{"text_format":"1","workbook":"xlsx","n_sheets":5,"sheets":["Introduction","Submitting Organization","Questionnaire","Results","Version Control"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":1,"defined_names":2,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":15,"n_cols":1,"rows_kept":15,"cut":false,"hidden":false,"merged":[]}
["Introduction"]
["          This Cybersecurity Compliance and Risk Assessment (CCRA) is developed by the Defense Industrial Base Sector Coordinating Council (DIB SCC) Supply Chain Task Force to drive a common set of cybersecurity requirements that both document compliance and measure risk. It’s intended to reduce the burden on our suppliers, currently being assessed against multiple standards and in varied formats (often with overly complex and outdated cyber requirements).\n\n          The CCRA is built on a set of Scoping Questions that will dynamically add/remove questions from the survey based on the response provided. The Scoping Questions will identify the type of information (i.e., Federal Contract Information (FCI), Controlled Unclassified Information (CUI), Covered Defense Information (CDI), or other customer defined Sensitive Information), the supplier possesses, processes, transmits, and/or stores; and highlight other key risk factors such as when Information & Communication Technology (ICT) is being provided by the supplier.  It will align them to a set of questions that will help us understand a supplier’s compliance and risk posture."]
["Using this Form (.xlsm)"]
["Step 1: Enable Macros"]
["Step 2: Fill in the Submitting Organization Details"]
["Step 3: Complete the \"Questionnaire\" tab"]
["Step 4: Review \"Results\" tab for Compliance status and Cyber Risk Rating"]
["Step 5: Save the questionnaire (or Export a .csv file - Step 6) and provide to the requesting organization."]
["Step 6: Use the \"Validate & Export\" button on the \"Questionnaire\" tab to export your responses to a Comma Separated Value (.csv) file for submission."]
["Step 7: When applicable, use the \"Import CCRA (.csv)\" button to import a .csv to view a submitted response in this document."]
["Regulatory Compliance"]
["Upon submission, you will be provided compliance statuses for regulatory requirements as described below:\n\n           •\tCompliance with 48 CFR 52.204-21 is based on Questions 1 and 1.a\n                         o To be identified as compliant with 48 CFR 52.204-21 you must attest to having implemented the (15) security requirements provided in\n                             the clause.\n\n           •  Compliance with DFARS Clause 252.204-7012 is based on Questions 2, 2.a, 2.b, and 2.c. \n                        o  To be identified as compliant with DFARS 252.204-7012 you  must attest to having implemented and/or documented your plan(s) to \n                             implement the security controls required in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171.\n                        o  To rapidly report cyber incidents to the DoD CIO within 72 hours, suppliers are required to obtain a DoD-approved Medium Assurance\n                             Certificate.\n\n           •  Compliance with DFARS Clause 252.204-7019 / -7020 is based on Questions 3, 3.a, 3.b, and 3.c\n                        o  To be identified as compliant with DFARS – 7019/-7020, a NIST assessment (< 3 years old) score must be posted to the DoD Supplier\n                            Performance Risk System (SPRS) database."]
["Cyber Risk"]
["Cyber Risk is measured based on the responses to the Security Controls. In total, there are (31) Security Controls; (11) Category 1, (10) Category 2, and (10) Category 3. These are identified on the \"Questionnaire\" tab.  Based on the response to the Cyber Security controls, a user will be given Cyber Risk Rating of Negligible, Moderate, Significant."]
["The following rules are applied for calculating Cyber Risk:\n\n           •  Negligible = (All Category 1, 2, and 3 controls are implemented)\n                        o  Negligible to minimal risks are identified based on response provided. The supplier has a strong performing cyber risk management \n                            program.\n\n           •  Moderate  = (All Category 1 implemented AND < 10 Category 2 or 3 implemented)\n                        o  Minimal to moderate risk are identified based on the response provided. The supplier has a Cyber risk management program with \n                            good protections in place, but additional risk mitigations are likely required to protect Sensitive Information and/or Government/DOD \n                            Controlled Unclassified Information (CUI).\n\n           •  Significant  = (Less than 11 Category 1 implemented) \n                        o  Moderate to significant risks are identified based on the response provided. The supplier has minimal or no cyber risk management \n                            program and significant cyber protections are lacking.\n\nFor Suppliers receiving only FCI and no other customer Sensitive or Controlled data types, the following rules are applied:\n           •  FCI- only suppliers = Negligible if all 6 FCI security controls are implemented else Significant\n           ** The subset of FCI security controls are highlighted Yellow on the \"Questionnaire\" tab"]

{"sheet":"Submitting Organization","index":1,"n_rows":10,"n_cols":3,"rows_kept":10,"cut":false,"hidden":false,"merged":[[0,0,0,2],[9,0,12,2]]}
["Submitting Organization Data"]
["Field Name","Response","Guidance"]
["Vendor Name",null,"Company/Organization Name"]
["Vendor Primary POC Name",null,"Fname Lname (i.e., John Doe)"]
["Vendor Primary POC Email",null,"Primary POC email address"]
["Vendor IT Security POC Name",null,"Fname Lname (i.e., John Doe)"]
["Vendor IT Security POC Email",null,"IT Security POC email address"]
["Vendor Local DUNS Number(s)",null,"If more than one, use a comma to separate values (i.e., 007505491, 000665432)"]
["Vendor CAGE Code(s)",null,"If more than one, use a comma to separate values (i.e., 3T456, 56789)"]
["If the response on this form is applicable to more than one of your organization's business units/divisions, provide all the Local DUNS Number and CAGE Codes that applies.  You'll be able to export a single form for multiple DUNS/CAGE Code"]

{"sheet":"Questionnaire","index":2,"n_rows":59,"n_cols":5,"rows_kept":59,"cut":false,"hidden":false,"merged":[]}
["Number","Question Identifier","Scoping Question","Response Options","Guidance"]
[1,"FCI","Does your organization receive 48 CFR 52.204-21, Basic Safeguarding of Covered Contractor Information, in the performance of US Federal contract(s)?","Select Option","See 48 CFR 52.204-21 for more details - https://www.acquisition.gov/far/52.204-21"]
["1.a","FCI","Have you implemented the basic safeguarding security controls as required by the clause?","Select Option","See 48 CFR 52.204-21 for more details - https://www.acquisition.gov/far/52.204-21"]
[2,"CUI","Does your organization receive and/or generate Covered Defense Information (CDI) / Controlled Unclassified Information (CUI) in the performance of US DoD contract(s), as defined in DFARS Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting?","Select Option","See DFARS 252.204-7012 for more details - https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting."]
