Everyone and everything proves who they are before getting in. 11 requirements, 3.5.1 to 3.5.11, 4 of them worth 5 points.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
Every person, every device and every automated process that connects to your systems has its own name in them.
Usually applies to: Every user, device and automated connection in scope, including shared crew tablets and the accounts that link your software to other systems.
Official wording: “Identify system users, processes acting on behalf of users, and devices.”
Nobody and nothing gets in without first proving who they are, usually with a password and more.
Usually applies to: Every sign-in in scope: moving software, email, computers, phones and tablets, network equipment and remote tools.
Official wording: “Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.”
Use multifactor sign-in, a code or an app approval on a phone as well as the password, for administrators at all times and for everyone who signs in over a network, which includes cloud software and email.
Usually applies to: Every administrator account, and every sign-in over a network: email, moving software and other cloud services, remote access and remote support.
Official wording: “Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.”
Use sign-in methods that an attacker cannot capture and reuse. Modern sign-in systems and multifactor apps do this; old plain-text logins do not.
Usually applies to: Sign-ins over a network: your moving software, email and other cloud services, remote access and network equipment.
Official wording: “Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.”
Do not give a departed employee's username to someone new for a set period, so old records still point to the right person.
Usually applies to: Usernames in your moving software, email and computers; it matters most with seasonal turnover.
Official wording: “Prevent reuse of identifiers for a defined period.”
Accounts that have not been used for a set time, such as a seasonal crew member's, are switched off.
Usually applies to: Accounts in your moving software, email and computers, especially seasonal crew accounts.
Official wording: “Disable identifiers after a defined period of inactivity.”
Passwords must meet a minimum strength, and a new password must differ from the old one by more than a character or two.
Usually applies to: Passwords for your moving software, email, computers and network equipment.
Official wording: “Enforce a minimum password complexity and change of characters when new passwords are created.”
People cannot reuse their last several passwords.
Usually applies to: The same passwords as 3.5.7.
Official wording: “Prohibit password reuse for a specified number of generations.”
A temporary password, for a new hire or after a reset, works once and must be changed to a permanent one right away.
Usually applies to: Passwords for new hires and resets in your moving software, email and computers.
Official wording: “Allow temporary password use for system logons with an immediate change to a permanent password.”
Systems keep and send passwords only in protected form, scrambled (hashed) or encrypted, and nobody keeps them in a spreadsheet or sends them by email. A password manager is fine.
Usually applies to: How your systems store passwords, and how staff keep and share them: spreadsheets, sticky notes, texts and email.
Official wording: “Store and transmit only cryptographically-protected passwords.”
Password fields show dots instead of the characters, so nobody can read them over a shoulder.
Usually applies to: Sign-in screens on computers, phones, tablets and your software.
Official wording: “Obscure feedback of authentication information.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
