Security Controls

Authorized Access Control [CUI Data]

Northwind implements 3.1.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Transaction & Function Control

Northwind implements 3.1.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Control CUI Flow

Northwind implements 3.1.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Separation Of Duties

Northwind implements 3.1.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Least Privilege

Northwind has not yet met 3.1.5. Least privilege is asserted, not enforced: three engineers hold local admin on the CAD …

Non-Privileged Account Use

Northwind implements 3.1.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Privileged Functions

Northwind has not yet met 3.1.7. No technical control stops a standard user from running privileged functions on the sho…

Unsuccessful Logon Attempts

Northwind implements 3.1.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Privacy & Security Notices

Northwind has not yet met 3.1.9. Interactive logon notice is missing on two servers migrated in July. A plan of action i…

Session Lock

Northwind implements 3.1.10 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Session Termination

Northwind implements 3.1.11 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Control Remote Access

Northwind has not yet met 3.1.12. Remote maintenance sessions from the ERP vendor are not monitored or recorded. A plan …

Remote Access Confidentiality

Northwind implements 3.1.13 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Remote Access Routing

Northwind implements 3.1.14 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Privileged Remote Access

Northwind implements 3.1.15 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Wireless Access Authorization

Northwind implements 3.1.16 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Wireless Access Protection

Northwind implements 3.1.17 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Mobile Device Connection

Northwind implements 3.1.18 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Encrypt CUI On Mobile

Northwind implements 3.1.19 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

External Connections [CUI Data]

Northwind implements 3.1.20 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Portable Storage Use

Northwind implements 3.1.21 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Control Public Information [CUI Data]

Northwind implements 3.1.22 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Role-Based Risk Awareness

Northwind has not yet met 3.2.1. Security awareness training was delivered in 2025 but 4 of 38 staff hired since have no…

Role-Based Training

Northwind has not yet met 3.2.2. Role-based training for the two ISSO-designates has not been completed. A plan of actio…

Insider Threat Awareness

Northwind has not yet met 3.2.3. Insider-threat awareness has not been delivered to the engineering staff. A plan of act…

System Auditing

Northwind implements 3.3.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

User Accountability

Northwind implements 3.3.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Event Review

Northwind implements 3.3.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Audit Failure Alerting

Northwind has not yet met 3.3.4. No alert fires when audit logging fails on the file server. A plan of action is open.

Audit Correlation

Northwind has not yet met 3.3.5. Audit review is ad hoc; no correlated review across the ERP, file server and identity p…

Reduction & Reporting

Northwind implements 3.3.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Authoritative Time Source

Northwind implements 3.3.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Audit Protection

Northwind implements 3.3.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Audit Management

Northwind implements 3.3.9 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

System Baselining

Northwind implements 3.4.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Security Configuration Enforcement

Northwind has not yet met 3.4.2. Configuration baseline exists for servers but not for the CAD workstations. A plan of a…

System Change Management

Northwind implements 3.4.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Security Impact Analysis

Northwind implements 3.4.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Access Restrictions For Change

Northwind implements 3.4.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Least Functionality

Northwind implements 3.4.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Nonessential Functionality

Northwind implements 3.4.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Application Execution Policy

Northwind has not yet met 3.4.8. Application allow-listing runs in audit-only mode on 11 workstations. A plan of action …

User-Installed Software

Northwind has not yet met 3.4.9. User-installed software is not restricted on the CAD workstations. A plan of action is …

Identification [CUI Data]

Northwind implements 3.5.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Authentication [CUI Data]

Northwind implements 3.5.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Multifactor Authentication

Northwind implements 3.5.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Replay-Resistant Authentication

Northwind implements 3.5.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Identifier Reuse

Northwind implements 3.5.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Identifier Handling

Northwind implements 3.5.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Password Complexity

Northwind implements 3.5.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Password Reuse

Northwind implements 3.5.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Temporary Passwords

Northwind implements 3.5.9 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Cryptographically-Protected Passwords

Northwind implements 3.5.10 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Obscure Feedback

