Check that your protections work, and write down how you meet each requirement. 4 requirements, 3.12.1 to 3.12.4, 2 of them worth 5 points.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
On a schedule you set, at least once a year, check whether each of these requirements is actually working, for example with Project Spectrum's self-assessment.
Usually applies to: All 110 requirements, across everything in scope.
Official wording: “Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.”
Keep a running list of problems that come up after a requirement is in place, such as a missed update or a setting that has drifted, and how you will fix each one. This operational plan of action is not the POA&M, which covers gaps found in an assessment and must be closed within 180 days. A temporary problem that is on the list, reviewed and being fixed can still count as met.
Usually applies to: Your operational plan of action: problems that come up after a requirement is in place, such as a missed update or a setting that drifted, and how you will fix each one. It is separate from the POA&M for gaps found in an assessment.
Official wording: “Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.”
Keep an eye on your protections all year, not only when an assessment is due.
Usually applies to: Everything in scope, all year.
Official wording: “Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.”
Write a System Security Plan and update it at least once a year: which systems hold DoD shipment information, where they are, how each requirement is met and what they connect to.
Usually applies to: Your whole scope: its boundary, each asset and its type, how you meet each of the 110 requirements, and what it connects to.
Official wording: “Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
