Man looking at a action plan

How to fill out your POA&M

Your POA&M is your Plan of Action and Milestone document. Here are some key strategies and best practices that you need to observe when you are filling out your POA&M document. Through the course of your audit and your security analysis or your compliance audit, information system audit or any other IT-based audits you are…

Compliance risk man in the computer

NIST 800 -171 3.1.4

Separate the duties of individuals to reduce the risk of malevolent activity without collusion Malevolent Activity is when someone is trying to inflict harm on an entity like a person, government or company. Organizations must separate CUI handling and processing based tasks that employees work on in order to minimize the chance that they could…

NIST 800 – 171 3.1.3

3.1.3 Control the flow of CUI in accordance with approved authorizations CUI is Controlled Unclassified Information. This is the data that needs to be protected and you need to protect how it arrives, who has access to it, who might have access to where it is stored, how it is stored, etc. You need to…

NIST 800 – 171 3.1.2

Limit information system access to the types of transactions and functions that authorized users are permitted to execute. Once you have a domain and you have identified who will have access to the sensitive data, you will want to restrict access to those systems from any ordinary user or member of your network from accessing…