Estimate your SPRS score.

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

Worth 5 points if not met.

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

Worth 5 points if not met.

Control the flow of CUI in accordance with approved authorizations.

Controlled unclassified information is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy.

Worth 1 point if not met.

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

Worth 1 point if not met.

Employ the principle of least privilege, including for specific security functions and privileged accounts.

Worth 3 points if not met.

Use non-privileged accounts or roles when accessing nonsecurity functions.

Worth 1 point if not met.

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Worth 1 point if not met.

Limit unsuccessful logon attempts.

Worth 1 point if not met.

Provide privacy and security notices consistent with applicable CUI rules.

Controlled unclassified information is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy.

Worth 1 point if not met.

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

Worth 1 point if not met.

Terminate (automatically) a user session after a defined condition.

Worth 1 point if not met.

Monitor and control remote access sessions.

Worth 5 points if not met.

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Worth 5 points if not met.

Route remote access via managed access control points.

Worth 1 point if not met.

Authorize remote execution of privileged commands and remote access to security-relevant information.

Worth 1 point if not met.

Authorize wireless access prior to allowing such connections.

Worth 5 points if not met.

Protect wireless access using authentication and encryption.

Worth 5 points if not met.

Control connection of mobile devices.

Worth 5 points if not met.

Encrypt CUI on mobile devices and mobile computing platforms.

Worth 3 points if not met.

Verify and control/limit connections to and use of external systems.

Worth 1 point if not met.

Limit use of portable storage devices on external systems.

Worth 1 point if not met.

Control CUI posted or processed on publicly accessible systems.

Worth 1 point if not met.