{"text_format":"1","workbook":"xlsx","n_sheets":4,"sheets":["Welcome","Dashboard","Assessment","Table References"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":1,"defined_names":1,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Welcome","index":0,"n_rows":25,"n_cols":4,"rows_kept":25,"cut":false,"hidden":false,"merged":[[15,1,15,9],[14,1,14,9],[13,1,13,9],[0,0,0,3],[5,0,5,9],[9,0,9,9]]}
["NIST 800-171 Control Evaluation Spreadsheet"]
[null,null,"Version 1.0"]
[]
["Introduction"]
[]
["The NIST 800-171 Control Evaluation Spreadsheet supports colleges and universities in their efforts to comply with the NIST standard, prioritize information security efforts, and provide metrics for reporting.  It is free to use and requires no permission.  All questions should be directed to EDUCAUSE Working Groups."]
[]
["Basic Instructions"]
[]
["All of the working should be done on the Assessment table. Using the dropdowns, select your current state of completion, the priority to the institution, and any inhibitors to completion. Once selected, these items will be totaled on the Dashboard and Table References tabs. The columns for Tags and Notes are for the institution to use to support efforts or reporting as needed. The source tables for the dropdowns can be found on the Assessment tab in N1 through U11. Definitions of fields can be found on the Table References tab.\nAny time you need to update a cell value in the Assessment tab, you must first delete the existing value (otherwise the cell will show multiple values). When you need to clear a field, please use the Clear Contents command (in the Editing menu) for best results.\nIf you have a control that has been completed, there should be no inhibitors listed for that item.\nYou may have more than on inhibitor per control.\nAlways be consistent in how you answer questions for the best results."]
[]
["Notices"]
[]
[1,"The workbook is intended to be shared and/or modified to fit your organization. It was created by EDUCAUSE for general use and should not be sold or monetized."]
[2,"For full functionality, macros need to be enabled for the spreadsheet."]
[3,"This workbook is to support organizational efforts to improve cybersecurity stance.  It is not a substitute for a professional audit and not to be considered comprehensive or authoritative."]
[]
["References"]
[]
["Protecting CUI in Nonfederal Systems and Organizations",null,null,"https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final"]
["NIST 800-171 Compliance Template",null,null,"https://library.educause.edu/resources/2016/9/nist-sp-800-171-compliance-template"]
["NIST Spec Pub. 800-171A (Assessing Security Requirements for CUI)",null,null,"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171A.pdf"]
["Cybersecurity Maturity Model Certification (CMMC) 2.0",null,null,"https://www.federalregister.gov/documents/2021/11/17/2021-24880/cybersecurity-maturity-model-certification-cmmc-20-updates-and-way-forward"]
["NIST SP 800-171 DoD Assessment Mythology, Version 1.2.1",null,null,"https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf"]
["Sample NIST SP 800-171 DoD Assessment Score Report",null,null,"https://www.rapidfiretools.com/reports/compliance-manager/CMMC/NIST_SP_800_171_DoD_Assessment_Score_Report.pdf"]

{"sheet":"Dashboard","index":1,"n_rows":30,"n_cols":5,"rows_kept":30,"cut":false,"hidden":false,"merged":[]}
[null,"DASHBOARD"]
[]
[null,"Family","Alignment (pts.)","Possible","Alignment (per.)"]
[3.1,"Access Control",{"$f":"'Table References'!B45","v":1.5},22,{"$f":"(C4/D4)","v":6.8181818181818177E-2}]
[3.2,"Awareness and Training",{"$f":"'Table References'!C45","v":0},3,{"$f":"(C5/D5)","v":0}]
[3.3,"Audit and Accountability",{"$f":"'Table References'!D45","v":0},9,0]
[3.4,"Configuration Management",{"$f":"'Table References'!F45","v":0},9,0]
[3.5,"Identification and Authentication",{"$f":"'Table References'!G45","v":0},11,0]
[3.6,"Incident Response",{"$f":"'Table References'!H45","v":0},3,0]
[3.7,"Maintenance",{"$f":"'Table References'!I45","v":0},6,0]
[3.8,"Media Protection",{"$f":"'Table References'!J45","v":0},9,0]
[3.9,"Personnel Security",{"$f":"'Table References'!K45","v":0},2,0]
[3.1,"Physical Protection",{"$f":"'Table References'!L45","v":0},6,0]
[3.11,"Risk Assessment",{"$f":"'Table References'!M45","v":0},3,0]
[3.12,"Security Assessment",{"$f":"'Table References'!N45","v":0},4,0]
[3.13,"System and Communications Protection",{"$f":"'Table References'!N45","v":0},16,0]
[3.14,"System and Information Integrity",{"$f":"'Table References'!O45","v":1},7,0.14285714285714285]
[null,"Overall Alignment",{"$f":"SUM(C4:C17)","v":2.5},{"$f":"SUM(D4:D17)","v":110},2.2727272727272728E-2]
[]
[]
["Summary of Inhibitors for the Enterprise",null,"#","%"]
["Complex Infrastructure",null,{"$f":"COUNTIF(Assessment!H1:'Assessment'!H422,\"*Complex Infrastructure*\")","v":1},{"$f":"C22/$C$30","v":0.2}]
["Complex Political Issues",null,{"$f":"COUNTIF(Assessment!H1:'Assessment'!H422,\"*Comples Political Issues*\")","v":0},0]
["Complex Processes",null,{"$f":"COUNTIF(Assessment!H1:'Assessment'!H422,\"*Complex Processes*\")","v":1},0.2]
["Financial Constraints",null,{"$f":"COUNTIF(Assessment!H1:'Assessment'!H422,\"*Financial Constraints*\")","v":0},0]
["Human Resource Constraints",null,{"$f":"COUNTIF(Assessment!H1:'Assessment'!H422,\"*Human Resource Constraints*\")","v":2},0.4]
["Knowledge Gaps",null,{"$f":"COUNTIF(Assessment!H1:'Assessment'!H422,\"*Knowledge Gaps*\")","v":0},0]
["Project Procedural Issues",null,{"$f":"COUNTIF(Assessment!H1:'Assessment'!H425,\"*Project Procedural Issues*\")","v":0},0]
["Time Constraints",null,{"$f":"COUNTIF(Assessment!H1:'Assessment'!H422,\"*Complex Infrastructure*\")","v":1},0.2]
[null,null,{"$f":"SUM(C22:C29)","v":5},{"$f":"SUM(D22:D29)","v":1}]

{"sheet":"Assessment","index":2,"n_rows":422,"n_cols":21,"rows_kept":422,"cut":false,"hidden":false,"merged":[[1,15,1,16],[1,18,1,20]]}
["Family Num.","Family Sub Num.","Assessment Obj.","Control Family","Current State","DoD Score","Priority","Inhibitors","TAGS","Notes"]
[3.1,null,null,"Access Control",null,null,null,null,null,null,null,null,null,"Inhibitors",null,"Priority",null,null,"Current State"]
[null,"3.1.1",null,"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",1,5,"Low","Human Resource Constraints, Complex Processes",null,null,null,null,null,null,null,"Code","Color",null,"Status","Color","Num Value"]
[null,null,"3.1.1[a]","Authorized users are identified.",null,null,null,null,null,null,null,null,null,"Complex Infrastructure",null,"Low","Yellow",null,"N/A",null,0]
[null,null,"3.1.1[b]","Security risks associated with organizational activities involving CUI are identified. ",null,null,null,null,null,null,null,null,null,"Complex Political Issues",null,"Med","Orange",null,"Not started","Red",0]
[null,null,"3.1.1[c]","Devices (and other systems) authorized to connect to the system are identified. ",null,null,null,null,null,null,null,null,null,"Complex Processes",null,"High","Red",null,0.25,"Red",0]
[null,null,"3.1.1[d]","System access is limited to authorized users.",null,null,null,null,null,null,null,null,null,"Financial Constraints",null,null,null,null,0.5,"Yellow",0.5]
[null,null,"3.1.1[e]","System access is limited to processes acting on behalf of authorized users. ",null,null,null,null,null,null,null,null,null,"Human Resource Constraints",null,null,null,null,0.75,"Yellow",0.5]
[null,null,"3.1.1[f]","System access is limited to authorized devices (including other systems). ",null,null,null,null,null,null,null,null,null,"Knowledge Gaps",null,null,null,null,1,"Green",1]
[null,"3.1.2",null,"Limit system access to the types of transactions and functions that authorized users are permitted to execute.","N/A",5,"Med",null,null,null,null,null,null,"Project Procedural Issues"]
[null,null,"3.1.2[a]","The types of transactions and functions that authorized users are permitted to execute are defined. ",null,null,null,null,null,null,null,null,null,"Time Constraints",null,"Color is the conditional formatting used when the dropdown code/status is selected."]
