Audit and Accountability Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If Applicable,” provide “Not rationale. Establish and enforce security configuration settings for information technology products employed in organizational systems. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If Applicable,” provide “Not rationale. Track, review, approve or disapprove, and log changes to organizational systems. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If Applicable,” provide “Not rationale. Analyze the security impact of changes to implementation. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If Applicable,” provide “Not rationale. Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If Applicable,” provide “Not rationale. Employ the principle of functionality by configuring organizational systems to provide only essential capabilities. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If Applicable,” provide “Not rationale. Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
Audit and Accountability Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If “Not Applicable,” provide rationale. Establish and enforce security configuration settings for information technology products employed in organizational systems. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If “Not Applicable,” provide rationale. Track, review, approve or disapprove, and log changes to organizational systems. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If “Not Applicable,” provide rationale. Analyze the security impact of changes to implementation. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If “Not Applicable,” provide rationale. Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If “Not Applicable,” provide rationale. Employ the principle of functionality by configuring organizational systems to provide only essential capabilities. Implemented Planned to be Implemented Not Applicable Current implementation or planned implementation details. If “Not Applicable,” provide rationale. Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
CUI-SSP-Template-final.docx