{"text_format":"1","workbook":"xlsx","n_sheets":2,"sheets":["Dashboard_Instructions","Assessment"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":1,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Dashboard_Instructions","index":0,"n_rows":34,"n_cols":11,"rows_kept":34,"cut":false,"hidden":false,"merged":[[25,0,26,5],[17,0,17,5],[18,0,19,5],[20,0,20,5],[21,1,23,4],[0,6,1,9],[2,6,4,9],[5,6,6,6],[5,7,6,7],[5,8,6,8],[5,9,6,9],[7,8,8,8],[7,9,8,9],[9,6,10,6],[9,7,10,7],[9,8,10,8],[9,9,10,9],[7,6,8,6],[7,7,8,7],[11,6,12,6],[11,7,12,7],[11,8,12,8],[11,9,12,9],[13,6,14,6],[13,7,14,7],[13,8,14,8],[13,9,14,9],[15,6,16,6],[15,7,16,7],[15,8,16,8],[15,9,16,9],[17,6,18,6],[17,7,18,7],[17,8,18,8],[17,9,18,9],[19,9,20,9],[21,6,22,6],[21,7,22,7],[21,8,22,8],[21,9,22,9],[33,6,34,6],[33,7,34,7],[33,8,34,8],[33,9,34,9],[27,6,28,6],[27,7,28,7],[27,8,28,8],[27,9,28,9],[29,6,30,6],[29,7,30,7],[29,8,30,8],[29,9,30,9],[0,10,1,22],[31,6,32,6],[31,7,32,7],[31,8,32,8],[31,9,32,9],[23,6,24,6],[23,7,24,7],[23,8,24,8],[23,9,24,9],[25,6,26,6],[25,7,26,7],[25,8,26,8],[25,9,26,9],[19,6,20,6],[19,7,20,7],[19,8,20,8]]}
[null,null,null,null,null,null,"SCORE",null,null,null,"Powered By:"]
[]
[null,null,null,null,null,null,{"$f":"Assessment!C433","v":-202}]
[]
[]
[null,null,null,null,null,null,"Family","Controls","Met","Percent"]
[]
[null,null,null,null,null,null,"AC",22,{"$f":"COUNTIFS(Assessment!G:G,\"AC\",Assessment!C:C, \">0\")","v":0},{"$f":"I8/H8","v":0}]
[]
[null,null,null,null,null,null,"AT",3,{"$f":"COUNTIFS(Assessment!G:G,\"AT\",Assessment!C:C, \">0\")","v":0},{"$f":"I10/H10","v":0}]
[]
[null,null,null,null,null,null,"AU",9,{"$f":"COUNTIFS(Assessment!G:G,\"AU\",Assessment!C:C, \">0\")","v":0},{"$f":"I12/H12","v":0}]
[]
[null,null,null,null,null,null,"CM",9,{"$f":"COUNTIFS(Assessment!G:G,\"CM\",Assessment!C:C, \">0\")","v":0},{"$f":"I14/H14","v":0}]
[]
[null,null,null,null,null,null,"IA",11,{"$f":"COUNTIFS(Assessment!G:G,\"IA\",Assessment!C:C, \">0\")","v":0},{"$f":"I16/H16","v":0}]
[]
["Warning",null,null,null,null,null,"IR",3,{"$f":"COUNTIFS(Assessment!G:G,\"IR\",Assessment!C:C, \">0\")","v":0},{"$f":"I18/H18","v":0}]
["3.12.4 is a required control. Calculated score is not valid till this control is fully in place. "]
[null,null,null,null,null,null,"MA",6,{"$f":"COUNTIFS(Assessment!G:G,\"MA\",Assessment!C:C, \">0\")","v":0},{"$f":"I20/H20","v":0}]
["Status"]
[null,{"$f":"IF(Assessment!F340=\"Not Met\", \"Score Not Valid\", \"Looking Good!\")","v":"Score Not Valid"},null,null,null,null,"MP",9,{"$f":"COUNTIFS(Assessment!G:G,\"MP\",Assessment!C:C, \">0\")","v":0},{"$f":"I22/H22","v":0}]
[]
[null,null,null,null,null,null,"PS",2,{"$f":"COUNTIFS(Assessment!G:G,\"PS\",Assessment!C:C, \">0\")","v":0},{"$f":"I24/H24","v":0}]
[]
["NOTE: If you want to add a new line of text in a current cell press ALT+Enter",null,null,null,null,null,"PE",6,{"$f":"COUNTIFS(Assessment!G:G,\"PE\",Assessment!C:C, \">0\")","v":0},{"$f":"I26/H26","v":0}]
[]
[null,null,null,null,null,null,"RA",3,{"$f":"COUNTIFS(Assessment!G:G,\"RA\",Assessment!C:C, \">0\")","v":0},{"$f":"I28/H28","v":0}]
[]
[null,null,null,null,null,null,"CA",4,{"$f":"COUNTIFS(Assessment!G:G,\"CA\",Assessment!C:C, \">0\")","v":1},{"$f":"I30/H30","v":0.25}]
[]
[null,null,null,null,null,null,"SC",16,{"$f":"COUNTIFS(Assessment!G:G,\"SC\",Assessment!C:C, \">0\")","v":1},{"$f":"I32/H32","v":6.25E-2}]
[]
[null,null,null,null,null,null,"SI",7,{"$f":"COUNTIFS(Assessment!G:G,\"SI\",Assessment!C:C, \">0\")","v":0},{"$f":"I34/H34","v":0}]

{"sheet":"Assessment","index":1,"n_rows":441,"n_cols":17,"rows_kept":441,"cut":false,"hidden":false,"merged":[[333,12,335,12],[333,13,335,13],[339,12,346,12],[339,13,346,13],[348,12,349,12],[350,12,355,12],[350,13,355,13],[357,12,362,12],[357,13,362,13],[318,13,319,13],[322,12,325,12],[321,13,325,13],[327,12,328,12],[327,13,328,13],[330,12,331,12],[330,13,331,13],[297,12,299,12],[296,13,299,13],[301,13,304,13],[301,12,304,12],[306,12,307,12],[306,13,307,13],[312,12,313,12],[315,13,316,13],[311,13,313,13],[266,12,267,12],[268,12,269,12],[266,13,269,13],[273,12,274,12],[273,13,274,13],[276,12,277,12],[276,13,277,13],[279,13,280,13],[293,12,294,12],[292,13,294,13],[18,14,20,14],[22,14,25,14],[27,14,28,14],[2,14,7,14],[9,14,10,14],[12,14,16,14],[2,12,4,12],[5,12,7,12],[2,13,7,13],[9,13,10,13],[12,13,16,13],[12,12,13,12],[18,13,20,13],[19,12,20,12],[22,13,25,13],[27,13,28,13],[59,12,60,12],[61,12,62,12],[64,13,65,13],[67,12,68,12],[67,13,68,13],[41,14,43,14],[45,14,46,14],[48,14,51,14],[30,14,33,14],[35,14,36,14],[38,14,39,14],[30,13,33,13],[30,12,31,12],[32,12,33,12],[35,13,36,13],[38,13,39,13],[41,13,43,13],[42,12,43,12],[45,13,46,13],[48,12,49,12],[50,12,51,12],[48,13,51,13],[64,14,65,14],[67,14,68,14],[70,14,72,14],[53,14,54,14],[56,14,57,14],[59,14,62,14],[70,13,72,13],[53,13,54,13],[56,13,57,13],[59,13,62,13],[88,14,92,14],[94,14,97,14],[99,14,101,14],[74,14,75,14],[77,14,82,14],[84,14,86,14],[74,13,75,13],[77,13,82,13],[77,12,78,12],[79,12,80,12],[81,12,82,12],[84,12,85,12],[84,13,86,13],[88,12,89,12],[90,12,92,12],[88,13,92,13],[94,12,95,12],[96,12,97,12],[94,13,97,13],[100,12,101,12],[99,13,101,13],[116,14,118,14],[120,14,122,14],[124,14,125,14],[103,14,104,14],[106,14,111,14],[113,14,114,14],[120,12,121,12],[120,13,122,13],[124,13,125,13],[103,13,104,13],[106,12,107,12],[108,12,109,12],[106,13,111,13],[113,13,114,13],[116,13,118,13],[141,14,142,14],[144,14,149,14],[151,14,152,14],[127,14,128,14],[130,14,132,14],[134,14,139,14],[127,12,128,12],[127,13,128,13],[130,13,132,13],[134,13,139,13],[134,12,139,12],[141,13,142,13],[145,12,146,12],[148,12,149,12],[144,13,149,13],[151,13,152,13],[173,14,187,14],[189,14,191,14],[193,14,195,14],[154,14,157,14],[161,14,168,14],[170,14,171,14],[154,12,157,12],[154,13,157,13],[161,12,162,12],[165,12,166,12],[167,12,168,12],[161,13,168,13],[170,13,171,13],[173,12,174,12],[176,12,177,12],[179,12,180,12],[182,12,183,12],[185,12,186,12],[173,13,187,13],[189,13,191,13],[189,12,190,12],[193,13,195,13],[212,14,213,14],[215,14,216,14],[218,14,221,14],[197,14,199,14],[201,14,203,14],[205,14,208,14],[206,12,208,12],[205,13,208,13],[212,13,213,13],[215,13,216,13],[218,12,219,12],[220,12,221,12],[218,13,221,13],[197,13,199,13],[198,12,199,12],[201,12,203,12],[201,13,203,13],[241,14,246,14],[252,14,255,14],[261,14,262,14],[223,14,224,14],[228,14,229,14],[233,14,239,14],[223,13,224,13],[228,12,229,12],[228,13,229,13],[233,12,239,12],[233,13,239,13],[241,12,246,12],[241,13,246,13],[252,12,254,12],[252,13,255,13],[261,13,262,13],[301,14,304,14],[306,14,307,14],[311,14,313,14],[315,14,316,14],[318,14,319,14],[321,14,325,14],[266,14,269,14],[273,14,274,14],[276,14,277,14],[279,14,280,14],[292,14,294,14],[296,14,299,14],[364,14,366,14],[370,14,371,14],[373,14,374,14],[378,14,380,14],[382,14,384,14],[386,14,387,14],[327,14,328,14],[330,14,331,14],[333,14,335,14],[339,14,346,14],[348,14,355,14],[357,14,362,14],[421,14,423,14],[425,14,427,14],[429,14,430,14],[391,14,393,14],[395,14,396,14],[398,14,399,14],[405,14,410,14],[412,14,413,14],[415,14,417,14],[364,12,365,12],[364,13,366,13],[370,13,371,13],[373,12,374,12],[373,13,374,13],[378,12,379,12],[378,13,380,13],[383,12,384,12],[382,13,384,13],[416,12,417,12],[415,13,417,13],[421,13,423,13],[422,12,423,12],[425,12,427,12],[425,13,427,13],[429,13,430,13],[386,12,387,12],[386,13,387,13],[391,13,393,13],[395,12,396,12],[395,13,396,13],[398,12,399,12],[398,13,399,13],[405,13,410,13],[412,13,413,13]]}
["GROUP","Point Value","Point Calculator","Check 1","Check 2","Status","DOMAIN","LEVEL","OBJECTIVE","SECURITY REQUIREMENT","EVIDENCE TYPE","Assessment Methodology","EVIDENCE EXAMPLES","MICROSOFT SERVICES","Evidence Provided","Finding Details","Missing Items"]
[1,5,{"$f":"IF(OR(F2=\"Met\", F2=\"NA\"),5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F3:F8))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F3:F8))","v":0},{"$f":"IF(D2+E2=6, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L1","3.1.1","Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)."]
[1,null,null,null,null,null,"AC","L1","3.1.1[a]","Authorized users are identified.","Document",null,"HR document of current staff.\nPolicy and Procedures.\nRequest approval documentation or ticket.\nDocument including device request.","Active Directory\nMicrosoft Entra\nAzure SSO\nIntune"]
[1,null,null,null,null,null,"AC","L1","3.1.1[b]","Processes acting on behalf of authorized users are identified.","Document"]
[1,null,null,null,null,null,"AC","L1","3.1.1[c]","Devices (and other systems) authorized to connect to the system are identified.","Document"]
[1,null,null,null,null,null,"AC","L1","3.1.1[d]","System access is limited to authorized users.","Screen Share",null,"Active Directory List of Users\nMDM Solution\nSystem or Service Accounts"]
[1,null,null,null,null,null,"AC","L1","3.1.1[e]","System access is limited to processes acting on behalf of authorized users.","Screen Share"]
[1,null,null,null,null,null,"AC","L1","3.1.1[f]","System access is limited to authorized devices (including other systems).","Screen Share"]
[1,5,{"$f":"IF(OR(F9=\"Met\",F9=\"NA\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F10:F11))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F10:F11))","v":0},{"$f":"IF(D9+E9=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L1","3.1.2","Limit system access to the types of transactions and functions that authorized users are permitted to execute."]