[null,null,"3.1.2[b]","System access is limited to the defined types of transactions and functions for authorized users."]
[null,"3.1.3",null,"Control the flow of CUI in accordance with approved authorizations.","Not started",1,"High"]
[null,null,"3.1.3[a]","Information flow control policies are defined. "]
[null,null,"3.1.3[b]","Methods and enforcement mechanisms for controlling the flow of CUI are defined. "]
[null,null,"3.1.3[c]","Designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified. "]
[null,null,"3.1.3[d]","Authorizations for controlling the flow of CUI are defined."]
[null,null,"3.1.3[e]","Approved authorizations for controlling the flow of CUI are enforced. "]
[null,"3.1.4",null,"Separate the duties of individuals to reduce the risk of malevolent activity without collusion. ",0.5,1]
[null,null,"3.1.4[a]","The duties of individuals requiring separation are defined."]
[null,null,"3.1.4[b]","Responsibilities for duties that require separation are assigned to separate individuals. "]
[null,null,"3.1.4[c]","Access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals."]
[null,"3.1.5",null,"Employ the principle of least privilege, including for specific security functions and privileged accounts. ",0.25,3]
[null,null,"3.1.5[a]","Privileged accounts are identified."]
[null,null,"3.1.5[b]","Access to privileged accounts is authorized in accordance with the principle of least privilege. "]
[null,null,"3.1.5[c]","Security functions are identified."]
[null,null,"3.1.5[d]","Access to security functions is authorized in accordance with the principle of least privilege. "]
[null,"3.1.6",null,"Use non-privileged accounts or roles when accessing nonsecurity functions. ",null,1]
[null,null,"3.1.6[a]","Nonsecurity functions are identified. "]
[null,null,"3.1.6[b]","Users are required to use non-privileged accounts or roles when accessing nonsecurity functions. "]
[null,"3.1.7",null,"Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. ",null,1]
[null,null,"3.1.7[a]","Privileged functions are defined. "]
[null,null,"3.1.7[b]","Non-privileged users are defined."]
[null,null,"3.1.7[c]","Bon-privileged users are prevented from executing privileged functions."]
[null,null,"3.1.7[d]","The execution of privileged functions is captured in audit logs. "]
[null,"3.1.8",null,"Limit unsuccessful logon attempts.",null,1]
[null,null,"3.1.8[a]","The means of limiting unsuccessful logon attempts is defined."]
[null,null,"3.1.8[b]","The defined means of limiting unsuccessful logon attempts is implemented."]
[null,"3.1.9",null,"Provide privacy and security notices consistent with applicable CUI rules.",null,1]
[null,null,"3.1.9[a]","Privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category. "]
[null,null,"3.1.9[b]","Privacy and security notices are displayed. "]
[null,"3.1.10",null,"Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. ",null,1]
[null,null,"3.1.10[a]","The period of inactivity after which the system initiates a session lock is defined. "]
[null,null,"3.1.10[b]","Access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity. "]
[null,null,"3.1.10[c]","Previously visible information is concealed via a pattern-hiding display after the defined period of inactivity. "]
[null,"3.1.11",null,"Terminate (automatically) a user session after a defined condition. ",null,1]
[null,null,"3.1.11[a]","Conditions requiring a user session to terminate are defined. "]
[null,null,"3.1.11[b]","A user session is automatically terminated after any of the defined conditions occur."]
[null,"3.1.12",null,"Monitor and control remote access sessions",null,5]
[null,null,"3.1.12[a]","Remote access sessions are permitted."]
[null,null,"3.1.12[b]","The type of permitted remote access are identified."]
[null,null,"3.1.12[c]","Remote access sessions are controlled."]
[null,null,"3.1.12[d]","Remote access sessions are monitored."]
[null,"3.1.13",null,"Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. ",null,5]
[null,null,"3.1.13[a]","Cryptographic mechanisms to protect the confidentiality of remote access sessions are identified. "]
[null,null,"3.1.13[b]","Cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented. "]
[null,"3.1.14",null,"Route remote access via managed access control points.",null,1]
[null,null,"3.1.14[a]","Managed access control points are identified and implemented."]
[null,null,"3.1.14[b]","Remote access is routed through managed network access control points."]
[null,"3.1.15",null,"Authorize remote execution of privileged commands and remote access to security-relevant information.",null,1]
[null,null,"3.1.15[a]","Privileged commands authorized for remote execution are identified. "]
[null,null,"3.1.15[b]","Security-relevant information authorized to be accessed remotely is identified. "]
[null,null,"3.1.15[c]","The execution of the identified privileged commands via remote access is authorized."]
[null,null,"3.1.15[d]","Access to the identified security-relevant information via remote access is authorized."]
[null,"3.1.16",null,"Authorized wireless access prior to allowing such connections.",null,5]
[null,null,"3.1.16[a]","Wireless access points are identified."]
[null,null,"3.1.16[b]","Wireless access is authorized prior to allowing such connections."]
[null,"3.1.17",null,"Protect wireless access using authentication and encryption.",null,5]
[null,null,"3.1.17[a]","Wireless access to the system is protected using authentication."]
[null,null,"3.1.17[b]","Wireless access to the system is protected using encryption."]
[null,"3.1.18",null,"Control connection of mobile devices.",null,5]
[null,null,"3.1.18[a]","Mobile devices that process, store, or transmit CUI are identified."]
[null,null,"3.1.18[b]","Mobile devices connections are authorized."]
[null,null,"3.1.18[c]","Mobile device connections are monitored and logged."]
[null,"3.1.19",null,"Encrypt CUI on mobile devices and mobile computing platforms.",null,3]
[null,null,"3.1.19[a]","Mobile devices and mobile computing platforms that process, store, or transmit CUI are identified. "]
[null,null,"3.1.19[b]","Encryption is employed to protect CUI on identified mobile devices and mobile computing platforms. "]
[null,"3.1.20",null,"Verify and control/limit connections to and use of external systems.",null,1]
[null,null,"3.1.20[a]","Connections to external systems are identified."]
[null,null,"3.1.20[b]","The use of external systems is identified."]
[null,null,"3.1.20[c]","Connections to external systems are identified."]
[null,null,"3.1.20[d]","The use of external systems is verified."]
[null,null,"3.1.20[e]","Connections to external systems are controlled/limited."]
[null,null,"3.1.20[f]","The use of external systems is controlled/limited."]
[null,"3.1.21",null,"Limit use of portable storage devices on external systems. ",null,1]
[null,null,"3.1.21[a]","The use of portable storage devices containing CUI on external systems is \nidentified and documented."]
