incident Response)

03.06.01Incident Handling hard 03.06.02Incident Monitoring, Reporting, and Response Assistance hard 03.06.03Incident Response Testing hard 03.06.04Incident Response Training hard 03.06.05Incident Response Plan hard

03.07 MA (Maintenance)

03.07.04Maintenance Tools moderate 03.07.05Nonlocal Maintenance hard 03.07.06Maintenance Personnel moderate

03.08 MP (Media Protection)

03.08.01Media Storage moderate 03.08.02Media Access easy 03.08.03Media Sanitization easy 03.08.04Media Marking hard 03.08.05Media Transport hard 03.08.07Media Use hard 03.08.09System Backup - Cryptographic Protection moderate

03.09 PS (Personnel Security)

03.09.01Personnel Screening hard 03.09.02Personnel Termination and Transfer moderate

03.10 PE (Physical Protection)

03.10.01Physical Access Authorizations easy 03.10.02Monitoring Physical Access moderate 03.10.06Alternate Work Site hard 03.10.07Physical Access Control moderate 03.10.08Access Control for Transmission hard

03.11 RA (Risk Assessment)

03.11.01Risk Assessment hard 03.11.02Vulnerability Monitoring and Scanning easy 03.11.04Risk Response hard

03.12 CA (Security Assessment and Monitoring)

03.12.01Security Assessment hard 03.12.02Plan of Action and Milestones hard 03.12.03Continuous Monitoring easy 03.12.05Information Exchange hard

03.13 SC (System and Communications Protection)

03.13.01Boundary Protection moderate 03.13.04Information in Shared System Resources moderate 03.13.06Network Communications - Deny by Default - Allow by Exception hard 03.13.08Transmission Confidentiality and Integrity moderate 03.13.09Network Disconnect easy 03.13.10Cryptographic Key Establishment and Management moderate 03.13.11Cryptographic Protection hard 03.13.12Collaborative Computing Devices and Applications moderate 03.13.13Mobile Code hard 03.13.15Session Authenticity moderate

03.14 SI (System and Information Integrity)

03.14.01Flaw Remediation hard 03.14.02Malicious Code Protection moderate 03.14.03Security Alerts, Advisories, and Directives easy 03.14.06System Monitoring easy 03.14.08Information Management and Retention hard

03.15 PL (Planning)

03.15.01Policy and Procedures hard 03.15.02System Security Plan hard 03.15.03Rules of Behavior hard

03.16 SA (System and Services Acquisition)

03.16.01Security Engineering Principles hard 03.16.02Unsupported System Components hard 03.16.03External System Services moderate

03.17 SR (Supply Chain Risk Management)

03.17.01Supply Chain Risk Management Plan hard 03.17.02Acquisition Strategies, Tools, and Methods hard 03.17.03Supply Chain Requirements and Processes hard