["2.a","CUI","Have you implemented and/or have a plan to implement the security controls required in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations?","Select Option","See DFARS 252.204-7012 for more details - https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting."]
["2.b","CUI","Have you documented how you implemented and/or planned to implement those controls in your required System Security Plan (SSP) / Plan of Action and Milestones (POAM)? ","Select Option","See DFARS 252.204-7012 for more details - https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting."]
["2.c","CUI","Do you have a DoD-approved medium assurance certificate to “rapidly report” cyber incidents to the DoD CIO within 72 hours to https://dibnet.dod.mil, as required under the clause?","Select Option","See DFARS 252.204-7012 for more details - https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.\nMedium assurance certificate requirement - To report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see https://public.cyber.mil/eca/.\nDetailed Instructions are provided here: https://dibnet.dod.mil/portal/rest/jcr/repository/collaboration/sites/intranet/web%20contents/site%20artifacts/public-content/DIBNet_ECA_Instructions_DCISE.pdf"]
[3,"CUI","Does your organization receive contracts that includes DFARS Clause 252.204-7019 /- 7020, NIST SP 800-171 DoD Assessment Requirements?","Select Option","See DFARS 252.204-7019 for more details - https://www.acquisition.gov/dfars/252.204-7019-notice-nistsp-800-171-dod-assessment-requirements.\n  -  Requires contractors to have a record of their NIST 800-171 assessment documented in DoD’s Supplier Performance Risk System (SPRS). \nSee DFARS 252.204-7020 for more details - https://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements.\n  -  Requires contractors to provide DoD access to conduct an assessment and maintain current assessment results in SPRS prior to being awarded the contract. "]
["3.a","CUI","Does your organization have a current NIST SP 800-171 DoD Assessment Methodology Score in the DoD's Supplier Performance Risk System (SPRS)?","Select Option","See DFARS 252.204-7019 for more details - https://www.acquisition.gov/dfars/252.204-7019-notice-nistsp-800-171-dod-assessment-requirements.\nRequirement. In order to be considered for award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. The Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment Methodology located at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171"]
["3.b","CUI","What is the date of your organization's most recent NIST SP 800-171 DoD Assessment Methodology score, as input into SPRS?","MM/DD/YYYY","See DFARS 252.204-7019 for more details - https://www.acquisition.gov/dfars/252.204-7019-notice-nistsp-800-171-dod-assessment-requirements.\nRequirement. In order to be considered for award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. The Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment Methodology located at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171"]
["3.c","CUI","What is the Confidence Level of your most recent NIST SP 800-171 DoD Assessment Methodology score, as input into SPRS?","Select Option","See DFARS 252.204-7020 form more details - https://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements.\n“High Assessment” means an assessment that is conducted by Government personnel using NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information\n“Medium Assessment” means an assessment conducted by the Government that consists of a review of the contractor's Basic Assessment, a thorough document review, and discussions with the contractor to obtain additional information or clarification, as needed. \n\"Basic Assessments\" means a contractor may submit summary level scores of Self Assessments conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology (https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171) for posting to SPRS."]
["3.d","CUI","Are you willing to share your most recent NIST 800-171 DoD Assessment Methodology score, as input into SPRS?","Select Option","Sharing your NIST SP 800-171 DoD Assessment Methodology Score on this survey is optional and will not impact your risk rating if you choose not to share it on this survey."]
["3.e","CUI","What is your most recent NIST 800-171 DOD Assessment Methodology score?","Enter Score","Self Assessments conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology (https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171)  for posting to SPRS will have a score between -204 and 110."]
[4,"CUI;FCI","Does your organization receive contracts that includes Cybersecurity Maturity Model Certification Requirement OR are you part of an early adopter / Joint Surveillance program?","No","Default to No. Updates are forthcoming."]
["4.a","CUI","What is the  Cybersecurity Maturity Model Certification (CMMC)  level your organization achieved?","Select Option"]
["4.b","CUI","What is the date of your organization's most recent CMMC certificate OR self-assessment?","MM/DD/YYYY"]
[5,"SI","Does your company receive Sensitive Information from a third-party company? ","Select Option","Examples of Sensitive Information include, but are not limited to, company Proprietary Information, Intellectual Property, Export Controlled Information, Personal Data/Information, Federal Contract Information (FCI), Controlled Unclassified Information (CUI), Covered Defense Information (CDI), etc."]
[6,"ICT","Does your organization provide Information & Communication Technology (ICT) products or services?","Select Option","Information & Communication Technology (ICT) is an umbrella term that includes any communication device, logic bearing device (computer equipment, microchips, processors), or software."]
[7,"Risk","Does your organization have any industry recognized cybersecurity certifications and/or accreditations?",null,"ISO 27001 - https://www.iso.org/isoiec-27001-information-security.html\nCyber Essentials + (certification) - https://www.ncsc.gov.uk/cyberessentials/overview\nBSI - German - https://www.bsi.bund.de/EN/Das-BSI/Auftrag/auftrag_node.html\nAustralia Cyber Framework for Defense Industry (CFDI)\nEssential 8 - https://www.cyber.gov.au/acsc/view-all-content/ism\nDEFSTAN 05-138 (Level V Low to High)- https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138"]
[8,"Risk","Does your organization align your cyber security polices with recognized industry standards?",null,"NIST SP 800-53 : Security and Privacy Controls for Information Systems and Organization - https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final\nNIST SP 500-37 : Risk Management Framework - https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final\nNIST Cybersecurity Framework - https://www.nist.gov/cyberframework\nISO 27000 Series - https://www.iso.org/isoiec-27001-information-security.html\nControl Objectives for Information and Related Technologies (COBIT) - https://www.isaca.org/resources/cobit\nCOSO Framework for Internal Controls - https://www.coso.org/SitePages/Home.aspx\nCenter for Internet Security Critical Security Controls (CIS CSC) - https://www.cisecurity.org/controls\nCyber Essentials (self-attestation) - https://www.ncsc.gov.uk/cyberessentials/overview"]
[9,"Risk","Does your organization utilize any third-party managed service providers to include cloud services or cloud service providers that are used to store, process, or transmit Sensitive Information?","Select Option","Examples of Sensitive Information include, but are not limited to, company Proprietary Information, Intellectual Property, Export Controlled Information, Personal Data/Information, Federal Contract Information (FCI), Controlled Unclassified Information (CUI), Covered Defense Information (CDI), etc."]