[null,null,"3.1.21[b]","Limits on the use of portable storage devices containing CUI on external systems are defined. "]
[null,null,"3.1.21[c]","The use of portable storage devices containing CUI on external systems is limited as defined. "]
[null,"3.1.22",null,"Control CUI posted or processed on publicly accessible systems. ",null,1]
[null,null,"3.1.22[a]","Individuals authorized to post or process information on publicly accessible systems are identified. "]
[null,null,"3.1.22[b]","Procedures to ensure CUI is not posted or processed on publicly accessible systems are identified. "]
[null,null,"3.1.22[c]","A review process is in place prior to posting of any content to publicly accessible systems. "]
[null,null,"3.1.22[d]","Content on publicly accessible systems is reviewed to ensure that it does not include CUI. "]
[null,null,"3.1.22[e]","Mechanisms are in place to remove and address improper posting of CUI. "]
[3.2,null,null,"Awareness and Training"]
[null,"3.2.1",null,"Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. ",null,5]
[null,null,"3.2.1[a]","Security risks associated with organizational activities involving CUI are identified. "]
[null,null,"3.2.1[b]","Policies, standards, and procedures related to the security of the system are identified. "]
[null,null,"3.2.1[c]","Managers, systems administrators, and users of the system are made aware of the security risks associated with their activities. "]
[null,null,"3.2.1[d]","Managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system. "]
[null,"3.2.2",null,"Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.",null,5]
[null,null,"3.2.2[a]","Information security-related duties, roles and responsibilities are defined."]
[null,null,"3.2.2[b]","Information security-related duties, roles and responsibilities are assigned to designated personnel."]
[null,null,"3.2.2[c]","Personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities."]
[null,"3.2.3",null,"Provide security awareness training on recognizing and reporting potential indicators of insider threat. ",null,1]
[null,null,"3.2.3[a]","Potential indicators associated with insider threats are identified. "]
[null,null,"3.2.3[b]","Security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees. "]
[3.3,null,null,"Audit and Accountability"]
[null,"3.3.1",null,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.  ",null,5]
[null,null,"3.3.1[a]","Audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified. "]
[null,null,"3.3.1[b]","The content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined. "]
[null,null,"3.3.1[c]","Audit records are created (generated)."]
[null,null,"3.3.1[d]","Audit records, once created, contain the defined content."]
[null,null,"3.3.1[e]","Retention requirements for audit records are defined."]
[null,null,"3.3.1[f]","Audit records are retained as defined."]
[null,"3.3.2",null,"Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.",null,3]
[null,null,"3.3.2[a]","The content of the audit records needed to support the ability to uniquely trace users to their actions is defined."]
[null,null,"3.3.2[b]","Audit records, once created, contain the defined content."]
[null,"3.3.3",null,"Review and update logged events.",null,1]
[null,null,"3.3.3[a]","A process for determining when to review logged events is defined."]
[null,null,"3.3.3[b]","Event types being logged are reviewed in accordance with the defined review process."]
[null,null,"3.3.3[c]","Event types being logged are updated based on the review."]
[null,"3.3.4",null,"Alert in the event of an audit logging process failure.",null,1]
[null,null,"3.3.4[a]","Personnel or roles to be alerted in the event of an audit logging process failure are identified."]
[null,null,"3.3.4[b]","Types of audit logging process failures for which alert will be generated are defined."]
[null,null,"3.3.4[c]","Identified personnel or roles are alerted in the event of an audit logging process failure."]
[null,"3.3.5",null,"Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. ",null,5]
[null,null,"3.3.5[a]","Audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined. "]
[null,null,"3.3.5[b]","Defined audit record review, analysis, and reporting processes are correlated."]
[null,"3.3.6",null,"Provide audit record reduction and report generation to support on-demand analysis and reporting. ",null,1]
[null,null,"3.3.6[a]","An audit record reduction capability that supports on-demand analysis is provided. "]
[null,null,"3.3.6[b]","A report generation capability that supports on-demand reporting is provided. "]
[null,"3.3.7",null,"Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.",null,1]
[null,null,"3.3.7[a]","Internal system clocks are used to generate time stamps for audit records.  "]
[null,null,"3.3.7[b]","An authoritative source with which to compare and synchronize internal system clocks is specified. "]
[null,null,"3.3.7[c]","Internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source. "]
[null,"3.3.8",null,"Protect audit information and audit logging tools from unauthorized access, modification, and deletion. ",null,1]
[null,null,"3.3.8[a]","Audit information is protected from unauthorized access."]
[null,null,"3.3.8[b]","Audit information is protected from unauthorized modification."]
[null,null,"3.3.8[c]","Audit information is protected from unauthorized deletion."]
[null,null,"3.3.8[d]","Audit logging tools are protected from unauthorized access."]
[null,null,"3.3.8[e]","Audit logging tools are protected from unauthorized modification."]
[null,null,"3.3.8[f]","Audit logging tools are protected from unauthorized deletion."]
[null,"3.3.9",null,"Limit management of audit logging functionality to a subset of privileged users.",null,1]
[null,null,"3.3.9[a]","A subset of privileged users granted access to manage audit logging functionality is defined. "]
[null,null,"3.3.9[b]","Management of audit logging functionality is limited to the defined subset of privileged users. "]
[3.4,null,null,"Configuration Management"]
[null,"3.4.1",null,"Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. ",null,5]
[null,null,"3.4.1[a]","A baseline configuration is established.  "]
[null,null,"3.4.1[b]","The baseline configuration includes hardware, software, firmware, and documentation."]
[null,null,"3.4.1[c]","The baseline configuration is maintained (reviewed and updated) throughout Thesystem development life cycle."]
[null,null,"3.4.1[d]","A system inventory is established.   "]
[null,null,"3.4.1[e]","The system inventory includes hardware, software, firmware, and documentation."]
[null,null,"3.4.1[f]","The inventory is maintained (reviewed and updated) throughout the system development life cycle. "]
[null,"3.4.2",null,"Establish and enforce security configuration settings for information technology products employed in organizational systems.",null,5]
[null,null,"3.4.2[a]","Security configuration settings for information technology products employed in the system are established and included in the baseline configuration. "]
[null,null,"3.4.2[b]","Security configuration settings for information technology products employed in the system are enforced. "]
[null,"3.4.3",null,"Track, review, approve or disapprove, and log changes to organizational systems.",null,1]
[null,null,"3.4.3[a]","Changes to the system are tracked."]
[null,null,"3.4.3[b]","Changes to the system are reviewed."]
[null,null,"3.4.3[c]","Changes to the system are approved or disapproved."]
[null,null,"3.4.3[d]","Changes to the system are logged."]
[null,"3.4.4",null,"Analyze the security impact of changes prior to implementation.",null,1]
[null,"3.4.5",null,"Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. ",null,5]
[null,null,"3.4.5[a]","Physical  access restrictions associated with changes to the system are defined."]
[null,null,"3.4.5[b]","Physical  access restrictions associated with changes to the system are documented."]
[null,null,"3.4.5[c]","Physical  access restrictions associated with changes to the system are approved. "]
[null,null,"3.4.5[d]","Physical  access restrictions associated with changes to the system are enforced. "]
[null,null,"3.4.5[e]","logical access restrictions associated with changes to the system are defined."]
[null,null,"3.4.5[f]","logical access restrictions associated with changes to the system are documented. "]
[null,null,"3.4.5[g]","logical access restrictions associated with changes to the system are approved. "]
[null,null,"3.4.5[h]","logical access restrictions associated with changes to the system are enforced. "]
[null,"3.4.6",null,"Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. ",null,5]
[null,null,"3.4.6[a]","Essential system capabilities are defined based on the principle of least functionality."]
