Every Rev. 2 requirement with its official statement, an independent plain-language explanation, and the practices that genuinely support it. The revision most current DIB contracts reference through DFARS 252.204-7012.
Requirement identifiers and official language come from the primary NIST publication; every explanation, mapping, and caveat is independent analysis by this site, authored against the primary source and last updated 2026-08-06. A subject-matter-expert review pass has not yet been completed, and the content is labeled accordingly. Nothing here is a compliance determination, an assessment, or a substitute for your own analysis within your defined system boundary. Publication status: NIST has withdrawn Rev. 2 as superseded by Rev. 3. That is a statement about the publication, not about your obligations — contracts that reference Rev. 2 continue to mean Rev. 2 until their own terms change.
Who and what may reach the system, and what they may do once inside: account authorization, least privilege, remote and wireless pathways, mobile devices, external systems, and public content. The largest family in Rev. 2, and the one where most small-business gaps concentrate.
People know the risks their role carries and are trained for their security duties — including recognizing insider-threat indicators. Three requirements, all of which depend on records to demonstrate.
Actions on the system can be reconstructed and attributed: logs exist, are reviewed, are protected from tampering, alert when logging fails, and rest on synchronized clocks.
Systems are built from known baselines, changed only through review, and stripped to essential functions. Inventory and baseline discipline here is what most other families silently assume.
Every user, process, and device is identified and authenticated before access — with multifactor and replay-resistant authentication for the accounts attackers actually target, and password handling that limits what a stolen credential is worth.
An operational capability to prepare for, detect, analyze, contain, and recover from incidents — tracked, reported to the right officials, and tested rather than merely written down.
System maintenance happens under control: tools and personnel are supervised, equipment leaving for service is sanitized, and nonlocal maintenance sessions authenticate strongly and end when the work does.
CUI on media — paper, drives, removable storage, backups — is stored, marked, transported, sanitized, and destroyed under control, with cryptography where physical safeguards are absent.
People are screened before receiving access to systems containing CUI, and access is handled deliberately through terminations and transfers.
Physical access to systems and facilities is limited, monitored, and logged — including visitor control, access devices, and safeguarding CUI at alternate work sites.
Risk is assessed periodically, vulnerabilities are scanned for on a cadence and on new disclosures, and remediation follows the risk — not the scanner's default severity order.
Controls are assessed for effectiveness, deficiencies get plans of action, monitoring is continuous, and the system security plan describing boundaries and implementations stays current. The family where documentation and reality meet.
Communications are monitored and protected at boundaries, networks deny by default, remote sessions are encrypted, cryptography is FIPS-validated where it protects CUI confidentiality, and CUI is protected at rest. The architectural heart of Rev. 2.
Flaws are identified and corrected in a timely manner, malicious code is caught at designated locations, advisories are acted on, and systems are monitored for attack indicators and unauthorized use.
“Mapped” counts requirements with at least one genuine practice relationship. Families with low counts — personnel, physical, media — are not gaps in this site’s analysis: the campaign simply has no practice working that ground, and pretending otherwise would make every other mapping less trustworthy.
| Requirement | Family | Mapped practices |
|---|---|---|
| 3.1.1 Authorized access controlbasic | 3.1 Access Control | IT-01IT-02OT-01 |
| 3.1.2 Transaction and function controlbasic | 3.1 Access Control | OT-01 |
| 3.1.3 CUI flow controlderived | 3.1 Access Control | IT-05IT-08 |
| 3.1.4 Separation of dutiesderived | 3.1 Access Control | No mapped practice |
| 3.1.5 Least privilegederived | 3.1 Access Control | OT-01 |
| 3.1.6 Non-privileged account usederived | 3.1 Access Control | No mapped practice |
| 3.1.7 Privileged function controlderived | 3.1 Access Control | No mapped practice |
| 3.1.8 Unsuccessful logon attemptsderived | 3.1 Access Control | No mapped practice |
| 3.1.9 Privacy and security noticesderived | 3.1 Access Control | No mapped practice |
| 3.1.10 Session lockderived | 3.1 Access Control | No mapped practice |
| 3.1.11 Session terminationderived | 3.1 Access Control | No mapped practice |
| 3.1.12 Remote access monitoring and controlderived | 3.1 Access Control | IT-01OT-06 |
