AC — Access Control
Who and what is allowed to touch the system, and what they're allowed to do once they're in.
Limit system access to authorized users, processes, and devices
Restrict information system access to authorized users, processes acting on behalf of authorized users, and devices — the foundational access-control requirement everything else in the AC family builds on.
For a small contractor: For a small contractor this usually means a maintained user list tied to an identity provider, not shared logins or accounts that outlive an employee's last day.
Evidence that closes the gap:
- ✓Current user/account inventory tied to job role
- ✓Offboarding checklist showing access removal date
- ✓Screenshot of enforced group/role-based access in the identity provider
Limit access to the types of transactions and functions authorized users are permitted to execute
Even an authorized user should only be able to perform the specific transactions and functions their role requires — least privilege applied to what a logged-in user can actually do, not just whether they can log in.
For a small contractor: Role-based permissions in the file share, ERP, or CUI system should map to job function, and admin rights should be a short, documented list.
Evidence that closes the gap:
- ✓Role-permission matrix
- ✓List of accounts with administrative privileges and business justification
- ✓Periodic access review record
Encrypt CUI on mobile devices and mobile computing platforms
CUI stored on laptops, tablets, and phones has to be encrypted, since mobile devices are more likely to be lost, stolen, or accessed outside a controlled facility.
For a small contractor: Full-disk encryption enabled by default on company laptops (BitLocker/FileVault) plus mobile device management for phones is usually sufficient evidence for a small environment.
Evidence that closes the gap:
- ✓MDM policy showing encryption enforced
- ✓Device inventory with encryption status column
- ✓Screenshot of BitLocker/FileVault status on a sample device
AT — Awareness & Training
Making sure people handling CUI actually know the risks and rules, not just IT.
Ensure managers, system administrators, and users are made aware of security risks
Personnel need role-appropriate security awareness training before or as they're given system access, covering the risks tied to their specific role.
For a small contractor: A short annual training with sign-off, tailored slightly for admins vs. general users, is realistic evidence for a small contractor — it doesn't need to be a formal LMS.
Evidence that closes the gap:
- ✓Training sign-off log with dates
- ✓Training content covering CUI handling and phishing
- ✓New-hire training completion record
AU — Audit & Accountability
Logging enough to reconstruct what happened, and actually reviewing those logs.
Create and retain system audit logs and records
The system needs to generate audit logs sufficient to monitor, analyze, investigate, and report unlawful, unauthorized, or inappropriate activity.
For a small contractor: This is the requirement assessors probe hardest on small environments — logging has to actually be enabled and retained somewhere, not just theoretically available.
Evidence that closes the gap:
- ✓Log retention policy with retention period stated
- ✓Screenshot of centralized logging (SIEM or log aggregator)
- ✓Sample log export showing authentication and access events
CM — Configuration Management
Locking systems to a known-good baseline instead of ad-hoc settings.
Establish and maintain baseline configurations and inventories of organizational systems
Maintain a current baseline configuration and a hardware/software/network inventory throughout the system development life cycle.
For a small contractor: A living asset inventory plus a documented hardening baseline (even a checklist based on CIS Benchmarks) is the practical version of this for a small environment.
Evidence that closes the gap:
- ✓Asset inventory spreadsheet or CMDB export
- ✓Baseline configuration standard document
- ✓Change log showing deviations approved from baseline
IA — Identification & Authentication
Proving who a user or device really is before trusting them.
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts
MFA is required for privileged accounts on both local and network access, and for network access to non-privileged accounts — one of the most frequently cited gaps in small-business assessments.
For a small contractor: Enforcing MFA through the identity provider for VPN, email, and admin logins covers most of this for a small company; the gap usually found is local/console admin access left on password-only.
Evidence that closes the gap:
- ✓MFA enforcement policy in the identity provider
- ✓Screenshot of MFA prompt on a privileged account
- ✓List of accounts with MFA status
IR — Incident Response
Having a real capability to detect, contain, and report a security incident — not just a policy PDF.
Establish an operational incident-handling capability
The organization needs an incident-handling capability covering preparation, detection and analysis, containment, recovery, and user response activities — a real capability, not only a written policy.
For a small contractor: For a small contractor this means a short incident response plan with named roles, plus evidence the plan has actually been walked through (a tabletop exercise counts).
Evidence that closes the gap:
- ✓Incident response plan with roles and contact list
- ✓Tabletop exercise record or after-action notes
- ✓Sample incident ticket showing the process followed
MA — Maintenance
Controlling who performs system maintenance and how, especially remotely.
Require multifactor authentication for nonlocal maintenance sessions
Remote maintenance sessions on organizational systems require MFA and termination of session and network connections when nonlocal maintenance is complete.
For a small contractor: This is the control that trips up companies using an MSP for remote support — the remote-access tool itself needs MFA, and sessions need to actually close, not stay open indefinitely.
Evidence that closes the gap:
- ✓MSP remote-access tool configuration showing MFA enabled
- ✓Session log showing connection start/end times
- ✓MSP contract language addressing this requirement
MP — Media Protection
Protecting and properly destroying the physical and digital media CUI lives on.
Sanitize or destroy information system media containing CUI before disposal or reuse
Media has to be sanitized or destroyed before it is disposed of or made available for reuse, so CUI cannot be recovered from decommissioned drives, printers, or copiers.
For a small contractor: The most commonly missed devices are multifunction printers/copiers with internal storage and old drives pulled from replaced workstations — both need a documented sanitization method.
Evidence that closes the gap:
- ✓Media sanitization log with method (clear/purge/destroy) per NIST SP 800-88
- ✓Certificate of destruction from a disposal vendor
- ✓Inventory reconciliation showing sanitized devices removed
Protect the confidentiality of backup CUI at storage locations
Backups containing CUI need the same confidentiality protection as the production data — encryption at rest and access control on the backup storage location.
