System Security Plan

Organization: Northwind Defense Components, LLC
System Name: Northwind Engineering Information System (NEIS)
System Owner: Dana Whitfield, Director of Engineering (fictional) <dana.whitfield@northwind-defense.example>
ISSO: Marcus Oyelaran, IT Lead (fictional) <marcus.oyelaran@northwind-defense.example>
CAGE Code: 0DEMO
Generated: 9/19/2026

Authorization Boundary Statement

The NEIS authorization boundary comprises NWD-FS01, NWD-ERP01, eleven engineering workstations, the Entra ID tenant and the perimeter gateway. CUI is stored only on the engineering share and transmitted only through the gateway. The shop-floor kiosk and the corporate finance systems are outside the boundary and do not process CUI.

Network & Boundary Narrative

Scoped 2026-03 with the boundary diagram NWD-BD-2026-03 rev C.

CUI Categories

CTI (Controlled Technical Information)
EXPT (Export Controlled)

External Service Providers

Contoso Cloud Backup (fictional) — Backup
Inherited controls: 3.8.9

Fabrikam ERP Support (fictional) — Maintenance

Control Narratives

One section per NIST SP 800-171 Rev 2 control.

3.1.1 — Authorized Access Control [CUI Data]

Implemented

Governance narrative

Northwind implements 3.1.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.2 — Transaction & Function Control

Implemented

Governance narrative

Northwind implements 3.1.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.3 — Control CUI Flow

Implemented

Governance narrative

Northwind implements 3.1.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.4 — Separation Of Duties

Implemented

Governance narrative

Northwind implements 3.1.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.5 — Least Privilege

In Progress

Governance narrative

Northwind has not yet met 3.1.5. Least privilege is asserted, not enforced: three engineers hold local admin on the CAD workstations for driver installs. A plan of action is open.

3.1.6 — Non-Privileged Account Use

Implemented

Governance narrative

Northwind implements 3.1.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.7 — Privileged Functions

In Progress

Governance narrative

Northwind has not yet met 3.1.7. No technical control stops a standard user from running privileged functions on the shop-floor kiosk. A plan of action is open.

3.1.8 — Unsuccessful Logon Attempts

Implemented

Governance narrative

Northwind implements 3.1.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.9 — Privacy & Security Notices

In Progress

Governance narrative

Northwind has not yet met 3.1.9. Interactive logon notice is missing on two servers migrated in July. A plan of action is open.

3.1.10 — Session Lock

Implemented

Governance narrative

Northwind implements 3.1.10 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.11 — Session Termination

Implemented

Governance narrative

Northwind implements 3.1.11 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.12 — Control Remote Access

In Progress

Governance narrative

Northwind has not yet met 3.1.12. Remote maintenance sessions from the ERP vendor are not monitored or recorded. A plan of action is open.

3.1.13 — Remote Access Confidentiality

Implemented

Governance narrative

Northwind implements 3.1.13 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.14 — Remote Access Routing

Implemented

Governance narrative

Northwind implements 3.1.14 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.15 — Privileged Remote Access

Implemented

Governance narrative

Northwind implements 3.1.15 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.16 — Wireless Access Authorization

Implemented

Governance narrative

Northwind implements 3.1.16 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.17 — Wireless Access Protection

Implemented

Governance narrative

Northwind implements 3.1.17 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.18 — Mobile Device Connection

Implemented

Governance narrative

Northwind implements 3.1.18 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.19 — Encrypt CUI On Mobile

Implemented

Governance narrative

Northwind implements 3.1.19 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.20 — External Connections [CUI Data]

Implemented

Governance narrative

Northwind implements 3.1.20 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.21 — Portable Storage Use

Implemented

Governance narrative

Northwind implements 3.1.21 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.1.22 — Control Public Information [CUI Data]

Implemented

Governance narrative

Northwind implements 3.1.22 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.2.1 — Role-Based Risk Awareness

In Progress

Governance narrative

Northwind has not yet met 3.2.1. Security awareness training was delivered in 2025 but 4 of 38 staff hired since have not completed it. A plan of action is open.

3.2.2 — Role-Based Training

In Progress

Governance narrative

Northwind has not yet met 3.2.2. Role-based training for the two ISSO-designates has not been completed. A plan of action is open.

3.2.3 — Insider Threat Awareness

In Progress

Governance narrative

Northwind has not yet met 3.2.3. Insider-threat awareness has not been delivered to the engineering staff. A plan of action is open.

3.3.1 — System Auditing

Implemented

Governance narrative

Northwind implements 3.3.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.3.2 — User Accountability

Implemented

Governance narrative

Northwind implements 3.3.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.3.3 — Event Review

Implemented

Governance narrative

Northwind implements 3.3.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.3.4 — Audit Failure Alerting

In Progress

Governance narrative

Northwind has not yet met 3.3.4. No alert fires when audit logging fails on the file server. A plan of action is open.

