Cybersecurity Maturity Model Certification 2.0

Limit system access to authorized users, processes, devices

Limit access to authorized transaction types and functions

Verify and control/limit connections to external systems

Control information posted on publicly accessible systems

Use session lock with pattern-hiding displays

Terminate user session after defined condition

Monitor and control remote access sessions

Employ cryptographic mechanisms for remote access

Route remote access via managed access control points

Authorize remote execution of privileged commands

Authorize wireless access prior to connections

Protect wireless access using auth and encryption

Control connection of mobile devices

Encrypt CUI on mobile devices and platforms

Limit use of portable storage on external systems

Control CUI flow per approved authorizations

Separate duties to reduce malevolent activity risk

Employ least privilege, including for privileged accounts

Use non-privileged accounts for nonsecurity functions

Prevent non-privileged users from executing privileged functions

Limit unsuccessful logon attempts

Provide privacy/security notices consistent with CUI rules

Create and retain system audit logs

Ensure actions traceable to individual users

Review and update logged events

Alert on audit logging process failure

Correlate audit review, analysis, and reporting

Provide audit record reduction and report generation

Synchronize clocks with authoritative time source

Protect audit info and tools from unauthorized access

Limit audit logging management to privileged users

Ensure awareness of security risks and applicable policies

Train in assigned security duties and responsibilities

Provide insider threat awareness training

Establish/maintain baseline configs and inventories

Establish/enforce security configuration settings

Track, review, approve/disapprove, log changes

Analyze security impact of changes prior to implementation

Define/enforce physical and logical access restrictions for changes

Employ least functionality — only essential capabilities

Restrict/disable nonessential programs, ports, protocols

Apply deny-by-exception software policy

Control and monitor user-installed software

Identify system users, processes, and devices

Authenticate identities as prerequisite to access

Store/transmit only cryptographically-protected passwords

Obscure feedback of authentication information

Use MFA for local/network access

Employ replay-resistant authentication

Prevent reuse of identifiers for defined period

Disable identifiers after defined inactivity period

Enforce minimum password complexity

Prohibit password reuse for specified generations

Allow temporary password with immediate change required

Establish incident-handling capability

Track, document, report incidents to officials

Test organizational incident response capability

Perform maintenance on organizational systems

Controls on maintenance tools, techniques, personnel

Ensure off-site maintenance equipment sanitized of CUI

Check diagnostic/test media for malicious code

Require MFA for nonlocal maintenance; terminate when complete

Supervise maintenance personnel without required access

Sanitize/destroy media before disposal/reuse

Physically control and securely store media with CUI

Limit access to CUI on system media

Mark media with CUI markings and distribution limitations

Control media access; maintain accountability during transport

Encrypt CUI on digital media during transport

Control use of removable media on system components

Prohibit portable storage with no identifiable owner

Protect confidentiality of backup CUI at storage locations

Screen individuals prior to authorizing access to CUI

Protect CUI during/after personnel actions

Limit physical access to systems, equipment, environments

Escort visitors and monitor visitor activity

Maintain audit logs of physical access

Control and manage physical access devices

Protect and monitor physical facility/support infrastructure

Enforce CUI safeguarding at alternate work sites

Periodically assess risk to operations, assets, individuals

Scan for vulnerabilities periodically and when new ones identified

Remediate vulnerabilities per risk assessments

Periodically assess security controls for effectiveness

Develop/implement plans of action for deficiencies

Monitor security controls on an ongoing basis

Develop, document, periodically update system security plans

Monitor/control/protect communications at boundaries

Implement subnetworks for publicly accessible components

Establish and manage cryptographic keys

Employ FIPS-validated cryptography for CUI

Prohibit remote activation of collaborative devices

Control and monitor use of mobile code

Control and monitor use of VoIP technologies

Protect authenticity of communications sessions

Protect confidentiality of CUI at rest

Employ architectural designs for security

Separate user functionality from system management

Prevent unauthorized info transfer via shared resources

Deny network traffic by default; allow by exception

Prevent split tunneling on remote devices

Encrypt CUI during transmission

Terminate connections at end of sessions/after inactivity

Identify, report, correct system flaws in timely manner

Provide malicious code protection at appropriate locations

Update malicious code protection when new releases available

Perform periodic scans and real-time scans from external sources

Monitor security alerts/advisories and take action

Monitor systems for attack indicators (inbound/outbound)

Identify unauthorized use of organizational systems