“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
3.13.1 Guard the edges of your network
Monitor and control what comes into and goes out of your network, with a properly set up firewall where you connect to the internet and at key points inside, such as between your business network and guest Wi-Fi.
Usually applies to: Your router and firewall where you connect to the internet, and the boundary between your business network and guest Wi-Fi.
5 points if not met Cannot wait on a POA&M
Official wording: “Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.”
3.13.2 Build security in
Design and set up your systems with security in mind from the start, for example when choosing software or setting up a new office network.
Usually applies to: New systems and big changes: choosing moving software or other cloud services, setting up an office network, opening a new office or warehouse.
5 points if not met Cannot wait on a POA&M
Official wording: “Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.”
3.13.3 Keep administration separate
Keep the tools for managing systems apart from everyday use, for example a separate administrator console or account.
Usually applies to: Administrator consoles and accounts for your email, moving software, computers and network equipment.
1 point if not met May wait on a POA&M
Official wording: “Separate user functionality from system management functionality.”
3.13.4 No leftovers in shared resources
Make sure information does not pass from one user to the next through something shared, such as a shared computer or a printer's memory.
Usually applies to: Shared computers, shared crew tablets, and printers or copiers that keep copies.
1 point if not met May wait on a POA&M
Official wording: “Prevent unauthorized and unintended information transfer via shared system resources.”
3.13.5 Keep public-facing systems separate
Anything the public can reach, such as your website or a customer portal, is kept separate from the internal network where DoD shipment information lives.
Usually applies to: Your website, customer portal, online booking or quote forms, and anything else the public can reach. If nothing the public can reach is inside your scope, it may not apply.
5 points if not met Cannot wait on a POA&M
Official wording: “Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.”
3.13.6 Block by default
Network traffic is blocked unless you have allowed it: the firewall starts from deny all.
Usually applies to: Your firewall and router.
5 points if not met Cannot wait on a POA&M
Official wording: “Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).”
3.13.7 No side doors during remote work
While someone is connected to your systems remotely, for example over a VPN, their device cannot reach the internet outside that protected connection at the same time. Allowing both at once is called split tunneling, and it must be blocked.
Usually applies to: Laptops and phones that connect to your systems over a VPN.
1 point if not met May wait on a POA&M
Official wording: “Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).”
3.13.8 Encrypt information on the move
Encrypt DoD shipment information whenever it travels over a network: secure websites (https), encrypted email or secure file transfer, not ordinary email attachments.
Usually applies to: Email, file sharing, texting, your moving software's web and app connections, and remote connections.
3 points if not met Cannot wait on a POA&M
Official wording: “Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.”
3.13.9 Close idle network connections
Network connections close at the end of a session or after a period without use.
Usually applies to: VPN and remote desktop connections, and sessions in your moving software and other cloud services.
1 point if not met May wait on a POA&M
Official wording: “Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.”
3.13.10 Manage encryption keys
Whoever manages your encryption keys and certificates does it deliberately: keys and certificates are stored safely, replaced on schedule and withdrawn when needed.
Usually applies to: Encryption keys and certificates: website and portal certificates, VPN keys and disk-encryption recovery keys.
1 point if not met May wait on a POA&M
Official wording: “Establish and manage cryptographic keys for cryptography employed in organizational systems.”
3.13.11 Use government-validated encryption
The encryption that protects DoD shipment information must be FIPS-validated, which means the encryption module has passed independent lab testing and been validated through a NIST program. Ask your software and device vendors whether theirs is.
Usually applies to: Everywhere encryption protects DoD shipment information: laptops, phones, USB drives, email, file sharing, VPN and your cloud services.
5 points if not encrypted; 3 if encrypted but not FIPS-validated May wait on a POA&M only if encrypted but not FIPS-validated
Official wording: “Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.”
3.13.12 No remote switching-on of cameras and microphones
Cameras and microphones on your computers, and devices such as networked whiteboards, cannot be switched on remotely, and they show a light or icon when in use.
Usually applies to: Cameras and microphones on office computers and laptops, and networked whiteboards. Dedicated video-conferencing systems are excluded.
1 point if not met May wait on a POA&M
Official wording: “Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.”
3.13.13 Control code that runs in documents and browsers
Control and monitor code that runs inside documents and web pages, such as macros in spreadsheets.
Usually applies to: Office computers and laptops: macros in spreadsheets and documents, and code that runs in web browsers.
1 point if not met May wait on a POA&M
Official wording: “Control and monitor the use of mobile code.”
3.13.14 Control internet phones
Control and monitor internet phone (VoIP) systems, such as who can change the phone system's settings and who can use it.
Usually applies to: Your office phone system, if it runs over the internet, and its settings.
1 point if not met May wait on a POA&M
Official wording: “Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.”
3.13.15 Make sure connections are genuine
Protect communication sessions so nobody can hijack or fake a connection. Secure connections (https) with valid certificates do this.
Usually applies to: Connections to your moving software, email, cloud services and VPN.
5 points if not met Cannot wait on a POA&M
Official wording: “Protect the authenticity of communications sessions.”
3.13.16 Protect stored information
Protect DoD shipment information where it is stored, on servers, laptops and in the cloud, usually by encrypting it.
Usually applies to: Wherever DoD shipment information is stored: cloud services, computers, laptops, phones, servers, shared drives and backups.
1 point if not met May wait on a POA&M
Official wording: “Protect the confidentiality of CUI at rest.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