[1,null,null,null,null,null,"AC","L1","3.1.2[a]","The types of transactions and functions that authorized users are permitted to execute are defined.","Document",null,"Roles and Responsibilities Matrix\nPolicy ","Active Directory\nMicrosoft Entra"]
[1,null,null,null,null,null,"AC","L1","3.1.2[b]","System access is limited to the defined types of transactions and functions for authorized users.","Screen Share",null,"RBAC settings\nPIM/JIT settings"]
[1,1,{"$f":"IF(OR(F12=\"Met\", F12=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F13:F17))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F13:F17))","v":0},{"$f":"IF(D12+E12=5, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.3","Control the flow of CUI in accordance with approved authorizations."]
[1,null,null,null,null,null,"AC","L2","3.1.3[a]","Information flow control policies are defined.","Document",null,"SSP\nPolicy \nDataflow Diagram","Azure Information Protection"]
[1,null,null,null,null,null,"AC","L2","3.1.3[b]","Methods and enforcement mechanisms for controlling the flow of CUI are defined.","Document"]
[1,null,null,null,null,null,"AC","L2","3.1.3[c]","Designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified.","Artifact",null,"Dataflow Diagram\nList of VLANs and Subnets where CUI is authorized\nAzure Information Protection (AIP) Label Settings\nDLP Settings"]
[1,null,null,null,null,null,"AC","L2","3.1.3[d]","Authorizations for controlling the flow of CUI are defined.","Document",null,"Policy\nDataflow Diagram"]
[1,null,null,null,null,null,"AC","L2","3.1.3[e]","Approved authorizations for controlling the flow of CUI are enforced.","Screen Share",null,"DLP Settings\nAIP Settings\nFirewall Rules"]
[1,1,{"$f":"IF(OR(F18=\"Met\", F18=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F19:F21))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F19:F21))","v":0},{"$f":"IF(D18+E18=3, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.4","Separate the duties of individuals to reduce the risk of malevolent activity without collusion."]
[1,null,null,null,null,null,"AC","L2","3.1.4[a]","The duties of individuals requiring separation are defined.","Document",null,"Roles and Responsibilities Matrix\nPolicy ","Active Directory\nMicrosoft Entra"]
[1,null,null,null,null,null,"AC","L2","3.1.4[b]","Responsibilities for duties that require separation are assigned to separate individuals.","Screen Share",null,"PIM/JIT Settings\nAD Role settings\nScreenshot examples such as network admins not being able to access security logs in the SIEM. "]
[1,null,null,null,null,null,"AC","L2","3.1.4[c]","Access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.","Screen Share"]
[1,3,{"$f":"IF(OR(F22=\"Met\", F22=\"NA\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F23:F26))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F23:F26))","v":0},{"$f":"IF(D22+E22=4, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.5","Employ the principle of least privilege, including for specific security functions and privileged accounts."]
[1,null,null,null,null,null,"AC","L2","3.1.5[a]","Privileged accounts are identified.","Document",null,"Roles and Responsibilities Matrix","Active Directory\nMicrosoft Entra"]
[1,null,null,null,null,null,"AC","L2","3.1.5[b]","Access to privileged accounts is authorized in accordance with the principle of least privilege.","Artifact",null,"AD Role settings\nPIM/JIT settings"]
[1,null,null,null,null,null,"AC","L2","3.1.5[c]","Security functions are identified.","Document",null,"Roles and Responsibilities Matrix\nPolicy"]
[1,null,null,null,null,null,"AC","L2","3.1.5[d]","Access to security functions is authorized in accordance with the principle of least privilege.","Artifact",null,"AD Role settings\nPIM/JIT settings\nScreenshot of standard account attempting to access administrator privilege and prompted for admin credentials"]
[1,1,{"$f":"IF(OR(F27=\"Met\", F27=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F28:F29))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F28:F29))","v":0},{"$f":"IF(D27+E27=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.6","Use non-privileged accounts or roles when accessing non-security functions."]
[1,null,null,null,null,null,"AC","L2","3.1.6[a]","Nonsecurity functions are identified.","Document",null,"Roles and Responsibilities Matrix\nPolicy (AUP and AC) ","Active Directory\nMicrosoft Entra"]
[1,null,null,null,null,null,"AC","L2","3.1.6[b]","Users are required to use non-privileged accounts or roles when accessing nonsecurity functions.","Screen Share",null,"AD Standard Role Settings\nAD List showing admins also have standard user roles"]
[1,1,{"$f":"IF(OR(F30=\"Met\", F30=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F31:F34))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F31:F34))","v":0},{"$f":"IF(D30+E30=4, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.7","Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs."]
[1,null,null,null,null,null,"AC","L2","3.1.7[a]","Privileged functions are defined.","Document",null,"Roles and Responsibilities Matrix\nPolicy ","Active Directory\nMicrosoft Entra\nSentinel"]
[1,null,null,null,null,null,"AC","L2","3.1.7[b]","Non-privileged users are defined.","Document"]
[1,null,null,null,null,null,"AC","L2","3.1.7[c]","Non-privileged users are prevented from executing privileged functions.","Screen Share",null,"\nAD Role settings\nSentinel Log of privilege function execution"]
[1,null,null,null,null,null,"AC","L2","3.1.7[d]","The execution of privileged functions is captured in audit logs.","Screen Share"]
[1,1,{"$f":"IF(OR(F35=\"Met\", F35=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F36:F37))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F36:F37))","v":0},{"$f":"IF(D35+E35=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.8","Limit unsuccessful logon attempts."]
[1,null,null,null,null,null,"AC","L2","3.1.8[a]","The means of limiting unsuccessful logon attempts is defined.","Document",null,"Roles and Responsibilities Matrix\nPolicy ","Active Directory\nMicrosoft Entra\nGroup Policy Manager"]
[1,null,null,null,null,null,"AC","L2","3.1.8[b]","The defined means of limiting unsuccessful logon attempts is implemented.","Artifact",null,"GPO unsuccessful log on settings"]
[1,1,{"$f":"IF(OR(F38=\"Met\", F38=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F39:F40))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F39:F40))","v":0},{"$f":"IF(D38+E38=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.9","Provide privacy and security notices consistent with applicable CUI rules."]
[1,null,null,null,null,null,"AC","L2","3.1.9[a]","Privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category.","Document","Examination","Policy ","Active Directory\nMicrosoft Entra\nGroup Policy Manager"]
[1,null,null,null,null,null,"AC","L2","3.1.9[b]","Privacy and security notices are displayed.","Artifact","Interview/Test","GPO unsuccessful log on settings\nScreenshot of privacy and security notice"]
[1,1,{"$f":"IF(OR(F41=\"Met\", F41=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F42:F44))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F42:F44))","v":0},{"$f":"IF(D41+E41=3, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.10","Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity."]
[1,null,null,null,null,null,"AC","L2","3.1.10[a]","The period of inactivity after which the system initiates a session lock is defined.","Document",null,"Policy","Active Directory\nMicrosoft Entra\nGroup Policy Manager"]
[1,null,null,null,null,null,"AC","L2","3.1.10[b]","Access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity.","Artifact",null,"GPO inactivity session lock setting"]
[1,null,null,null,null,null,"AC","L2","3.1.10[c]","Previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.","Artifact"]
[1,1,{"$f":"IF(OR(F45=\"Met\", F45=\"NA\"), 1, -1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F46:F47))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F46:F47))","v":0},{"$f":"IF(D45+E45=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.11","Terminate (automatically) a user session after a defined condition."]
[1,null,null,null,null,null,"AC","L2","3.1.11[a]","Conditions requiring a user session to terminate are defined.","Document",null,"Policy (AUP and AC) and Procedures","Active Directory\nMicrosoft Entra\nGroup Policy Manager"]
[1,null,null,null,null,null,"AC","L2","3.1.11[b]","A user session is automatically terminated after any of the defined conditions occur.","Screen Share",null,"GPO inactivity session termination setting"]
[1,5,{"$f":"IF(OR(F48=\"Met\", F48=\"NA\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F49:F52))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F49:F52))","v":0},{"$f":"IF(D48+E48=4, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.12","Monitor and control remote access sessions."]
[1,null,null,null,null,null,"AC","L2","3.1.12[a]","Remote access sessions are permitted.","Document",null,"Policy and Procedures","Active Directory\nMicrosoft Entra\nSentinel"]
[1,null,null,null,null,null,"AC","L2","3.1.12[b]","The types of permitted remote access are identified.","Document"]
[1,null,null,null,null,null,"AC","L2","3.1.12[c]","Remote access sessions are controlled.","Screen Share",null,"Conditional Access Control settings related to how users access the information system. \nFirewall log settings.\nLog capture example in SIEM of remote access. "]
[1,null,null,null,null,null,"AC","L2","3.1.12[d]","Remote access sessions are monitored.","Screen Share"]
[1,5,{"$f":"IF(OR(F53=\"Met\", F53=\"NA\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F54:F55))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F54:F55))","v":0},{"$f":"IF(D53+E53=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.13","Employ cryptographic mechanisms to protect the confidentiality of remote access sessions."]
[1,null,null,null,null,null,"AC","L2","3.1.13[a]","Cryptographic mechanisms to protect the confidentiality of remote access sessions are identified.","Document",null,"Policy and Procedures","Inherited"]
[1,null,null,null,null,null,"AC","L2","3.1.13[b]","Cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.","Screen Share",null,"If enclave this is inherited from Microsoft and AvePoint. \nFirewall in FIPS mode configuration settings."]
[1,1,{"$f":"IF(OR(F56=\"Met\", F56=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F57:F58))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F57:F58))","v":0},{"$f":"IF(D56+E56=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.14","Route remote access via managed access control points."]
[1,null,null,null,null,null,"AC","L2","3.1.14[a]","Managed access control points are identified and implemented.","Screen Share",null,"Policy and Procedures\nFirewall VPN Settings if traditional on premises in use. ","Active Directory\nMicrosoft Entra\nGroup Policy Manager"]
[1,null,null,null,null,null,"AC","L2","3.1.14[b]","Remote access is routed through managed network access control points.","Screen Share",null,"If enclave look at conditional access policies denying users access to the information system without first going through AVD Hosts. \nFirewall VPN Settings if traditional on premises in use. "]
[1,1,{"$f":"IF(OR(F59=\"Met\", F59=\"NA\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F60:F63))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F60:F63))","v":0},{"$f":"IF(D59+E59=4, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.15","Authorize remote execution of privileged commands and remote access to security-relevant information."]
[1,null,null,null,null,null,"AC","L2","3.1.15[a]","Privileged commands authorized for remote execution are identified.","Document",null,"Policy and Procedures\nRoles and Responsibility Matrix","Active Directory\nMicrosoft Entra\nSentinel"]
[1,null,null,null,null,null,"AC","L2","3.1.15[b]","Security-relevant information authorized to be accessed remotely is identified.","Document"]
[1,null,null,null,null,null,"AC","L2","3.1.15[c]","The execution of the identified privileged commands via remote access is authorized.","Artifact",null,"If enclave all execution of privileged commands is authorized based on policy and procedures. \nRBAC and AD Roles assigned.\nSentinel logs of privileged commands if requested. "]
[1,null,null,null,null,null,"AC","L2","3.1.15[d]","Access to the identified security-relevant information via remote access is authorized.","Artifact"]
[1,5,{"$f":"IF(OR(F64=\"Met\", F64=\"NA\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F65:F66))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F65:F66))","v":0},{"$f":"IF(D64+E64=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.16","Authorize wireless access prior to allowing such connections."]
[1,null,null,null,null,null,"AC","L2","3.1.16[a]","Wireless access points are identified.","Document",null,"SSP\nNetwork and/or Dataflow Diagrams","Potentially Active Directory if WPA2 Enterprise in use for on premises infrastructure"]
[1,null,null,null,null,null,"AC","L2","3.1.16[b]","Wireless access is authorized prior to allowing such connections.","Screen Share",null,"Wireless access point configuration settings for password if traditional on premises infrastructure in place."]
[1,5,{"$f":"IF(OR(F67=\"NA\", F67=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F68:F69))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F68:F69))","v":0},{"$f":"IF(D67+E67=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.17","Protect wireless access using authentication and encryption."]
[1,null,null,null,null,null,"AC","L2","3.1.17[a]","Wireless access to the system is protected using authentication.","Screen Share",null,"Not applicable for enclave builds. \nWireless access point configuration settings for password and encryption. ","NA"]
[1,null,null,null,null,null,"AC","L2","3.1.17[b]","Wireless access to the system is protected using encryption.","Screen Share"]
[1,5,{"$f":"IF(OR(F70=\"NA\",F70=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F71:F73))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F71:F73))","v":0},{"$f":"IF(D70+E70=3, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.18","Control connection of mobile devices."]