[null,null,"3.4.6[b]","The system is configured to provide only the defined essential capabilities. "]
[null,"3.4.7",null,"Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.",null,5]
[null,null,"3.4.7[a]","Essential programs are defined."]
[null,null,"3.4.7[b]","The user of nonessential programs is defined."]
[null,null,"3.4.7[c]","The use of nonessential programs is restricted, disabled, or prevented as defined."]
[null,null,"3.4.7[d]","Essential functions are defined."]
[null,null,"3.4.7[e]","The use of nonessential functions is defined."]
[null,null,"3.4.7[f]","The use of nonessential functions is restricted, disabled, or prevented as defined."]
[null,null,"3.4.7[g]","Essential ports are defined."]
[null,null,"3.4.7[h]","The use of nonessential ports is defined."]
[null,null,"3.4.7[i]","The use of nonessential ports is restricted, disabled, or prevented as defined."]
[null,null,"3.4.7[j]","Essential protocols are defined."]
[null,null,"3.4.7[k]","The use of nonessential protocols is defined."]
[null,null,"3.4.7[l]","The use of nonessential protocols is restricted, disabled, or prevented as defined."]
[null,null,"3.4.7[m]","Essential services are defined."]
[null,null,"3.4.7[n]","The use of nonessential services is defined."]
[null,null,"3.4.7[o]","The use of nonessetial services is restricted, disabled, or prevented as defined."]
[null,"3.4.8",null,"Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. ",null,5]
[null,null,"3.4.8[a]","A policy specifying whether whitelisting or blacklisting is to be implemented is specified. "]
[null,null,"3.4.8[b]","The software allowed to execute under whitelisting or denied use under blacklisting is specified."]
[null,null,"6.4.8[c]","Whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.  "]
[null,"3.4.9",null,"Control and monitor user-installed software.",null,1]
[null,null,"3.4.9.[a]","A policy for controlling the installation of software by users is established."]
[null,null,"3.4.9[b]","Installation of software by users is controlled based on the established policy."]
[null,null,"3.4.9[c]","Installation of software by users is monitored."]
[3.5,null,null,"Identification and Authentication"]
[null,"3.5.1",null,"Identify system users, processes acting on behalf of users, and devices.",null,5]
[null,null,"3.5.1[a]","System users are identified."]
[null,null,"3.5.1[b]","Processes acting on behalf of users are identified."]
[null,null,"3.5.1[c]","Devices accessing the system are identified."]
[null,"3.5.2",null,"Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. ",null,5]
[null,null,"3.5.2[a]","The identity of each user is authenticated or verified as a prerequisite to system access. "]
[null,null,"3.5.2[b]","The identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access. "]
[null,null,"3.5.2[c]","The identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access. "]
[null,"3.5.3",null,"Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. ",null,"3 to 5"]
[null,null,"3.5.3[a]","Privileged accounts are identified."]
[null,null,"3.5.3[b]","Multifactor authentication is implemented for local access to privileged accounts."]
[null,null,"3.5.3[c]","Multifactor authentication is implemented for network access to privileged accounts."]
[null,null,"3.5.3[d]","Multifactor authentication is implemented for network access to non-privileged accounts."]
[null,"3.5.4",null,"Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. ",null,1]
[null,"3.5.5",null,"Prevent reuse of identifiers for a defined period.",null,1]
[null,null,"3.5.5[a]","A period within which identifiers cannot be reused is defined."]
[null,null,"3.5.5[b]","Reuse of identifiers is prevented within the defined period."]
[null,"3.5.6",null,"Disable identifiers after a defined period of inactivity.",null,1]
[null,null,"3.5.6[a]","A period of inactivity after which an identifier is disabled is defined."]
[null,null,"3.5.6[b]","Identifiers are disabled after the defined period of inactivity."]
[null,"3.5.7",null,"Enforce a minimum password complexity and change of characters when new passwords are created.",null,1]
[null,null,"3.5.7[a]","Password complexity requirements are defined."]
[null,null,"3.5.7[b]","Password change of character requirements are defined."]
[null,null,"3.5.7[c]","Minimum password complexity requirements as defined are enforced when new passwords are created."]
[null,null,"3.5.7[d]","Minimum password change of character requirements as defined are enforced when new passwords are created."]
[null,"3.5.8",null,"Prohibit password reuse for a specified number of generations.",null,1]
[null,null,"3.5.8[a]","The number of generations during which a password cannot be reused is specified."]
[null,null,"3.5.8[b]","Reuse of passwords is prohibited during the specified number of generations."]
[null,"3.5.9",null,"Allow temporary password use for system logons with an immediate change to a permanent password.",null,1]
[null,"3.5.10",null,"Store and transmit only cryptographically-protected passwords.",null,5]
[null,null,"3.5.10[a]","Passwords are cryptographically protected in storage."]
[null,null,"3.5.10[b]","Passwords are cryptographically protected in transit."]
[null,"3.5.11",null,"Obscure feedback of authentication information.",null,1]
[3.6,null,null,"Incident Response"]
[null,"3.6.1",null,"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.",null,5]
[null,null,"3.6.1[a]","An operational incident-handling capability is established."]
[null,null,"3.6.1[b]","The operational incident-handling capability includes preparation."]
[null,null,"3.6.1[c]","The operational incident-handling capability includes detection."]
[null,null,"3.6.1[d]","The operation incident-handling capability includes analysis."]
[null,null,"3.6.1[e]","The operation incident-handling capability includes containment."]
[null,null,"3.6.1[f]","The operation incident-handling capability includes recovery."]
[null,null,"3.6.1[g]","The operational incident-handling capability includes user response activities."]
[null,"3.6.2",null,"Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. ",null,5]
[null,null,"3.6.2[a]","Incidents are tracked."]
[null,null,"3.6.2[b]","Incidents are documented."]
[null,null,"3.6.2[c]","Authorities to whom incidents are to be reported are identified."]
[null,null,"3.6.2[d]","Organizational officials to whom incidents are to be reported are identified."]
[null,null,"3.6.2[e]","Identified authorities are notified of incidents."]
[null,null,"3.6.2[f]","Identified organizational officials are notified of incidents."]
[null,"3.6.3",null,"Test the organizational incident response capability.",null,1]
[3.7,null,null,"Maintenance"]
[null,"3.7.1",null,"Perform maintenance on organizational systems.",null,3]
[null,"3.7.2",null,"Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. ",null,5]
[null,null,"3.7.2[a]","Tools used to conduct system maintenance are controlled."]
[null,null,"3.7.2[b]","Techniques used to conduct system maintenance are controlled."]
[null,null,"3.7.2[c]","Mechanisms used to conduct system maintenance are controlled."]
[null,null,"3.7.2[d]","Personnel used to conduct system maintenance are controlled."]
[null,"3.7.3",null,"Ensure equipment removed for off-site maintenance is sanitized of any CUI.",null,1]
[null,"3.7.4",null,"Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.",null,3]
[null,"3.7.5",null,"Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.  ",null,5]
[null,null,"3.7.5[a]","Multifactor authentication is used to establish nonlocal maintenance sessions \nvia external network connections."]
[null,null,"3.7.5[b]","Nonlocal maintenance sessions established via external network connections \nare terminated when nonlocal maintenance is complete. "]
[null,"3.7.6",null,"Supervise the maintenance activities of maintenance personnel without required access authorization. ",null,1]
[3.8,null,null,"Media Protection"]
[null,"3.8.1",null,"Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.",null,3]
[null,null,"3.8.1[a]","Paper media containing CUI is physically controlled."]