3.3.5 — Audit Correlation

In Progress

Governance narrative

Northwind has not yet met 3.3.5. Audit review is ad hoc; no correlated review across the ERP, file server and identity provider. A plan of action is open.

3.3.6 — Reduction & Reporting

Implemented

Governance narrative

Northwind implements 3.3.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.3.7 — Authoritative Time Source

Implemented

Governance narrative

Northwind implements 3.3.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.3.8 — Audit Protection

Implemented

Governance narrative

Northwind implements 3.3.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.3.9 — Audit Management

Implemented

Governance narrative

Northwind implements 3.3.9 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.4.1 — System Baselining

Implemented

Governance narrative

Northwind implements 3.4.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.4.2 — Security Configuration Enforcement

In Progress

Governance narrative

Northwind has not yet met 3.4.2. Configuration baseline exists for servers but not for the CAD workstations. A plan of action is open.

3.4.3 — System Change Management

Implemented

Governance narrative

Northwind implements 3.4.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.4.4 — Security Impact Analysis

Implemented

Governance narrative

Northwind implements 3.4.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.4.5 — Access Restrictions For Change

Implemented

Governance narrative

Northwind implements 3.4.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.4.6 — Least Functionality

Implemented

Governance narrative

Northwind implements 3.4.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.4.7 — Nonessential Functionality

Implemented

Governance narrative

Northwind implements 3.4.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.4.8 — Application Execution Policy

In Progress

Governance narrative

Northwind has not yet met 3.4.8. Application allow-listing runs in audit-only mode on 11 workstations. A plan of action is open.

3.4.9 — User-Installed Software

In Progress

Governance narrative

Northwind has not yet met 3.4.9. User-installed software is not restricted on the CAD workstations. A plan of action is open.

3.5.1 — Identification [CUI Data]

Implemented

Governance narrative

Northwind implements 3.5.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.2 — Authentication [CUI Data]

Implemented

Governance narrative

Northwind implements 3.5.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.3 — Multifactor Authentication

Implemented

Governance narrative

Northwind implements 3.5.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.4 — Replay-Resistant Authentication

Implemented

Governance narrative

Northwind implements 3.5.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.5 — Identifier Reuse

Implemented

Governance narrative

Northwind implements 3.5.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.6 — Identifier Handling

Implemented

Governance narrative

Northwind implements 3.5.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.7 — Password Complexity

Implemented

Governance narrative

Northwind implements 3.5.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.8 — Password Reuse

Implemented

Governance narrative

Northwind implements 3.5.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.9 — Temporary Passwords

Implemented

Governance narrative

Northwind implements 3.5.9 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.10 — Cryptographically-Protected Passwords

Implemented

Governance narrative

Northwind implements 3.5.10 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.5.11 — Obscure Feedback

In Progress

Governance narrative

Northwind has not yet met 3.5.11. The ERP login form echoes the last username and reveals which of username or password was wrong. A plan of action is open.

3.6.1 — Incident Handling

Implemented

Governance narrative

Northwind implements 3.6.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.6.2 — Incident Reporting

Implemented

Governance narrative

Northwind implements 3.6.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.6.3 — Incident Response Testing

In Progress

Governance narrative

Northwind has not yet met 3.6.3. The incident response plan has not been exercised in the last 12 months. A plan of action is open.

3.7.1 — Perform Maintenance

Implemented

Governance narrative

Northwind implements 3.7.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.7.2 — System Maintenance Control

Implemented

Governance narrative

Northwind implements 3.7.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.7.3 — Equipment Sanitization

Implemented

Governance narrative

Northwind implements 3.7.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.7.4 — Media Inspection

Implemented

Governance narrative

Northwind implements 3.7.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.7.5 — Nonlocal Maintenance

Implemented

Governance narrative

Northwind implements 3.7.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.7.6 — Maintenance Personnel

Implemented

Governance narrative

Northwind implements 3.7.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.8.1 — Media Protection

Implemented

Governance narrative

Northwind implements 3.8.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.8.2 — Media Access

Implemented

Governance narrative

Northwind implements 3.8.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.8.3 — Media Disposal [CUI Data]

Implemented

Governance narrative

Northwind implements 3.8.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.8.4 — Media Markings

In Progress

Governance narrative

Northwind has not yet met 3.8.4. Printed drawings leave the engineering office without CUI markings or distribution statements. A plan of action is open.

3.8.5 — Media Accountability

Implemented

Governance narrative

Northwind implements 3.8.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.8.6 — Portable Storage Encryption

Implemented

Governance narrative

Northwind implements 3.8.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.8.7 — Removeable Media

In Progress

Governance narrative

Northwind has not yet met 3.8.7. USB mass storage is permitted on the CAD workstations. A plan of action is open.