Northwind has not yet met 3.5.11. The ERP login form echoes the last username and reveals which of username or password …

Incident Handling

Northwind implements 3.6.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Incident Reporting

Northwind implements 3.6.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Incident Response Testing

Northwind has not yet met 3.6.3. The incident response plan has not been exercised in the last 12 months. A plan of acti…

Perform Maintenance

Northwind implements 3.7.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

System Maintenance Control

Northwind implements 3.7.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Equipment Sanitization

Northwind implements 3.7.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Media Inspection

Northwind implements 3.7.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Nonlocal Maintenance

Northwind implements 3.7.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Maintenance Personnel

Northwind implements 3.7.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Media Protection

Northwind implements 3.8.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Media Access

Northwind implements 3.8.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Media Disposal [CUI Data]

Northwind implements 3.8.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Media Markings

Northwind has not yet met 3.8.4. Printed drawings leave the engineering office without CUI markings or distribution stat…

Media Accountability

Northwind implements 3.8.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Portable Storage Encryption

Northwind implements 3.8.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Removeable Media

Northwind has not yet met 3.8.7. USB mass storage is permitted on the CAD workstations. A plan of action is open.

Shared Media

Northwind implements 3.8.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Protect Backups

Northwind implements 3.8.9 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Screen Individuals

Northwind implements 3.9.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Personnel Actions

Northwind implements 3.9.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance re…

Limit Physical Access [CUI Data]

Monitor Facility

Escort Visitors [CUI Data]

Northwind implements 3.10.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Physical Access Logs [CUI Data]

Manage Physical Access [CUI Data]

Alternative Work Sites

Northwind implements 3.10.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Risk Assessments

Northwind has not yet met 3.11.1. The last documented risk assessment is dated 2024 and predates the ERP migration. A pl…

Vulnerability Scan

Northwind implements 3.11.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Vulnerability Remediation

Northwind implements 3.11.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Security Control Assessment

Northwind has not yet met 3.12.1. No periodic self-assessment of control effectiveness has been recorded. A plan of acti…

Operational Plan Of Action

Northwind implements 3.12.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Security Control Monitoring

Northwind implements 3.12.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

System Security Plan

Northwind implements 3.12.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Boundary Protection [CUI Data]

Northwind has not yet met 3.13.1. The file server has a public IP for the vendor VPN endpoint; boundary protection relie…

Security Engineering

Northwind implements 3.13.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Role Separation

Northwind implements 3.13.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Shared Resource Control

Northwind implements 3.13.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Public-Access System Separation [CUI Data]

Northwind implements 3.13.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Network Communication By Exception

Northwind implements 3.13.6 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Split Tunneling

Northwind implements 3.13.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Data In Transit

Northwind implements 3.13.8 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Connections Termination

Northwind implements 3.13.9 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Key Management

Northwind implements 3.13.10 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance …

CUI Encryption

Northwind has not yet met 3.13.11. Backups are encrypted with a module that is not CMVP-validated. A plan of action is o…

Collaborative Device Control

Northwind has not yet met 3.13.12. Collaborative computing devices (conference-room camera) have no indicator-of-use con…

Mobile Code

Northwind implements 3.13.13 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance …

Voice Over Internet Protocol

Northwind implements 3.13.14 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance …

Communications Authenticity

Northwind implements 3.13.15 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance …

Data At Rest

Northwind implements 3.13.16 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance …

Flaw Remediation [CUI Data]

Northwind implements 3.14.1 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Malicious Code Protection [CUI Data]

Northwind implements 3.14.2 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Security Alerts & Advisories

Northwind implements 3.14.3 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Update Malicious Code Protection [CUI Data]

Northwind implements 3.14.4 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

System & File Scanning [CUI Data]

Northwind implements 3.14.5 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…

Monitor Communications For Attacks

Northwind has not yet met 3.14.6. Inbound and outbound traffic is not monitored for indicators of attack; only firewall …

Identify Unauthorized Use

Northwind implements 3.14.7 on the NEIS boundary. Evidence is collected by the weekly hardening run and the governance r…