["9.a","Risk","Do you have contractual agreements (i.e., Service Level Agreements) or documented Shared Responsibility Matrix that defines the security roles and responsibilities between the seller and buyer?","Select Option","Examples of Shared Responsibility Matrix can be found: https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility or https://aws.amazon.com/compliance/shared-responsibility-model/"]
[10,"Risk","Is third-party Sensitive Information being shared to sub-tier suppliers, consultants, or contractors?","Select Option","Examples of Sensitive Information include, but are not limited to, company Proprietary Information, Intellectual Property, Export Controlled Information, Personal Data/Information, Federal Contract Information (FCI), Controlled Unclassified Information (CUI), Covered Defense Information (CDI), etc."]
["10.a","Risk","Are safeguarding requirements flowed down to sub-tier suppliers, consultants, or contractors?","Select Option","The requirements could be included in master service agreements, subcontracts, statement of work, Peformance Work Statements (PWS), or mandatory flowdowns (i.e, FAR, DFARS), and refer to relevant security guidelines, safeguarding requirements, standards, and frameworks."]
[11,"Risk","Has your organization experienced a cyber incident that required mandatory reporting in the last 12 months?","Select Option","An example of a mandatory reporting requirements is DFARS Clause 252.204-7012: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.\nWhen the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall rapidly report cyber incidents to DoD at https://dibnet.dod.mil. \"Rapidly report\" means within 72 hours of discovery of any cyber incident.\n\nReview your contracts and business requirements  for other mandatory reporting obligations that may apply"]
[12,"Risk","Have you had an independent objective third party cybersecurity assessment in the past 2 years?","Select Option","Examples are penetration testing, security assessments, SOX, other \"cyber\" certifications, internal independent audits, or third-party audits."]
["12.a","Rlsk","What type of independent assessment was conducted?"]
["Control","Category","Cyber Security Controls - As applicable","Response Options","Guidance"]
["3.1.1",1,"Limit information system access to authorized users, processes acting on behalf of authorized users or devices (including other information systems). ","Select Control Status","(ref., NIST SP 800-171 3.1.1 or CMMC AC.L1-3.1.1)\n\nAccess control policies (e.g., identity- or role-based policies, control matrices, and cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, and domains) in systems. Access enforcement mechanisms can be employed at the application and service level to provide increased information security. Other systems include systems internal and external to the organization. This requirement focuses on account management for systems and applications. The definition of and enforcement of access authorizations, other than those determined by account type (e.g., privileged verses [sic] non-privileged) are addressed in requirement 3.1.2 (AC.L1-3.1.2). \n\n"]
["3.1.4",2,"Separate the duties of individuals to reduce the risk of malevolent activity without collusion.","Select Control Status","(ref., NIST SP 800-171 3.1.4 or CMMC AC.L2-3.1.4)\n\nSeparation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes dividing mission functions and system support functions among different individuals or roles; conducting system support functions with different individuals (e.g., configuration management, quality assurance and testing, system management, programming, and network security); and ensuring that security personnel administering access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations consider the entirety of organizational systems and system components when developing policy on separation of duties.  "]
["3.1.5",2,"Employ the principle of least privilege, including for specific security functions and privileged accounts. ","Select Control Status","(ref., NIST SP 800-171 3.1.5 or CMMC AC.L2-3.1.5)\n\nOrganizations employ the principle of least privilege for specific duties and authorized accesses for users and processes. The principle of least privilege is applied with the goal of authorized privileges no higher than necessary to accomplish required organizational missions or business functions. Organizations consider the creation of additional processes, roles, and system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational systems. Security functions include establishing system accounts, setting events to be logged, setting intrusion detection parameters, and configuring access authorizations (i.e., permissions, privileges). \n\nPrivileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from having access to privileged information or functions. Organizations may differentiate in the application of this requirement between allowed privileges for local accounts and for domain accounts provided organizations retain the ability to control system configurations for key security parameters and as otherwise necessary to sufficiently mitigate risk. "]
["3.1.12",3,"Monitor and control remote access sessions. ","Select Control Status","(ref., NIST SP 800-171 3.1.12 or CMMC AC.L2-3.1.12)\n\nRemote access is access to organizational systems by users (or processes acting on behalf of users) communicating through external networks (e.g., the internet). Remote access methods include dial-up, broadband, and wireless. Organizations often employ encrypted virtual private networks (VPNs) to enhance confidentiality over remote connections. The use of encrypted VPNs does not make the access non-remote; however, the use of VPNs, when adequately provisioned with appropriate control (e.g., employing encryption techniques for confidentiality protection), may provide sufficient assurance to the organization that it can effectively treat such connections as internal networks. VPNs with encrypted tunnels can affect the capability to adequately monitor network communications traffic for malicious code. \n\nAutomated monitoring and control of remote access sessions allows organizations to detect cyber-attacks and help to ensure ongoing compliance with remote access policies by auditing connection activities of remote users on a variety of system components (e.g., servers, workstations, notebook computers, smart phones, and tablets). \n\nNIST SP 800-46, SP 800-77, and SP 800-113 provide guidance on secure remote access and virtual private networks. "]
["3.1.19",3,"Encrypt Sensitive Information on mobile devices and mobile computing platforms. ","Select Control Status","(ref., NIST SP 800-171 3.1.19 or CMMC AC.L2-3.1.19)\n\nOrganizations can employ full-device encryption or container-based encryption to protect the confidentiality of Sensitive Information on mobile devices and computing platforms. Container-based encryption provides a more fine-grained approach to the encryption of data and information including encrypting selected data structures such as files, records, or fields. "]
["3.2.1",1,"Ensure that managers, system administrators and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards and procedures related to the security of those systems.","Select Control Status","(ref., NIST SP 800-171 3.2.1 or CMMC AT.L2-3.2.1)\n\nOrganizations determine the content and frequency of security awareness training and security awareness techniques based on the specific organizational requirements and the systems to which personnel have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security. Security awareness techniques include: formal training; offering supplies inscribed with security reminders; generating email advisories or notices from organizational officials; displaying logon screen messages; displaying security awareness posters; and conducting information security awareness events. \n\nNIST SP 800-50 provides guidance on security awareness and training programs. "]
["3.3.1",1,"Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity.","Select Control Status","(ref., NIST SP 800-171 3.3.1 or CMMC AU.L2-3.3.1)\n\nAn event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. \n\nAudit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloud-based architectures. \n\nAudit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or failure indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred). \n\nDetailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. \n\nNIST SP 800-92 provides guidance on security log management."]
