• Ignyte CMMC Specialist


Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations

Safeguarding Controlled Unclassified Information (CUI) when working with a federal customer is critical to federal agencies and can directly impact your business. NIST SP 800-171 provides recommended minimal controls for protecting CUI. The requirements apply to all of the non-federal systems that process, store, or transmit CUI, or provide security protection for such components.

Requirements are specifically broken out into "Families" with sub-requirements underneath each family.

Configuration Management

3.4.1 Establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

NIST Special Publication 800-128 provides guidance on security-focused configuration management

3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational information systems.

This requirement establishes and maintains baseline configurations for systems and system components including for system communications and connectivity.

Baseline configurations include information about:

  • System components

  • Network topology

  • Logical placement within the system architecture

Organizations can implement centralized system component inventories that include components 897 from multiple organizational systems.

NIST Special Publications 800-70 and 800-128 provide guidance on security configuration settings

3.4.3 Track, review, approve/disapprove, and audit changes to information systems.

Configuration change controls for organizational systems involve the systematic proposal, justification, implementation, testing, review, and disposition of changes to the systems.

Configuration change control includes:

  • Changes to baseline configurations for components and configuration items of systems

  • Changes to configuration settings for information technology products

  • Unscheduled and unauthorized changes

  • Changes to remediate vulnerabilities.

Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes to systems.

NIST Special Publication 800-128 provides guidance on configuration change control

3.4.4 Analyze the security impact of changes prior to implementation.

Individuals conducting security impact analyses possess the necessary skills and technical expertise to analyze the changes to systems and the associated security ramifications.

Security impact analysis may include

  • Reviewing security plans to understand security requirements and reviewing system design documentation to understand the implementation of safeguards

  • How specific changes might affect the safeguards.

Security impact analyses may also include risk assessments to better understand the impact of the changes and to determine if additional safeguards are required

NIST Special Publication 800-128 provides guidance on configuration change controland security impact analysis

3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to the information system.

Any changes to the hardware, software, or firmware components of systems can potentially have significant effects on the overall security of the systems.

Organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes, including upgrades and modifications

Access restrictions include:

  • Physical and logical access control requirements

  • Workflow automation

  • Media libraries

  • Abstract layers

  • Change windows

NIST Special Publication 800-128 provides guidance on configuration change control

3.4.6 Employ the principle of least functionality by configuring the information system to provide only essential capabilities.

Organizations disable unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of devices, transfer of information, and tunneling.

Organizations can utilize:

  • Network scanning tools

  • Intrusion detection and prevention systems

  • End-point protections such as firewalls and host-based intrusion detection systems

3.4.7 Restrict, disable, and prevent the use of nonessential programs, functions, ports, protocols, and services.

Restricting the use of nonessential software includes:

  • Restricting the roles allowed to approve program execution

  • Prohibiting auto-execute

  • Program blacklisting and whitelisting

  • Restricting the number of program instances executed at the same time

3.4.8 Apply deny-by-exception (blacklist) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

The process used to identify software programs that are not authorized to execute on systems is commonly referred to as blacklisting.

The process used to identify software programs that are authorized to execute on systems is commonly referred to as whitelisting.

Whitelisting is the stronger of the two policies for restricting software program execution.

Organizations consider verifying the integrity of white-listed software programs using:

  • Cryptographic checksums

  • Digital signatures

  • Hash functions

NIST Special Publication 800-167 provides guidance on application whitelisting

3.4.9 Control and monitor user-installed software.

To maintain control over the types of software installed, organizations identify permitted and prohibited actions regarding software installation.

The policies organizations select governing user-installed software may be organization-developed or provided by some external entity.

For further Information and Demo, please contact us:

  • LinkedIn
  • Facebook
  • Twitter
  • Instagram
  • YouTube
  • Pinterest | 1.833.IGNYTE1 


Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Generic disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Gartner is a registered trademark and service mark of Gartner, Inc. and/or of its affiliates in the U.S. and internationally, and is used herein with permission. All rights reserved

Igntye © 2020 All Rights Reserved. Ignyte Assurance Platform, Privacy Policy and Terms of Service.