| 3.1.13 Remote access confidentialityderived | 3.1 Access Control | No mapped practice |
| 3.1.14 Managed access control pointsderived | 3.1 Access Control | OT-06 |
| 3.1.15 Privileged remote access authorizationderived | 3.1 Access Control | OT-06 |
| 3.1.16 Wireless access authorizationderived | 3.1 Access Control | No mapped practice |
| 3.1.17 Wireless access protectionderived | 3.1 Access Control | No mapped practice |
| 3.1.18 Mobile device connection controlderived | 3.1 Access Control | No mapped practice |
| 3.1.19 CUI encryption on mobilederived | 3.1 Access Control | No mapped practice |
| 3.1.20 External system connectionsderived | 3.1 Access Control | IT-08 |
| 3.1.21 Portable storage on external systemsderived | 3.1 Access Control | No mapped practice |
| 3.1.22 Publicly accessible content controlderived | 3.1 Access Control | No mapped practice |
| 3.2.1 Role-appropriate security awarenessbasic | 3.2 Awareness and Training | IT-10 |
| 3.2.2 Security duty trainingbasic | 3.2 Awareness and Training | IT-10 |
| 3.2.3 Insider-threat awarenessderived | 3.2 Awareness and Training | No mapped practice |
| 3.3.1 Audit log creation and retentionbasic | 3.3 Audit and Accountability | OT-07 |
| 3.3.2 Individual accountabilitybasic | 3.3 Audit and Accountability | IT-02 |
| 3.3.3 Logged event reviewderived | 3.3 Audit and Accountability | No mapped practice |
| 3.3.4 Audit failure alertingderived | 3.3 Audit and Accountability | No mapped practice |
| 3.3.5 Audit correlationderived | 3.3 Audit and Accountability | OT-07 |
| 3.3.6 Audit reduction and reportingderived | 3.3 Audit and Accountability | No mapped practice |
| 3.3.7 Authoritative time sourcederived | 3.3 Audit and Accountability | No mapped practice |
| 3.3.8 Audit information protectionderived | 3.3 Audit and Accountability | No mapped practice |
| 3.3.9 Audit management restrictionderived | 3.3 Audit and Accountability | No mapped practice |
| 3.4.1 Baseline configurations and inventoriesbasic | 3.4 Configuration Management | IT-02OT-02IT-03 |
| 3.4.2 Security configuration enforcementbasic | 3.4 Configuration Management | IT-04 |
| 3.4.3 Change tracking and approvalderived | 3.4 Configuration Management | OT-10IT-07 |
| 3.4.4 Security impact analysisderived | 3.4 Configuration Management | OT-10IT-07 |
| 3.4.5 Change access restrictionsderived | 3.4 Configuration Management | OT-10 |
| 3.4.6 Least functionalityderived | 3.4 Configuration Management | No mapped practice |
| 3.4.7 Nonessential functionality restrictionderived | 3.4 Configuration Management | No mapped practice |
| 3.4.8 Software execution policyderived | 3.4 Configuration Management | No mapped practice |
| 3.4.9 User-installed software controlderived | 3.4 Configuration Management | No mapped practice |
| 3.5.1 User and device identificationbasic | 3.5 Identification and Authentication | IT-02 |
| 3.5.2 Authentication before accessbasic | 3.5 Identification and Authentication | IT-01 |
| 3.5.3 Multifactor authenticationderived | 3.5 Identification and Authentication | IT-01 |
| 3.5.4 Replay-resistant authenticationderived | 3.5 Identification and Authentication | IT-01 |
| 3.5.5 Identifier reuse preventionderived | 3.5 Identification and Authentication | No mapped practice |
| 3.5.6 Inactive identifier handlingderived | 3.5 Identification and Authentication | IT-02 |
| 3.5.7 Password complexityderived | 3.5 Identification and Authentication | No mapped practice |
| 3.5.8 Password reuse prohibitionderived | 3.5 Identification and Authentication | No mapped practice |
| 3.5.9 Temporary password handlingderived | 3.5 Identification and Authentication | No mapped practice |
| 3.5.10 Cryptographic password protectionderived | 3.5 Identification and Authentication | No mapped practice |
| 3.5.11 Authentication feedback obscuringderived | 3.5 Identification and Authentication | No mapped practice |
| 3.6.1 Incident-handling capabilitybasic | 3.6 Incident Response | OT-04IT-09 |
| 3.6.2 Incident tracking and reportingbasic | 3.6 Incident Response | OT-04 |
| 3.6.3 Incident response testingderived | 3.6 Incident Response | OT-04 |
| 3.7.1 System maintenancebasic | 3.7 Maintenance | No mapped practice |
| 3.7.2 Maintenance controlsbasic | 3.7 Maintenance | No mapped practice |
| 3.7.3 Off-site maintenance sanitizationderived | 3.7 Maintenance | No mapped practice |
| 3.7.4 Diagnostic media checkingderived | 3.7 Maintenance | No mapped practice |
| 3.7.5 Nonlocal maintenance authenticationderived | 3.7 Maintenance | OT-06IT-01 |
| 3.7.6 Maintenance personnel supervisionderived | 3.7 Maintenance | OT-06 |
| 3.8.1 Media protection and storagebasic | 3.8 Media Protection | No mapped practice |
| 3.8.2 Media access limitationbasic | 3.8 Media Protection | No mapped practice |
| 3.8.3 Media sanitizationbasic | 3.8 Media Protection | No mapped practice |
| 3.8.4 Media markingderived | 3.8 Media Protection | No mapped practice |
| 3.8.5 Media transport accountabilityderived | 3.8 Media Protection | No mapped practice |
| 3.8.6 Media transport encryptionderived | 3.8 Media Protection | No mapped practice |