["3.3.2",2,"Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.","Select Control Status","(ref., NIST SP 800-171 3.3.2 or CMMC AU.L2-3.3.2)\n\nThis requirement ensures that the contents of the audit record include the information needed to link the audit event to the actions of an individual to the extent feasible. Organizations consider logging for traceability including results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, communications at system boundaries, configuration settings, physical access, nonlocal maintenance, use of maintenance tools, temperature and humidity, equipment delivery and removal, system component inventory, use of mobile code, and use of VoIP."]
["3.4.1",1,"Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware and documentation) throughout the respective system development life cycles.","Select Control Status","(ref., NIST SP 800-171 3.4.1 or CMMC CM.L2-3.4.1)\n\nThis requirement establishes and maintains baseline configurations for systems and system components including for system communications and connectivity. Baseline configurations are documented, formally reviewed, and agreed-upon sets of specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, and changes to systems. Baseline configurations include information about system components (e.g., standard software packages installed on workstations, notebook computers, servers, network components, or mobile devices; current version numbers and update and patch information on operating systems and applications; and configuration settings and parameters), network topology, and the logical placement of those components within the system architecture. Baseline configurations of systems also reflect the current enterprise architecture. Maintaining effective baseline configurations requires creating new baselines as organizational systems change over time. Baseline configuration maintenance includes reviewing and updating the baseline configuration when changes are made based on security risks and deviations from the established baseline configuration. \n\nOrganizations can implement centralized system component inventories that include components from multiple organizational systems. In such situations, organizations ensure that the resulting inventories include system-specific information required for proper component accountability (e.g., system association, system owner). Information deemed necessary for effective accountability of system components includes hardware inventory specifications, software license information, software version numbers, component owners, and for networked components or devices, machine names and network addresses. Inventory specifications include manufacturer, device type, model, serial number, and physical location. \n\nNIST SP 800-128 provides guidance on security-focused configuration management."]
["3.4.2",2,"Establish and enforce security configuration settings for information technology products employed in organizational systems.","Select Control Status","(ref., NIST SP 800-171 3.4.2 or CMMC CM.L2-3.4.2)\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture or functionality of the system. Information technology products for which security-related configuration settings can be defined include mainframe computers, servers, workstations, input and output devices (e.g., scanners, copiers, and printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications. \n\nSecurity parameters are those parameters impacting the security state of systems including the parameters required to satisfy other security requirements. Security parameters include: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, and remote connections. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the systems configuration baseline. \n\nCommon secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific information technology platforms/products and instructions for configuring those system components to meet operational requirements. Common secure configurations can be developed by a variety of organizations including information technology product developers, manufacturers, vendors, consortia, academia, industry, federal agencies, and other organizations in the public and private sectors. \n\nNIST SP 800-70 and SP 800-128 provide guidance on security configuration settings. "]
["3.4.3",3,"Track, review, approve or disapprove and log changes to organizational systems.","Select Control Status","(ref., NIST SP 800-171 3.4.3 or CMMC CM.L2-3.4.3)\n\nTracking, reviewing, approving/disapproving, and logging changes is called configuration change control. Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of changes to the systems, including system upgrades and modifications. Configuration change control includes changes to baseline configurations for components and configuration items of systems, changes to configuration settings for information technology products (e.g., operating systems, applications, firewalls, routers, and mobile devices), unscheduled and unauthorized changes, and changes to remediate vulnerabilities. \n\nProcesses for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes to systems. \n\nFor new development systems or systems undergoing major upgrades, organizations consider including representatives from development organizations on the Configuration Control Boards or Change Advisory Boards. Audit logs of changes include activities before and after changes are made to organizational systems and the activities required to implement such changes. \n\nNIST SP 800-128 provides guidance on configuration change control."]
["3.4.7",2,"Restrict, disable or prevent the use of nonessential programs, functions, ports, protocols and services.","Select Control Status","(ref., NIST SP 800-171 3.4.7 or CMMC CM.L2-3.4.7)\n\nRestricting the use of nonessential software (programs) includes restricting the roles allowed to approve program execution; prohibiting auto-execute; program blacklisting and whitelisting; or restricting the number of program instances executed at the same time. The organization makes a security-based determination which functions, ports, protocols, and/or services are restricted. Bluetooth, File Transfer Protocol (FTP), and peer-to-peer networking are examples of protocols organizations consider preventing the use of, restricting, or disabling."]
["3.4.9",3,"Control and monitor user-installed software.","Select Control Status","(ref., NIST SP 800-171 3.4.9 or CMMC CM.L2-3.4.9)\n\nUsers can install software in organizational systems if provided the necessary privileges. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation through policies. Permitted software installations include updates and security patches to existing software and applications from organization-approved “app stores.” Prohibited software installations may include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. The policies organizations select governing user-installed software may be organization-developed or provided by some external entity. Policy enforcement methods include procedural methods, automated methods, or both."]
["3.5.3",3,"Use multi-factor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. ","Select Control Status","(ref., NIST SP 800-171 3.5.3 or CMMC IA.L2-3.5.3)\n\nMultifactor authentication requires the use of two or more different factors to authenticate. The factors are defined as something you know (e.g., password, personal identification number [PIN]); something you have (e.g., cryptographic identification device, token); or something you are (e.g., biometric). Multifactor authentication solutions that feature physical authenticators include hardware authenticators providing time-based or challenge-response authenticators and smart cards. In addition to authenticating users at the system level (i.e., at logon), organizations may also employ authentication mechanisms at the application level, when necessary, to provide increased information security. Access to organizational systems is defined as local access or network access. Local access is any access to organizational systems by users (or processes acting on behalf of users) where such access is obtained by direct connections without the use of networks. Network access is access to systems by users (or processes acting on behalf of users) where such access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. The use of encrypted virtual private networks for connections between organization-controlled and non-organization controlled endpoints may be treated as internal networks with regard to protecting the confidentiality of information.\n\nNIST SP 800-63-3 provides guidance on digital identities."]
