NIST SP 800-171 Revision 3 control library
Every control CMDash tracks for NIST SP 800-171 Revision 3, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
97 controls17 families0 mapped to other frameworks97 with authoritative text
Families
Access Control · 16Awareness and Training · 2Audit and Accountability · 8Configuration Management · 10Identification and Authentication · 8Incident Response · 5Maintenance · 3Media Protection · 7Personnel Security · 2Physical Protection · 5Risk Assessment · 3Security Assessment and Monitoring · 4System and Communications Protection · 10System and Information Integrity · 5Planning · 3System and Services Acquisition · 3Supply Chain Risk Management · 3
Access Control · 16
| 03.01.01 | Account Management |
| 03.01.02 | Access Enforcement |
| 03.01.03 | Information Flow Enforcement |
| 03.01.04 | Separation of Duties |
| 03.01.05 | Least Privilege |
| 03.01.06 | Least Privilege – Privileged Accounts |
| 03.01.07 | Least Privilege – Privileged Functions |
| 03.01.08 | Unsuccessful Logon Attempts |
| 03.01.09 | System Use Notification |
| 03.01.10 | Device Lock |
| 03.01.11 | Session Termination |
| 03.01.12 | Remote Access |
| 03.01.16 | Wireless Access |
| 03.01.18 | Access Control for Mobile Devices |
| 03.01.20 | Use of External Systems |
| 03.01.22 | Publicly Accessible Content |
Awareness and Training · 2
| 03.02.01 | Literacy Training and Awareness |
| 03.02.02 | Role-Based Training |
Audit and Accountability · 8
| 03.03.01 | Event Logging |
| 03.03.02 | Audit Record Content |
| 03.03.03 | Audit Record Generation |
| 03.03.04 | Response to Audit Logging Process Failures |
| 03.03.05 | Audit Record Review, Analysis, and Reporting |
| 03.03.06 | Audit Record Reduction and Report Generation |
| 03.03.07 | Time Stamps |
| 03.03.08 | Protection of Audit Information |
Configuration Management · 10
| 03.04.01 | Baseline Configuration |
| 03.04.02 | Configuration Settings |
| 03.04.03 | Configuration Change Control |
| 03.04.04 | Impact Analyses |
| 03.04.05 | Access Restrictions for Change |
| 03.04.06 | Least Functionality |
| 03.04.08 | Authorized Software – Allow by Exception |
| 03.04.10 | System Component Inventory |
| 03.04.11 | Information Location |
| 03.04.12 | System and Component Configuration for High-Risk Areas |
Identification and Authentication · 8
| 03.05.01 | User Identification and Authentication |
| 03.05.02 | Device Identification and Authentication |
| 03.05.03 | Multi-Factor Authentication |
| 03.05.04 | Replay-Resistant Authentication |
| 03.05.05 | Identifier Management |
| 03.05.07 | Password Management |
| 03.05.11 | Authentication Feedback |
| 03.05.12 | Authenticator Management |
Incident Response · 5
| 03.06.01 | Incident Handling |
| 03.06.02 | Incident Monitoring, Reporting, and Response Assistance |
| 03.06.03 | Incident Response Testing |
| 03.06.04 | Incident Response Training |
| 03.06.05 | Incident Response Plan |
Maintenance · 3
| 03.07.04 | Maintenance Tools |
| 03.07.05 | Nonlocal Maintenance |
| 03.07.06 | Maintenance Personnel |
Media Protection · 7
| 03.08.01 | Media Storage |
| 03.08.02 | Media Access |
| 03.08.03 | Media Sanitization |
| 03.08.04 | Media Marking |
| 03.08.05 | Media Transport |
| 03.08.07 | Media Use |
| 03.08.09 | System Backup – Cryptographic Protection |
Personnel Security · 2
| 03.09.01 | Personnel Screening |
| 03.09.02 | Personnel Termination and Transfer |
Physical Protection · 5
| 03.10.01 | Physical Access Authorizations |
| 03.10.02 | Monitoring Physical Access |
| 03.10.06 | Alternate Work Site |
| 03.10.07 | Physical Access Control |
| 03.10.08 | Access Control for Transmission |
Risk Assessment · 3
| 03.11.01 | Risk Assessment |
| 03.11.02 | Vulnerability Monitoring and Scanning |
| 03.11.04 | Risk Response |
Security Assessment and Monitoring · 4
| 03.12.01 | Security Assessment |
| 03.12.02 | Plan of Action and Milestones |
| 03.12.03 | Continuous Monitoring |
| 03.12.05 | Information Exchange |
System and Communications Protection · 10
System and Information Integrity · 5
| 03.14.01 | Flaw Remediation |
| 03.14.02 | Malicious Code Protection |
| 03.14.03 | Security Alerts, Advisories, and Directives |
| 03.14.06 | System Monitoring |
| 03.14.08 | Information Management and Retention |
Planning · 3
| 03.15.01 | Policy and Procedures |
| 03.15.02 | System Security Plan |
| 03.15.03 | Rules of Behavior |
System and Services Acquisition · 3
| 03.16.01 | Security Engineering Principles |
| 03.16.02 | Unsupported System Components |
| 03.16.03 | External System Services |
Supply Chain Risk Management · 3
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for NIST SP 800-171 Revision 3 Rev 3, published from a build-time export rather than read from any customer’s workspace. Control text is quoted verbatim from NIST SP 800-171 Rev 3, which is in the public domain. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.