Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  The list of active accounts along with the name of individuals associated with the account.

·  The list of permissions and rights associated with a group account or role.

·  Documentation of individuals terminated, transferred within the organization, or assigned a new role in the organization.

The above information may be compared with system and application accounts to verify the actual accounts and associated permissions were implemented as described in the company's documented procedure.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Access control list that limit access to systems (network and servers).

·  Access control list for applications and data based on role and/or identity. 

·  Access control list that show the type of access permitted, for example, administrator rights vs. user rights to view, edit, update, or delete records.

·  Provisioning processes and associated examples of approval by an identified individual with the authority to approve access with evidence such as an email or signature on a form.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Documentation, such as diagram or security plan to verify if the organization has identified a system boundary and that connections to external systems have been identified.

·  Account management process and connection agreements to determine if the use of external system is restricted to authorized individuals and system interconnections .

·  Policy and procedures on personally owned systems and the security standards set by the organization and determine if controls exist to restrict unauthorized connections to identified access points to systems.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  List of users authorized to post or process information on public facing systems

·  Training records to demonstrate employees receive training that non-public information such as Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) must not be posted on public facing systems.

·  Evidence that content on a public facing system is reviewed and approved prior to posting, for example, a change record or audit log.

·  Evidence that public facing systems are periodically reviewed for authorized content, for example, a review log.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Service or group accounts used by the organization

·  Policy or procedures on method(s) used to uniquely identify and authenticate users.

·  Organizational procedures to remove access to service or group accounts when an individual terminates or due to change in job responsibilities e.g., an individual is transferred to another business unit.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  An account provision process to examine identified methods of authentication. 

·  The use of unique accounts for new employees and contractors

·  The use and assignment of initial passwords

·  A password reset function for initial use

·  The requirement for password complexity, such as 12 characters, a mix of upper and lower case letters, number, and special characters.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Processes or procedures to identify Federal Contract Information or Controlled Unclassified Information (CUI).

·  An inventory of process/or tools used to sanitize media before it is released for reuse or destroyed for disposal.

·   Documentation that shows who approved and who sanitized the media or a signed form that verifies the media was destroyed securely.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Lists of personnel with authorized physical access/credentials who are identified and reviewed periodically for appropriate access – may also be asked how often the review is performed and to provide evidence of reviews.

·  Identified areas that control physical access to organizational systems, production systems, equipment or as defined by company policy.

·  Physical security protections used to monitor and restrict access to controlled areas, such as guards, cameras, locks, badges etc.

·  The location of output devices such as printers are placed in areas that do not expose data to unauthorized employees.
 

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Policy or procedures related to physical protections to determine if all visitors to sensitive areas are escorted by an authorized employee and monitored e.g., access control device, guard, camera etc.

·  Visitor logs, access control system logs, or documentation of validation (testing).

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Physical access audit logs such as: a written log of persons accessing a facility or an audit log from an automated system that records the identificaiton of personnel entering the facility and areas where sensitive systems may be located (i.e., non-public or restricted areas).

·  Organization related documents or records related to physical access control to identify length of time audit logs are maintained.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  An inventory of physical access devices,

·  Information on how access devices are maintained and operated per the manufacturer recommendations,

·  Change logs or records to show updates of access devices when access control information is revised or changed,

·  Records of key and lock combination changes,

·  Records of unused or unassigned keys or keys cards with assurance that unused items are stored securely to prevent unauthorized access.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  If network communication boundaries have been identified

·  List of hardware/software used for network monitoring of key internal and external boundaries

·  Procedures that addresses boundary protection systems, such as routers, gateways, firewalls, configurations, and/or VPNs used to monitor or restrict authorized/unauthorized communications.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Procedures or processes for protecting and separating internal systems from public facing systems,

·  The use of demilitarized zones (DMZ) that shows the structure and separation of systems in the DMZ,

·  Network routing configurations that verify all incoming and outgoing through the DMZ.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Policy or procedures that address flaw remediation,

·  Security-relevant software updates (patches, service pack updates, hot fixes, or signature updates) in response to reported system flaws or vulnerabilities,

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

An inventory of malicious code protections provided to systems at designated locations.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

Malicious code protections are updated when new releases are available and also updated based on your organizational configuration management process.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

Security scans of files from an external source are scanned when downloaded, opened, or executed.  (This would include files downloaded from websites, email attachments, embedded links, or from other interfaces with external systems.)