CUI-specific Controls
This technology implements CUI protection requirements as a classification scheme and marking rules that can be processed automatically.
Limits of existing approaches
Classification limited to marking text
When a classification is managed only as marking text, it is difficult for systems to apply protection based on it.
Old markings remaining after reclassification
With templates or manual markings, old markings tend to remain after the classification changes.
Login records without data-level detail
System login records alone can hardly show which data at which level was accessed.
Existing approaches and CUI-specific controls
Machine-readable classification scheme
Categories from the US CUI Registry are converted into machine-readable classification codes and recorded in the file's security attributes.
A mapping to the Korean classification levels is also defined, so classifications from both schemes can be applied to one document at the same time.
Automatic application of marking rules
The marking requirements of 32 CFR Part 2002 and DoDI 5200.48 (banner markings, portion markings, and others) are organized into rules, and header and footer markings, portion markings, and printout banners are generated from the document's security attributes.
Because markings are not typed in by hand, errors and omissions decrease, and markings stay consistent with the actual protection conditions.
Records that serve as evidence of control implementation
Data events such as viewing, printing, export, and level changes are recorded with the user, time, and target, so they can serve as evidence of implementing controls such as NIST SP 800-171 Audit and Accountability (AU).
Assurances
Alignment with NIST SP 800-171
Addresses the highlighted families among the NIST SP 800-171 security requirement families.
Certification assessment must be conducted separately.
Try JOLDISK for free