[1,null,null,null,null,null,"AC","L2","3.1.18[a]","Mobile devices that process, store, or transmit CUI are identified.","Document",null,"Not applicable for enclave builds. \nMobile device inventory.\nPolicy and Procedures.","Intune\nSentinel"]
[1,null,null,null,null,null,"AC","L2","3.1.18[b]","Mobile device connections are authorized.","Artifact",null,"Policy (AC and AUM) and Procedures. \nMDM showing authorized device list. "]
[1,null,null,null,null,null,"AC","L2","3.1.18[c]","Mobile device connections are monitored and logged.","Screen Share",null,"Screenshot of logs in SIEM or in MDM solution with procedure of review. "]
[1,3,{"$f":"IF(OR(F74=\"NA\", F74=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F75:F76))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F75:F76))","v":0},{"$f":"IF(D74+E74=2, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.19","Encrypt CUI on mobile devices and mobile computing platforms."]
[1,null,null,null,null,null,"AC","L2","3.1.19[a]","Mobile devices and mobile computing platforms that process, store, or transmit CUI are identified.","Document",null,"Not applicable for enclave builds. \nMobile and Laptop device inventory.\nPolicy and Procedures.","Intune"]
[1,null,null,null,null,null,"AC","L2","3.1.19[b]","Encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.","Screen Share",null,"MDM configuration policy on enforcing encryption"]
[1,1,{"$f":"IF(OR(F77=\"NA\",F77=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F78:F83))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F78:F83))","v":0},{"$f":"IF(D77+E77=6, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L1","3.1.20","Verify and control/limit connections to and use of external systems."]
[1,null,null,null,null,null,"AC","L1","3.1.20[a]","Connections to external systems are identified.","Document",null,"SSP\nNetwork and/or Dataflow Diagrams","NA"]
[1,null,null,null,null,null,"AC","L1","3.1.20[b]","The use of external systems is identified.","Document"]
[1,null,null,null,null,null,"AC","L1","3.1.20[c]","Connections to external systems are verified.","Artifact",null,"External systems agreements\nValidadation of FedRAMP moderate or equivalency (If Final Rule Passed). \nFirewall rule settings\nFirewall Baseline Configurations"]
[1,null,null,null,null,null,"AC","L1","3.1.20[d]","The use of external systems is verified.","Artifact"]
[1,null,null,null,null,null,"AC","L1","3.1.20[e]","Connections to external systems are controlled/limited.","Screen Share",null,"Change Control Procedure for adding new external systems. "]
[1,null,null,null,null,null,"AC","L1","3.1.20[f]","The use of external systems is controlled/limited.","Screen Share"]
[1,1,{"$f":"IF(OR(F84=\"NA\", F84=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F85:F87))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F85:F87))","v":0},{"$f":"IF(D84+E84=3, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L2","3.1.21","Limit use of portable storage devices on external systems."]
[1,null,null,null,null,null,"AC","L2","3.1.21[a]","The use of portable storage devices containing CUI on external systems is identified and documented.","Document",null,"Policy (AC and AUM) and Procedures. ","Active Directory\nMicrosoft Entra\nIntune\nGroup Policy Manager"]
[1,null,null,null,null,null,"AC","L2","3.1.21[b]","Limits on the use of portable storage devices containing CUI on external systems are defined.","Document"]
[1,null,null,null,null,null,"AC","L2","3.1.21[c]","The use of portable storage devices containing CUI on external systems is limited as defined.","Screen Share",null,"Enclave review the AVD GPO showing portable storage redirection is toggled off. \nFor traditional check either GPO or Intune settings  match with policy and procedures."]
[1,1,{"$f":"IF(OR(F88=\"NA\", F88=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F89:F93))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F89:F93))","v":0},{"$f":"IF(D88+E88=5, \"Met\", \"Not Met\")","v":"Not Met"},"AC","L1","3.1.22","Control CUI posted or processed on publicly accessible systems."]
[1,null,null,null,null,null,"AC","L1","3.1.22[a]","Individuals authorized to post or process information on publicly accessible systems are identified.","Document",null,"Policy (AC and AUM) and Procedures","NA"]
[1,null,null,null,null,null,"AC","L1","3.1.22[b]","Procedures to ensure CUI is not posted or processed on publicly accessible systems are identified.","Document"]
[1,null,null,null,null,null,"AC","L1","3.1.22[c]","A review process is in place prior to posting of any content to publicly accessible systems.","Artifact",null,"Access Control Procedure (Or Public Posting) \nDocumented proof of review process being practiced. \nIncident Response Procedure"]
[1,null,null,null,null,null,"AC","L1","3.1.22[d]","Content on publicly accessible systems is reviewed to ensure that it does not include CUI.","Artifact"]
[1,null,null,null,null,null,"AC","L1","3.1.22[e]","Mechanisms are in place to remove and address improper posting of CUI.","Artifact"]
[2,5,{"$f":"IF(OR(F94=\"NA\", F94=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F95:F98))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F95:F98))","v":0},{"$f":"IF(D94+E94=4, \"Met\", \"Not Met\")","v":"Not Met"},"AT","L2","3.2.1","Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems."]
[2,null,null,null,null,null,"AT","L2","3.2.1[a]","Security risks associated with organizational activities involving CUI are identified.","Document",null,"AT/AUM Policy and Procedures\nLearning Management Solution or manual training based on CDSE as an example. ","NA"]
[2,null,null,null,null,null,"AT","L2","3.2.1[b]","Policies, standards, and procedures related to the security of the system are identified.","Document"]
[2,null,null,null,null,null,"AT","L2","3.2.1[c]","Managers, systems administrators, and users of the system are made aware of the security risks associated with their activities.","Artifact",null,"Training Records\nAUM sign off documentation"]
[2,null,null,null,null,null,"AT","L2","3.2.1[d]","Managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.","Artifact"]
[2,5,{"$f":"IF(OR(F99=\"NA\", F99=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F100:F102))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F100:F102))","v":0},{"$f":"IF(D99+E99=3, \"Met\", \"Not Met\")","v":"Not Met"},"AT","L2","3.2.2","Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities."]
[2,null,null,null,null,null,"AT","L2","3.2.2[a]","Information security-related duties, roles, and responsibilities are defined.","Document",null,"AT Policy and Procedures\nJob Description ","Active Directory\nMicrosoft Entra"]
[2,null,null,null,null,null,"AT","L2","3.2.2[b]","Information security-related duties, roles, and responsibilities are assigned to designated personnel.","Artifact",null,"AD settings for admin users and assigned roles\nCertifications\nTraining records on technologies in use"]
[2,null,null,null,null,null,"AT","L2","3.2.2[c]","Personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities.","Artifact"]
[2,1,{"$f":"IF(OR(F103=\"NA\", F103=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F104:F105))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F104:F105))","v":0},{"$f":"IF(D103+E103=2, \"Met\", \"Not Met\")","v":"Not Met"},"AT","L2","3.2.3","Provide security awareness training on recognizing and reporting potential indicators of insider threat."]
[2,null,null,null,null,null,"AT","L2","3.2.3[a]","Potential indicators associated with insider threats are identified.","Document",null,"AT/AUM Policy and Procedures\nLearning Management Solution or manual training based on CDSE as an example. ","NA"]
[2,null,null,null,null,null,"AT","L2","3.2.3[b]","Security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.","Artifact",null,"Training Records\nAUM sign off documentation"]
[1,5,{"$f":"IF(OR(F106=\"NA\", F106=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F107:F112))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F107:F112))","v":0},{"$f":"IF(D106+E106=6, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.1","Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity."]
[1,null,null,null,null,null,"AU","L2","3.3.1[a]","Audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified.","Document",null,"AU Policy and Procedures (Content of audit logs specified)","Sentinel"]
[1,null,null,null,null,null,"AU","L2","3.3.1[b]","The content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined.","Document"]
[1,null,null,null,null,null,"AU","L2","3.3.1[c]","Audit records are created (generated).","Screen Share",null,"Screenshot of logs in SIEM and if they match policy and/or procedures. "]
[1,null,null,null,null,null,"AU","L2","3.3.1[d]","Audit records, once created, contain the defined content.","Screen Share"]
[1,null,null,null,null,null,"AU","L2","3.3.1[e]","Retention requirements for audit records are defined.","Document",null,"AU Policy and Procedures"]
[1,null,null,null,null,null,"AU","L2","3.3.1[f]","Audit records are retained as defined.","Screen Share",null,"Screenshot of logs and retention settings in SIEM to validate they match policy and/or procedures. "]
[1,3,{"$f":"IF(OR(F113=\"NA\", F113=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F114:F115))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F114:F115))","v":0},{"$f":"IF(D113+E113=2, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.2","Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions."]
[1,null,null,null,null,null,"AU","L2","3.3.2[a]","The content of the audit records needed to support the ability to uniquely trace users to their actions is defined.","Document",null,"AU Policy and Procedures","Sentinel"]
[1,null,null,null,null,null,"AU","L2","3.3.2[b]","Audit records, once created, contain the defined content.","Screen Share",null,"Screenshot of logs in SIEM and if they match policy and/or procedures. "]
[1,1,{"$f":"IF(OR(F116=\"NA\", F116=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F117:F119))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F117:F119))","v":0},{"$f":"IF(D116+E116=3, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.3","Review and update logged events."]
[1,null,null,null,null,null,"AU","L2","3.3.3[a]","A process for determining when to review logged events is defined.","Document",null,"AU Policy and Procedures","Sentinel"]
[1,null,null,null,null,null,"AU","L2","3.3.3[b]","Event types being logged are reviewed in accordance with the defined review process.","Artifact",null,"Screenshot of IT ticket for audit review or documentation on audit review signoffs"]
[1,null,null,null,null,null,"AU","L2","3.3.3[c]","Event types being logged are updated based on the review.","Artifact",null,"Evidence of an audit event review (e.g. - Annual review with sign off or IT ticket showing review)"]
[1,1,{"$f":"IF(OR(F120=\"NA\", F120=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F121:F123))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F121:F123))","v":0},{"$f":"IF(D120+E120=3, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.4","Alert in the event of an audit logging process failure."]
[1,null,null,null,null,null,"AU","L2","3.3.4[a]","Personnel or roles to be alerted in the event of an audit logging process failure are identified.","Document",null,"AU Policy and Procedures","Sentinel"]
[1,null,null,null,null,null,"AU","L2","3.3.4[b]","Types of audit logging process failures for which alert will be generated are defined.","Document"]
[1,null,null,null,null,null,"AU","L2","3.3.4[c]","Identified personnel or roles are alerted in the event of an audit logging process failure.","Artifact",null,"Settings in SIEM of who gets alerted on audit log failures"]
[1,5,{"$f":"IF(OR(F124=\"NA\",F124=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F125:F126))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F125:F126))","v":0},{"$f":"IF(D124+E124=2, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.5","Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity."]
[1,null,null,null,null,null,"AU","L2","3.3.5[a]","Audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined.","Document",null,"AU Policy and Procedures","Sentinel"]
[1,null,null,null,null,null,"AU","L2","3.3.5[b]","Defined audit record review, analysis, and reporting processes are correlated.","Artifact",null,"Settings in SIEM on connectors to pull in different audit logs and KQL query examples. "]
[1,1,{"$f":"IF(OR(F127=\"NA\", F127=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F128:F129))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F128:F129))","v":0},{"$f":"IF(D127+E127=2, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.6","Provide audit record reduction and report generation to support on-demand analysis and reporting."]
[1,null,null,null,null,null,"AU","L2","3.3.6[a]","An audit record reduction capability that supports on-demand analysis is provided.","Screen Share",null,"Run through of KTL queries in Sentinel and saved workbooks on typical queries run on a regular basis. ","Sentinel"]
[1,null,null,null,null,null,"AU","L2","3.3.6[b]","A report generation capability that supports on-demand reporting is provided.","Screen Share"]
[1,1,{"$f":"IF(OR(F130=\"NA\", F130=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F131:F133))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F131:F133))","v":0},{"$f":"IF(D130+E130=3, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.7","Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records."]
[1,null,null,null,null,null,"AU","L2","3.3.7[a]","Internal system clocks are used to generate time stamps for audit records.","Screen Share",null,"Windows Event Logs match up with time server settings on time stamps. ","Group Policy Manager"]
[1,null,null,null,null,null,"AU","L2","3.3.7[b]","An authoritative source with which to compare and synchronize internal system clocks is specified.","Document",null,"AU Policy and Procedures"]
[1,null,null,null,null,null,"AU","L2","3.3.7[c]","Internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source.","Screen Share",null,"Time server settings AVD hosts in enclave builds.  \nGPO setttings on time server. "]
[1,1,{"$f":"IF(OR(F134=\"NA\", F134=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F135:F140))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F135:F140))","v":0},{"$f":"IF(D134+E134=6, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.8","Protect audit information and audit logging tools from unauthorized access, modification, and deletion."]