3.8.8 — Shared Media

Implemented

Governance narrative

Northwind implements 3.8.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.8.9 — Protect Backups

Implemented

Governance narrative

Northwind implements 3.8.9 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.9.1 — Screen Individuals

Implemented

Governance narrative

Northwind implements 3.9.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.9.2 — Personnel Actions

Implemented

Governance narrative

Northwind implements 3.9.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.10.1 — Limit Physical Access [CUI Data]

Inherited

No narrative yet.

3.10.2 — Monitor Facility

Inherited

No narrative yet.

3.10.3 — Escort Visitors [CUI Data]

Implemented

Governance narrative

Northwind implements 3.10.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.10.4 — Physical Access Logs [CUI Data]

Inherited

No narrative yet.

3.10.5 — Manage Physical Access [CUI Data]

Inherited

No narrative yet.

3.10.6 — Alternative Work Sites

Implemented

Governance narrative

Northwind implements 3.10.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.11.1 — Risk Assessments

In Progress

Governance narrative

Northwind has not yet met 3.11.1. The last documented risk assessment is dated 2024 and predates the ERP migration. A plan of action is open.

3.11.2 — Vulnerability Scan

Implemented

Governance narrative

Northwind implements 3.11.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.11.3 — Vulnerability Remediation

Implemented

Governance narrative

Northwind implements 3.11.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.12.1 — Security Control Assessment

In Progress

Governance narrative

Northwind has not yet met 3.12.1. No periodic self-assessment of control effectiveness has been recorded. A plan of action is open.

3.12.2 — Operational Plan Of Action

Implemented

Governance narrative

Northwind implements 3.12.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.12.3 — Security Control Monitoring

Implemented

Governance narrative

Northwind implements 3.12.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.12.4 — System Security Plan

Implemented

Governance narrative

Northwind implements 3.12.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.1 — Boundary Protection [CUI Data]

In Progress

Governance narrative

Northwind has not yet met 3.13.1. The file server has a public IP for the vendor VPN endpoint; boundary protection relies on host firewall alone. A plan of action is open.

3.13.2 — Security Engineering

Implemented

Governance narrative

Northwind implements 3.13.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.3 — Role Separation

Implemented

Governance narrative

Northwind implements 3.13.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.4 — Shared Resource Control

Implemented

Governance narrative

Northwind implements 3.13.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.5 — Public-Access System Separation [CUI Data]

Implemented

Governance narrative

Northwind implements 3.13.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.6 — Network Communication By Exception

Implemented

Governance narrative

Northwind implements 3.13.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.7 — Split Tunneling

Implemented

Governance narrative

Northwind implements 3.13.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.8 — Data In Transit

Implemented

Governance narrative

Northwind implements 3.13.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.9 — Connections Termination

Implemented

Governance narrative

Northwind implements 3.13.9 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.10 — Key Management

Implemented

Governance narrative

Northwind implements 3.13.10 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.11 — CUI Encryption

In Progress

Governance narrative

Northwind has not yet met 3.13.11. Backups are encrypted with a module that is not CMVP-validated. A plan of action is open.

3.13.12 — Collaborative Device Control

In Progress

Governance narrative

Northwind has not yet met 3.13.12. Collaborative computing devices (conference-room camera) have no indicator-of-use control documented. A plan of action is open.

3.13.13 — Mobile Code

Implemented

Governance narrative

Northwind implements 3.13.13 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.14 — Voice Over Internet Protocol

Implemented

Governance narrative

Northwind implements 3.13.14 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.15 — Communications Authenticity

Implemented

Governance narrative

Northwind implements 3.13.15 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.13.16 — Data At Rest

Implemented

Governance narrative

Northwind implements 3.13.16 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.14.1 — Flaw Remediation [CUI Data]

Implemented

Governance narrative

Northwind implements 3.14.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.14.2 — Malicious Code Protection [CUI Data]

Implemented

Governance narrative

Northwind implements 3.14.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.14.3 — Security Alerts & Advisories

Implemented

Governance narrative

Northwind implements 3.14.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.14.4 — Update Malicious Code Protection [CUI Data]

Implemented

Governance narrative

Northwind implements 3.14.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.14.5 — System & File Scanning [CUI Data]

Implemented

Governance narrative

Northwind implements 3.14.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.

3.14.6 — Monitor Communications For Attacks

In Progress

Governance narrative

Northwind has not yet met 3.14.6. Inbound and outbound traffic is not monitored for indicators of attack; only firewall logs are kept. A plan of action is open.

3.14.7 — Identify Unauthorized Use

Implemented

Governance narrative

Northwind implements 3.14.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance registers; see the linked evidence and the SSP.

Technical narrative

Configured on NWD-FS01, NWD-ERP01 and the CAD workstation OU; validated weekly.