“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
3.4.1 Know what you have
Keep an up-to-date list of every computer, phone, tablet, printer, router and program that touches DoD shipment information, and a record of how each one is set up.
Usually applies to: Everything in scope: computers, phones, tablets, printers, scanners, routers, Wi-Fi equipment, security tools, and the software and cloud services you use.
5 points if not met Cannot wait on a POA&M
Official wording: “Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.”
3.4.2 Set things up securely
Use secure settings on every device and program, such as changed default passwords, guest accounts off and automatic updates on, and keep them that way.
Usually applies to: The same list: every device, program and cloud service in scope.
5 points if not met Cannot wait on a POA&M
Official wording: “Establish and enforce security configuration settings for information technology products employed in organizational systems.”
3.4.3 Track changes
Changes to your systems, such as new software, a new router or new settings, are requested, approved and written down.
Usually applies to: Changes to anything in scope: new software or apps, new devices, network changes, and setting changes in your moving software and email.
1 point if not met May wait on a POA&M
Official wording: “Track, review, approve or disapprove, and log changes to organizational systems.”
3.4.4 Think before you change
Before a change, ask what it could do to security. For example: does the new scheduling app need access to your customer list?
Usually applies to: The same changes, before they are made.
1 point if not met May wait on a POA&M
Official wording: “Analyze the security impact of changes prior to implementation.”
3.4.5 Control who can make changes
Only approved people can change settings or install things on your systems, or physically get at equipment to change it, such as the network closet, and you have written down who they are.
Usually applies to: The admin settings of your moving software, email and cloud services, office computers, and the closet or shelf where the router and firewall sit.
5 points if not met Cannot wait on a POA&M
Official wording: “Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.”
3.4.6 Only what the business needs
Set up devices to do only what the business needs; the dispatch computer has no games or programs it does not need.
Usually applies to: Office computers, phones and tablets, and network equipment.
5 points if not met Cannot wait on a POA&M
Official wording: “Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.”
3.4.7 Turn off what the business does not need
Remove or turn off programs, features and network connections the business does not need, such as an old remote-access tool, file sharing that was left on or peer-to-peer file-sharing apps.
Usually applies to: Office computers, phones and tablets, network equipment and cloud services: unused programs, open network ports, old remote tools and file sharing.
5 points if not met Cannot wait on a POA&M
Official wording: “Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.”
3.4.8 Control which software can run
Pick one approach and enforce it: block the programs you have banned or, better, let only approved programs run and block everything else.
Usually applies to: Office computers and laptops, and any phone or tablet in scope, personal ones included, through the settings that control which apps they can run.
5 points if not met Cannot wait on a POA&M
Official wording: “Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.”
3.4.9 Watch what people install
Control and keep an eye on software staff install themselves, such as browser add-ons and free apps.
Usually applies to: Office computers, laptops, phones and tablets: browser add-ons, free apps and anything staff install themselves.
1 point if not met May wait on a POA&M
Official wording: “Control and monitor user-installed software.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