[1,null,null,null,null,null,"AU","L2","3.3.8[a]","Audit information is protected from unauthorized access.","Screen Share",null,"AD and role permissions for administrators of SIEM.\nRoles and Responsibility Matrix aligned with assigned roles.","Active Directory\nMicrosoft Entra"]
[1,null,null,null,null,null,"AU","L2","3.3.8[b]","Audit information is protected from unauthorized modification.","Screen Share"]
[1,null,null,null,null,null,"AU","L2","3.3.8[c]","Audit information is protected from unauthorized deletion.","Screen Share"]
[1,null,null,null,null,null,"AU","L2","3.3.8[d]","Audit logging tools are protected from unauthorized access.","Screen Share"]
[1,null,null,null,null,null,"AU","L2","3.3.8[e]","Audit logging tools are protected from unauthorized modification.","Screen Share"]
[1,null,null,null,null,null,"AU","L2","3.3.8[f]","Audit logging tools are protected from unauthorized deletion.","Screen Share"]
[1,1,{"$f":"IF(OR(F141=\"NA\", F141=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F142:F143))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F142:F143))","v":0},{"$f":"IF(D141+E141=2, \"Met\", \"Not Met\")","v":"Not Met"},"AU","L2","3.3.9","Limit management of audit logging functionality to a subset of privileged users."]
[1,null,null,null,null,null,"AU","L2","3.3.9[a]","A subset of privileged users granted access to manage audit logging functionality is defined.","Document",null,"AU Policy and Procedures\nRoles and Responsibility Matrix","Active Directory\nMicrosoft Entra"]
[1,null,null,null,null,null,"AU","L2","3.3.9[b]","Management of audit logging functionality is limited to the defined subset of privileged users.","Screen Share",null,"AD and role permissions for administrators of SIEM match with what's defined"]
[3,5,{"$f":"IF(OR(F144=\"NA\", F144=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F145:F150))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F145:F150))","v":0},{"$f":"IF(D144+E144=6, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.1","Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles."]
[3,null,null,null,null,null,"CM","L2","3.4.1[a]","A baseline configuration is established.","Document",null,"CM Policy and Procedure\nBaseline documentation of all configurable system components ","Intune\nDefender for Endpoint"]
[3,null,null,null,null,null,"CM","L2","3.4.1[b]","The baseline configuration includes hardware, software, firmware, and documentation.","Artifact",null,"Baseline documentation includes hardware, software, and firmware. \nReference to vendor documentation.\nDocumented review of baselines based on policy. "]
[3,null,null,null,null,null,"CM","L2","3.4.1[c]","The baseline configuration is maintained (reviewed and updated) throughout the system development life cycle.","Artifact"]
[3,null,null,null,null,null,"CM","L2","3.4.1[d]","A system inventory is established.","Document",null,"System Inventory List. May be in several locations (e.g. - Intune, Defender for Endpoint, etc.). "]
[3,null,null,null,null,null,"CM","L2","3.4.1[e]","The system inventory includes hardware, software, firmware, and documentation.","Artifact",null,"Does the system inventory include hardware, software, and firmware. \nReference to vendor documentation.\nEvidence of a system inventory review (IT Ticket, Signoff, etc.) per the policy and/or procedures."]
[3,null,null,null,null,null,"CM","L2","3.4.1[f]","The inventory is maintained (reviewed and updated) throughout the system development life cycle.","Artifact"]
[3,5,{"$f":"IF(OR(F151=\"NA\", F151=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F152:F153))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F152:F153))","v":0},{"$f":"IF(D151+E151=2, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.2","Establish and enforce security configuration settings for information technology products employed in organizational systems."]
[3,null,null,null,null,null,"CM","L2","3.4.2[a]","Security configuration settings for information technology products employed in the system are established and included in the baseline configuration.","Document",null,"Baseline documentation\nPolicy and Procedure pointing to baselines","Intune\nGroup Policy Manager"]
[3,null,null,null,null,null,"CM","L2","3.4.2[b]","Security configuration settings for information technology products employed in the system are enforced.","Artifact",null,"Intune if in use\nGroup Policy settings around security configurations."]
[3,1,{"$f":"IF(OR(F154=\"NA\", F154=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F155:F158))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F155:F158))","v":0},{"$f":"IF(D154+E154=4, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.3","Track, review, approve or disapprove, and log changes to organizational systems."]
[3,null,null,null,null,null,"CM","L2","3.4.3[a]","Changes to the system are tracked.","Artifact",null,"IT Ticketing system or manual tracking and sign off of review and approval to system change requests. \nSentinel logs of system changes.","Sentinel"]
[3,null,null,null,null,null,"CM","L2","3.4.3[b]","Changes to the system are reviewed.","Artifact"]
[3,null,null,null,null,null,"CM","L2","3.4.3[c]","Changes to the system are approved or disapproved.","Artifact"]
[3,null,null,null,null,null,"CM","L2","3.4.3[d]","Changes to the system are logged.","Artifact"]
[3,1,{"$f":"IF(OR(F159=\"NA\",F159=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F160))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F160))","v":0},{"$f":"IF(D159+E159=1, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.4","Analyze the security impact of changes prior to implementation."]
[3,null,null,null,null,null,"CM","L2","3.4.4 [a]","Determine if the security impact of changes to the system is analyzed prior to implementation.","Artifact",null,"IT Ticketing system or manual tracking and sign off of review and approval to system change requests. \nSentinel logs of system changes.","NA"]
[3,5,{"$f":"IF(OR(F161=\"NA\", F161=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F162:F169))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F162:F169))","v":0},{"$f":"IF(D161+E161=8, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.5","Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems."]
[3,null,null,null,null,null,"CM","L2","3.4.5[a]","Physical access restrictions associated with changes to the system are defined.","Document",null,"Not applicable to enclave builds. \nPolicy and procedures on system changes and physical access restrictions. ","Active Directory \nMicrosoft Entra\nGroup Policy Manager"]
[3,null,null,null,null,null,"CM","L2","3.4.5[b]","Physical access restrictions associated with changes to the system are documented.","Document"]
[3,null,null,null,null,null,"CM","L2","3.4.5[c]","Physical access restrictions associated with changes to the system are approved.","Artifact",null,"IT Ticketing system or manual tracking on physical access approvals for change. "]
[3,null,null,null,null,null,"CM","L2","3.4.5[d]","Physical access restrictions associated with changes to the system are enforced.","Physical Review",null,"Badge reader access.\nKey sign in/sign out and approvals form."]
[3,null,null,null,null,null,"CM","L2","3.4.5[e]","Logical access restrictions associated with changes to the system are defined.","Document",null,"Access Control and Configuration Management Policy and Procedures. \nIT Ticketing system or manual tracking document. "]
[3,null,null,null,null,null,"CM","L2","3.4.5[f]","Logical access restrictions associated with changes to the system are documented.","Document"]
[3,null,null,null,null,null,"CM","L2","3.4.5[g]","Logical access restrictions associated with changes to the system are approved.","Artifact",null,"Active Directory role based settings.\nMicrosoft Entra role based settings. \nGPO settings\n"]
[3,null,null,null,null,null,"CM","L2","3.4.5[h]","Logical access restrictions associated with changes to the system are enforced.","Artifact"]
[3,5,{"$f":"IF(OR(F170=\"NA\", F170=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F171:F172))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F171:F172))","v":0},{"$f":"IF(D170+E170=2, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.6","Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities."]
[3,null,null,null,null,null,"CM","L2","3.4.6[a]","Essential system capabilities are defined based on the principle of least functionality.","Document",null,"Policy and Procedures on least functionality definition and process. ","NA"]
[3,null,null,null,null,null,"CM","L2","3.4.6[b]","The system is configured to provide only the defined essential capabilities.","Screen Share",null,"Golden image and baseline documentation"]
[3,5,{"$f":"IF(OR(F173=\"NA\", F173=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F174:F188))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F174:F188))","v":0},{"$f":"IF(D173+E173=15, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.7","Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services."]
[3,null,null,null,null,null,"CM","L2","3.4.7[a]","Essential programs are defined.","Document",null,"Policy and Procedures\nBaseline documentation","Defender for Endpoint\nAzure Firewall \nGroup Policy Manager"]
[3,null,null,null,null,null,"CM","L2","3.4.7[b]","The use of nonessential programs is defined.","Document"]
[3,null,null,null,null,null,"CM","L2","3.4.7[c]","The use of nonessential programs is restricted, disabled, or prevented as defined.","Screen Share",null,"Defender for Endpoint application restriction settings"]
[3,null,null,null,null,null,"CM","L2","3.4.7[d]","Essential functions are defined.","Document",null,"Policy and Procedures\nBaseline documentation"]
[3,null,null,null,null,null,"CM","L2","3.4.7[e]","The use of nonessential functions is defined.","Document"]
[3,null,null,null,null,null,"CM","L2","3.4.7[f]","The use of nonessential functions is restricted, disabled, or prevented as defined.","Screen Share",null,"Group Policy settings on functions. "]
[3,null,null,null,null,null,"CM","L2","3.4.7[g]","Essential ports are defined.","Document",null,"Policy and Procedures\nBaseline documentation"]
[3,null,null,null,null,null,"CM","L2","3.4.7[h]","The use of nonessential ports is defined.","Document"]
[3,null,null,null,null,null,"CM","L2","3.4.7[i]","The use of nonessential ports is restricted, disabled, or prevented as defined.","Screen Share",null,"Firewall rule settings on allowed ports. "]
[3,null,null,null,null,null,"CM","L2","3.4.7[j]","Essential protocols are defined.","Document",null,"Policy and Procedures\nBaseline documentation"]
[3,null,null,null,null,null,"CM","L2","3.4.7[k]","The use of nonessential protocols is defined.","Document"]
[3,null,null,null,null,null,"CM","L2","3.4.7[l]","The use of nonessential protocols is restricted, disabled, or prevented as defined.","Screen Share",null,"Firewall rule settings on allowed protocols. "]
[3,null,null,null,null,null,"CM","L2","3.4.7[m]","Essential services are defined.","Document",null,"Policy and Procedures\nBaseline documentation"]
[3,null,null,null,null,null,"CM","L2","3.4.7[n]","The use of nonessential services is defined.","Document"]
[3,null,null,null,null,null,"CM","L2","3.4.7[o]","The use of nonessential services is restricted, disabled, or prevented as defined.","Screen Share",null,"Group Policy settings on restriction of nonessential services. "]
[3,5,{"$f":"IF(OR(F189=\"NA\", F189=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F190:F192))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F190:F192))","v":0},{"$f":"IF(D189+E189=3, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.8","Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software."]
[3,null,null,null,null,null,"CM","L2","3.4.8[a]","A policy specifying whether whitelisting or blacklisting is to be implemented is specified.","Document",null,"Policy and Procedures","Microsoft AppLocker"]
[3,null,null,null,null,null,"CM","L2","3.4.8[b]","The software allowed to execute under whitelisting or denied use under blacklisting is specified.","Document"]
[3,null,null,null,null,null,"CM","L2","3.4.8[c]","Whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.","Screen Share",null,"Microsoft AppLocker configurations"]
[3,1,{"$f":"IF(OR(F193=\"NA\", F193=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F194:F196))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F194:F196))","v":0},{"$f":"IF(D193+E193=3, \"Met\", \"Not Met\")","v":"Not Met"},"CM","L2","3.4.9","Control and monitor user-installed software."]
[3,null,null,null,null,null,"CM","L2","3.4.9[a]","A policy for controlling the installation of software by users is established.","Document",null,"Policy and procedures","Active Directory\nMicrosoft Entra\nIntune\nGroup Policy Manager"]
[3,null,null,null,null,null,"CM","L2","3.4.9[b]","Installation of software by users is controlled based on the established policy.","Screen Share",null,"Microsoft AppLocker configurations\nGPO settings"]
[3,null,null,null,null,null,"CM","L2","3.4.9[c]","Installation of software by users is monitored.","Screen Share",null,"Sentinel configuration for software installation"]
[1,5,{"$f":"IF(OR(F197=\"NA\", F197=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F198:F200))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F198:F200))","v":0},{"$f":"IF(D197+E197=3, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L1","3.5.1","Identify system users, processes acting on behalf of users, and devices."]