["3.6.1",1,"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery and user response activities.","Select Control Status","(ref., NIST SP 800-171 3.6.1 or CMMC IR.L2-3.6.1)\n\nOrganizations recognize that incident handling capability is dependent on the capabilities of organizational systems and the mission/business processes being supported by those systems. Organizations consider incident handling as part of the definition, design, and development of mission/business processes and systems. Incident-related information can be obtained from a variety of sources including audit monitoring, network monitoring, physical access monitoring, user and administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including mission/business owners, system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive.\n\nAs part of user response activities, incident response training is provided by organizations and is linked directly to the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail is included in such training. For example, regular users may only need to know who to call or how to recognize an incident on the system; system administrators may require additional training on how to handle or remediate incidents; and incident responders may receive more specific training on forensics, reporting, system recovery, and restoration. Incident response training includes user training in the identification/reporting of suspicious activities from external and internal sources. User response activities also includes incident response assistance which may consist of help desk support, assistance groups, and access to forensics services or consumer redress services, when required.\n\nNIST SP 800-61 provides guidance on incident handling. SP 800-86 and SP 800-101 provide guidance on integrating forensic techniques into incident response. SP 800-161 provides guidance on supply chain risk management."]
["3.6.2",3,"Track, document and report incidents to designated officials and/or authorities both internal and external to the organization.","Select Control Status","(ref., NIST SP 800-171 3.6.2 or CMMC IR.L2-3.6.2)\n\nTracking and documenting system security incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports. Reporting incidents addresses specific incident reporting requirements within an organization and the formal incident reporting requirements for the organization. Suspected security incidents may also be reported and include the receipt of suspicious email communications that can potentially contain malicious code. The types of security incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, Executive Orders, directives, regulations, and policies.\n\nNIST SP 800-61 provides guidance on incident handling."]
["3.7.1",1,"Perform maintenance on organizational systems.","Select Control Status","(ref., NIST SP 800-171 3.7.1 or CMMC MA.L2-3.7.1)\n\nThis requirement addresses the information security aspects of the system maintenance program and applies to all types of maintenance to any system component (including hardware, firmware, applications) conducted by any local or nonlocal entity. System maintenance also includes those components not directly associated with information processing and data or information retention such as scanners, copiers, and printers."]
["3.8.9",2,"Protect the confidentiality of backup Sensitive Information at storage locations.","Select Control Status","(ref., NIST SP 800-171 3.8.9 or CMMC MP.L2-3.8.9)\n\nOrganizations can employ cryptographic mechanisms or alternative physical controls to protect the confidentiality of backup information at designated storage locations. Backed-up information containing Sensitive Information may include system-level information and user-level information. System-level information includes system-state information, operating system software, application software, and licenses. User-level information includes information other than system-level information."]
["3.9.2",3,"Ensure that organizational systems containing Sensitive Information are protected during and after personnel actions such as terminations and transfers. ","Select Control Status","(ref., NIST SP 800-171 3.9.2 or CMMC PS.L2-3.9.2)\n\nProtecting Sensitive Information during and after personnel actions may include returning system-related property and conducting exit interviews. System-related property includes hardware authentication tokens, identification cards, system administration technical manuals, keys, and building passes. Exit interviews ensure that individuals who have been terminated understand the security constraints imposed by being former employees and that proper accountability is achieved for system-related property. Security topics of interest at exit interviews can include reminding terminated individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not be possible for some terminated individuals, for example, in cases related to job abandonment, illnesses, and non-availability of supervisors. For termination actions, timely execution is essential for individuals terminated for cause. In certain situations, organizations consider disabling the system accounts of individuals that are being terminated prior to the individuals being notified.\n\nThis requirement applies to reassignments or transfers of individuals when the personnel action is permanent or of such extended durations as to require protection. Organizations define the protections appropriate for the types of reassignments or transfers, whether permanent or extended. Protections that may be required for transfers or reassignments to other positions within organizations include returning old and issuing new keys, identification cards, and building passes; changing system access authorizations (i.e., privileges); closing system accounts and establishing new accounts; and providing for access to official records to which individuals had access at previous work locations and in previous system accounts."]
["3.10.1",1,"Limit physical access to organizational information systems, equipment and the respective operating environments to authorized individuals. ","Select Control Status","(ref., NIST SP 800-171 3.10.1 or CMMC PE.L1-3.10.1)\n\nThis requirement applies to employees, individuals with permanent physical access authorization credentials, and visitors. Authorized individuals have credentials that include badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed consistent with applicable laws, directives, policies, regulations, standards, procedures, and guidelines. This requirement applies only to areas within facilities that have not been designated as publicly accessible.\n\nLimiting physical access to equipment may include placing equipment in locked rooms or other secured areas and allowing access to authorized individuals only, and placing equipment in locations that can be monitored by organizational personnel. Computing devices, external disk drives, networking devices, monitors, printers, copiers, scanners, facsimile machines, and audio devices are examples of equipment."]
["3.11.1",1,"Periodically assess the risk to organizational operations (including mission, functions, image or reputation), organizational assets and individuals, resulting from the operation of organizational systems and the associated processing, storage or transmission of Sensitive Information. ","Select Control Status","(ref., NIST SP 800-171 3.11.1 or CMMC RA.L2-3.11.1)\n\nClearly defined system boundaries are a prerequisite for effective risk assessments. Such risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations, organizational assets, and individuals based on the operation and use of organizational systems. Risk assessments also consider risk from external parties (e.g., service providers, contractor operating systems on behalf of the organization, individuals accessing organizational systems, outsourcing entities). Risk assessments, either formal or informal, can be conducted at the organization level, the mission or business process level, or the system level, and at any phase in the system development life cycle.\n\nNIST SP 800-30 provides guidance on conducting risk assessments."]
["3.11.2",2,"Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.","Select Control Status","(ref., NIST SP 800-171 3.11.2 or CMMC RA.L2-3.11.2)\n\nOrganizations determine the required vulnerability scanning for all system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. The vulnerabilities to be scanned are readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This process ensures that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in source code reviews and in a variety of tools (e.g., static analysis tools, web-based application scanners, binary analyzers). Vulnerability scanning includes: scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating information flow control mechanisms.\n\nTo facilitate interoperability, organizations consider using products that are Security Content Automated Protocol (SCAP)-validated, scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention, and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of system vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD).\n\nSecurity assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). In certain situations, the nature of the vulnerability scanning may be more intrusive or the system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates thorough vulnerability scanning and protects the sensitive nature of such scanning.\n\nNIST SP 800-40 provides guidance on vulnerability management."]
