Home
Browse frameworks
Contact us
SAMMY premium
Sign in
SAMMY works best on screens 1024px wide or larger.
NIST 800-171 Rev 2
Browse NIST 800-171...
AIMA
ASVS
BSIMM 15
CIS Critical Security Controls
Cloud Controls Matrix
Cybersecurity Fundamentals
Cybersecurity Fundamentals 2.0
DSOMM
NIS2
NIST 800-171 Rev 2
NIST 800-171 Rev 3
NIST 800-34
NIST 800-53 v5
NIST CSF 2.0
NIST SSDF
OpenSAMM1.5
SAMM
Secure Controls Framework
Access Control
Account Management
Access Enforcement
Information Flow Enforcement
Separation of Duties
Least Privilege
Least Privilege – Privileged Accounts
Least Privilege – Privileged Functions
Unsuccessful Logon Attempts
System Use Notification
Device Lock
Session Termination
Remote Access - Automated Monitoring and Control
Awareness and Training
Remote Access - Protection of Confidentiality and Integrity Using Encryption
Security Awareness Training
Role-Based Security Training
Security Awareness Training - Insider Threat
Audit and Accountability
Remote Access - Managed Access Control Points
Event Logging
Audit Record Content
Event Logging - Review and Updates
Response to Audit Logging Process Failures
Audit Record Review, Analysis, and Reporting
Audit Record Reduction and Report Generation
Time Stamps
Protection of Audit Information
Protection of Audit Information - Access by Subset of Privileged Users
Configuration Management
Remote Access - Privileged Commands
Baseline Configuration
Configuration Settings
Configuration Change Control
Impact Analyses
Access Restrictions for Change
Least Functionality
Least Functionality - Periodic Review
Authorized Software – Allow by Exception
User-Installed Software
Identification and Authentication
Wireless Access
User Identification and Authentication
Device Identification and Authentication
Multi-Factor Authentication
Replay-Resistant Authentication
Identifier Management
Identifier Management - Disabling
Password Management
Password Management - Prohibit Reuse
Password Management - Temporary Passwords Immediate Change
Password Management - Storage and Transmission
Authentication Feedback
Incident Response
Wireless Access - Autentication and Encryption
Incident Handling
Incident Monitoring, Reporting, and Response Assistance
Incident Response Testing
Maintenance
Access Control for Mobile Devices
Controlled Maintenance
Maintenant Tools
Equipment Maintenance
Maintenance Tools - Inspect Media
Nonlocal Maintenance
Maintenance Personnel
Media Protection
Access Control for Mobile Devices - Full Device Encryption
Media Storage
Media Access
Media Sanitization
Media Marking
Media Transport
Media Transport - Cryptographic Protection
Media Use
Media Use - Prohibit Use Without Owner
System Backup – Cryptographic Protection
Personnel Security
Use of External Systems
Personnel Screening
Personnel Termination and Transfer
Physical Protection
Use of External Systems
Physical Access Authorizations
Monitoring Physical Access
Visitor monitoring
Physical Access Audit Logs
Physical Access Device Management
Alternate Work Site
Risk Assessment
Publicly Accessible Content
Risk Assessment
Vulnerability Monitoring and Scanning
Vulnerability Remediation
Security Assessment and Monitoring
Security Assessment
Plan of Action and Milestones
Continuous Monitoring
System Security Plan
System and Communications Protection
Boundary Protection
Security Engineering Principles
Application Partitioning
Information in Shared System Resources
Boundary Protection
Boundary Protection – Deny by Default – Allow by Exception
Boundary Protection - Prevent Split Tunneling for Remote Devices
Transmission and Storage Confidentiality
Network Disconnect
Cryptographic Key Establishment and Management
Cryptographic Protection
Collaborative Computing Devices and Applications
Mobile Code
Voice over Internet Protocol
Session Authenticity
Protection of Information at Rest
System and Information Integrity
Flaw Remediation
Malicious Code Protection
Security Alerts, Advisories, and Directives
Malicious Code Protection - New Releases
Malicious Code Protection - Periodic Scans
System Monitoring
System Monitoring - Unauthorized Use
03.05.08: Password Management - Prohibit Reuse
Password Management - Prohibit Reuse
03.05.08: Password Management - Prohibit Reuse
Prohibit password reuse for a specified number of generations.
Implementation
Not applicable - Not applicable
Planned - The implementation is planned
In progress - The implementation is currently in progress
Partially implemented - The control is partially implemented
Implemented - The control is fully implemented
Alternative implementation - There is an alternative implementation in place (e.g., shared responsibility or inherited implementation)
Not applicable
Planned
In progress
Partially implemented
Implemented
Alternative implementation
Description
Password lifetime restrictions do not apply to temporary passwords