[1,null,null,null,null,null,"IA","L1","3.5.1[a]","System users are identified.","Document",null,"Roles and Responsibilities Matrix\nActive Directory user list\nHR Personnel List","Active Directory\nMicrosoft Entra\nIntune"]
[1,null,null,null,null,null,"IA","L1","3.5.1[b]","Processes acting on behalf of users are identified.","Screen Share",null,"Active Directory inheritance (Devices as computer objects in enclave builds)\nMicrosoft Entra inheritance\nIntune if used"]
[1,null,null,null,null,null,"IA","L1","3.5.1[c]","Devices accessing the system are identified.","Screen Share"]
[1,5,{"$f":"IF(OR(F201=\"NA\", F201=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F202:F204))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F202:F204))","v":0},{"$f":"IF(D201+E201=3, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L1","3.5.2","Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems."]
[1,null,null,null,null,null,"IA","L1","3.5.2[a]","The identity of each user is authenticated or verified as a prerequisite to system access.","Screen Share",null,"IA Policy\nAD password settings\nMicosoft Entra password settings\nConditional access settings enforcing MFA\nIntune settings if used to for devices.\nFortiGate EMS if used for only allowing authorized devices. ","Active Directory\nMicrosoft Entra\nIntune"]
[1,null,null,null,null,null,"IA","L1","3.5.2[b]","The identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access.","Screen Share"]
[1,null,null,null,null,null,"IA","L1","3.5.2[c]","The identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.","Screen Share"]
[1,"3 or 5",{"$f":"IF(F205=\"Met\",5, IF(F205=\"Partial\", 3, -5))","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F206:F209))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F206:F209))","v":0},{"$f":"IF(AND(F206:F208=\"Met\",F209=\"Not Met\"), \"Partial\",IF(D205+E205=4,\"Met\", \"Not Met\"))","v":"Not Met"},"IA","L2","3.5.3","Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts."]
[1,null,null,null,null,null,"IA","L2","3.5.3[a]","Privileged accounts are identified.","Document",null,"Roles and Responsibilities Matrix\nIA Policy\nActive Directory user list","Active Directory \nMicrosoft Entra"]
[1,null,null,null,null,null,"IA","L2","3.5.3[b]","Multifactor authentication is implemented for local access to privileged accounts.","Screen Share",null,"Microsoft Entra Conditional Access Settings enforcement of MFA for all users"]
[1,null,null,null,null,null,"IA","L2","3.5.3[c]","Multifactor authentication is implemented for network access to privileged accounts.","Screen Share"]
[1,null,null,null,null,null,"IA","L2","3.5.3[d]","Multifactor authentication is implemented for network access to non-privileged accounts.","Screen Share"]
[1,1,{"$f":"IF(OR(F210=\"NA\", F210=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F211))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F211))","v":0},{"$f":"IF(D210+E210=1, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L2","3.5.4","Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts."]
[1,null,null,null,null,null,"IA","L2","3.5.4[a]","Determine if replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts.","Screen Share",null,"Micosoft Entra conditional access for MFA enforcement. \nScreenshot of Kerberos settings in GPO. ","Microsoft Entra\nGroup Policy Manager"]
[1,1,{"$f":"IF(OR(F212=\"NA\", F212=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F213:F214))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F213:F214))","v":0},{"$f":"IF(D212+E212=2, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L2","3.5.5","Prevent reuse of identifiers for a defined period. "]
[1,null,null,null,null,null,"IA","L2","3.5.5[a]","A period within which identifiers cannot be reused is defined.","Document",null,"IA Policy","NA"]
[1,null,null,null,null,null,"IA","L2","3.5.5[b]","Reuse of identifiers is prevented within the defined period.","Artifact",null,"Procedure\nDocumentation or IT Ticket showing that an identifier has been disabled per policy. "]
[1,1,{"$f":"IF(OR(F215=\"NA\", F215=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F216:F217))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F216:F217))","v":0},{"$f":"IF(D215+E215=2, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L2","3.5.6","Disable identifiers after a defined period of inactivity."]
[1,null,null,null,null,null,"IA","L2","3.5.6[a]","A period of inactivity after which an identifier is disabled is defined.","Document",null,"IA Policy","NA"]
[1,null,null,null,null,null,"IA","L2","3.5.6[b]","Identifiers are disabled after the defined period of inactivity.","Artifact",null,"Manual process or automated tool to do this. "]
[1,1,{"$f":"IF(OR(F218=\"NA\", F218=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F219:F222))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F219:F222))","v":0},{"$f":"IF(D218+E218=4, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L2","3.5.7","Enforce a minimum password complexity and change of characters when new passwords are created."]
[1,null,null,null,null,null,"IA","L2","3.5.7[a]","Password complexity requirements are defined.","Document",null,"IA Policy","Active Directory\nMicrosoft Entra\nGroup Policy Manager"]
[1,null,null,null,null,null,"IA","L2","3.5.7[b]","Password change of character requirements are defined.","Document"]
[1,null,null,null,null,null,"IA","L2","3.5.7[c]","Minimum password complexity requirements as defined are enforced when new passwords are created.","Screen Share",null,"Active Directory\nMicrosoft Entra\nGPO Settings"]
[1,null,null,null,null,null,"IA","L2","3.5.7[d]","Minimum password change of character requirements as defined are enforced when new passwords are created.","Screen Share"]
[1,1,{"$f":"IF(OR(F223=\"NA\", F223=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F224:F225))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F224:F225))","v":0},{"$f":"IF(D223+E223=2, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L2","3.5.8","Prohibit password reuse for a specified number of generations."]
[1,null,null,null,null,null,"IA","L2","3.5.8[a]","The number of generations during which a password cannot be reused is specified.","Document",null,"IA Policy","Active Directory\nMicrosoft Entra\nGroup Policy Manager"]
[1,null,null,null,null,null,"IA","L2","3.5.8[b]","Reuse of passwords is prohibited during the specified number of generations.","Screen Share",null,"Active Directory\nMicrosoft Entra\nGPO Settings "]
[1,1,{"$f":"IF(OR(F226=\"NA\", F226=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F227))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F227))","v":0},{"$f":"IF(D226+E226=1, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L2","3.5.9","Allow temporary password use for system logons with an immediate change to a permanent password."]
[1,null,null,null,null,null,"IA","L2","3.5.9[a]","Determine if an immediate change to a permanent password is required when a temporary password is used for system logon.","Screen Share",null,"GPO configuration to show \"change password at first logon\"","Group Policy Manager"]
[1,5,{"$f":"IF(OR(F228=\"NA\", F228=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F229:F230))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F229:F230))","v":0},{"$f":"IF(D228+E228=2, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L2","3.5.10","Store and transmit only cryptographically-protected passwords."]
[1,null,null,null,null,null,"IA","L2","3.5.10[a]","Passwords are cryptographically protected in storage.","Screen Share",null,"Shared Responsibility","NA"]
[1,null,null,null,null,null,"IA","L2","3.5.10[b]","Passwords are cryptographically protected in transit.","Screen Share"]
[1,1,{"$f":"IF(OR(F231=\"NA\", F231=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F232))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F232))","v":0},{"$f":"IF(D231+E231=1, \"Met\", \"Not Met\")","v":"Not Met"},"IA","L2","3.5.11","Obscure feedback of authentication information."]
[1,null,null,null,null,null,"IA","L2","3.5.11[a]","Determine if authentication information is obscured during the authentication process.","Screen Share",null,"GPO Settings (Shared Responsibility)","Group Policy Manager"]
[4,5,{"$f":"IF(OR(F233=\"NA\", F233=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F234:F240))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F234:F240))","v":0},{"$f":"IF(D233+E233=7, \"Met\", \"Not Met\")","v":"Not Met"},"IR","L2","3.6.1 ","Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities."]
[4,null,null,null,null,null,"IR","L2","3.6.1[a]","An operational incident-handling capability is established.","Document",null,"IR Policy\nIR Procedures\nIR Playbook\nIf there was a past incident - Any documented evidence (e.g. - IT Ticket, after action report, etc.)","NA"]
[4,null,null,null,null,null,"IR","L2","3.6.1[b]","The operational incident-handling capability includes preparation.","Document"]
[4,null,null,null,null,null,"IR","L2","3.6.1[c]","The operational incident-handling capability includes detection.","Document"]
[4,null,null,null,null,null,"IR","L2","3.6.1[d]","The operational incident-handling capability includes analysis.","Document"]
[4,null,null,null,null,null,"IR","L2","3.6.1[e]","The operational incident-handling capability includes containment.","Document"]
[4,null,null,null,null,null,"IR","L2","3.6.1[f]","The operational incident-handling capability includes recovery.","Document"]
[4,null,null,null,null,null,"IR","L2","3.6.1[g]","The operational incident-handling capability includes user response activities.","Document"]
[4,5,{"$f":"IF(OR(F241=\"NA\", F241=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F242:F247))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F242:F247))","v":0},{"$f":"IF(D241+E241=6, \"Met\", \"Not Met\")","v":"Not Met"},"IR","L2","3.6.2","Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization."]
[4,null,null,null,null,null,"IR","L2","3.6.2[a]","Incidents are tracked.","Artifact",null,"Medium Assurance Certificate for reporting to DIBNET\nIR Policy\nIR Procedures\nIR Playbook\nIf there was a past incident - Any documented evidence (e.g. - IT Ticket, after action report, etc.)","NA"]
[4,null,null,null,null,null,"IR","L2","3.6.2[b]","Incidents are documented.","Artifact"]
[4,null,null,null,null,null,"IR","L2","3.6.2[c]","Authorities to whom incidents are to be reported are identified.","Document"]
[4,null,null,null,null,null,"IR","L2","3.6.2[d]","Organizational officials to whom incidents are to be reported are identified.","Document"]
[4,null,null,null,null,null,"IR","L2","3.6.2[e]","Identified authorities are notified of incidents.","Screen Share"]
[4,null,null,null,null,null,"IR","L2","3.6.2[f]","Identified organizational officials are notified of incidents.","Artifact"]
[4,1,{"$f":"IF(OR(F248=\"NA\", F248=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F249))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F249))","v":0},{"$f":"IF(D248+E248=1, \"Met\", \"Not Met\")","v":"Not Met"},"IR","L2","3.6.3","Test the organizational incident response capability."]
[4,null,null,null,null,null,"IR","L2","3.6.3[a]","Determine if the incident response capability is tested.","Artifact",null,"IR Tabletop exercise","NA"]
[3,3,{"$f":"IF(OR(F250=\"NA\", F250=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F251))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F251))","v":0},{"$f":"IF(D250+E250=1, \"Met\", \"Not Met\")","v":"Not Met"},"MA","L2","3.7.1","Perform maintenance on organizational systems."]
[3,null,null,null,null,null,"MA","L2","3.7.1[a]","System maintenance is performed","Artifact",null,"MA Policy\nMA Procedure\nIT Ticket or document evidence of maintenance performed","NA"]
[3,5,{"$f":"IF(OR(F252=\"NA\", F252=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F253:F256))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F253:F256))","v":0},{"$f":"IF(D252+E252=4, \"Met\", \"Not Met\")","v":"Not Met"},"MA","L2","3.7.2","Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance."]
[3,null,null,null,null,null,"MA","L2","3.7.2[a]","Tools used to conduct system maintenance are controlled.","Artifact",null,"Physical (Server room, locked cabinet, etc) or logical access controls in active directory resticting access to authorized users for maintenance and mechanisms (e.g. - automated scripts, scheduled jobs, etc.).\nPhysical (Document in secure location, etc) or logical access controls (Application or SharePoint) preventing access to system documentation or maintenance procedures.\nMaintenance policy and procedures.","Active Directory\nMicrosoft Entra\nSharePoint"]
[3,null,null,null,null,null,"MA","L2","3.7.2[b]","Techniques used to conduct system maintenance are controlled.","Artifact"]
[3,null,null,null,null,null,"MA","L2","3.7.2[c]","Mechanisms used to conduct system maintenance are controlled.","Artifact"]
[3,null,null,null,null,null,"MA","L2","3.7.2[d]","Personnel used to conduct system maintenance are controlled.","Physical Review",null,"Physical or logical access controls (Active Direcotry, server room, etc) limiting access to authorized personnel. \nMaintenance documentation (Logs of maintenance performed) either hardcopy or digital (e.g. - IT Ticket)."]
[3,1,{"$f":"IF(OR(F257=\"NA\", F257=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F258))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F258))","v":0},{"$f":"IF(D257+E257=1, \"Met\", \"Not Met\")","v":"Not Met"},"MA","L2","3.7.3","Ensure equipment removed for off-site maintenance is sanitized of any CUI."]
