# Level 1 and 2 task list

## Access control (AC)&#x20;

Lvl1&#x20;

1\. Limit information system access to authorized users, process acting on behalf of authorized users, or devices (including other information systems)&#x20;

2\. Limit information system access to the types of transactions and functions that authorized uses are permitted to execute&#x20;

3\. Verify and control/limit connections to and use of external information systems &#x20;

4\. Control information posted or processed on publicly accessible information systems&#x20;

&#x20;

Lvl2&#x20;

5\. Communicate security details to users when dealing with CUI([Controlled Unclassified Information](https://www.dcsa.mil/mc/isd/cui/))&#x20;

6\. Control which storage devices are used and limit portable mediums&#x20;

7\. Give users only the privileges necessary to complete a designated task&#x20;

8\. Use privileged accounts only when necessary&#x20;

9\. Allow only a set number of login attempts for user accounts&#x20;

10\. Lock user sessions when inactive for a certain amount of time&#x20;

11\. Remote connections are validated before they are allowed&#x20;

12\. Remote connections are monitored in a controlled environment&#x20;

13\. Remote connections are routed to managed nodes&#x20;

14\. CUI ([Controlled Unclassified Information](https://www.dcsa.mil/mc/isd/cui/)) is used according to established guidelines&#x20;

## Identification and Authentication (IA)&#x20;

Lvl1&#x20;

15\. Identify information system user processes acting on behalf of users, or devices&#x20;

16\. Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems&#x20;

Lvl2 &#x20;

17\. Have minimum password requirements and require new passwords to be different than previous ones&#x20;

18\. Restrict passwords from being the same for a set number of changes&#x20;

19\. Allow users to log in with a temporary password before requiring a permanent change&#x20;

20\. Use cryptography to protect passwords during storage or transmission&#x20;

21\. Authentication messages are hidden from users&#x20;

## Media Protection (MP)&#x20;

Lvl1&#x20;

22\. Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse&#x20;

Lvl2 &#x20;

23\. Physical and digital media containing CUI is secured and properly stored&#x20;

24\. Only authorized users have access to media containing CUI&#x20;

25\. Limited use of removable drives on authorized equipment&#x20;

&#x20;

## System and Communications Protection (SC)&#x20;

Lvl1&#x20;

26\. Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems&#x20;

27\. Implement sub-networks for publicly accessible system components that are physically or logically separated from internal networks&#x20;

&#x20;

Lvl2&#x20;

28\. Restrict access to collaborative computing systems so that only those physically present are authorized&#x20;

29\. Protect network devices with encrypted sessions&#x20;

&#x20;

## System and Information Integrity (SI)&#x20;

Lvl1&#x20;

30\. Identify, report, and correct information and information system flaws in a timely manner&#x20;

31\. Provide protection from malicious code at appropriate locations within organizational information systems&#x20;

32\. Update malicious code protection mechanisms when new releases are available&#x20;

33\. Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed&#x20;

Lvl2&#x20;

34\. Respond to security events and alerts by taking the necessary actions&#x20;

35\. Assess network communications in real-time for ongoing threats or attacks&#x20;

36\. Discover unauthorized users and purge them from the system&#x20;

&#x20;

## Only in level 1&#x20;

## Physical Protection (PP)&#x20;

Lvl1&#x20;

37\. Limit physical access to organization information systems, equipment, and the respective operating environments to authorized individuals&#x20;

38\. Escort visitors and monitor visitor activity &#x20;

39\. Maintain audit logs of physical access devices&#x20;

40\. Control and manage physical access devices&#x20;

&#x20;

## Only in level 2&#x20;

## Audit and Accountability (AU)&#x20;

41\. Create individual identifiers for each user so activity can be tracked&#x20;

42\. Maintain records of network activity in case of unlawful use or access of material&#x20;

43\. Sync internal clocks with a controlled source for accurate timestamps&#x20;

44\. Continuously monitor and audit logs for common errors&#x20;

&#x20;

## Awareness and Training (AT)&#x20;

45\. All stakeholders know existing risks associated with their roles and understand best practices for dealing with them&#x20;

46\. All stakeholders have received the proper training in IT security practices associated with their position&#x20;

&#x20;

&#x20;

## Configuration Management (CM)&#x20;

47\. Have a clear picture of existing assets and system configurations throughout the development process  &#x20;

48\. Internal systems offer only the needed functionality to users &#x20;

49\. User-level applications and software are tightly controlled  &#x20;

50\. Use a strict security policy for essential IT assets&#x20;

51\. Control the approval process for changes made to all internal systems&#x20;

52\. Understand the implications of policy changes before they are carried out&#x20;

&#x20;

## Incident Response (IR)&#x20;

53\. Be prepared to respond to incidents with well-defined management capabilities &#x20;

54\. Actively discover issues and do reporting&#x20;

55\. Resolve incidents with real-time monitoring and detection strategies&#x20;

56\. Outline procedures that will be used for specific incidents&#x20;

57\. Assess the underlying cause of incidents and target the real issue&#x20;

&#x20;

## Maintenance (MA)&#x20;

58\. Perform regular maintenance on systems&#x20;

59\. Maintain control over procedures and processes associated with system maintenance&#x20;

60\. Require multi-factor authentication for remote maintenance sessions and close sessions when complete&#x20;

61\. Maintain physical supervision over individuals who lack the necessary authorization credentials&#x20;

&#x20;

## Physical Protection (PE)&#x20;

62\. All essential facilities are protected and monitored to maintain the integrity of IT systems&#x20;

&#x20;

## Recovery (RE)&#x20;

63\. Backups are done on a regular basis and tested for validity&#x20;

64\. Backups remain confidential while in storage&#x20;

## Risk Management (RM)&#x20;

65\. Assess dangers posed by ongoing operations associated with CUI&#x20;

66\. Do ongoing scanning for potential vulnerabilities&#x20;

67\. Fix discovered vulnerabilities promptly according to specified rules outlined by the company&#x20;

&#x20;

## Security Assessment (CA)&#x20;

68\. Outline security strategies with clear boundaries that define the operational content and associated requirements&#x20;

69\. Regularly evaluate security management capabilities&#x20;

70\. Create a plan of action for finding vulnerabilities and deploying solutions&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;
