Overview
  1. ⚪03.01: Access Control
  2. ⚪03.02: Awareness and Training
  3. ⚪03.03: Audit and Accountability
  4. ⚪03.04: Configuration Management
  5. ⚪03.05: Identification and Authentication
  6. ⚪03.06: Incident Response
  7. ⚪03.07: Maintenance
  8. ⚪03.08: Media Protection
  9. ⚪03.09: Personnel Security
  10. ⚪03.10: Physical Protection
  11. ⚪03.11: Risk Assessment
  12. ⚪03.12: Security Assessment and Monitoring
  13. ⚪03.13: System and Communications Protection
  14. ⚪03.14: System and Information Integrity
  15. ⚪03.15: Planning
  16. ⚪03.16: System and Services Acquisition
  17. ⚪03.17: Supply Chain Risk Management

Requirements for 03.04: Configuration Management ⚪

Requirements from NIST 800-171 R3
  1. ⚪03.04.01: Baseline Configuration
  2. ⚪03.04.02: Configuration Settings
  3. ⚪03.04.03: Configuration Change Control
  4. ⚪03.04.04: Impact Analyses
  5. ⚪03.04.05: Access Restrictions for Change
  6. ⚪03.04.06: Least Functionality
  7. ⚪03.04.08: Authorized Software – Allow by Exception
  8. ⚪03.04.10: System Component Inventory
  9. ⚪03.04.11: Information Location
  10. ⚪03.04.12: System and Component Configuration for High-Risk Areas