“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
3.1.1 Only approved people and devices get in
Only people, devices and automated connections you have approved, such as a link between your moving software and your accounting system, can get into the computers, phones and software that hold DoD shipment information. Everyone has their own login, and you keep a list of who and what has access.
Usually applies to: Every system in scope: your moving software, email, office computers, phones and tablets, shared drives and cloud storage, network equipment and security tools, and any automated links between them.
5 points if not met Cannot wait on a POA&M
Official wording: “Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).”
3.1.2 Each person does only their job
Each login can do only what that person's job needs. A crew lead sees today's jobs, not the billing screens; an estimator cannot add or change user accounts.
Usually applies to: The permissions in each system in scope, mainly your moving software, email and shared drives, for every role: office staff, estimators, crew leads, drivers, warehouse staff and your IT company.
5 points if not met Cannot wait on a POA&M
Official wording: “Limit system access to the types of transactions and functions that authorized users are permitted to execute.”
3.1.3 Control where the information goes
DoD shipment information travels only where you have decided it may, such as to the TSP or the government's systems, and not to personal email, a texting app or a spreadsheet on someone's own laptop.
Usually applies to: Every route the information can take: email, texting, file sharing, exports and downloads, printing, and hand-offs to your TSP or agents.
1 point if not met May wait on a POA&M
Official wording: “Control the flow of CUI in accordance with approved authorizations.”
3.1.4 No one person can do it all
Split sensitive duties so one person cannot misuse them unnoticed. For example, the person who adds user accounts is not also the one who reviews the activity records.
Usually applies to: The administrator and review duties in your moving software, email, computers and network equipment, including the ones your IT company handles.
1 point if not met May wait on a POA&M
Official wording: “Separate the duties of individuals to reduce the risk of malevolent activity without collusion.”
3.1.5 Least access, few administrators
Give everyone the least access they need, and keep administrator rights, the power to install software or change settings, to the few people who truly need them.
Usually applies to: Every account in scope, above all the administrator accounts in your moving software, email, computers and network equipment.
3 points if not met Cannot wait on a POA&M
Official wording: “Employ the principle of least privilege, including for specific security functions and privileged accounts.”
3.1.6 Everyday login for everyday work
Anyone with administrator rights uses a normal login for email and daily work, and switches to the administrator login only to change settings.
Usually applies to: Everyone with administrator rights, often the owner, the office manager or your IT company, on computers, email, moving software and network equipment.
1 point if not met May wait on a POA&M
Official wording: “Use non-privileged accounts or roles when accessing nonsecurity functions.”
3.1.7 Administrator tasks for administrators only, and logged
Ordinary users cannot do administrator things such as turning off antivirus or adding users, and whenever administrator powers are used, it is recorded.
Usually applies to: Office computers, phones and tablets, email, moving software and network equipment, plus the records of administrator actions.
1 point if not met May wait on a POA&M
Official wording: “Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.”
3.1.8 Lock out password guessing
After a few wrong password attempts the account locks for a while, so nobody can keep guessing.
Usually applies to: Every sign-in in scope: moving software, email, office computers, phones and tablets, network equipment and remote access.
1 point if not met May wait on a POA&M
Official wording: “Limit unsuccessful logon attempts.”
3.1.9 Show a notice at sign-in
Systems that hold DoD shipment information show a short notice at sign-in about who may use them and how, consistent with the CUI rules.
Usually applies to: The sign-in screens of systems that hold DoD shipment information, such as office computers and your moving software.
1 point if not met May wait on a POA&M
Official wording: “Provide privacy and security notices consistent with applicable CUI rules.”
3.1.10 Lock unattended screens
Screens lock after a few minutes without use and hide what was on them, so a visitor walking past the dispatch desk cannot read a shipment.
Usually applies to: Office computers, laptops, phones and tablets: anything whose screen can show DoD shipment information.
1 point if not met May wait on a POA&M
Official wording: “Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.”
3.1.11 End sessions automatically
Logins end by themselves after a set condition, such as a period of inactivity or the end of a shift, so open sessions are not left running.
Usually applies to: Your moving software, email and other cloud services, remote connections and office computers.
1 point if not met May wait on a POA&M
Official wording: “Terminate (automatically) a user session after a defined condition.”
