Keep systems updated, free of malware and watched. 7 requirements, 3.14.1 to 3.14.7, 5 of them worth 5 points.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
Find out about security flaws in your computers, phones, routers and software, tell whoever looks after them, and install the fixes within a time you set.
Usually applies to: Every computer, phone, tablet, router, firewall, printer and program in scope.
Official wording: “Identify, report, and correct system flaws in a timely manner.”
Run protection against malicious software on computers, servers, phones and email, wherever DoD shipment information is handled.
Usually applies to: Office computers, laptops, servers, phones and tablets, and email.
Official wording: “Provide protection from malicious code at designated locations within organizational systems.”
Someone follows security alerts and advisories, such as those from your software vendors or the government's cybersecurity agency, CISA, and acts on the ones that apply to you.
Usually applies to: Whoever looks after your systems, usually the owner or your IT company, for alerts about the systems in scope.
Official wording: “Monitor system security alerts and advisories and take action in response.”
Malware protection updates itself whenever new versions are released.
Usually applies to: The malware protection on every computer, phone and email service in scope.
Official wording: “Update malicious code protection mechanisms when new releases are available.”
Run full scans on a regular schedule, at least once a year, and scan files as they are downloaded, opened or run, such as email attachments.
Usually applies to: Office computers, laptops and servers, and files arriving by email, download or USB drive.
Official wording: “Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.”
Monitor your systems and network traffic, coming in and going out, for signs of an attack.
Usually applies to: Your network, email, computers and cloud sign-ins, usually watched through your security tools or your IT company.
Official wording: “Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.”
Notice when your systems are used in ways they should not be, such as a sign-in at 3 a.m. from another country or an account suddenly downloading every shipment.
Usually applies to: Sign-ins and activity in your moving software, email and cloud services, and on your computers.
Official wording: “Identify unauthorized use of organizational systems.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