[null,null,"3.8.1[b]","Digital media containing CUI is physically controlled."]
[null,null,"3.8.1[c]","Paper media containing CUI is securely stored."]
[null,null,"3.8.1[d]","Digital media containing CUI is security stored."]
[null,"3.8.2",null,"Limit access to CUI on system media to authorized users.",null,3]
[null,"3.8.3",null,"Sanitize or destroy system media containing CUI before disposal or release for reuse. ",null,5]
[null,null,"3.8.3[a]","System media containing CUI is sanitized or destroyed before disposal."]
[null,null,"3.8.3[b]","System media containing CUI is sanitized before it is released for reuse."]
[null,"3.8.4",null,"Mark media with necessary CUI markings and distribution limitations.",null,1]
[null,null,"3.8.4[a]","Media containing CUI is marked with applicable CUI markings."]
[null,null,"3.8.4[b]","Media containing CUI is marked with distribution limitations."]
[null,"3.8.5",null,"Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. ",null,1]
[null,null,"3.8.5[a]","Access to media containing CUI is controlled."]
[null,null,"3.8.5[b]","Accountability for media containing CUI is maintained during transport \noutside of controlled areas. "]
[null,"3.8.6",null,"Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. ",null,1]
[null,"3.8.7",null,"Control the use of removable media on system components. ",null,5]
[null,"3.8.8",null,"Prohibit the use of portable storage devices when such devices have no identifiable owner.",null,3]
[null,"3.8.9",null,"Protect the confidentiality of backup CUI at storage locations.",null,1]
[3.9,null,null,"Personnel Security"]
[null,"3.9.1",null,"Screen individuals prior to authorizing access to organizational systems containing CUI.  ",null,3]
[null,"3.9.2",null,"Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.  ",null,5]
[null,null,"3.9.2[a]","A policy and/or process for terminating system access and any credentials coincident with personnel actions is established."]
[null,null,"3.9.2[b]","System access and credentials are terminated consistent with personnel actions such as termination or transfer."]
[null,null,"3.9.2[c]","The system is protected during and after personnel transfer actions. "]
[3.1,null,null,"Physical Protection"]
[null,"3.10.1",null,"Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.  ",null,5]
[null,null,"3.10.1[a]","Authorized individuals allowed physical access are identified."]
[null,null,"3.10.1[b]","Physical access to organizational systems is limited to authorized individuals."]
[null,null,"3.10.1[c]","Physical access to equipment is limited to authorized individuals."]
[null,null,"3.10.1[d]","Physical access to operating environments is limited to authorized individuals."]
[null,"3.10.2",null,"Protect and monitor the physical facility and support infrastructure for organizational systems.  ",null,5]
[null,null,"3.10.2[a]","The physical facility where organizational systems reside is protected."]
[null,null,"3.10.2[b]","The support infrastructure for organizational systems is protected."]
[null,null,"3.10.2[c]","The physical facility where organizational systems reside is monitored."]
[null,null,"3.10.2[c]","The support infrastructure for organizational systems is monitored."]
[null,"3.10.3",null,"Escort visitors and monitor visitors activity.",null,1]
[null,null,"3.10.3[a]","Visitors are escorted."]
[null,null,"3.10.3[b]","Visitors are monitored."]
[null,"3.10.4",null,"Maintain audit logs of physical access.",null,1]
[null,"3.10.5",null,"Control and manage physical devices.",null,1]
[null,null,"3.10.5[a]","Physical access devices are identified."]
[null,null,"3.10.5[b]","Physical access devices are controlled."]
[null,null,"3.10.5[c]","Physical access devices are managed."]
[null,"3.10.6",null,"Enforce safeguarding measures for CUI at alternate work sites.",null,1]
[null,null,"3.10.6[a]","Safeguarding measures for CUI are defined for alternative work sites."]
[null,null,"3.10.6[b]","Safeguarding measures for CUI are enforced for alternate work sites."]
[3.11,null,null,"Identification and Authentication"]
[null,"3.11.1",null,"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. ",null,3]
[null,null,"3.11.1[a]","The frequency to assess risk to organizational operations, organizational assets, and individuals is defined."]
[null,null,"3.11.1[b]","Risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency."]
[null,"3.11.2",null,"Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. ",null,5]
[null,null,"3.11.2[a]","The frequency to scan for vulnerabilities in organizational systems and applications is defined. "]
[null,null,"3.11.2[b]","Vulnerability scans are performed on organizational systems with the defined frequency."]
[null,null,"3.11.2[c]","Vulnerability scans are performed on applications with the defined frequency."]
[null,null,"3.11.2[d]","Vulnerability scans are performed on organizational systems when new vulnerabilities are identified. "]
[null,null,"3.11.2[e]","Vulnerability scans are performed on applications when new vulnerabilities are identified. "]
[null,"3.11.3",null,"Remediate vulnerabilities in accordance with risk assessments.",null,1]
[null,null,"3.11.3[a]","Vulnerabilities are identified."]
[null,null,"3.11.3[b]","Vulnerabilities are remediated in accordance with risk assessments."]
[3.12,null,null,"Identification and Authentication"]
[null,"3.12.1",null,"Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.  ",null,5]
[null,null,"3.12.1[a]","The frequency of security control assessments is defined. "]
[null,null,"3.12.1[b]","Security controls are assessed with the defined frequency to determine if the controls are effective in their application."]
[null,"3.12.2",null,"Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.",null,3]
[null,null,"3.12.2[a]","Deficiencies and vulnerabilities to be addressed by the plan of action are identified."]
[null,null,"3.12.2[b]","A plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities."]
[null,null,"3.12.2[c]","The plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities. "]
[null,"3.12.3",null,"Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. ",null,4]
[null,"3.12.4",null,"Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.  ",null,"N/A"]
[null,null,"3.12.4[a]","A system security plan is developed."]
[null,null,"3.12.4[b]","The system boundary is described and documented in the system security plan."]
[null,null,"3.12.4[c]","The system environment of operation is described and documented in the system security plan."]
[null,null,"3.12.4[d]","The security requirements identified and approved by the designated authority as non-applicable are identified."]
[null,null,"3.12.4[e]","The method of security requirement implementation is described and documented in the system security plan. "]
[null,null,"3.12.4[f]","The relationship with or connection to other systems is described and documented in the system security plan. "]
[null,null,"3.12.4[g]","The frequency to update the system security plan is defined."]
[null,null,"3.12.4[h]","System security plan is updated with the defined frequency."]
[3.13,null,null,"System and Communications Protection"]
[null,"3.13.1",null,"Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.  ",null,5]
[null,null,"3.13.1[a]","The external system boundary is defined."]
[null,null,"3.13.1[b]","Key internal system boundaries are defined."]
[null,null,"3.13.1[c]","Communications are monitored at the external system boundary"]
[null,null,"3.13.1[d]","Communications are monitored at key internal boundaries."]
[null,null,"3.13.1[e]","Communications are controlled at the external system boundary."]
[null,null,"3.13.1[f]","Communications are controlled at key internal boundaries."]
[null,null,"3.13.1[g]","Communications are protected at the external system boundary."]
[null,null,"3.13.1[h]","Communications are protected at key internal boundaries."]
[null,"3.13.2",null,"Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.  ",null,5]
[null,null,"3.13.2[a]","Architectural designs that promote effective information security are identified. "]
[null,null,"3.13.2[b]","Software development techniques that promote effective information security are identified."]
[null,null,"3.13.2[c]","Systems engineering principles that promote effective information security are identified. "]
[null,null,"3.13.2[d]","Identified architectural designs that promote effective information security are employed."]
