3.1 Access Control: the NIST SP 800-171 requirements

Build an authoritative list of every user, service account, and device permitted to touch the CUI environment, then enforce it through your directory (Active Directory, Entra ID, or Google Workspace) so nothing outside that list can authenticate. Remove or disable shared, orphaned, and vendor default accounts as a quick win. Document an account provisioning and deprovisioning procedure with a required approval step. Evidence: the account inventory, a directory export showing only approved accounts, and completed access request forms.

Define what each role is actually allowed to do (read CUI, modify CUI, administer systems) and enforce it with security groups and file share or SharePoint permissions rather than granting broad access. Strip Everyone and Domain Users permissions from CUI repositories as an immediate fix. Restrict high-impact functions such as exporting data or changing security settings to named roles. Evidence: a role-to-permission matrix and screenshots of ACLs on CUI shares.

Map how CUI moves through your environment, then put technical enforcement at the choke points: DNS/web filtering to block unsanctioned cloud storage, firewall egress rules, and DLP or conditional-access policies in Microsoft 365 GCC High or Google Workspace that block CUI from leaving approved locations. Blocking personal email and consumer file-sharing sites at the gateway is a fast, high-value win. Document approved flows in a data flow diagram. Evidence: the diagram, DLP policy exports, and firewall/proxy rule screenshots.

Identify combinations of duties that would let one person both commit and conceal harm (for example, the same admin approving and implementing changes, or administering systems and reviewing the audit logs of those systems). Split them across different people or, in a very small shop, add compensating review by a second person with documented sign-off. Capture the split in a separation-of-duties matrix. Evidence: the matrix, distinct admin group memberships, and samples of second-person reviews.

Audit group memberships and remove standing admin rights from anyone who does not need them daily: most small contractors find local admin granted to entire departments. Create a small, named set of privileged accounts and consider a PAM approach (even just LAPS for local admin passwords plus separate admin accounts) rather than shared credentials. Review privileged access quarterly and record the review. Evidence: privileged account inventory, group membership exports, and quarterly review records.

Issue administrators two accounts: a standard account for email and daily work and a separate admin account used only for administrative tasks. Configure conditional access or logon restrictions so admin accounts cannot sign in to email, browse the web, or use productivity apps. This is a low-cost policy plus configuration change achievable in a day. Evidence: naming convention documentation and directory screenshots showing the paired accounts.

Configure UAC, sudo, or your endpoint management tool so standard users cannot run installers, change security settings, or execute admin utilities, and enable audit logging (Windows Security log, sudo logs, or your EDR) for privileged command execution. Removing local admin rights from standard users is the single biggest win here. Forward those logs to a central location so they survive tampering. Evidence: GPO/MDM policy exports and sample log entries showing privileged actions attributed to specific admins.

Set an account lockout policy in Group Policy, Entra ID Smart Lockout, or your identity provider: a common baseline is 5-10 failed attempts triggering a 15-minute lockout. Apply it to VPN, cloud, and local logons, not just domain workstations. This is typically a one-hour configuration task. Evidence: the policy export and a screenshot of a test account locking out after repeated bad passwords.

Deploy a logon banner referencing authorized use, monitoring consent, and CUI handling on all interactive entry points: Windows logon (GPO interactive logon message), VPN portal, and cloud sign-in pages where supported. Have counsel or your compliance lead approve the wording once, then push it everywhere via policy. This is one of the cheapest controls to close. Evidence: banner text approval and screenshots of the banner at each logon point.

Enforce an inactivity screen lock (15 minutes or less is typical) with a password or PIN to resume, pushed via GPO, Intune, or your MDM so users cannot disable it, and confirm the lock hides screen contents rather than showing open documents. Include mobile devices in the policy. Evidence: policy exports and a spot-check video or screenshot of a workstation locking on schedule.

Define session termination conditions (VPN idle timeout, cloud session lifetime, RDP session limits, after-hours disconnects) and configure them in the respective systems (firewall/VPN concentrator, Entra ID conditional access sign-in frequency, RDS session host settings). Start with the VPN, since remote sessions carry the most risk. Evidence: configuration exports showing timeout values and your documented rationale for each.

