NIST SP 800-171 REV. 3 Access Control

• 03.01.01 Account Management

  Define the types of system accounts allowed and prohibited.

• 03.01.02 Access Enforcement

  Enforce approved authorizations for logical access to CUI and system resources in accordance with applicable access control policies.

• 03.01.03 Information Flow Enforcement

  Enforce approved authorizations for controlling the flow of CUI within the system and between connected systems.

• 03.01.04 Separation of Duties

  Identify the duties of individuals requiring separation.

• 03.01.05 Least Privilege

  Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks.

• 03.01.06 Least Privilege – Privileged Accounts

  Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].

• 03.01.07 Least Privilege – Privileged Functions

  Prevent non-privileged users from executing privileged functions.

• 03.01.08 Unsuccessful Logon Attempts

  Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period].

• 03.01.09 System Use Notification

  Display a system use notification message with privacy and security notices consistent with applicable CUI rules before granting access to the system.

• 03.01.10 Device Lock

  Prevent access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended].

• 03.01.11 Session Termination

  Terminate a user session automatically after [Assignment: organization-defined conditions or trigger events requiring session disconnect.

• 03.01.12 Remote Access

  Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access.

• 03.01.16 Wireless Access

  Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system.

• 03.01.18 Access Control for Mobile Devices

  Establish usage restrictions, configuration requirements, and connection requirements for mobile devices.

• 03.01.20 Use of External Systems

  Prohibit the use of external systems unless the systems are specifically authorized.

• 03.01.22 Publicly Accessible Content

  Train authorized individuals to ensure that publicly accessible information does not contain CUI.

Need help putting this into practice? See our NIST SP 800-171 & CMMC compliance services or read our NIST SP 800-171 & CMMC articles.