[null,null,"3.13.2[e]","Identified software development techniques that promote effective information security are employed. "]
[null,null,"3.13.2[f]","Identified systems engineering principles that promote effective information security are employed."]
[null,"3.13.3",null,"Separate user functionality from system management functionality.",null,1]
[null,null,"3.13.3[a]","User functionality is identified."]
[null,null,"3.13.3[b]","System management functionality is identified."]
[null,null,"3.13.3[c]","User functionality is separated from system management functionality."]
[null,"3.13.4",null,"Prevent a unauthorized and unintended information transfer via shared system resources.",null,1]
[null,"3.13.5",null,"Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. ",null,5]
[null,null,"3.13.5[a]","Publicly accessible system components are identified."]
[null,null,"3.13.5[b]","Subnetworks for publicly accessible system components are physically or logically separated from internal networks.  "]
[null,"3.13.6",null,"Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).",null,5]
[null,null,"3.13.6[a]","Network communications traffic is denied by default."]
[null,null,"3.13.6[b]","Network communications traffic is allowed by exception."]
[null,"3.13.7",null,"Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).",null,1]
[null,"3.13.8",null,"Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. ",null,3]
[null,null,"3.13.8[a]","Cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified."]
[null,null,"3.18.8[b]","Alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified. "]
[null,null,"3.18.3[c]","Either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission. "]
[null,"3.13.9",null,"Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. ",null,1]
[null,null,"3.13.9[a]","A period of inactivity to terminate network connections associated with communications sessions is defined. "]
[null,null,"3.13.9[b]","Network connections associated with communications sessions are terminated at the end of the sessions. "]
[null,null,"3.13.9[c]","Network connections associated with communications sessions are terminated after the defined period of inactivity. "]
[null,"3.13.10",null,"Establish and manage cryptographic keys for cryptography employed in organizational systems.",null,1]
[null,null,"3.13.10[a]","Cryptographic keys are established whenever cryptography is employed. "]
[null,null,"3.13.10[b]","Cryptographic keys are managed whenever cryptography is employed."]
[null,"3.13.11",null,"Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.  ",null,"3 to 5"]
[null,"3.13.12",null,"Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.  ",null,1]
[null,null,"3.13.123[a]","Collaborative computer devices are identified."]
[null,null,"3.13.12[b]","Collaborative computer devices aprovide indication to users of devices in use."]
[null,null,"3.13.12[c]","Remote activation of collaborative computing devices is prohibited."]
[null,"3.13.13",null,"Control and monitor the use of mobile code.",null,1]
[null,null,"3.13.13[a]","Use of mobile code is controlled."]
[null,null,"3.13.13.[b]","Use of mobile code is monitored."]
[null,"3.13.14",null,"Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.",null,1]
[null,null,"3.13.14[a]","Use of Voice over Internet Protocol (VoIP) technologies is controlled."]
[null,null,"3.13.14[b]","Use of Voice over Internet Protocol (VoIP) technologies is monitored."]
[null,"3.13.15",null,"Protect the authenticity of communications sessions.",null,5]
[null,"3.13.16",null,"Protect the confidentiality of CUI at rest.",null,1]
[3.14,null,null,"System and Information Integrity"]
[null,"3.14.1",null,"Identify, report, and correct system flaws in a timely manner.",1,5]
[null,null,"3.14.1[a]","The time within which to identify system flaws is specified."]
[null,null,"3.14.1[b]","System flaws are identified within the specified time frame."]
[null,null,"3.14.1[c]","The time within which to report system flaws is specified."]
[null,null,"3.14.1[d]","System flaws are reported within the specified time frame."]
[null,null,"3.14.1[e]","The time within which to correct system flaws is specified."]
[null,null,"3.14.1[f]","System flaws are corrected within the specified time frame."]
[null,"3.14.2",null,"Provide protection from malicious code at designated locations within organizational systems. ",null,5]
[null,null,"3.14.2[a]","Designated locations for malicious code protection are identified."]
[null,null,"3.14.2[b]","Protection from malicious code at designated locations is provided."]
[null,"3.14.3",null,"Monitor system security alerts and advisories and take action in response.",null,5]
[null,null,"3.14.3[a]","Response actions to system security alerts and advisories are identified."]
[null,null,"3.14.3[b]","System security alerts and advisories are monitored."]
[null,null,"3.14.3[c]","Actions in response to system security alerts and advisories are taken."]
[null,"3.14.4",null,"Update malicious code protection mechanisms when new releases are available.",null,5]
[null,"3.14.5",null,"Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. ",null,3]
[null,null,"3.14.5[a]","The frequency for malicious code scans is defined."]
[null,null,"3.14.5[b]","Malicious code scans are performed with the defined frequency. "]
[null,null,"3.14.5[c]","Real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed."]
[null,"3.14.6",null,"Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.  ",null,5]
[null,null,"3.14.6[a]","The system is monitored to detect attacks and indicators of potential attacks. "]
[null,null,"3.14.6[b]","Inbound communications traffic is monitored to detect attacks and indicators of potential attacks. "]
[null,null,"3.14.6[c]","Outbound communications traffic is monitored to detect attacks and indicators of potential attacks. "]
[null,"3.14.7",null,"Identify unauthorized use of organizational systems.","Half done",3,5,"Complex Infrastructure, Human Resource Constraints"]
[null,null,"3.14.7[a]","Authorized use of system is defined."]
[null,null,"3.14.7[b]","Unauthorized use of system is identified."]

{"sheet":"Table References","index":3,"n_rows":45,"n_cols":15,"rows_kept":45,"cut":false,"hidden":false,"merged":[[13,4,13,14],[14,0,14,3],[15,0,15,3],[10,4,10,14],[6,0,6,2],[6,3,6,14],[11,4,11,14],[12,4,12,14],[0,0,0,2],[1,0,1,2],[2,0,2,2],[16,0,16,3],[4,0,4,2],[5,0,5,2],[5,3,5,14],[9,0,9,3],[10,0,10,3],[11,0,11,3],[12,0,12,3],[13,0,13,3],[14,4,14,14],[15,4,15,14],[16,4,16,14],[9,4,9,14],[3,0,3,2],[1,3,1,14],[2,3,2,14],[3,3,3,14],[4,3,4,14]]}
["Field Definitions"]
["Current State",null,null,"The current state of the control as assessed by the organization"]
["DoD Score",null,null,"Static score assigned to item by DoD for evaluating total level of compliance"]
["Priority",null,null,"Priority level assigned to item by organization"]
["Inhibitors",null,null,"Items hindering the completion of a control"]
["Tags",null,null,"Keywords used to locate control with Excel search features"]
["Notes",null,null,"Use for any notes your organization may want to keep on an item"]
[]
["Inhibitors"]
["Complex Infrastructure",null,null,null,"Current infrastructure design inhibits the implementation."]
["Complex Political Issues",null,null,null,"Current political necessities inhibit implementation."]
["Complex Processes",null,null,null,"Currently processes and/or policies inhibit implementation."]
["Financial Constraints",null,null,null,"Current financial constraints inhibit the implementation."]
["Human Resource Constraints",null,null,null,"Current availability of labor inhibits implementation."]
["Knowledge Gaps",null,null,null,"Current gaps in knowledge inhibit implementation."]
["Project Procedural Issues",null,null,null,"In-process or upcoming projects are needed prior to implementation of this constraint/project."]
["Time Constraints",null,null,null,"Current schedules and time requirements inhibit implantation."]
[]
[]
["Alignment Points Table"]
["This table is for reference and manual adjustment (if needed)."]