[3,null,null,null,null,null,"MA","L2","3.7.3[a]","Determine if equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.","Artifact",null,"Sanitization Records prior to off-site maintenance. \nProcedures","NA"]
[3,3,{"$f":"IF(OR(F259=\"NA\", F259=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F260))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F260))","v":0},{"$f":"IF(D259+E259=1, \"Met\", \"Not Met\")","v":"Not Met"},"MA","L2","3.7.4","Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems."]
[3,null,null,null,null,null,"MA","L2","3.7.4[a]","Determine if media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI.","Artifact",null,"Defender for Endpoint GPO settings to check USB or application downloads for malicious code prior to execution","Defender for Endpoint\nGroup Policy Manager"]
[3,5,{"$f":"IF(OR(F261=\"NA\", F261=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F262:F263))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F262:F263))","v":0},{"$f":"IF(D261+E261=2, \"Met\", \"Not Met\")","v":"Not Met"},"MA","L2","3.7.5","Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete."]
[3,null,null,null,null,null,"MA","L2","3.7.5[a]","Multifactor authentication is used to establish nonlocal maintenance sessions via external network connections.","Screen Share",null,"Microsoft Entra Conditional Access Settings enforcement of MFA for all users","Microsoft Entra\nGroup Policy Manager"]
[3,null,null,null,null,null,"MA","L2","3.7.5[b]","Nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.","Screen Share",null,"Maintenance policy \nGPO VPN timeout limit for session inactivity"]
[3,1,{"$f":"IF(OR(F264=\"NA\", F264=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F265))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F265))","v":0},{"$f":"IF(D264+E264=1, \"Met\", \"Not Met\")","v":"Not Met"},"MA","L2","3.7.6","Supervise the maintenance activities of maintenance personnel without required access authorization."]
[3,null,null,null,null,null,"MA","L2","3.7.6[a]","Determine if maintenance personnel without required access authorization are supervised during maintenance activities.","Document",null,"Maintenance policy\nMaintenance procedures\nMaintenance records (Hardcopy or digital)\nSign in/out documents for on premises visitors","NA"]
[3,3,{"$f":"IF(OR(F266=\"NA\", F266=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F267:F270))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F267:F270))","v":0},{"$f":"IF(D266+E266=4, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L2","3.8.1","Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital."]
[3,null,null,null,null,null,"MP","L2","3.8.1[a]","Paper media containing CUI is physically controlled.","Document",null,"Media Protection Policy \nMedia Protection Procedures\nLocked cabinets, desks, or areas if on premises\nGroup Policy settings on preventing extraction of data (Enclave only)\nBitlocker/Bitlocker ToGo settings\n\n","Microsoft Entra \nBitlocker\nGroup Policy Manager"]
[3,null,null,null,null,null,"MP","L2","3.8.1[b]","Digital media containing CUI is logically controlled.","Document"]
[3,null,null,null,null,null,"MP","L2","3.8.1[c]","Paper media containing CUI is securely stored.","Physical Review",null,"CUI sign in/out documents\nMicrosoft Entra Conditional Access Settings\nAccess card/key logs\nBitlocker/Bitlocker ToGo settings\nBackup encryption"]
[3,null,null,null,null,null,"MP","L2","3.8.1[d]","Digital media containing CUI is securely stored.","Physical Review"]
[3,3,{"$f":"IF(OR(F271=\"NA\", F271=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F272))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F272))","v":0},{"$f":"IF(D271+E271=1, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L2","3.8.2","Limit access to CUI on system media to authorized users."]
[3,null,null,null,null,null,"MP","L2","3.8.2[a]","Determine if access to CUI on system media is limited to authorized users.","Artifact",null,"HR Document of current staff\nActive Directory user list\nMicrosoft Entra access control settings\nSharePoint/OneDrive access settings","Active Directory\nMicrosoft Entra\nSharePoint/OneDrive"]
[3,5,{"$f":"IF(OR(F273=\"NA\", F273=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F274:F275))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F274:F275))","v":0},{"$f":"IF(D273+E273=2, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L1","3.8.3","Sanitize or destroy system media containing CUI before disposal or release for reuse."]
[3,null,null,null,null,null,"MP","L1","3.8.3[a]","System media containing CUI is sanitized or destroyed before disposal.","Document",null,"Does not apply to enclave builds, but may require GPO settings to show CUI data cannot be extracted. \nMedia Protection Policy\nMedia Protection Procedure\nDocument of destruction","Group Policy Manager"]
[3,null,null,null,null,null,"MP","L1","3.8.3[b]","System media containing CUI is sanitized before it is released for reuse.","Document"]
[3,1,{"$f":"IF(OR(F276=\"NA\", F276=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F277:F278))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F277:F278))","v":0},{"$f":"IF(D276+E276=2, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L2","3.8.4","Mark media with necessary CUI markings and distribution limitations."]
[3,null,null,null,null,null,"MP","L2","3.8.4[a]","Media containing CUI is marked with applicable CUI markings.","Physical Review",null,"If physical on premise looking for the CUI labels or documentation with distribution limitations\nMicrosoft Purview Information Protection labels for enclave ","Microsoft Purview Informaiton Protection"]
[3,null,null,null,null,null,"MP","L2","3.8.4[b]","Media containing CUI is marked with distribution limitations.","Physical Review"]
[3,1,{"$f":"IF(OR(F279=\"NA\", F279=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F280:F281))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F280:F281))","v":0},{"$f":"IF(D279+E279=2, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L2","3.8.5","Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas."]
[3,null,null,null,null,null,"MP","L2","3.8.5[a]","Access to media containing CUI is controlled.","Document",null,"Media Protection Policy \nMedia Protection Procedures\nChain of custody documentation","NA"]
[3,null,null,null,null,null,"MP","L2","3.8.5[b]","Accountability for media containing CUI is maintained during transport outside of controlled areas.","Artifact",null,"Audit logs of tracking (e.g. - inventory, chain of custody, etc.)"]
[3,1,{"$f":"IF(OR(F282=\"NA\", F282=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F283))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F283))","v":0},{"$f":"IF(D282+E282=1, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L2","3.8.6","Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards."]
[3,null,null,null,null,null,"MP","L2","3.8.6[a]","Determine if the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.","Artifact",null,"For Enclave builds evidence would be AVD host settings to show USB connections are not allowed. \nMP Policy and/or AUP\nBitlocker to Go Windows configurations pushed through Intune or GPO. ","Windows \nIntune\nGroup Policy Manager"]
[3,5,{"$f":"IF(OR(F284=\"NA\", F284=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F285))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F285))","v":0},{"$f":"IF(D284+E284=1, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L2","3.8.7","Control the use of removable media on system components."]
[3,null,null,null,null,null,"MP","L2","3.8.7[a]","Determine if the use of removable media on system components is controlled.","Artifact",null,"For Enclave builds evidence would be AVD host settings to show USB connections are not allowed. \nMP Policy and/or AUP\nBitlocker to Go Windows configurations pushed through Intune or GPO. \nIntune whitelisting of USB or removable media devices. ","Windows \nIntune\nGroup Policy Manager"]
[3,3,{"$f":"IF(OR(F286=\"NA\", F286=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F287))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F287))","v":0},{"$f":"IF(D286+E286=1, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L2","3.8.8","Prohibit the use of portable storage devices when such devices have no identifiable owner."]
[3,null,null,null,null,null,"MP","L2","3.8.8[a]","Determine if the use of portable storage devices is prohibited when such devices have no identifiable owner.","Artifact",null,"For Enclave builds evidence would be AVD host settings to show USB connections are not allowed. \nMP Policy and/or AUP\nBitlocker to Go Windows configurations pushed through Intune or GPO. \nIntune whitelisting of USB or removable media devices. ","Windows \nIntune\nGroup Policy Manager"]
[3,1,{"$f":"IF(OR(F288=\"NA\", F288=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F289))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F289))","v":0},{"$f":"IF(D288+E288=1, \"Met\", \"Not Met\")","v":"Not Met"},"MP","L2","3.8.9","Protect the confidentiality of backup CUI at storage locations."]
[3,null,null,null,null,null,"MP","L2","3.8.9[a]","Determine if the confidentiality of backup CUI is protected at storage locations.","Artifact",null,"MP Policy\nFor enclave builds this is a shared responsibility with Microsoft and AvePoint. \nEncyption settings for backup locations. ","NA"]
[2,3,{"$f":"IF(OR(F290=\"NA\", F290=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F291))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F291))","v":0},{"$f":"IF(D290+E290=1, \"Met\", \"Not Met\")","v":"Not Met"},"PS","L2","3.9.1","Screen individuals prior to authorizing access to organizational systems containing CUI."]
[2,null,null,null,null,null,"PS","L2","3.9.1[a]","Determine if individuals are screened prior to authorizing access to organizational systems containing CUI.","Artifact",null,"Screenshot of records of screened personnel/background checks","NA"]
[2,5,{"$f":"IF(OR(F292=\"NA\", F292=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F293:F295))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F293:F295))","v":0},{"$f":"IF(D292+E292=3, \"Met\", \"Not Met\")","v":"Not Met"},"PS","L2","3.9.2","Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers."]
[2,null,null,null,null,null,"PS","L2","3.9.2[a]","A policy and/or process for terminating system access and any credentials coincident with personnel actions is established.","Document",null,"AC & PS Policy and Procedures","NA"]
[2,null,null,null,null,null,"PS","L2","3.9.2[b]","System access and credentials are terminated consistent with personnel actions such as termination or transfer.","Artifact",null,"IT Ticket capturing request for transfer or termination.\nProcedures"]
[2,null,null,null,null,null,"PS","L2","3.9.2[c]","The system is protected during and after personnel transfer actions.","Artifact"]
[2,5,{"$f":"IF(OR(F296=\"NA\", F296=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F297:F300))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F297:F300))","v":0},{"$f":"IF(D296+E296=4, \"Met\", \"Not Met\")","v":"Not Met"},"PE","L1","3.10.1","Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals."]
[2,null,null,null,null,null,"PE","L1","3.10.1[a]","Authorized individuals allowed physical access are identified.","Artifact",null,"HR or Payroll list of users.\nDoes not apply to enclave builds unless an on premises requirement is made (e.g. - Secure print room). ","NA"]
[2,null,null,null,null,null,"PE","L1","3.10.1[b]","Physical access to organizational systems is limited to authorized individuals.","Physical Review",null,"Badge reader logs, audit logs, and/or card swipe test"]
[2,null,null,null,null,null,"PE","L1","3.10.1[c]","Physical access to equipment is limited to authorized individuals.","Physical Review"]
[2,null,null,null,null,null,"PE","L1","3.10.1[d]","Physical access to operating environments is limited to authorized individuals.","Physical Review"]
[2,5,{"$f":"IF(OR(F301=\"NA\", F301=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F302:F305))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F302:F305))","v":0},{"$f":"IF(D301+E301=4, \"Met\", \"Not Met\")","v":"Not Met"},"PE","L2","3.10.2","Protect and monitor the physical facility and support infrastructure for organizational systems."]
[2,null,null,null,null,null,"PE","L2","3.10.2[a]","The physical facility where organizational systems reside is protected.","Physical Review",null,"Does not apply to enclave builds unless an on premises requirement is made (e.g. - Secure print room). \nThe physical security measures and barriers into the physical facility (cameras/locks/gates/guards, etc.).","NA"]
[2,null,null,null,null,null,"PE","L2","3.10.2[b]","The support infrastructure for organizational systems is protected.","Physical Review"]
[2,null,null,null,null,null,"PE","L2","3.10.2[c]","The physical facility where organizational systems reside is monitored.","Physical Review"]
[2,null,null,null,null,null,"PE","L2","3.10.2[d]","The support infrastructure for organizational systems is monitored.","Physical Review"]
[2,1,{"$f":"IF(OR(F306=\"NA\", F306=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F307:F308))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F307:F308))","v":0},{"$f":"IF(D306+E306=2, \"Met\", \"Not Met\")","v":"Not Met"},"PE","L1","3.10.3","Escort visitors and monitor visitor activity."]
[2,null,null,null,null,null,"PE","L1","3.10.3[a]","Visitors are escorted.","Physical Review",null,"Does not apply to enclave builds unless an on premises requirement is made (e.g. - Secure print room). \nPolicy/Procedures/Instruction on methodology for handling non-authorized personnel (entry to exit)","NA"]
[2,null,null,null,null,null,"PE","L1","3.10.3[b]","Visitor activity is monitored.","Physical Review"]
[2,1,{"$f":"IF(OR(F309=\"NA\", F309=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F310))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F310))","v":0},{"$f":"IF(D309+E309=1, \"Met\", \"Not Met\")","v":"Not Met"},"PE","L1","3.10.4","Maintain audit logs of physical access."]