| 3.8.7 Removable media controlderived | 3.8 Media Protection | No mapped practice |
| 3.8.8 Ownerless storage prohibitionderived | 3.8 Media Protection | No mapped practice |
| 3.8.9 Backup CUI confidentialityderived | 3.8 Media Protection | IT-09OT-08 |
| 3.9.1 Personnel screeningbasic | 3.9 Personnel Security | No mapped practice |
| 3.9.2 Personnel action safeguardsbasic | 3.9 Personnel Security | No mapped practice |
| 3.10.1 Physical access limitationbasic | 3.10 Physical Protection | No mapped practice |
| 3.10.2 Facility protection and monitoringbasic | 3.10 Physical Protection | No mapped practice |
| 3.10.3 Visitor escort and monitoringderived | 3.10 Physical Protection | No mapped practice |
| 3.10.4 Physical access logsderived | 3.10 Physical Protection | No mapped practice |
| 3.10.5 Physical access device controlderived | 3.10 Physical Protection | No mapped practice |
| 3.10.6 Alternate work site safeguardsderived | 3.10 Physical Protection | No mapped practice |
| 3.11.1 Periodic risk assessmentbasic | 3.11 Risk Assessment | IT-06 |
| 3.11.2 Vulnerability scanningderived | 3.11 Risk Assessment | IT-06OT-05 |
| 3.11.3 Vulnerability remediationderived | 3.11 Risk Assessment | IT-06OT-05 |
| 3.12.1 Control effectiveness assessmentbasic | 3.12 Security Assessment | No mapped practice |
| 3.12.2 Plans of actionbasic | 3.12 Security Assessment | IT-06 |
| 3.12.3 Continuous control monitoringbasic | 3.12 Security Assessment | IT-02 |
| 3.12.4 System security planbasic | 3.12 Security Assessment | IT-02IT-05 |
| 3.13.1 Boundary communications protectionbasic | 3.13 System and Communications Protection | IT-05OT-03 |
| 3.13.2 Secure engineering principlesbasic | 3.13 System and Communications Protection | No mapped practice |
| 3.13.3 User / management functionality separationderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.4 Shared resource information controlderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.5 Public-access subnetworksderived | 3.13 System and Communications Protection | IT-05OT-03 |
| 3.13.6 Deny-by-default network trafficderived | 3.13 System and Communications Protection | OT-03IT-05 |
| 3.13.7 Split tunneling preventionderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.8 Transmission confidentialityderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.9 Network connection terminationderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.10 Cryptographic key managementderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.11 FIPS-validated cryptographyderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.12 Collaborative device controlderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.13 Mobile code controlderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.14 VoIP controlderived | 3.13 System and Communications Protection | No mapped practice |
| 3.13.15 Session authenticityderived | 3.13 System and Communications Protection | IT-01 |
| 3.13.16 CUI at restderived | 3.13 System and Communications Protection | IT-08 |
| 3.14.1 Flaw identification and remediationbasic | 3.14 System and Information Integrity | IT-06IT-03OT-05 |
| 3.14.2 Malicious code protectionbasic | 3.14 System and Information Integrity | No mapped practice |
| 3.14.3 Security alert monitoringbasic | 3.14 System and Information Integrity | IT-06 |
| 3.14.4 Malicious code protection updatesderived | 3.14 System and Information Integrity | No mapped practice |
| 3.14.5 Periodic and real-time scanningderived | 3.14 System and Information Integrity | No mapped practice |
| 3.14.6 Attack monitoringderived | 3.14 System and Information Integrity | OT-07IT-02 |
| 3.14.7 Unauthorized use identificationderived | 3.14 System and Information Integrity | OT-07 |
Filtering happens in this browser — nothing you type is sent anywhere. A requirement without a mapped practice is a deliberate editorial decision, not an omission: the campaign’s twenty practices do not cover every requirement, and this site does not manufacture coverage.
| Relationship type | Mappings | Meaning |
|---|---|---|
| Direct implementation support | 10 | The practice's core activity works on the substance of the requirement. Implementing the practice well advances this requirement directly — it still does not, by itself, satisfy it. |
| Partial implementation support | 36 | The practice advances part of the requirement's scope; other parts are untouched by it and need separate work. |
| Operational support | 7 | The practice keeps the capability the requirement depends on running day to day, rather than establishing it. |
| Evidence support | 2 | The practice's normal operation produces records relevant to demonstrating this requirement; it does not implement the requirement itself. |
| Dependency | 3 | The practice is a prerequisite that makes implementing the requirement realistic — absent it, work on the requirement is built on sand. |
| Contextual relationship | 6 | The practice informs or constrains how an organization approaches the requirement without acting on its substance. |