["3.11.3",3,"Remediate vulnerabilities in accordance with risk assessments. ","Select Control Status","(ref., NIST SP 800-171 3.11.3 or CMMC RA.L2-3.11.3)\n\nVulnerabilities discovered, for example, via the scanning conducted in response to RA.L2-3.11.2, are remediated with consideration of the related assessment of risk. The consideration of risk influences the prioritization of remediation efforts and the level of effort to be expended in the remediation for specific vulnerabilities."]
["3.12.1",1,"Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.","Select Control Status","(ref., NIST SP 800-171 3.12.1 or CMMC CA.L2-3.12.1)\n\nOrganizations assess security controls in organizational systems and the environments in which those systems operate as part of the system development life cycle. Security controls are the safeguards or countermeasures organizations implement to satisfy security requirements. By assessing the implemented security controls, organizations determine if the security safeguards or countermeasures are in place and operating as intended. Security control assessments ensure that information security is built into organizational systems; identify weaknesses and deficiencies early in the development process; provide essential information needed to make risk-based decisions; and ensure compliance to vulnerability mitigation procedures. Assessments are conducted on the implemented security controls as documented in system security plans. \n\nSecurity assessment reports document assessment results in sufficient detail as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the security controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security requirements. Security assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted.\n\nOrganizations ensure that security assessment results are current, relevant to the determination of security control effectiveness, and obtained with the appropriate level of assessor independence. Organizations can choose to use other types of assessment activities such as vulnerability scanning and system monitoring to maintain the security posture of systems during the system life cycle.\n\nNIST SP 800-53 provides guidance on security and privacy controls for systems and organizations. SP 800-53A provides guidance on developing security assessment plans and conducting assessments."]
["3.12.4",2,"Develop, document and periodically update System Security Plans (SSPs) that describe system boundaries, system environments of operation, how security requirements are implemented and the relationships with or connections to other systems.","Select Control Status","(ref., NIST SP 800-171 3.12.4 or CMMC CA.L2-3.12.4)\n\nSystem security plans relate security requirements to a set of security controls. System security plans also describe, at a high level, how the security controls meet those security requirements, but do not provide detailed, technical descriptions of the design or implementation of the controls. System security plans contain sufficient information to enable a design and implementation that is unambiguously compliant with the intent of the plans and subsequent determinations of risk if the plan is implemented as intended. Security plans need not be single documents; the plans can be a collection of various documents including documents that already exist. Effective security plans make extensive use of references to policies, procedures, and additional documents (e.g., design and implementation specifications) where more detailed information can be obtained. This reduces the documentation requirements associated with security programs and maintains security-related information in other established management/operational areas related to enterprise architecture, system development life cycle, systems engineering, and acquisition.\n\nNIST SP 800-18 provides guidance on developing security plans."]
["3.13.1",1,"Monitor, control and protect organizational communications (e.g., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.","Select Control Status","(ref., NIST SP 800-171 3.13.1 or CMMC SC.L1-3.13.1)\n\nCommunications can be monitored, controlled, and protected at boundary components and by restricting or prohibiting interfaces in organizational systems. Boundary components include gateways, routers, firewalls, guards, network-based malicious code analysis and virtualization systems, or encrypted tunnels implemented within a system security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Restricting or prohibiting interfaces in organizational systems includes restricting external web communications traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses.\n\nOrganizations consider the shared nature of commercial telecommunications services in the implementation of security requirements associated with the use of such services. Commercial telecommunications services are commonly based on network components and consolidated management systems shared by all attached commercial customers and may also include third party-provided access lines and other service elements. Such transmission services may represent sources of increased risk despite contract security provisions. NIST SP 800-41 provides guidance on firewalls and firewall policy. \n\nNIST SP 800-125B provides guidance on security for virtualization technologies."]
["3.13.13",3,"Control and monitor the use of mobile code. ","Select Control Status","(ref., NIST SP 800-171 3.13.13 or CMMC SC.L2-3.13.13)\n\nMobile code technologies include Java, JavaScript, ActiveX, Postscript, PDF, Flash animations, and VBScript. Decisions regarding the use of mobile code in organizational systems are based on the potential for the code to cause damage to the systems if used maliciously. Usage restrictions and implementation guidance apply to the selection and use of mobile code installed on servers and mobile code downloaded and executed on individual workstations, notebook computers, and devices (e.g., smart phones). Mobile code policy and procedures address controlling or preventing the development, acquisition, or introduction of unacceptable mobile code in systems, including requiring mobile code to be digitally signed by a trusted source."]
["3.13.16",3,"Protect the confidentiality of Sensitive Information at rest. ","Select Control Status","(ref., NIST SP 800-171 3.13.16 or CMMC SC.L2-3.13.16)\n\nInformation at rest refers to the state of information when it is not in process or in transit and is located on storage devices as specific components of systems. The focus of protection at rest is not on the type of storage device or the frequency of access but rather the state of the information. Organizations can use different mechanisms to achieve confidentiality protections, including the use of cryptographic mechanisms and file share scanning. Organizations may also use other controls including secure off-line storage in lieu of online storage when adequate protection of information at rest cannot otherwise be achieved or continuous monitoring to identify malicious code at rest."]
["3.14.1",1,"Identify, report and correct information and information system flaws in a timely manner. ","Select Control Status","(ref., NIST SP 800-171 3.14.1 or CMMC SI.L1-3.14.1)\n\nOrganizations identify systems that are affected by announced software and firmware flaws including potential vulnerabilities resulting from those flaws and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources such as the Common Weakness Enumeration (CWE) database or Common Vulnerabilities and Exposures (CVE) database in remediating flaws discovered in organizational systems.\n\nOrganization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types of remediation. NIST SP 800-40 provides guidance on patch management technologies."]
["3.14.2",2,"Provide protection from malicious code at appropriate locations within organizational information systems.","Select Control Status","(ref., NIST SP 800-171 3.14.2 or CMMC SI.L1-3.14.2)\n\nDesignated locations include system entry and exit points which may include firewalls, remote access servers, workstations, electronic mail servers, web servers, proxy servers, notebook computers, and mobile devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files, or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways including web accesses, electronic mail, electronic mail attachments, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities.\n\nMalicious code protection mechanisms include anti-virus signature definitions and reputation-based technologies. A variety of technologies and methods exist to limit or eliminate the effects of malicious code. Pervasive configuration management and comprehensive software integrity controls may be effective in preventing execution of unauthorized code. In addition to commercial off-the-shelf software, malicious code may also be present in custom-built software. This could include logic bombs, back doors, and other types of cyber-attacks that could affect organizational missions/business functions. Traditional malicious code protection mechanisms cannot always detect such code. In these situations, organizations rely instead on other safeguards including secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to help ensure that software does not perform functions other than the functions intended. \n\nNIST SP 800-83 provides guidance on malware incident prevention."]
