NIST SP 800-171 R3: An Overview of the Changes

3.1

Access Control

Consolidated:

• 3.1.13, 3.1.14, and 3.1.15 (Remote Access) into 3.1.12
• 3.1.17 (Wireless Access Protection) into 3.1.16
• 3.1.19 (Mobile Device Protection) into 3.1.18

Added:

3.1.23 added to address session logout following a period of inactivity—this new practice is essentially an extension of previously existing practice 3.1.11.

3.4

Configuration Management

Consolidated:

3.4.7 (Prevention of Non-Essential Functionality) into 3.4.6

3.5

Identification and Authentication

Withdrawn:

• 3.5.6 (Disabling Identifiers After a Period of Inactivity)
• 3.5.8 (Password Reuse)

Consolidated:

3.5.9 and 3.5.10 (Temporary Passwords and Password Encryption) into 3.5.7

Added:

3.5.12 (Authenticator Management) regarding controls for managing authenticators which had previously been covered under other practices.

3.7

Maintenance

Withdrawn:

3.7.1 (Performance of System Maintenance) has been reclassified as NCO (or, not directly related to protecting the confidentiality of CUI).

Consolidated:

• 3.7.2 (Control of Tools, Techniques, Mechanisms, and Personnel Within The Performance Of Maintenance) into 3.7.4 and 3.7.6
• 3.7.3 (Sanitization of Disposed Equipment) into 3.8.3

3.8

Media Protection

Consolidated:

• 3.8.6 (Media Accountability) into 3.8.5
• 3.8.8 (Use of Portable Storage Devices) into 3.8.7

3.10

Physical and Environmental Protection

Consolidated:

3.10.3, 3.10.4, and 3.10.5 (Facility Access by Visitors) have all been incorporated into a new practice, 3.10.7 for Physical Access Control.

Added:

3.10.8 (Physical Access to Transmission Lines (e.g., network cables and devices, etc.) and Output Devices (e.g. printers, scanners, etc.).

3.11

Risk Assessment

Consolidated:

3.12 – Security Assessment

Consolidated:

Added:

• 3.12.5 (Independent Assessment): Addresses the potential conflict of interest that might exist when an organization’s system management and security controls would be assessed by the same individuals who are managing them—now, independent assessors are required to evaluate those controls.
• 3.12.6 (Information Exchange): Requires the documenting and secure managing of the exchange of CUI between organizations (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual).
• 3.12.7 (Internal System Connections): Deals with the authorization and periodic review of intersystem connections within an organization.

3.13

System and Communications Protection

Consolidated:

• 3.13.2 (Use Of Architectural Designs, Software Development Techniques, and Systems Engineering Principles to Promote Effective Security) into 3.16.1
• 3.13.5 (Subnetting Publicly Available Network Segments) into 3.13.1
• 3.13.16 (Protection of CUI at Rest) into 3.13.8

Withdrawn:

3.13.14 (Control of VoIP Technologies), as it represents a technology-specific practice.

Added:

• 3.13.17: Addresses the protection of internal network traffic routing to external points over a designated proxy server.
• 3.13.18: Regards control access points into the system and incorporates portions of the former 3.1.14

3.14

System and Information Integrity

Consolidated:

• 3.14.4 and 3.14.5 (Updating Malicious Code Mechanisms and Scanning of Systems) into 3.14.2
• 3.14.7 (Identification of Unauthorized Systems) into 3.14.6

Added:

3.14.8: Addresses the control of spam or unsolicited email messages.

New Practice Family

Includes:

3.15

Planning

• 3.15.1 (Policy and Procedures): States that an organization must develop and document the policies and procedures associated with achieving compliance with 800-171 and that those documents are routinely reviewed and updated.
• 3.15.2 (System Security Plan): Not a “new” practice so much as it is a housekeeping item that has moved this requirement from 3.12.4.
• 3.15.3 (Rules of Behavior): Requires that the organization define rules describing the responsibilities and expected behavior regarding usage and the handling of CUI for individuals requiring access to the system.

3.16

System and Services Acquisition

• 3.16.1 (Security Engineering Principles): Specifies that an organization apply systems security engineering principles in the specification, design, development, implementation, and modification of the system and system components, including tactics such as:
  • Layered protections in development
  • Security policies, architecture, and controls as the foundation for design
  • Incorporation of security requirements into the system development life cycle
  • Physical and logical security boundaries
  • Training for developers on how to build trustworthy secure software
• 3.16.2 (Unsupported System Components): Stipulates that the organization must replace system components that are no longer supported by the developer, vendor, or manufacturer, or provide options for alternative sources for continued support for unsupported components.
• 3.16.3 (External System Services): Requires that any providers of external system services comply with the organization security requirements, with documentation and ongoing oversight for those external services.

3.17

Supply Chain Risk Management

• 3.17.1 (Supply Chain Risk Management Plan): Requires a plan for managing supply chain risks associated with the development, manufacturing, acquisition, delivery, operations, maintenance, and disposal of the system, system components, or system services.
• 3.17.2 (Acquisition Strategies, Tools, and Methods): Instructs the organization to develop and implement acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks.
• 3.17.3 (Supply Chain Controls and Processes): Requires that the organization define processes for identifying and addressing weaknesses or deficiencies in their supply chain and employ controls to protect those risks, thus limiting the harm or consequences from supply chain disruption.
• 3.17.4 (Component Disposal): An extension of 3.8.3 concerned with the disposal of media containing CUI, expands the scope to include the disposal of system components, documentation, or tools containing CUI.