For a small contractor: This is frequently missed because backups are treated as an IT-only concern; the backup target (cloud or on-prem) needs to be in scope and encrypted, not an afterthought outside the SSP boundary.
Evidence that closes the gap:
- ✓Backup solution configuration showing encryption enabled
- ✓Access control list for backup storage location
- ✓Backup restoration test record
PE — Physical Protection
Keeping unauthorized people away from the hardware and facilities that hold CUI.
Limit physical access to organizational systems, equipment, and operating environments
Physical access to organizational systems, equipment, and the respective operating environments has to be limited to authorized individuals — the foundational Physical Protection requirement the rest of the PE family builds on (visitor escort, access logs, and access-device management).
For a small contractor: For a small office, this usually means a locked server closet or IT room with a defined access list, not open access from the general office floor.
Evidence that closes the gap:
- ✓Access list for the server room/IT closet
- ✓Badge or key log for the restricted area
- ✓Facility diagram showing the physically protected boundary
PS — Personnel Security
Screening people and handling access changes when someone joins, changes roles, or leaves.
Ensure CUI and systems containing CUI are protected during and after personnel actions
Systems containing CUI have to stay protected during and after personnel actions such as terminations and transfers — timely access revocation is the core evidence point. A separate requirement, 3.9.1, covers screening individuals before initial access is granted; the two are companion controls in the same Personnel Security family but cover different moments.
For a small contractor: A documented offboarding checklist with same-day access removal is the concrete evidence assessors look for here. Pair it with a pre-hire screening record to cover 3.9.1 as well.
Evidence that closes the gap:
- ✓Offboarding checklist with access-removal timestamp
- ✓Termination/transfer log cross-referenced against account disable dates
- ✓Role-change checklist showing access adjusted, not just removed at exit
RA — Risk Assessment
Actually looking for vulnerabilities instead of assuming the network is fine.
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities are identified
Vulnerability scanning has to happen on a regular cadence and in response to newly disclosed vulnerabilities, not only once during initial setup.
For a small contractor: A recurring authenticated scan (monthly or quarterly) with a remediation-tracking record is realistic for a small environment; a one-time scan from years ago will not satisfy this.
Evidence that closes the gap:
- ✓Vulnerability scan report with date
- ✓Remediation tracker showing findings closed
- ✓Scanning tool subscription/configuration record
SC — System & Communications Protection
Boundary protection, encryption, and network architecture decisions.
Monitor, control, and protect communications at external and key internal boundaries
Boundary protection controls — firewalls, network segmentation, and monitoring — are required at the external boundary and at key internal boundaries of the system.
For a small contractor: For a small enclave this typically means a firewall with logging enabled and, when a CUI-handling segment exists, VLAN or subnet separation from the general office network.
Evidence that closes the gap:
- ✓Network diagram showing boundary and segmentation
- ✓Firewall rule set and logging configuration
- ✓IDS/IPS or monitoring tool configuration
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI
When cryptography is used to protect CUI confidentiality, it must be FIPS-validated — not just 'encrypted,' but encrypted using a validated cryptographic module.
For a small contractor: This is a common evidence gap: many disk-encryption and TLS configurations are on by default but not confirmed to be running in a FIPS-validated mode. Vendor documentation or a FIPS 140 validation certificate closes the gap.
Evidence that closes the gap:
- ✓Vendor FIPS 140 validation certificate or statement
- ✓Configuration screenshot showing FIPS mode enabled
- ✓Cloud service provider's published FIPS-validation documentation
Protect the confidentiality of CUI at rest
CUI stored on organizational systems — servers, databases, file shares — needs confidentiality protection at rest, in addition to protection in transit.
For a small contractor: Encrypting the storage volume or database, combined with access controls, is the usual approach; the evidence gap is often CUI copied into an unencrypted shared drive outside the assessed boundary.
Evidence that closes the gap:
- ✓Storage encryption configuration for CUI repositories
- ✓Data flow diagram showing where CUI is stored at rest
- ✓Access control list for the storage location
SI — System & Information Integrity
Patching, malware defense, and monitoring for signs something is already wrong.
Identify, report, and correct system flaws in a timely manner
Flaw remediation — patching operating systems, applications, and firmware — has to happen on a timely, tracked basis, not on an ad-hoc or 'when someone remembers' schedule.
For a small contractor: A documented patch cadence (e.g., critical patches within a stated number of days) with a tracking record is what turns this from a policy statement into evidence.
Evidence that closes the gap:
- ✓Patch management policy with SLA by severity
- ✓Patch compliance report or dashboard export
- ✓Ticket showing a specific vulnerability patched and closed
Provide protection from malicious code at designated locations
Malicious code protection mechanisms have to be deployed at appropriate locations (endpoints, email gateways, etc.) and kept current.
For a small contractor: Managed endpoint protection with centralized reporting, rather than default OS antivirus with no visibility, is the difference assessors usually flag.
Evidence that closes the gap:
- ✓Endpoint protection deployment coverage report
- ✓Definition/engine update configuration
- ✓Alert/incident log from the malware protection tool
Monitor organizational systems to detect attacks and indicators of potential attacks
Systems need ongoing monitoring for attacks and indicators of compromise, including inbound and outbound communications traffic.
For a small contractor: A managed detection and response (MDR) service or centralized log monitoring is the realistic path for most small contractors, rather than building an in-house SOC.
Evidence that closes the gap:
- ✓MDR/monitoring service contract and coverage scope
- ✓Alert triage log or sample alert investigation
- ✓Monitoring tool dashboard export
Official source
Every requirement above is a plain-English restatement. Read the exact requirement text and assessment objectives before treating any single item as complete.