Every requirement, in plain language, with the evidence to keep, the values you'll need to set, the audit script check where one exists, and links to the standard and to the matching reading on hans.study. The 13 Level 1 requirements are marked.
The standard's wording for each requirement is in ITSP.10.171. The descriptions here are plain-language readings, not a substitute for the standard.
| Code | Family | Requirements | At Level 1 |
|---|---|---|---|
| 01 | Access control | 16 | 4 |
| 02 | Awareness and training | 2 | |
| 03 | Audit and accountability | 8 | |
| 04 | Configuration management | 10 | |
| 05 | Identification and authentication | 8 | 3 |
| 06 | Incident response | 5 | |
| 07 | Maintenance | 3 | |
| 08 | Media protection | 7 | 1 |
| 09 | Personnel security | 2 | |
| 10 | Physical protection | 5 | 2 |
| 11 | Risk assessment | 3 | |
| 12 | Security assessment and monitoring | 4 | |
| 13 | System and communications protection | 10 | 1 |
| 14 | System and information integrity | 6 | 2 |
| 15 | Planning | 3 | |
| 16 | System and services acquisition | 3 | |
| 17 | Supply chain risk management | 3 |
- Level 1 checklist: the 13 requirements with the evidence to keep and the filing steps
- Level 1 crosswalk: the 13 against NIST SP 800-171 Rev 3 and Rev 2 and CMMC Level 1
| ID | Requirement | Level 1 | Script |
|---|---|---|---|
03.01.01 |
Account management | Level 1 | yes |
03.01.02 |
Access enforcement | Level 1 | |
03.01.03 |
Information flow enforcement | ||
03.01.04 |
Separation of duties | ||
03.01.05 |
Least privilege | yes | |
03.01.06 |
Least privilege (privileged accounts) | manual | |
03.01.07 |
Least privilege (privileged functions) | ||
03.01.08 |
Unsuccessful logon attempts | yes | |
03.01.09 |
System use notification | ||
03.01.10 |
Device lock | yes | |
03.01.11 |
Session termination | ||
03.01.12 |
Remote access | yes | |
03.01.16 |
Wireless access | ||
03.01.18 |
Access control for mobile devices | ||
03.01.20 |
Use of external systems | Level 1 | |
03.01.22 |
Publicly accessible content | Level 1 | |
03.02.01 |
Literacy training and awareness | ||
03.02.02 |
Role-based training | ||
03.03.01 |
Event logging | yes | |
03.03.02 |
Audit record content | ||
03.03.03 |
Audit record generation | ||
03.03.04 |
Response to audit logging process failures | ||
03.03.05 |
Audit record review, analysis, and reporting | ||
03.03.06 |
Audit record reduction and report generation | ||
03.03.07 |
Time stamps | yes | |
03.03.08 |
Protection of audit information | ||
03.04.01 |
Baseline configuration | ||
03.04.02 |
Configuration settings | ||
03.04.03 |
Configuration change control | ||
03.04.04 |
Impact analyses | ||
03.04.05 |
Access restrictions for change | ||
03.04.06 |
Least functionality | yes | |
03.04.08 |
Authorized software (allow by exception) | ||
03.04.10 |
System component inventory | ||
03.04.11 |
Information location | ||
03.04.12 |
System and component configuration for high-risk areas | ||
03.05.01 |
User identification, authentication, and re-authentication | Level 1 | |
03.05.02 |
Device identification and authentication | Level 1 | |
03.05.03 |
Multi-factor authentication | Level 1 | manual |
03.05.04 |
Replay-resistant authentication | ||
03.05.05 |
Identifier management | ||
03.05.07 |
Password management | yes | |
03.05.11 |
Authentication feedback | ||
03.05.12 |
Authenticator management | ||
03.06.01 |
Incident handling | ||
03.06.02 |
Incident monitoring, reporting, and response assistance | ||
03.06.03 |
Incident response testing | ||
03.06.04 |
Incident response training | ||
03.06.05 |
Incident response plan | ||
03.07.04 |
Maintenance tools | ||
03.07.05 |
Non-local maintenance | ||
03.07.06 |
Maintenance personnel | ||
03.08.01 |
Media storage | ||
03.08.02 |
Media access | ||
03.08.03 |
Media sanitization | Level 1 | |
03.08.04 |
Media marking | ||
03.08.05 |
Media transport | ||
03.08.07 |
Media use | yes | |
03.08.09 |
System backup (cryptographic protection) | ||
03.09.01 |
Personnel screening | ||
03.09.02 |
Personnel termination and transfer | ||
03.10.01 |
Physical access authorizations | Level 1 | |
03.10.02 |
Monitoring physical access | ||
03.10.06 |
Alternate work site | ||
03.10.07 |
Physical access control | Level 1 | |
03.10.08 |
Access control for transmission | ||
03.11.01 |
Risk assessment | ||
03.11.02 |
Vulnerability monitoring and scanning | ||
03.11.04 |
Risk response | ||
03.12.01 |
Security assessment | ||
03.12.02 |
Plan of action and milestones | ||
03.12.03 |
Continuous monitoring | ||
03.12.05 |
Information exchange | ||
03.13.01 |
Boundary protection | Level 1 | yes |
03.13.04 |
Information in shared system resources | ||
03.13.06 |
Network communications, deny by default, allow by exception | ||
03.13.08 |
Transmission and storage confidentiality | yes | |
03.13.09 |
Network disconnect | ||
03.13.10 |
Cryptographic key establishment and management | ||
03.13.11 |
Cryptographic protection | yes | |
03.13.12 |
Collaborative computing devices and applications | ||
03.13.13 |
Mobile code | ||
03.13.15 |
Session authenticity | ||
03.14.01 |
Flaw remediation | Level 1 | yes |
03.14.02 |
Malicious code protection | Level 1 | yes |
03.14.03 |
Security alerts, advisories, and directives | ||
03.14.06 |
System monitoring | ||
03.14.08 |
Information management and retention | ||
03.14.09 |
Dedicated administration workstation | manual | |
03.15.01 |
Policy and procedures | ||
03.15.02 |
System security plan | ||
03.15.03 |
Rules of behaviour | ||
03.16.01 |
Security engineering principles | ||
03.16.02 |
Unsupported system components | ||
03.16.03 |
External system services | ||
03.17.01 |
Supply chain risk management plan | ||
03.17.02 |
Acquisition strategies, tools, and methods | ||
03.17.03 |
Supply chain requirements and processes |
"Script" means the endpoint audit checks something for the requirement, or lists items for manual review. See scripts/.
Identifiers match NIST SP 800-171 Rev 3. The ones NIST withdrew stay in the Canadian numbering as "not allocated," which is why the sequence has gaps. 03.14.09 is the one requirement Canada added.