[null,3.1,3.2,3.3,3.4,3.5,3.6,3.7,3.8,3.9,3.1,3.11,3.12,3.13,3.14]
[1,{"$f":"IF(Assessment!$E$3=1,1,IF(Assessment!$E$3=0.5,0.5,IF(Assessment!$E$3=0.75,0.5,0)))","v":1},{"$f":"IF(Assessment!$E$96=1,1,IF(Assessment!$E$96=0.5,0.5,IF(Assessment!$E$96=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$109=1,1,IF(Assessment!$E$109=0.5,0.5,IF(Assessment!$E$109=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$148=1,1,IF(Assessment!$E$148=0.5,0.5,IF(Assessment!$E$148=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$201=1,1,IF(Assessment!$E$201=0.5,0.5,IF(Assessment!$E$201=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$235=1,1,IF(Assessment!$E$235=0.5,0.5,IF(Assessment!$E$235=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$252=1,1,IF(Assessment!$E$252=0.5,0.5,IF(Assessment!$E$252=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$265=1,1,IF(Assessment!$E$265=0.5,0.5,IF(Assessment!$E$265=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$285=1,1,IF(Assessment!$E$285=0.5,0.5,IF(Assessment!$E$285=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$291=1,1,IF(Assessment!$E$291=0.5,0.5,IF(Assessment!$E$291=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$313=1,1,IF(Assessment!$E$313=0.5,0.5,IF(Assessment!$E$313=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$326=1,1,IF(Assessment!$E$326=0.5,0.5,IF(Assessment!$E$326=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$344=1,1,IF(Assessment!$E$344=0.5,0.5,IF(Assessment!$E$344=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$397=1,1,IF(Assessment!$E$397=0.5,0.5,IF(Assessment!$E$397=0.75,0.5,0)))","v":1}]
[2,{"$f":"IF(Assessment!$E$10=1,1,IF(Assessment!$E$10=0.5,0.5,IF(Assessment!$E$10=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$101=1,1,IF(Assessment!$E$101=0.5,0.5,IF(Assessment!$E$101=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$116=1,1,IF(Assessment!$E$116=0.5,0.5,IF(Assessment!$E$116=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$155=1,1,IF(Assessment!$E$155=0.5,0.5,IF(Assessment!$E$155=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$205=1,1,IF(Assessment!$E$205=0.5,0.5,IF(Assessment!$E$205=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$243=1,1,IF(Assessment!$E$243=0.5,0.5,IF(Assessment!$E$243=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$253=1,1,IF(Assessment!$E$253=0.5,0.5,IF(Assessment!$E$253=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$270=1,1,IF(Assessment!$E$270=0.5,0.5,IF(Assessment!$E$270=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$286=1,1,IF(Assessment!$E$286=0.5,0.5,IF(Assessment!$E$286=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$296=1,1,IF(Assessment!$E$296=0.5,0.5,IF(Assessment!$E$296=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$316=1,1,IF(Assessment!$E$316=0.5,0.5,IF(Assessment!$E$316=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$329=1,1,IF(Assessment!$E$329=0.5,0.5,IF(Assessment!$E$329=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$353=1,1,IF(Assessment!$E$353=0.5,0.5,IF(Assessment!$E$353=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$404=1,1,IF(Assessment!$E$404=0.5,0.5,IF(Assessment!$E$404=0.75,0.5,0)))","v":0}]
[3,{"$f":"IF(Assessment!$E$13=1,1,IF(Assessment!$E$13=0.5,0.5,IF(Assessment!$E$13=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$105=1,1,IF(Assessment!$E$105=0.5,0.5,IF(Assessment!$E$105=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$119=1,1,IF(Assessment!$E$119=0.5,0.5,IF(Assessment!$E$119=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$158=1,1,IF(Assessment!$E$158=0.5,0.5,IF(Assessment!$E$158=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$209=1,1,IF(Assessment!$E$209=0.5,0.5,IF(Assessment!$E$209=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$250=1,1,IF(Assessment!$E$250=0.5,0.5,IF(Assessment!$E$250=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$258=1,1,IF(Assessment!$E$258=0.5,0.5,IF(Assessment!$E$258=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$271=1,1,IF(Assessment!$E$271=0.5,0.5,IF(Assessment!$E$271=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$301=1,1,IF(Assessment!$E$301=0.5,0.5,IF(Assessment!$E$301=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$322=1,1,IF(Assessment!$E$322=0.5,0.5,IF(Assessment!$E$322=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$333=1,1,IF(Assessment!$E$333=0.5,0.5,IF(Assessment!$E$333=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$360=1,1,IF(Assessment!$E$360=0.5,0.5,IF(Assessment!$E$360=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$407=1,1,IF(Assessment!$E$407=0.5,0.5,IF(Assessment!$E$407=0.75,0.5,0)))","v":0}]
[4,{"$f":"IF(Assessment!$E$19=1,1,IF(Assessment!$E$19=0.5,0.5,IF(Assessment!$E$19=0.75,0.5,0)))","v":0.5},null,{"$f":"IF(Assessment!$E$123=1,1,IF(Assessment!$E$123=0.5,0.5,IF(Assessment!$E$123=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$163=1,1,IF(Assessment!$E$163=0.5,0.5,IF(Assessment!$E$163=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$214=1,1,IF(Assessment!$E$214=0.5,0.5,IF(Assessment!$E$214=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$259=1,1,IF(Assessment!$E$259=0.5,0.5,IF(Assessment!$E$259=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$274=1,1,IF(Assessment!$E$274=0.5,0.5,IF(Assessment!$E$274=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$304=1,1,IF(Assessment!$E$304=0.5,0.5,IF(Assessment!$E$304=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$334=1,1,IF(Assessment!$E$334=0.5,0.5,IF(Assessment!$E$334=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$364=1,1,IF(Assessment!$E$364=0.5,0.5,IF(Assessment!$E$364=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$411=1,1,IF(Assessment!$E$411=0.5,0.5,IF(Assessment!$E$411=0.75,0.5,0)))","v":0}]
[5,{"$f":"IF(Assessment!$E$23=1,1,IF(Assessment!$E$23=0.5,0.5,IF(Assessment!$E$23=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$127=1,1,IF(Assessment!$E$127=0.5,0.5,IF(Assessment!$E$127=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$164=1,1,IF(Assessment!$E$164=0.5,0.5,IF(Assessment!$E$164=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$215=1,1,IF(Assessment!$E$215=0.5,0.5,IF(Assessment!$E$215=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$260=1,1,IF(Assessment!$E$260=0.5,0.5,IF(Assessment!$E$260=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$277=1,1,IF(Assessment!$E$277=0.5,0.5,IF(Assessment!$E$277=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$305=1,1,IF(Assessment!$E$305=0.5,0.5,IF(Assessment!$E$305=0.75,0.5,0)))","v":0},null,null,{"$f":"IF(Assessment!$E$365=1,1,IF(Assessment!$E$365=0.5,0.5,IF(Assessment!$E$365=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$412=1,1,IF(Assessment!$E$412=0.5,0.5,IF(Assessment!$E$412=0.75,0.5,0)))","v":0}]
