5 Security requirement implementation
Each statement below is the approved (or pending) implementation statement for a NIST SP 800-171 r2 requirement and its 800-171A assessment objectives, compiled from the Implementation workspace. Responsibility is stated per requirement; see Appendix A for the provider matrix.
5.1Access Control
3.141 of 59 objectives approvedLimit system access to authorized users, processes acting on behalf of users, and devices
Enclave access is granted only to accounts approved through the User Access Provisioning Procedure [1] and enforced by Okta and AD group membership as set by the Access Control Policy [2]. Only Intune-compliant, domain-joined endpoints can connect. IT Operations reviews access quarterly with data owners [3].
Monitor and control remote access sessions
- [1]PRC-011User Access Provisioning Procedure, §2–3
- [2]POL-004Access Control Policy, §4.1 Account management
- [3]EVD-0302Access review sign-off — ERP Q2.xlsxDue soon
5.2Awareness and Training
3.29 of 9 objectives approved9 of 9 objective statements written, 9 approved · owner Sofia Alvarez.
5.3Audit and Accountability
3.324 of 30 objectives approved26 of 30 objective statements written, 24 approved · owner Tom Okafor.
5.4Configuration Management
3.418 of 33 objectives approved24 of 33 objective statements written, 18 approved · owner Tom Okafor.
5.5Identification and Authentication
3.518 of 24 objectives approvedAcme identifies every user, process and device before granting access to the CUI enclave [1]. Identities are mastered in Okta and provisioned to Microsoft 365 GCC High and on-prem Active Directory through the User Access Provisioning Procedure [2]. Authenticator strength, MFA and password rules are set by the Access Control Policy [3] and enforced technically by Okta, Duo and AD group policy.
Identify system users, processes acting on behalf of users, and devices
Authenticate the identities of users, processes, or devices before allowing access
Users authenticate to Okta (SAML / OIDC) before reaching any enclave resource [6]; devices present Intune certificates. BlueRidge operates the Okta tenant; Acme approves every account [7].
BlueRidge Managed IT — MSP operates the Okta tenant; Acme approves accounts (CRM row IA-04).
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts
MFA is required for all network access through Okta with Duo push or FIDO2 keys [8][9]. Privileged administrators use FIDO2 hardware keys for console and RDP access to enclave servers via Duo for Windows Logon [10]. Enrollment is verified monthly from the Duo enrollment report [11]. Four legacy CAD servers are not yet covered; see CAPA-024 [12].
BlueRidge Managed IT — MSP operates Duo and Okta tenants; Acme owns enrollment and exceptions (CRM row IA-07).
Privileged accounts are identified.
Privileged accounts are members of the AD group "Enclave-Admins" and the Okta group "Priv-Admins", reconciled quarterly against the privileged account register [13].
MFA is implemented for local access to privileged accounts.
Local console logon to enclave servers requires Duo for Windows Logon with a FIDO2 key [10].
MFA is implemented for network access to privileged accounts.
Inherited from the requirement statement: network access for privileged accounts goes through Okta with FIDO2 [11].
- [1]POL-001Information Security Policy, §6
- [2]PRC-011User Access Provisioning Procedure, §2–3
- [3]POL-004Access Control Policy, §4
- [4]PRC-011User Access Provisioning Procedure, §2 Joiners
- [5]AST-0108Siemens NX workstation pool
- [6]POL-004Access Control Policy, §4.2 Authentication
- [7]VND-011BlueRidge Managed IT — CRM v3
- [8]POL-004Access Control Policy, §4.3 Multifactor authentication
- [9]PLN-002System Security Plan (CUI enclave), §5.3Draft
- [10]AST-0112eng-fs-01 (and enclave servers)
- [11]EVD-0311Duo MFA enrollment report — Sep 2026.pdf
- [12]PRC-011User Access Provisioning Procedure, §3.2
- [13]EVD-0302Access review sign-off — ERP Q2.xlsxDue soon
- [14]PRC-011User Access Provisioning Procedure, Step 7
5.6Incident Response
3.614 of 14 objectives approved14 of 14 objective statements written, 14 approved · owner Dana Whitfield.
5.7Maintenance
3.78 of 14 objectives approved10 of 14 objective statements written, 8 approved · owner Tom Okafor.
5.8Media Protection
3.812 of 27 objectives approvedProtect the confidentiality of backup CUI at storage locations
Backups are encrypted with AES-256 by Atlas Cloud Backup [1].
Atlas Cloud Backup — Provider assurance expired 2026-09-01 — inheritance cannot be relied on until refreshed.
- [1]VND-009Atlas Cloud Backup — SOC 2 (expired)Expired
5.9Personnel Security
3.94 of 4 objectives approved4 of 4 objective statements written, 4 approved · owner Sofia Alvarez.
5.10Physical Protection
3.1015 of 16 objectives approved16 of 16 objective statements written, 15 approved · owner Priya Natarajan.
5.11Risk Assessment
3.118 of 10 objectives approved8 of 10 objective statements written, 8 approved · owner Marcus Lee.
5.12Security Assessment
3.129 of 13 objectives approved11 of 13 objective statements written, 9 approved · owner Marcus Lee.
5.13System and Communications Protection
3.1323 of 43 objectives approvedEmploy FIPS-validated cryptography when used to protect the confidentiality of CUI
Data at rest and in transit in Microsoft 365 GCC High uses FIPS 140-validated modules operated by Microsoft [1]. On-prem file shares use BitLocker in FIPS mode [2]; legacy NAS replication is not yet FIPS-validated (POA&M) [3].
Microsoft 365 GCC High — Inherited for cloud workloads per Microsoft CRM; on-prem remains Acme.
- [1]AST-0097Microsoft 365 GCC High — customer responsibility matrix
- [2]WI-031BitLocker FIPS configuration
- [3]PLN-002System Security Plan, POA&M-07Draft
5.14System and Information Integrity
3.1411 of 24 objectives approved14 of 24 objective statements written, 11 approved · owner Tom Okafor.