3.1.12 Watch remote access
If anyone connects from outside the office, including from home or your outside IT helper, you control how they connect and can see who is connected.
Usually applies to: Every way into your systems from outside the office: sign-ins to your moving software and email from home, the road or a residence, and VPN, remote desktop and remote-support tools, including your IT company's.
5 points if not met Cannot wait on a POA&M
Official wording: “Monitor and control remote access sessions.”
3.1.13 Encrypt remote connections
Remote connections into your systems are encrypted, so DoD shipment information cannot be read on the way.
Usually applies to: The same connections: cloud sign-ins from outside the office, VPN, remote desktop and remote-support sessions.
5 points if not met Cannot wait on a POA&M
Official wording: “Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.”
3.1.14 Remote access through managed entry points
Remote connections come through a small number of managed entry points, such as a company VPN or your software's secure sign-in, not through remote-desktop tools set up one by one.
Usually applies to: Your VPN or other remote-access gateway, and the remote-support tools your IT company uses.
1 point if not met May wait on a POA&M
Official wording: “Route remote access via managed access control points.”
3.1.15 Approve remote administrator work
Using administrator powers from outside the office, or reaching security information such as activity records and security settings, happens only when you have specifically approved it.
Usually applies to: Administrator work done from outside the office, by your staff or your IT company, and remote access to activity records and security settings.
1 point if not met May wait on a POA&M
Official wording: “Authorize remote execution of privileged commands and remote access to security-relevant information.”
3.1.16 Approve wireless connections first
Decide which wireless connections are allowed before anyone uses them. The Wi-Fi that reaches your business systems is not handed out to whoever asks.
Usually applies to: Office and warehouse Wi-Fi, and any other wireless link to systems in scope.
5 points if not met Cannot wait on a POA&M
Official wording: “Authorize wireless access prior to allowing such connections.”
3.1.17 Protect your Wi-Fi
Office and warehouse Wi-Fi uses strong encryption and a password or company login. If you offer guest Wi-Fi, keep it separate from the business network.
Usually applies to: Office and warehouse Wi-Fi that reaches systems in scope, and the settings that keep any guest network separate.
5 points if not met Cannot wait on a POA&M
Official wording: “Protect wireless access using authentication and encryption.”
3.1.18 Control phones and tablets
Only phones and tablets you have approved, including crew phones, may connect to systems holding DoD shipment information, and you know which ones they are.
Usually applies to: Crew, estimator, driver and office phones and tablets, and any personal phone that gets shipment emails or texts.
5 points if not met Cannot wait on a POA&M
Official wording: “Control connection of mobile devices.”
3.1.19 Encrypt phones, tablets and laptops
If DoD shipment information is on a phone, tablet or laptop, the device's storage is encrypted and protected with a screen lock.
Usually applies to: Laptops, phones and tablets that can hold DoD shipment information, including photos of paperwork and downloaded files.
3 points if not met Cannot wait on a POA&M
Official wording: “Encrypt CUI on mobile devices and mobile computing platforms.”
3.1.20 Check and limit outside systems
Decide which outside systems may connect to your systems or be used with DoD shipment information, such as a personal computer, a home printer, a partner's system or an online service, check that each one is properly protected, and block the rest.
Usually applies to: Personal computers and phones, home printers, your TSP's and agents' systems, and any online service you have not approved, such as free file-sharing sites or AI chat tools.
1 point if not met Cannot wait on a POA&M
Official wording: “Verify and control/limit connections to and use of external systems.”
3.1.21 Limit USB drives on other people's computers
Limit the use of your company USB drives and other portable storage on computers you do not control, such as a hotel business center or a family computer.
Usually applies to: Company USB drives and other portable storage, when used on computers you do not control.
1 point if not met May wait on a POA&M
Official wording: “Limit use of portable storage devices on external systems.”
3.1.22 Keep it off public pages
DoD shipment information never goes on anything the public can see: your website, social media, online review replies or a public link. Only people you name may post, someone checks before anything is posted, and anything posted by mistake is taken down right away.
Usually applies to: Your website, social media, review-site replies, any customer portal page that needs no sign-in, and any public link.
1 point if not met Cannot wait on a POA&M
Official wording: “Control CUI posted or processed on publicly accessible systems.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
