SPRS score calculator

Limit system access to authorized users, processes, and devices.

Limit access to the types of transactions and functions authorized users may execute.

Control the flow of CUI in accordance with approved authorizations.

Separate duties of individuals to reduce risk of malevolent activity.

Employ least privilege, including for specific security functions and privileged accounts.

Use non-privileged accounts when accessing non-security functions.

Prevent non-privileged users from executing privileged functions; capture in audit logs.

Limit unsuccessful logon attempts.

Provide privacy and security notices consistent with applicable CUI rules.

Use session lock with pattern-hiding displays after inactivity.

Terminate user sessions after a defined condition.

Monitor and control remote access sessions.

Use cryptographic mechanisms to protect remote access sessions.

Route remote access via managed access control points.

Authorize remote execution of privileged commands and remote access to security info.

Authorize wireless access prior to allowing connections.

Protect wireless access using authentication and encryption.

Control connection of mobile devices.

Encrypt CUI on mobile devices and mobile computing platforms.

Verify and control/limit connections to and use of external systems.

Limit use of portable storage devices on external systems.

Control CUI posted or processed on publicly accessible systems.

Ensure managers and users are aware of security risks and policies.

Ensure personnel are trained to carry out their security duties.

Provide security awareness training on recognizing insider threat.

Create and retain system audit logs and records.

Ensure actions of individual users can be uniquely traced.

Review and update logged events.

Alert in the event of an audit logging process failure.

Correlate audit record review, analysis, and reporting for investigation.

Provide audit record reduction and report generation.

Provide a system capability to compare and synchronize time sources.

Protect audit information and logging tools from unauthorized access.

Limit management of audit logging to a subset of privileged users.

Establish and maintain baseline configurations and inventories.

Establish and enforce security configuration settings.

Track, review, approve/disapprove, and log changes to systems.

Analyze the security impact of changes prior to implementation.

Define, document, and enforce access restrictions for changes.

Employ the principle of least functionality.

Restrict, disable, or prevent nonessential programs, functions, ports, protocols.

Apply deny-by-exception (blacklist) or permit-by-exception (whitelist) policy.

Control and monitor user-installed software.

Identify system users, processes acting on behalf of users, and devices.

Authenticate identities as a prerequisite to system access.

Use multifactor authentication for privileged and network access.

Employ replay-resistant authentication mechanisms.

Prevent reuse of identifiers for a defined period.

Disable identifiers after a defined period of inactivity.

Enforce a minimum password complexity and change of characters.

Prohibit password reuse for a specified number of generations.

Allow temporary password use with immediate change to permanent.

Store and transmit only cryptographically-protected passwords.

Obscure feedback of authentication information.

Establish an operational incident-handling capability.

Track, document, and report incidents to designated officials.

Test the organizational incident response capability.

Perform maintenance on organizational systems.

Provide controls on tools, techniques, mechanisms, and personnel for maintenance.

Sanitize equipment removed for off-site maintenance of any CUI.

Check media containing diagnostic/test programs for malicious code.

Require multifactor authentication to establish nonlocal maintenance sessions.

Supervise maintenance activities of personnel without required access.

Protect system media containing CUI, both paper and digital.

Limit access to CUI on system media to authorized users.

Sanitize or destroy media containing CUI before disposal or reuse.

Mark media with necessary CUI markings and distribution limitations.

Control access to and account for media during transport.

Implement cryptographic mechanisms to protect CUI on transported media.

Control the use of removable media on system components.

Prohibit use of portable storage devices with no identifiable owner.

Protect the confidentiality of backup CUI at storage locations.

Screen individuals prior to authorizing access to CUI systems.

Protect CUI during and after personnel actions (terminations, transfers).

Limit physical access to systems, equipment, and operating environments.

Protect and monitor the physical facility and support infrastructure.

Escort visitors and monitor visitor activity.

Maintain audit logs of physical access.

Control and manage physical access devices.

Enforce safeguarding measures for CUI at alternate work sites.

Periodically assess risk to operations, assets, and individuals.

Scan for vulnerabilities in systems and applications periodically.

Remediate vulnerabilities in accordance with risk assessments.

Periodically assess security controls for effectiveness.

Develop and implement plans of action to correct deficiencies.

Monitor security controls on an ongoing basis.

Develop, document, and update system security plans.

Monitor, control, and protect communications at external and key internal boundaries.

Employ architectural designs and principles that promote effective security.

Separate user functionality from system management functionality.

Prevent unauthorized and unintended information transfer via shared resources.

Implement subnetworks for publicly accessible components (DMZ).

Deny network traffic by default and allow by exception.

Prevent remote devices from split tunneling into external networks.

Use cryptographic mechanisms to prevent disclosure of CUI in transit.

Terminate network connections at end of session or after inactivity.

Establish and manage cryptographic keys.

Employ FIPS-validated cryptography to protect CUI.

Prohibit remote activation of collaborative devices; indicate use to users.

Control and monitor use of mobile code.

Control and monitor use of Voice over Internet Protocol (VoIP).

Protect the authenticity of communications sessions.

Protect the confidentiality of CUI at rest.

Identify, report, and correct system flaws in a timely manner.

Provide protection from malicious code at designated locations.

Monitor system security alerts and advisories and take action.

Update malicious code protection mechanisms when new releases are available.

Perform periodic and real-time scans of files from external sources.

Monitor systems, including inbound and outbound traffic, to detect attacks.

Identify unauthorized use of organizational systems.