[2,null,null,null,null,null,"PE","L1","3.10.4[a]","Determine if audit logs of physical access are maintained.","Artifact",null,"Does not apply to enclave builds unless an on premises requirement is made (e.g. - Secure print room). \nLog or Report from Badging System","NA"]
[2,1,{"$f":"IF(OR(F311=\"NA\", F311=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F312:F314))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F312:F314))","v":0},{"$f":"IF(D311+E311=3, \"Met\", \"Not Met\")","v":"Not Met"},"PE","L1","3.10.5","Control and manage physical access devices."]
[2,null,null,null,null,null,"PE","L1","3.10.5[a]","Physical access devices are identified.","Document",null,"PE Policy \nDoes not apply to enclave builds unless an on premises requirement is made (e.g. - Secure print room). ","NA"]
[2,null,null,null,null,null,"PE","L1","3.10.5[b]","Physical access devices are controlled.","Physical Review",null,"Inventory records of physical access control devices (e.g. keys, locks, card readers, locks, etc.). \nFSO or equivalent personnel assigned to manage physical access devices. "]
[2,null,null,null,null,null,"PE","L1","3.10.5[c]","Physical access devices are managed.","Physical Review"]
[2,1,{"$f":"IF(OR(F315=\"NA\", F315=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F316:F317))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F316:F317))","v":0},{"$f":"IF(D315+E315=2, \"Met\", \"Not Met\")","v":"Not Met"},"PE","L2","3.10.6","Enforce safeguarding measures for CUI at alternate work sites."]
[2,null,null,null,null,null,"PE","L2","3.10.6[a]","Safeguarding measures for CUI are defined for alternate work sites.","Document",null,"Telework Agreement\nPE and AUP policy for alternate work locations","NA"]
[2,null,null,null,null,null,"PE","L2","3.10.6[b]","Safeguarding measures for CUI are enforced for alternate work sites.","Artifact",null,"Monitoring/audit log of user activity and logical/physical/technical mechanisms in place to preclude unauthorized activity (telework agrement , AUP?)"]
[2,3,{"$f":"IF(OR(F318=\"NA\", F318=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F319:F320))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F319:F320))","v":0},{"$f":"IF(D318+E318=2, \"Met\", \"Not Met\")","v":"Not Met"},"RA","L2","3.11.1","Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI."]
[2,null,null,null,null,null,"RA","L2","3.11.1[a]","The frequency to assess risk to organizational operations, organizational assets, and individuals is defined.","Document",null,"RA Policy","NA"]
[2,null,null,null,null,null,"RA","L2","3.11.1[b]","Risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency.","Artifact",null,"Copy of last risk assessment done within defined frequency"]
[2,5,{"$f":"IF(OR(F321=\"NA\", F321=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F322:F326))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F322:F326))","v":0},{"$f":"IF(D321+E321=5, \"Met\", \"Not Met\")","v":"Not Met"},"RA","L2","3.11.2","Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified."]
[2,null,null,null,null,null,"RA","L2","3.11.2[a]","The frequency to scan for vulnerabilities in organizational systems and applications is defined.","Document",null,"RA Policy ","Defender for Endpoint\nGroup Policy Manager"]
[2,null,null,null,null,null,"RA","L2","3.11.2[b]","Vulnerability scans are performed on organizational systems with the defined frequency.","Screen Share",null,"Defender for Endpoint GPO settings\nProcedures"]
[2,null,null,null,null,null,"RA","L2","3.11.2[c]","Vulnerability scans are performed on applications with the defined frequency.","Screen Share"]
[2,null,null,null,null,null,"RA","L2","3.11.2[d]","Vulnerability scans are performed on organizational systems when new vulnerabilities are identified.","Screen Share"]
[2,null,null,null,null,null,"RA","L2","3.11.2[e]","Vulnerability scans are performed on applications when new vulnerabilities are identified.","Screen Share"]
[2,1,{"$f":"IF(OR(F327=\"NA\", F327=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F328:F329))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F328:F329))","v":0},{"$f":"IF(D327+E327=2, \"Met\", \"Not Met\")","v":"Not Met"},"RA","L2","3.11.3","Remediate vulnerabilities in accordance with risk assessments."]
[2,null,null,null,null,null,"RA","L2","3.11.3[a]","Vulnerabilities are identified.","Artifact",null,"Defender for Endpoint vulnerability listings\nProcedures\nIT Ticket of vulnerabilities being tracked and remediated. ","Defender for Endpoint"]
[2,null,null,null,null,null,"RA","L2","3.11.3[b]","Vulnerabilities are remediated in accordance with risk assessments.","Artifact"]
[2,5,{"$f":"IF(OR(F330=\"NA\", F330=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F331:F332))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F331:F332))","v":0},{"$f":"IF(D330+E330=2, \"Met\", \"Not Met\")","v":"Not Met"},"CA","L2","3.12.1","Periodically assess the security controls in organizational systems to determine if the controls are effective in their application."]
[2,null,null,null,null,null,"CA","L2","3.12.1[a]","The frequency of security control assessments is defined.","Document",null,"SSP\nGRC audit history or documentation of last control assessment\nSpreadsheet document of last control assessment","NA"]
[2,null,null,null,null,null,"CA","L2","3.12.1[b]","Security controls are assessed with the defined frequency to determine if the controls are effective in their application.","Artifact"]
[2,3,{"$f":"IF(OR(F333=\"NA\", F333=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F334:F336))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F334:F336))","v":0},{"$f":"IF(D333+E333=3, \"Met\", \"Not Met\")","v":"Not Met"},"CA","L2","3.12.2","Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems."]
[2,null,null,null,null,null,"CA","L2","3.12.2[a]","Deficiencies and vulnerabilities to be addressed by the plan of action are identified.","Artifact",null,"Plan of Action & Milestones (POA&M)document.\nCan be in GRC, spreadsheet, word document, etc.","NA"]
[2,null,null,null,null,null,"CA","L2","3.12.2[b]","A plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities.","Artifact"]
[2,null,null,null,null,null,"CA","L2","3.12.2[c]","The plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.","Artifact"]
[2,5,{"$f":"IF(OR(F337=\"NA\", F337=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F338))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F338))","v":0},{"$f":"IF(D337+E337=1, \"Met\", \"Not Met\")","v":"Not Met"},"CA","L2","3.12.3","Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls."]
[2,null,null,null,null,null,"CA","L2","3.12.3[a]","Determine if security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.","Artifact",null,"Collection of risk assessment results.\nInternal or third-party audits/security assessments.\nAudit logs from Sentinel on endpoint monitoring (e.g. - Audit log failure, failed logon attempts showing effectiveness of conditional access, etc.). ","Sentinel"]
[2,"REQUIRED",1,{"$f":"SUMPRODUCT(--EXACT(\"Met\", F340:F347))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F340:F347))","v":0},{"$f":"IF(D339=8, \"Met\", \"Not Met\")","v":"Not Met"},"CA","L2","3.12.4","Develop, document, and periodically update system security plans (SSP) that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems."]
[2,null,null,null,null,"Not Met","CA","L2","3.12.4[a]","A system security plan is developed.","Document",null,"System Security Plan. \nRefer to NIST SP 800-18 for detailed guidance. ","NA"]
[2,null,null,null,null,null,"CA","L2","3.12.4[b]","The system boundary is described and documented in the system security plan.","Document"]
[2,null,null,null,null,null,"CA","L2","3.12.4[c]","The system environment of operation is described and documented in the system security plan.","Document"]
[2,null,null,null,null,null,"CA","L2","3.12.4[d]","The security requirements identified and approved by the designated authority as non-applicable are identified.","Document"]
[2,null,null,null,null,null,"CA","L2","3.12.4[e]","The method of security requirement implementation is described and documented in the system security plan.","Document"]
[2,null,null,null,null,null,"CA","L2","3.12.4[f]","The relationship with or connection to other systems is described and documented in the system security plan.","Document"]
[2,null,null,null,null,null,"CA","L2","3.12.4[g]","The frequency to update the system security plan is defined.","Document"]
[2,null,null,null,null,null,"CA","L2","3.12.4[h]","System security plan is updated with the defined frequency.","Document"]
[4,5,{"$f":"IF(OR(F348=\"NA\", F348=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F349:F356))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F349:F356))","v":0},{"$f":"IF(D348+E348=8, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L1","3.13.1","Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems."]
[4,null,null,null,null,null,"SC","L1","3.13.1[a]","The external system boundary is defined.","Document",null,"SSP\nNetwork diagrams\nDataflow diagrams"]
[4,null,null,null,null,null,"SC","L1","3.13.1[b]","Key internal system boundaries are defined.","Document"]
[4,null,null,null,null,null,"SC","L1","3.13.1[c]","Communications are monitored at the external system boundary.","Screen Share",null,"Defender for Endpoint audit logs in Sentinel\nFirewall ACL settings\nGPO settings on enforced encryption channels","Defender for Endpoint\nGroup Policy Manager"]
[4,null,null,null,null,null,"SC","L1","3.13.1[d]","Communications are monitored at key internal boundaries.","Screen Share"]
[4,null,null,null,null,null,"SC","L1","3.13.1[e]","Communications are controlled at the external system boundary.","Screen Share"]
[4,null,null,null,null,null,"SC","L1","3.13.1[f]","Communications are controlled at key internal boundaries.","Screen Share"]
[4,null,null,null,null,null,"SC","L1","3.13.1[g]","Communications are protected at the external system boundary.","Screen Share"]
[4,null,null,null,null,null,"SC","L1","3.13.1[h]","Communications are protected at key internal boundaries.","Screen Share"]
[4,5,{"$f":"IF(OR(F357=\"NA\", F357=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F358:F363))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F358:F363))","v":0},{"$f":"IF(D357+E357=6, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.2","Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems."]
[4,null,null,null,null,null,"SC","L2","3.13.2[a]","Architectural designs that promote effective information security are identified.","Document",null,"SSP\nCM Policy\nNetwork diagram\nConfiguration Baseline Documents","NA"]
[4,null,null,null,null,null,"SC","L2","3.13.2[b]","Software development techniques that promote effective information security are identified.","Document"]
[4,null,null,null,null,null,"SC","L2","3.13.2[c]","Systems engineering principles that promote effective information security are identified.","Document"]
[4,null,null,null,null,null,"SC","L2","3.13.2[d]","Identified architectural designs that promote effective information security are employed.","Artifact"]
[4,null,null,null,null,null,"SC","L2","3.13.2[e]","Identified software development techniques that promote effective information security are employed.","Artifact"]
[4,null,null,null,null,null,"SC","L2","3.13.2[f]","Identified systems engineering principles that promote effective information security are employed.","Artifact"]
[4,1,{"$f":"IF(OR(F364=\"NA\", F364=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F365:F367))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F365:F367))","v":0},{"$f":"IF(D364+E364=3, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.3","Separate user functionality from system management functionality."]
[4,null,null,null,null,null,"SC","L2","3.13.3[a]","User functionality is identified.","Document",null,"Roles and Responsibilities Document\nSC Policy","Active Directory\nMicrosoft Entra"]
[4,null,null,null,null,null,"SC","L2","3.13.3[b]","System management functionality is identified.","Document"]
[4,null,null,null,null,null,"SC","L2","3.13.3[c]","User functionality is separated from system management functionality.","Screen Share",null,"Active Directory user role and funtions\nMicrosoft Entra user role and funtions"]
[4,1,{"$f":"IF(OR(F368=\"NA\", F368=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F369))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F369))","v":0},{"$f":"IF(D368+E368=1, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.4","Prevent unauthorized and unintended information transfer via shared system resources."]
[4,null,null,null,null,null,"SC","L2","3.13.4[a]","Determine if unauthorized and unintended information transfer via shared system resources is prevented.","Screen Share",null,"Inherited from Microsoft","NA"]
[4,5,{"$f":"IF(OR(F370=\"NA\", F370=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F371:F372))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F371:F373))","v":0},{"$f":"IF(D370+E370=2, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L1","3.13.5","Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks."]
[4,null,null,null,null,null,"SC","L1","3.13.5[a]","Publicly accessible system components are identified.","Document",null,"SC Policy\nNetwork diagram","NA"]
[4,null,null,null,null,null,"SC","L1","3.13.5[b]","Subnetworks for publicly accessible system components are physically or logically separated from internal networks.","Artifact",null,"Firewall Rules"]
[4,5,{"$f":"IF(OR(F373=\"NA\", F373=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F374:F375))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F374:F376))","v":0},{"$f":"IF(D373+E373=2, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.6","Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)."]
[4,null,null,null,null,null,"SC","L2","3.13.6[a]","Network communications traffic is denied by default.","Screen Share",null,"Firewall Rules","NA"]
[4,null,null,null,null,null,"SC","L2","3.13.6[b]","Network communications traffic is allowed by exception.","Screen Share"]
[4,1,{"$f":"IF(OR(F376=\"NA\", F376=\"Met\"), 1,-1)","v":1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F377))","v":1},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F377))","v":0},{"$f":"IF(D376+E376=1, \"Met\", \"Not Met\")","v":"Met"},"SC","L2","3.13.7","Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling)."]
