Practices (L1)

Question 1

AC.L1-3.1.1

Answer 1

Title: Authorized Access Control
Access Control (AC)
Level 1

Purpose: Limit information system access to authorized users, processes acting on behalf of authorized users or devices.

FAR 52.204-21 Basic Safeguard: Limit access to authorized users, processes, or devices.

Question 2

AC.L1-3.1.2

Answer 2

Title: Transaction & Function Control

Access Control (AC)
Level 1

Purpose: Limit IS access to the types of transactions and functions that authorized users are permitted to execute.

FAR 52.204-21 Basic Safeguard: Limit access to the type of actions that authorized users are permitted to execute.

Question 3

AC.L1-3.1.22

Answer 3

Title: Control Public Information

Access Control (AC)
Level 1

Purpose: Control information posted or processed on publicly accessible information systems.

FAR 52.204-21 Basic Safeguard: Control information posted or processed on publicly accessible systems.

Question 4

AC.L1-3.1.20

Answer 4

Title: External Connections

Access Control (AC)
Level 1

Purpose: Verify and control/limit connections to and use of external information systems.

FAR 52.204-21 Basic Safeguard: Verify and control (or limit) connections to external information systems.

Question 5

IA.L1-3.5.1

Answer 5

Title: Identification

Identification and Authentication (IA)
Level 1

Purpose: Identify information system users, processes acting on behalf of users or devices.

FAR 52.204-21 Basic Safeguard: Identify information system users, processes, or devices.

Question 6

IA.L1-3.5.2

Answer 6

Title: Control Public Information

Identification and Authentication (IA)
Level 1

Purpose: Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access t organizational information systems.

FAR 52.204-21 Basic Safeguard: Authenticate identities of users, processes, or devices prior to allowing access.

Question 7

MP.L1-3.8.3

Answer 7

Title: Media Disposal

Media Protection (MP)
Level 1

Purpose: Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

FAR 52.204-21 Basic Safeguard: Sanitize or destroy media containing Federal Contract Information.

Question 8

PE.L1-3.10.1

Answer 8

Title: Limit Physical Access

Physical Protection (PE)
Level 1

Purpose: Limit physical access to organizational information systems, equipment and the respective operating environments to authorized individuals.

FAR 52.204-21 Basic Safeguard: Limit physical access to information systems, equipment, and operating environment to authorized individuals.

Question 9

PE.L1-3.10.3

Answer 9

Title: Escort Visitors

Physical Protection (PE)
Level 1

Purpose: Escort visitors and monitor visitor activity.

FAR 52.204-21 Basic Safeguard: Escort visitors, monitor visitor activity, maintain audit logs of visitor activity, and control and manage physical access devices.

Question 10

PE.L1-3.10.4

Answer 10

Title: Physical Access Logs

Physical Protection (PE)
Level 1

Purpose: Maintain audit logs of physical access.

FAR 52.204-21 Basic Safeguard: None.

Question 11

PE.L1-3.10.5

Answer 11

Title: Manage Physical Access

Physical Protection (PE)
Level 1

Purpose: Control and manage physical access devices (keys, combos, etc.)

FAR 52.204-21 Basic Safeguard: None.

Question 12

SC.L1-3.13.1

Answer 12

Title: Boundary Protection

System and Communications Protection (SC)
Level 1

Purpose: Monitor, control, and protect organizational communication s(i.e.,information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information system.

FAR 52.204-21 Basic Safeguard: Monitor, control, and protect organizational communications.

Question 13

SC.L1-3.13.5

Answer 13

Title: Public-Access System Separation

System and Communications Protection (SC)
Level 1

Purpose: Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

FAR 52.204-21 Basic Safeguard: Implement subnetworks for publicly accessible system components that are separated from internal networks.

Question 14

SI.L1-3.14.1

Answer 14

Title: Flaw Remediation

System and Information Integrity (SI)
Level 1

Purpose: Identify, report, and correct information and information system flaws in a timely manner.

FAR 52.204-21 Basic Safeguard: Identify, report, and correct information and system flaws in a timely manner.

Question 15

SI.L1-3.14.2

Answer 15

Title: Malicious Code Protection

System and Information Integrity (SI)
Level 1

Purpose: Provide protection from malicious code at appropriate locations within organizational information systems.

FAR 52.204-21 Basic Safeguard: Provide protection from malicious code.

Question 16

SI.L1-3.14.4

Answer 16

Title: Update Malicious Code Protection

System and Information Integrity (SI)
Level 1

Purpose: Update malicious code protection mechanisms when new releases are available.

FAR 52.204-21 Basic Safeguard: Update malicious code protection mechanisms when new releases are available.

Question 17

SI.L1-3.14.5

Answer 17

Title: System & File Scanning

System and Information Integrity (SI)
Level 1

Purpose: Perform periodic scans of the system and real-time scans of files rom external sources as files are downloaded, opened, or executed.

FAR 52.204-21 Basic Safeguard: Perform periodic scans of the system and real-time scans of file from external sources as files are downloaded, opened, or executed.