Consolidate all remote access to one or two sanctioned methods (VPN with MFA, or a ZTNA product) and disable everything else: hunt down TeamViewer, AnyDesk, and exposed RDP as a first step. Log every remote session with user, source, and duration, and review those logs on a schedule. Document who is authorized for remote access and from what devices. Evidence: remote access policy, VPN configuration, session logs, and firewall rules blocking unsanctioned tools.

Ensure every remote access path is encrypted with FIPS-validated cryptography: enable FIPS mode on your VPN appliance and verify its cryptographic module holds a CMVP certificate, and use TLS 1.2+ for web-based access. Replace legacy protocols (PPTP, raw RDP over the internet) immediately. Record the certificate numbers of the modules you rely on. Evidence: VPN cipher configuration, CMVP certificate references, and a scan showing no unencrypted remote access services exposed.

Funnel all remote traffic through a small number of managed access control points (typically your firewall/VPN concentrator or ZTNA gateway) and block direct inbound paths to individual hosts. Scan your public IP space for stray RDP, SSH, or vendor remote-access listeners and close them. Evidence: network diagram showing the managed entry points and external scan results showing no bypass paths.

Require explicit authorization before anyone can run privileged commands or reach security tooling remotely: restrict remote admin protocols to a dedicated admin VPN group or jump host, and keep an approved list of who may administer what remotely. A jump box with MFA and session logging is a practical pattern for small teams. Evidence: the authorization list, jump host configuration, and firewall rules restricting remote admin paths.

Inventory every wireless network in your facilities (including printer hotspots and rogue APs), then document which SSIDs are authorized, who approves device connections, and how guests are handled. Use certificate or credential-based onboarding (WPA2/WPA3-Enterprise with RADIUS, or at minimum MAC allowlisting on small networks) so unapproved devices cannot join the CUI network. Evidence: wireless authorization policy, AP inventory, and controller screenshots of the access configuration.

Configure WPA2-Enterprise or WPA3 with 802.1X authentication on any wireless network that can reach CUI: a small RADIUS deployment or cloud RADIUS service (via Entra ID or JumpCloud) makes this attainable for small shops. Retire WEP/WPA-Personal on corporate SSIDs and isolate the guest network from the CUI environment entirely. Evidence: wireless controller settings showing the auth and encryption modes, and VLAN configuration separating guest traffic.

Deploy MDM (Intune, Workspace ONE, or similar) and require enrollment before any phone or tablet can access company email or files, enforcing a passcode, encryption, and remote wipe. Block legacy ActiveSync connections from unenrolled devices via conditional access. Decide and document whether BYOD is permitted at all for CUI: prohibiting it is the simplest compliant answer. Evidence: MDM policy exports, enrolled device inventory, and conditional access rules.

Enforce full-device encryption on every laptop and mobile device that could hold CUI: BitLocker via Intune/GPO on Windows, FileVault on macOS, and native encryption verified through MDM on phones. Verify FIPS-validated modules where feasible and escrow recovery keys centrally. Run a compliance report to catch unencrypted stragglers. Evidence: encryption compliance reports from your management console and the enforcement policy itself.

Inventory every external system your users touch with company data (personal devices, partner portals, consumer cloud apps) and either bring them under agreement, block them, or formally prohibit their use for CUI. Use conditional access to block unmanaged devices from cloud tenants and web filtering to block unsanctioned SaaS. Publish an acceptable use policy naming the approved external systems. Evidence: the policy, conditional access rules, and the approved external systems list.

Set policy on whether company USB drives and portable media may be used on non-company systems: prohibition is the cleanest answer for most small contractors. Where portable storage is needed, issue encrypted, inventoried drives and restrict their use to managed systems via endpoint USB controls (Intune, Defender device control, or EDR policy). Evidence: the media policy, the issued-drive inventory, and device control configuration.

Establish a review gate before anything is posted to your website, social media, or public portals: name the reviewers trained to recognize CUI, require their sign-off, and keep a record of each review. Sweep existing public content once for inadvertently posted technical data as a quick win. Evidence: the publication procedure, reviewer designation memo, and completed review logs.