["3.14.5",2,"Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened or executed.","Select Control Status","(ref., NIST SP 800-171 3.14.5 or CMMC SI.L1-3.14.5)\n\nPeriodic scans of organizational systems and real-time scans of files from external sources can detect malicious code. Malicious code can be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files, or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways including web accesses, electronic mail, electronic mail attachments, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities."]

{"sheet":"Results","index":3,"n_rows":9,"n_cols":3,"rows_kept":9,"cut":false,"hidden":false,"merged":[]}
["Calculate Compliance","Status","Decription"]
["Compliance with 48 CFR 52.204-21",{"$f":"IF(AND(Questionnaire!D2=\"Yes\",Questionnaire!D3=\"Yes\"),\"Compliant\",IF(AND(Questionnaire!D2=\"Yes\",OR(Questionnaire!D3=\"Select Option\",Questionnaire!D3=\"\")),\"Question 1.a Required\",IF(AND(Questionnaire!D2=\"Yes\",Questionnaire!D3=\"No\"),\"Not Compliant\", \"Not Applicable\")))","v":"Not Applicable"},"When CFR 52.204-21 = Yes, 1.a = Yes then Compliant, if 1.a = no then Non-Compliant, Else Not applicable"]
["Compliance with DFARS 252.204-7012",{"$f":"IF(AND(Questionnaire!D4=\"Yes\",Questionnaire!D5=\"Yes\",Questionnaire!D6=\"Yes\"),\"Compliant\",IF(AND(Questionnaire!D4=\"Yes\",OR(Questionnaire!D5=\"Select Option\",Questionnaire!D5=\"\")),\"Question 2.a Required\",IF(AND(Questionnaire!D4=\"Yes\",OR(Questionnaire!D6=\"Select Option\",Questionnaire!D6=\"\")),\"Question 2.b Required\",IF(AND(Questionnaire!D4=\"Yes\",OR(Questionnaire!D5=\"No\",Questionnaire!D6=\"No\",Questionnaire!D7=\"No\")),\"Non-Compliant\",\"Not Applicable\"))))","v":"Not Applicable"},"When -7012 = Yes AND 2.a = Yes AND 2.b = Yes then Compliant. If 2 = Yes AND 2.a = No OR 2.b = No, Then Non-Compliant, Else not Applicable."]
["Compliance with DFARS 252.204-7020",{"$f":"IF(AND(Questionnaire!D8=\"Yes\",Questionnaire!D9=\"Yes\",Questionnaire!D10<>\"MM/DD/YYYY\",Questionnaire!D10<>\"\",Questionnaire!D11<>\"Select Option\",Questionnaire!D11<>\"\",Questionnaire!D12<>\"Select Option\",Questionnaire!D12=\"\"),\"Compliant\",IF(AND(Questionnaire!D8=\"Yes\",OR(Questionnaire!D9=\"Select Option\",Questionnaire!D9=\"\")),\"Question 3.a Required\",IF(AND(Questionnaire!D8=\"Yes\",Questionnaire!D9=\"Yes\",OR(Questionnaire!D10=\"MM/DD/YYYY\",Questionnaire!D10=\"\")),\"Question 3.b Required\",IF(AND(Questionnaire!D8=\"Yes\",Questionnaire!D9=\"Yes\",OR(Questionnaire!D11=\"Select Option\",Questionnaire!D11=\"\")),\"Question 3.c Required\",IF(AND(Questionnaire!D8=\"Yes\",Questionnaire!D9=\"Yes\",OR(Questionnaire!D12=\"Select Option\",Questionnaire!D12=\"\")),\"Question 3.d Required\",IF(AND(Questionnaire!D8=\"Yes\",Questionnaire!D9=\"Yes\",Questionnaire!D12=\"Yes\",OR(Questionnaire!D13=\"Enter Score\",Questionnaire!D13=\"\")),\"Question # 3.e is Required\",IF(AND(Questionnaire!D8=\"Yes\",Questionnaire!D9=\"Yes\",Questionnaire!D12=\"Yes\",OR(Questionnaire!D13<>\"Enter Score\",Questionnaire!D13<>\"\")),\"Compliant\",IF(AND(Questionnaire!D8=\"Yes\",Questionnaire!D9=\"Yes\",Questionnaire!D12=\"No\"),\"Compliant\",IF(AND(Questionnaire!D8=\"Yes\",Questionnaire!D9<>\"Yes\"),\"Non-Compliant\",\"Not Applicable\")))))))))","v":"Not Applicable"},"When -7020 = Yes, 3.a = Yes AND 3.b = 'Not Expired' AND 3.c != NULL Then Compliant, if 3.a = No OR 3.b = 'Expired' Then Non-Compliant, Else Not Applicable"]
["CMMC Certification Level",{"$f":"IF(AND(Questionnaire!D14=\"Yes\",Questionnaire!D15<>\"Select Option\",Questionnaire!D15<>\"\",Questionnaire!D16<>\"MM/DD/YYYY\",Questionnaire!D16<>\"\"),Questionnaire!D15,IF(AND(Questionnaire!D14=\"Yes\",OR(Questionnaire!D15=\"Select Option\",Questionnaire!D15=\"\")),\"Question 4.a Required\", IF(AND(Questionnaire!D14=\"Yes\",OR(Questionnaire!D16=\"MM/DD/YYYY\",Questionnaire!D16=\"\")),\"Question 4.b Required\", \"Not Applicable\")))","v":"Not Applicable"},"When -CMMC = Yes,  4.b = 'Not Expired' Then <CMMC Level>, If 4.b = \"expired\" then \"Expired\", Else \"Not Applicable\""]
[]
["Calculate Risk","Risk Rating","Description"]
["Cyber Risk Rating",{"$f":"IF(AND(Questionnaire!D4=\"No\",Questionnaire!D17=\"No\",Questionnaire!D18=\"No\"),\"Not Applicable\",IF(COUNTIF(Questionnaire!$D:$D,\"Select Control Status\")>0,\"Must complete Security Control Section\",IF(COUNTIFS(Questionnaire!$D:$D,\"Yes\",Questionnaire!$B:$B,1)<11,\"Significant\",IF(AND(COUNTIFS(Questionnaire!$D:$D,\"Yes\",Questionnaire!$B:$B,1)>=11,COUNTIFS(Questionnaire!$D:$D,\"Yes\",Questionnaire!$B:$B,2)<10),\"Moderate\",IF(AND(COUNTIFS(Questionnaire!$D:$D,\"Yes\",Questionnaire!$B:$B,1)>=11,COUNTIFS(Questionnaire!$D:$D,\"Yes\",Questionnaire!$B:$B,2)>=10,COUNTIFS(Questionnaire!$D:$D,\"Yes\",Questionnaire!$B:$B,3)>=10),\"Negligible\",\"\")))))","v":"Must complete Security Control Section"},"(31) Risk Controls - (11) Category 1, (10) Category 2, (10) Category 3\nNegligible = All Category 1,2,3 controls are Yes\nModerate = All Category 1 Yes AND < 10 Category 2 OR < 10 Category 3\nSignificant = Less than 11 Category 1 Yes"]