[6,{"$f":"IF(Assessment!$E$28=1,1,IF(Assessment!$E$28=0.5,0.5,IF(Assessment!$E$28=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$130=1,1,IF(Assessment!$E$130=0.5,0.5,IF(Assessment!$E$130=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$173=1,1,IF(Assessment!$E$173=0.5,0.5,IF(Assessment!$E$173=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$218=1,1,IF(Assessment!$E$218=0.5,0.5,IF(Assessment!$E$218=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$263=1,1,IF(Assessment!$E$263=0.5,0.5,IF(Assessment!$E$263=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$280=1,1,IF(Assessment!$E$280=0.5,0.5,IF(Assessment!$E$280=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$309=1,1,IF(Assessment!$E$309=0.5,0.5,IF(Assessment!$E$309=0.75,0.5,0)))","v":0},null,null,{"$f":"IF(Assessment!$E$368=1,1,IF(Assessment!$E$368=0.5,0.5,IF(Assessment!$E$368=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$416=1,1,IF(Assessment!$E$416=0.5,0.5,IF(Assessment!$E$416=0.75,0.5,0)))","v":0}]
[7,{"$f":"IF(Assessment!$E$31=1,1,IF(Assessment!$E$31=0.5,0.5,IF(Assessment!$E$31=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$133=1,1,IF(Assessment!$E$133=0.5,0.5,IF(Assessment!$E$133=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$176=1,1,IF(Assessment!$E$176=0.5,0.5,IF(Assessment!$E$176=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$221=1,1,IF(Assessment!$E$221=0.5,0.5,IF(Assessment!$E$221=0.75,0.5,0)))","v":0},null,null,{"$f":"IF(Assessment!$E$281=1,1,IF(Assessment!$E$281=0.5,0.5,IF(Assessment!$E$281=0.75,0.5,0)))","v":0},null,null,null,null,{"$f":"IF(Assessment!$E$371=1,1,IF(Assessment!$E$371=0.5,0.5,IF(Assessment!$E$371=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$420=1,1,IF(Assessment!$E$420=0.5,0.5,IF(Assessment!$E$420=0.75,0.5,0)))","v":0}]
[8,{"$f":"IF(Assessment!$E$36=1,1,IF(Assessment!$E$36=0.5,0.5,IF(Assessment!$E$36=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$137=1,1,IF(Assessment!$E$137=0.5,0.5,IF(Assessment!$E$137=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$192=1,1,IF(Assessment!$E$192=0.5,0.5,IF(Assessment!$E$192=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$226=1,1,IF(Assessment!$E$226=0.5,0.5,IF(Assessment!$E$226=0.75,0.5,0)))","v":0},null,null,{"$f":"IF(Assessment!$E$282=1,1,IF(Assessment!$E$282=0.5,0.5,IF(Assessment!$E$282=0.75,0.5,0)))","v":0},null,null,null,null,{"$f":"IF(Assessment!$E$372=1,1,IF(Assessment!$E$372=0.5,0.5,IF(Assessment!$E$372=0.75,0.5,0)))","v":0}]
[9,{"$f":"IF(Assessment!$E$39=1,1,IF(Assessment!$E$39=0.5,0.5,IF(Assessment!$E$39=0.75,0.5,0)))","v":0},null,{"$f":"IF(Assessment!$E$144=1,1,IF(Assessment!$E$144=0.5,0.5,IF(Assessment!$E$144=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$196=1,1,IF(Assessment!$E$196=0.5,0.5,IF(Assessment!$E$196=0.75,0.5,0)))","v":0},{"$f":"IF(Assessment!$E$229=1,1,IF(Assessment!$E$229=0.5,0.5,IF(Assessment!$E$229=0.75,0.5,0)))","v":0},null,null,{"$f":"IF(Assessment!$E$283=1,1,IF(Assessment!$E$283=0.5,0.5,IF(Assessment!$E$283=0.75,0.5,0)))","v":0},null,null,null,null,{"$f":"IF(Assessment!$E$376=1,1,IF(Assessment!$E$376=0.5,0.5,IF(Assessment!$E$376=0.75,0.5,0)))","v":0}]
[10,{"$f":"IF(Assessment!$E$42=1,1,IF(Assessment!$E$42=0.5,0.5,IF(Assessment!$E$42=0.75,0.5,0)))","v":0},null,null,null,{"$f":"IF(Assessment!$E$230=1,1,IF(Assessment!$E$230=0.5,0.5,IF(Assessment!$E$230=0.75,0.5,0)))","v":0},null,null,null,null,null,null,null,{"$f":"IF(Assessment!$E$380=1,1,IF(Assessment!$E$380=0.5,0.5,IF(Assessment!$E$380=0.75,0.5,0)))","v":0}]
[11,{"$f":"IF(Assessment!$E$46=1,1,IF(Assessment!$E$46=0.5,0.5,IF(Assessment!$E$46=0.75,0.5,0)))","v":0},null,null,null,{"$f":"IF(Assessment!$E$233=1,1,IF(Assessment!$E$233=0.5,0.5,IF(Assessment!$E$233=0.75,0.5,0)))","v":0},null,null,null,null,null,null,null,{"$f":"IF(Assessment!$E$383=1,1,IF(Assessment!$E$383=0.5,0.5,IF(Assessment!$E$383=0.75,0.5,0)))","v":0}]
[12,{"$f":"IF(Assessment!$E$49=1,1,IF(Assessment!$E$49=0.5,0.5,IF(Assessment!$E$49=0.75,0.5,0)))","v":0},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!$E$384=1,1,IF(Assessment!$E$384=0.5,0.5,IF(Assessment!$E$384=0.75,0.5,0)))","v":0}]
[13,{"$f":"IF(Assessment!$E$54=1,1,IF(Assessment!$E$54=0.5,0.5,IF(Assessment!$E$54=0.75,0.5,0)))","v":0},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!$E$388=1,1,IF(Assessment!$E$388=0.5,0.5,IF(Assessment!$E$388=0.75,0.5,0)))","v":0}]
[14,{"$f":"IF(Assessment!$E$57=1,1,IF(Assessment!$E$57=0.5,0.5,IF(Assessment!$E$57=0.75,0.5,0)))","v":0},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!$E$391=1,1,IF(Assessment!$E$391=0.5,0.5,IF(Assessment!$E$391=0.75,0.5,0)))","v":0}]
[15,{"$f":"IF(Assessment!$E$60=1,1,IF(Assessment!$E$60=0.5,0.5,IF(Assessment!$E$60=0.75,0.5,0)))","v":0},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!$E$394=1,1,IF(Assessment!$E$394=0.5,0.5,IF(Assessment!$E$394=0.75,0.5,0)))","v":0}]
[16,{"$f":"IF(Assessment!$E$65=1,1,IF(Assessment!$E$65=0.5,0.5,IF(Assessment!$E$65=0.75,0.5,0)))","v":0},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(Assessment!$E$395=1,1,IF(Assessment!$E$395=0.5,0.5,IF(Assessment!$E$395=0.75,0.5,0)))","v":0}]
[17,{"$f":"IF(Assessment!$E$68=1,1,IF(Assessment!$E$68=0.5,0.5,IF(Assessment!$E$68=0.75,0.5,0)))","v":0}]
[18,{"$f":"IF(Assessment!$E$71=1,1,IF(Assessment!$E$71=0.5,0.5,IF(Assessment!$E$71=0.75,0.5,0)))","v":0}]
[19,{"$f":"IF(Assessment!$E$75=1,1,IF(Assessment!$E$75=0.5,0.5,IF(Assessment!$E$75=0.75,0.5,0)))","v":0}]
[20,{"$f":"IF(Assessment!$E$78=1,1,IF(Assessment!$E$78=0.5,0.5,IF(Assessment!$E$78=0.75,0.5,0)))","v":0}]
[21,{"$f":"IF(Assessment!$E$85=1,1,IF(Assessment!$E$85=0.5,0.5,IF(Assessment!$E$85=0.75,0.5,0)))","v":0}]
[22,{"$f":"IF(Assessment!$E$89=1,1,IF(Assessment!$E$89=0.5,0.5,IF(Assessment!$E$89=0.75,0.5,0)))","v":0}]
["Total",{"$f":"SUM(B23:B44)","v":1.5},{"$f":"SUM(C23:C44)","v":0},0,0,0,0,0,0,0,0,0,0,0,1]