The National Institute of Standards and Technology is seeking public feedback on its draft update of a special publication on protecting controlled unclassified information, or CUI.
NIST on Thursday published its proposed third revision to Special Publication 800-171 for non-government CUI protection, as well as SP 800-171A for CUI security requirement assessment.
SP 800-171r3 includes significant changes in the employment of least privilege principles and monitoring and controlling remote access sessions. NIST proposes to limit authorized system access to users that need to complete assigned organizational tasks. The draft also calls for periodic review of privileges and the removal of access if necessary.
For SP 800-171Ar3, NIST aligned the assessment procedure syntax with the Cybersecurity and Privacy Reference Framework.
Both drafts are open for public comment until Jan. 12.