["Risk of FCI-only suppliers",{"$f":"IF(Questionnaire!D2 = \"No\", \"Not  Applicable\",IF(OR(Questionnaire!D4=\"Yes\",Questionnaire!D17=\"Yes\",Questionnaire!D18=\"Yes\"),\"Not Applicable\",IF(OR(Questionnaire!D2=\"Select Option\",Questionnaire!D4=\"Select Option\",Questionnaire!D17=\"Select Option\",Questionnaire!D18=\"Select Option\",Questionnaire!D14=\"Select Option\"),\"Complete Scoping Questions\", IF(AND(Questionnaire!D2=\"Yes\",Questionnaire!D4=\"No\",Questionnaire!D17=\"No\",Questionnaire!D18=\"No\"),IF(SUM(COUNTIFS(Questionnaire!D:D,\"Yes\",Questionnaire!A:A,{\"3.1.1\",\"3.10.1\",\"3.13.1\",\"3.14.1\",\"3.14.2\",\"3.14.5\"}))=6,\"Negligible\",IF(SUM(COUNTIFS(Questionnaire!D:D,\"Yes\",Questionnaire!A:A,{\"3.1.1\",\"3.10.1\",\"3.13.1\",\"3.14.1\",\"3.14.2\",\"3.14.5\"}))<6,\"Significant\",\"Not Applicable\"))))))","v":"Complete Scoping Questions"},"Based on response to 1.a and (6) FCI related Risk controls from the (31) Critical Security Controls are Implemented"]

{"sheet":"Version Control","index":4,"n_rows":17,"n_cols":5,"rows_kept":17,"cut":false,"hidden":false,"merged":[]}
["Date","Version","Changes","Comments","Author"]
["2024-03-04","1.03","SPRS Export date format changed to \"yyyy-mm-dd\"",null,"DIBSCC WG"]
["2024-02-28","--","Updated export function to change date to SPRS Self-Assessment date value to a short date format for easier uploading. ",null,"DIBSCC WG"]
["2024-01-15","` --","Updated Results formula to include not applicable when 1 = No",null,"DIBSCC WG"]
["2023-12-20","` --","Updated Moderate cyber rating description",null,"DIBSCC WG"]
["2023-11-16","1.02","Edited the \"Introduction\" tab to include instructions for Exporting /Importing .csv files.\nUpdated Cyber Rating details and description to change to \"Negligible, Moderate, and Significant\"",null,"DIBSCC WG"]
["2023-09-25","1.0","Ability to import the CCRA .csv files was added.\nFixed bug that excluded the 3.1.4 field from exporting.",null,"DIBSCC WG"]
["2023-08-17","--","Prevent focus to top after Response option selection.  For the Security Control Questions, the survey will scroll the last answered question to the top.",null,"DIBSCC WG"]
["2023-03-06","2.01","Udpdated logic for DFARS 252.204-7012 Compliance Scoring",null,"DIBSCC WG"]
["2023-02-09","2.0","CQ Introduction and Instruction","Updated Content from Pilot feedback, Macros to validate responses, and export to .CSV functionality","DIBSCC WG"]
["2023-01-10","1.3.3","Changed based on WG Feedback, DR-024, DR-029, DR-034","Textual changes","DIBSCC WG"]
["2022-12-01","1.3.2","1. Security Control Guidance - Discussion Column H was updated to reflect the current version of CMMC Level 2 Assessment Guide. References to CUI was changed to \"Sensitive Information\"\n2. Remove CMMC/NIST References from Security Controls and moved to the bottom of the Control Guidance (Discussion )",null,"DIBSCC WG"]
["2022-11-21","1.3.1","1. Change logic for question 4 to unhide 4.a AND 4.b when response is \"Yes\". Also Question 4 will only unhide upon a Yes response to Question 2.\n2. Change logic for question 3 to unhide only when question 2 is Yes.\n3. Renumber questions after 9 because question 10 was missing","updated macro logic.","DIBSCC WG"]
["2022-11-01","1.3","1. Critical Security Control Section response options change to only have \"Yes\" or \"No\".\n\n2. Update risk calculation functions/formula to align with the new \"Yes\" and \"No\" response options for the critical security controls.\n\n3. Remove duplicative Risk Calculations from Results tab.\n\n4. Remove DFARS 252.204-7021 references from question 4 on the Questionnaire and Results tab for compliance calculations.\n","1. Binary response to see if control is implemented or falls into a Other category {Not Implemented, On POAM, Other}\n2. Exostar to Add Tool Tip\nSelect Yes only when the security control is fully implemented.\nSelect No in all other cases; control is not implemented, partially implemented, on POAM\n3. Other Risk Calculations are rolled up into the Supplier Risk Rating. All other categories were scored the same way.\n4. CMMC is in rulemaking and DFARS -7021 may be subject to change.","DIBSCC WG"]
["2022-09-01","1.2","Update Critical secuirty control section to replace the word \"CUI\" with \"Sensitive Information\".",null,"DIBSCC WG"]
["2022-06-01","1.1","Text updates to questions",null,"DIBSCC WG"]
["2022-03-16","1.0","N/A","Minimal Viable Product","DIBSCC WG"]