NIST 800-171 Controls Matrix
A comprehensive breakdown of the 110 Controls across 14 Families required for safeguarding Controlled Unclassified Information (CUI).
Access Control
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
Awareness and Training
Ensure that managers, systems administrators, and users of organizational information systems are made aware of the security risks associated with their activities.
Audit and Accountability
Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized activity.
Configuration Management
Establish and maintain baseline configurations and inventories of organizational information systems.
Identification and Authentication
Identify information system users, processes acting on behalf of users, or devices and authenticate (or verify) the identities of those users, processes, or devices.
Incident Response
Establish an operational incident-handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities.
Maintenance
Perform maintenance on organizational information systems.
Media Protection
Protect (i.e., physically control and securely store) information system media containing CUI, both paper and digital.
Personnel Security
Screen individuals prior to authorizing access to information systems containing CUI.
Physical Protection
Limit physical access to information systems, equipment, and the respective operating environments to authorized individuals.
Risk Assessment
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals.
Security Assessment
Periodically assess the security controls in organizational information systems to determine if the controls are effective in their application.
System and Communications Protection
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
System and Information Integrity
Identify, report, and correct information and information system flaws in a timely manner.