Compliance Frameworks

NIST 800 171 Revision 2

nist_800_171_revision_2_aws

50 Requirements

82 Checks

Description

The cybersecurity controls within NIST 800-171 safeguard CUI in the IT networks of government contractors and subcontractors. It defines the practices and procedures that government contractors must adhere to when their networks process or store CUI. NIST 800-171 only applies to those parts of a contractor’s network where CUI is present.

Check your compliance status

prowler aws --compliance nist_800_171_revision_2_aws

Run in Prowler Cloud

Compliance Frameworks

NIST 800 171 Revision 2

Description

Compliance MetadataEdit

Check your compliance status

Requirements

Cryptographic standards include FIPS-validated cryptography and NSA-approved cryptography.2 Checks

Routing remote access through managed access control points enhances explicit, organizational control over such connections, reducing the susceptibility to unauthorized access to organizational systems resulting in the unauthorized disclosure of CUI.14 Checks

Identifiers are provided for users, processes acting on behalf of users, or devices (3.5.1). Preventing reuse of identifiers implies preventing the assignment of previously used individual, group, role, or device identifiers to different individuals, groups, roles, or devices.2 Checks

Inactive identifiers pose a risk to organizational information because attackers may exploit an inactive identifier to gain undetected access to organizational devices. The owners of the inactive accounts may not notice if unauthorized access to the account has been obtained.4 Checks

Password lifetime restrictions do not apply to temporary passwords.4 Checks

Cryptographically-protected passwords use salted one-way cryptographic hashes of passwords.6 Checks

Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones (DMZs). DMZs are typically implemented with boundary control devices and techniques that include routers, gateways, firewalls, virtualization, or cloud-based technologies.20 Checks