[4,null,null,null,null,"Met","SC","L2","3.13.7[a]","Determine if remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).","Screen Share",null,"VPN setting in firewall if not an enclave\nAVD Host Settings (GPO) in Enclave","Group Policy Manager"]
[4,3,{"$f":"IF(OR(F378=\"NA\", F378=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F379:F381))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F379:F381))","v":0},{"$f":"IF(D378+E378=3, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.8","Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards."]
[4,null,null,null,null,null,"SC","L2","3.13.8[a]","Cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified.","Document",null,"SC Policy & Procedures","NA"]
[4,null,null,null,null,null,"SC","L2","3.13.8[b]","Alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified.","Document"]
[4,null,null,null,null,null,"SC","L2","3.13.8[c]","Either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission.","Artifact",null,"Inherited from Microsoft"]
[4,1,{"$f":"IF(OR(F382=\"NA\", F382=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F383:F385))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F383:F385))","v":0},{"$f":"IF(D382+E382=3, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.9","Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity."]
[4,null,null,null,null,null,"SC","L2","3.13.9[a]","A period of inactivity to terminate network connections associated with communications sessions is defined.","Document",null,"SC Policy and AUP","Group Policy Manager"]
[4,null,null,null,null,null,"SC","L2","3.13.9[b]","Network connections associated with communications sessions are terminated at the end of the sessions.","Screen Share",null,"GPO inactivity timeout settings "]
[4,null,null,null,null,null,"SC","L2","3.13.9[c]","Network connections associated with communications sessions are terminated after the defined period of inactivity.","Screen Share"]
[4,1,{"$f":"IF(OR(F386=\"NA\", F386=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F387:F388))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F387:F389))","v":0},{"$f":"IF(D386+E386=2, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.10","Establish and manage cryptographic keys for cryptography employed in organizational systems."]
[4,null,null,null,null,null,"SC","L2","3.13.10[a]","Cryptographic keys are established whenever cryptography is employed.","Artifact",null,"Inherited from Microsoft for enclaves\nCryptographic key storage if on-premises","NA"]
[4,null,null,null,null,null,"SC","L2","3.13.10[b]","Cryptographic keys are managed whenever cryptography is employed.","Artifact"]
[4,"3 or 5",{"$f":"IF(OR(F389=\"Met\"), 5,IF(F389=\"Partial\", 3, -5))","v":-5},null,{"$f":"SUMPRODUCT(--EXACT(\"NA\", F390))","v":0},{"$f":"F390","v":0},"SC","L2","3.13.11","Employ FIPS-validated cryptography when used to protect the confidentiality of CUI."]
[4,null,null,null,null,null,"SC","L2","3.13.11[a]","Determine if FIPS-validated cryptography is employed to protect the confidentiality of CUI.","Artifact,\nand Screen Share",null,"GPO for AVD hosts showing FIPS enabled","Group Policy Manager"]
[4,1,{"$f":"IF(OR(F391=\"NA\", F391=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F392:F394))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F392:F394))","v":0},{"$f":"IF(D391+E391=3, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.12","Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device."]
[4,null,null,null,null,null,"SC","L2","3.13.12[a]","Collaborative computing devices are identified.","Document",null,"Network Diagrams","NA"]
[4,null,null,null,null,null,"SC","L2","3.13.12[b]","Collaborative computing devices provide indication to users of devices in use.","Physical Review",null,"Physical inspection of device if on premises.\nNot applicable for enclaves. "]
[4,null,null,null,null,null,"SC","L2","3.13.12[c]","Remote activation of collaborative computing devices is prohibited.","Artifact",null,"Remote activation settings if on premises. \nNot applicable for enclaves. "]
[4,1,{"$f":"IF(OR(F395=\"NA\", F395=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F396:F397))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F396:F398))","v":0},{"$f":"IF(D395+E395=2, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.13","Control and monitor the use of mobile code."]
[4,null,null,null,null,null,"SC","L2","3.13.13[a]","Use of mobile code is controlled.","Screen Share",null,"GPO settings for Defender for Endpoint (Browser based settings)\nSentinel","Group Policy Manager\nDefender for Endpoint\nSentinel"]
[4,null,null,null,null,null,"SC","L2","3.13.13[b]","Use of mobile code is monitored.","Screen Share"]
[4,1,{"$f":"IF(OR(F398=\"NA\", F398=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F399:F400))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F399:F401))","v":0},{"$f":"IF(D398+E398=2, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.14","Control and monitor the use of Voice over Internet Protocol (VoIP) technologies."]
[4,null,null,null,null,null,"SC","L2","3.13.14[a]","Use of Voice over Internet Protocol (VoIP) technologies is controlled.","Artifact",null,"Firewall Rules and Logs\nDefender for Endpoint Audit Logs in Sentinel","Defender for Endpoint\nSentinel"]
[4,null,null,null,null,null,"SC","L2","3.13.14[b]","Use of Voice over Internet Protocol (VoIP) technologies is monitored.","Artifact"]
[4,5,{"$f":"IF(OR(F401=\"NA\", F401=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F402))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F402))","v":0},{"$f":"IF(D401+E401=1, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.15","Protect the authenticity of communications sessions."]
[4,null,null,null,null,null,"SC","L2","3.13.15[a]","Determine if the authenticity of communications sessions is protected.","Screen Share",null,"GPO for AVD hosts and Explorer TLS settings","Group Policy Manager"]
[4,1,{"$f":"IF(OR(F403=\"NA\", F403=\"Met\"), 1,-1)","v":-1},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F404))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F404))","v":0},{"$f":"IF(D403+E403=1, \"Met\", \"Not Met\")","v":"Not Met"},"SC","L2","3.13.16","Protect the confidentiality of CUI at rest."]
[4,null,null,null,null,null,"SC","L2","3.13.16[a]","Determine if the confidentiality of CUI at rest is protected.","Artifact",null,"Inherited from Microsoft","NA"]
[4,5,{"$f":"IF(OR(F405=\"NA\", F405=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F406:F411))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F406:F411))","v":0},{"$f":"IF(D405+E405=6, \"Met\", \"Not Met\")","v":"Not Met"},"SI","L1","3.14.1","Identify, report, and correct system flaws in a timely manner."]
[4,null,null,null,null,null,"SI","L1","3.14.1[a]","The time within which to identify system flaws is specified.","Document",null,"SI Policy & Procedure","Defender for Endpoint\nGroup Policy Manager"]
[4,null,null,null,null,null,"SI","L1","3.14.1[b]","System flaws are identified within the specified time frame.","Screen Share",null,"Defender for Endpoint AV settings in GPO"]
[4,null,null,null,null,null,"SI","L1","3.14.1[c]","The time within which to report system flaws is specified.","Document",null,"SI Policy & Procedure"]
[4,null,null,null,null,null,"SI","L1","3.14.1[d]","System flaws are reported within the specified time frame.","Screen Share",null,"Defender for Endpoint AV settings in GPO\nIT Ticket showing flaws are being reviewed in a timely manner. "]
[4,null,null,null,null,null,"SI","L1","3.14.1[e]","The time within which to correct system flaws is specified.","Document",null,"SI Policy & Procedure"]
[4,null,null,null,null,null,"SI","L1","3.14.1[f]","System flaws are corrected within the specified time frame.","Screen Share",null,"IT Ticket showing flaw remediation"]
[4,5,{"$f":"IF(OR(F412=\"NA\", F412=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F413:F414))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F413:F415))","v":0},{"$f":"IF(D412+E412=2, \"Met\", \"Not Met\")","v":"Not Met"},"SI","L1","3.14.2","Provide protection from malicious code at designated locations within organizational systems."]
[4,null,null,null,null,null,"SI","L1","3.14.2[a]","Designated locations for malicious code protection are identified.","Document",null,"SI Policy\nNetwork Diagram","Defender for Office 365\nDefender for Endpoint\nGPO settings"]
[4,null,null,null,null,null,"SI","L1","3.14.2[b]","Protection from malicious code at designated locations is provided.","Screen Share",null,"Defender for Office 365\nDefender for Endpoint\nGPO settings"]
[4,5,{"$f":"IF(OR(F415=\"NA\", F415=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F416:F418))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F416:F418))","v":0},{"$f":"IF(D415+E415=3, \"Met\", \"Not Met\")","v":"Not Met"},"SI","L2","3.14.3","Monitor system security alerts and advisories and take action in response."]
[4,null,null,null,null,null,"SI","L2","3.14.3[a]","Response actions to system security alerts and advisories are identified.","Document",null,"SI Policy & Procedure","NA"]
[4,null,null,null,null,null,"SI","L2","3.14.3[b]","System security alerts and advisories are monitored.","Artifact",null,"Threat intelligence subscriptions\nEmail advisories from sources like CISA or Microsoft "]
[4,null,null,null,null,null,"SI","L2","3.14.3[c]","Actions in response to system security alerts and advisories are taken.","Artifact"]
[4,5,{"$f":"IF(OR(F419=\"NA\", F419=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F420))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F420))","v":0},{"$f":"IF(D419+E419=1, \"Met\", \"Not Met\")","v":"Not Met"},"SI","L1","3.14.4","Update malicious code protection mechanisms when new releases are available."]
[4,null,null,null,null,null,"SI","L1","3.14.4[a]","Determine if malicious code protection mechanisms are updated when new releases are available.","Screen Share",null,"Defender for Office 365\nDefender for Endpoint\nInherited from Microsoft","Defender for Office 365\nDefender for Endpoint"]
[4,3,{"$f":"IF(OR(F421=\"NA\", F421=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F422:F424))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F422:F424))","v":0},{"$f":"IF(D421+E421=3, \"Met\", \"Not Met\")","v":"Not Met"},"SI","L1","3.14.5","Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed."]
[4,null,null,null,null,null,"SI","L1","3.14.5[a]","The frequency for malicious code scans is defined.","Document",null,"SI Policy","Defender for Endpoint\nGroup Policy Manager"]
[4,null,null,null,null,null,"SI","L1","3.14.5[b]","Malicious code scans are performed with the defined frequency.","Screen Share",null,"GPO Settings for Defender for Endpoint (scan settings)\nSentinel"]
[4,null,null,null,null,null,"SI","L1","3.14.5[c]","Real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.","Screen Share"]
[4,5,{"$f":"IF(OR(F425=\"NA\", F425=\"Met\"), 5,-5)","v":-5},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F426:F428))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F426:F428))","v":0},{"$f":"IF(D425+E425=3, \"Met\", \"Not Met\")","v":"Not Met"},"SI","L2","3.14.6","Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks."]
[4,null,null,null,null,null,"SI","L2","3.14.6[a]","The system is monitored to detect attacks and indicators of potential attacks.","Screen Share",null,"Defender for Endpoint Logs for monitoring\nSentinel","Defender for Endpoint\nSentinel"]
[4,null,null,null,null,null,"SI","L2","3.14.6[b]","Inbound communications traffic is monitored to detect attacks and indicators of potential attacks.","Screen Share"]
[4,null,null,null,null,null,"SI","L2","3.14.6[c]","Outbound communications traffic is monitored to detect attacks and indicators of potential attacks.","Screen Share"]
[4,3,{"$f":"IF(OR(F429=\"NA\", F429=\"Met\"), 3,-3)","v":-3},{"$f":"SUMPRODUCT(--EXACT(\"Met\", F430:F431))","v":0},{"$f":"SUMPRODUCT(--EXACT(\"NA\", F430:F432))","v":0},{"$f":"IF(D429+E429=2, \"Met\", \"Not Met\")","v":"Not Met"},"SI","L2","3.14.7","Identify unauthorized use of organizational systems"]
[4,null,null,null,null,null,"SI","L2","3.14.7[a]","Authorized use of the system is defined.","Document",null,"AUP and SI Policy","Sentinel"]
[4,null,null,null,null,null,"SI","L2","3.14.7[b]","Unauthorized use of the system is identified.","Artifact",null,"Sentinel"]
[null,-313,{"$f":"SUMIF(C2:C431, \">0\", C2:C431)-1","v":1}]
[null,null,{"$f":"C432-203","v":-202}]
[null,null,null,null,null,null,null,null,"Met"]
[null,null,null,null,null,null,null,null,"Not Met"]
[null,null,null,null,null,null,null,null,"Partial"]
[]
[null,null,null,null,null,null,null,null,"Met"]
[null,null,null,null,null,null,null,null,"Not Met"]
[null,null,null,null,null,null,null,null,"NA"]
[null,null,null,null,null,null,null,null,"Partial"]