3.1.1
Limit system access to authorized users
3.1.2
Limit system access to authorized functions
3.1.3
Control the flow of CUI
3.1.4
Separate duties of individuals
3.1.5
Employ the principle of least privilege
3.1.6
Use non-privileged accounts for non-security functions
3.1.7
Prevent non-privileged users from executing privileged functions
3.1.8
Limit unsuccessful logon attempts
3.1.9
Provide privacy and security notices at logon
3.1.10
Use session lock with pattern-hiding displays
3.1.11
Terminate user sessions after defined conditions
3.1.12
Monitor and control remote access sessions
3.1.13
Employ cryptographic mechanisms for remote access
3.1.14
Route remote access via managed access control points
3.1.15
Authorize remote execution of privileged commands
3.1.16
Authorize wireless access prior to connection
3.1.17
Protect wireless access using authentication and encryption
3.1.18
Control connection of mobile devices
3.1.19
Encrypt CUI on mobile devices
3.1.20
Verify and control connections to external systems
3.1.21
Limit use of portable storage devices on external systems
3.1.22
Control CUI posted on publicly accessible systems