“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
3.3.1 Keep activity records
Your systems record who signed in, what they opened and what changed, and you keep those records long enough to investigate a problem.
Usually applies to: Your moving software, email, office computers, network equipment and security tools, wherever they can record activity, and wherever the records are kept.
5 points if not met Cannot wait on a POA&M
Official wording: “Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.”
3.3.2 Trace every action to a person
Every action can be traced to one named person. That only works if nobody shares a login.
Usually applies to: Every login in scope. Shared logins, such as one crew login on a shared tablet, break this.
3 points if not met Cannot wait on a POA&M
Official wording: “Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.”
3.3.3 Review what you record
On a schedule you set, such as once a year, review which events you record and adjust them as your systems and risks change.
Usually applies to: The recording settings in your moving software, email, computers and network equipment.
1 point if not met May wait on a POA&M
Official wording: “Review and update logged events.”
3.3.4 Get an alert if recording stops
If the recording stops, for example because a disk is full or a setting was switched off, someone gets an alert.
Usually applies to: Whatever collects your activity records: the computers themselves, the admin settings of your email and software, or a log service your IT company runs.
1 point if not met May wait on a POA&M
Official wording: “Alert in the event of an audit logging process failure.”
3.3.5 Connect the dots
When something looks wrong, look at the records from different systems together, such as email, computers and your moving software, to see the whole picture.
Usually applies to: The activity records from your email, computers, network equipment and moving software, looked at together.
5 points if not met Cannot wait on a POA&M
Official wording: “Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.”
3.3.6 Pull a report when needed
You can search and filter the records quickly to answer a question like: who opened this shipment last week?
Usually applies to: The same records, and the tool you use to search them.
1 point if not met May wait on a POA&M
Official wording: “Provide audit record reduction and report generation to support on-demand analysis and reporting.”
3.3.7 Keep clocks in sync
Computers and systems set their clocks from a trusted time source, so the times in different records line up.
Usually applies to: Office computers, servers, network equipment and anything else that stamps times on records. Phones and cloud services usually set their clocks automatically.
1 point if not met May wait on a POA&M
Official wording: “Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.”
3.3.8 Protect the records
Activity records, and the tools that manage them, are protected so only authorized people can see them and nobody can change or delete them, including someone who is being investigated.
Usually applies to: Wherever activity records are kept, and the tools that manage them: email and software admin consoles, computers and any log service.
1 point if not met May wait on a POA&M
Official wording: “Protect audit information and audit logging tools from unauthorized access, modification, and deletion.”
3.3.9 Few people manage the recording
Only a small number of administrators can change what is recorded or turn recording off.
Usually applies to: The administrator accounts that can change recording in your email, moving software, computers and network equipment.
1 point if not met May wait on a POA&M
Official wording: “Limit management of audit logging functionality to a subset of privileged users.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
