- \n
- End User Devices<\/strong> \u2013 Desktops, laptops, tablets, and virtual devices<\/li>\n\n\n\n
- Servers<\/strong> \u2013 Including on-premises, IaaS, PaaS, virtual, and hybrid environments<\/li>\n\n\n\n
- Applications<\/strong> \u2013 Covering on-premises, SaaS, and hybrid systems<\/li>\n<\/ul>\n\n\n\n
Direct links to official UWSA policies<\/strong>, enabling quick reference and deeper exploration<\/p>\n\n\n\n
References to NIST CSF 2.0<\/strong>, Govern, Identify, Protect, Detect, Respond, and Recover<\/em><\/p>\n\n\n\n
![\"\"](\"https:\/\/www.wisconsin.edu\/information-security\/wp-content\/uploads\/sites\/264\/2025\/08\/CSF-wheel-revamp-final-white-1024x987.png\")
<\/figure>\n\n\n\nCross-references to NIST SP 800-171<\/strong>, supporting efforts to align institutional policies with NIST<\/p>\n\n\n\n
<\/p>\n\n\n\n
\n\n\n\n\nEnd User Devices<\/strong> \u2013 Desktops, laptops, tablets, and virtual devices<\/summary>
\n<\/p>\n\n\n\n
Control<\/strong><\/th> Frequency<\/strong><\/th> What to do<\/strong><\/th> References<\/strong><\/th> CSF Function<\/strong><\/th><\/tr><\/thead> Operating System<\/strong><\/td> Ongoing maintenance<\/td> Maintain supported operating systems.<\/td> Policy 1036<\/a>
NIST 800-171 Rev 3: 3.4.2<\/td>Protect<\/td><\/tr> Configurations<\/strong><\/td> On setup and review<\/td> Enable host firewall.
Disable remote access protocols (RDP, SSH), by default.
Activate screen lock after 15 minutes of inactivity.<\/td>Policy 1036<\/a>
NIST 800-171 Rev 3: 3.4.2, 3.4.6, 3.4.7<\/td>Protect<\/td><\/tr> Malware Protection<\/strong><\/td> Continuous monitoring<\/td> Protect against malware using host-based and institutionally managed software.<\/td> Policy 1042<\/a>
NIST 800-171 Rev 3: 3.14.2, 3.14.4<\/td>Protect<\/td><\/tr> Vulnerability Scanning<\/strong><\/td> Monthly\/Quarterly\/Ad-hoc<\/td> Configure endpoints for scheduled vulnerability scans.
Monthly for high risk or high impact, quarterly for other systems, include authenticated internal scanning for maximum visibility<\/strong>.
Perform ad hoc scans after environmental changes.<\/td>Policy 1042<\/a>
NIST 800-171 Rev 3: 3.14.1, 3.14.5, 3.4.7<\/td>Protect<\/td><\/tr> Patching<\/strong><\/td> Ongoing<\/td> Prioritize endpoint patching based on importance.
Follow remediation timelines and CVSS ratings.<\/td>Policy 1042<\/a>
NIST 800-171 Rev 3: 3.14.1<\/td>Protect<\/td><\/tr> Infected Device<\/strong><\/td> On detection<\/td> Isolate the endpoint from the network until triaged.<\/td> Policy 1036<\/a>
NIST 800-171 Rev 3: 3.14.3<\/td>Protect<\/td><\/tr> Logging and Monitoring<\/strong><\/td> Continuous<\/td> Create logs for monitoring, investigation, reporting unauthorized activity.
Applies to end-user devices with increased security risks.
Logs must be monitored locally or centrally.<\/td>Policy 1041<\/a>
NIST 800-171 Rev 3: 3.1.7, 3.3.1, 3.3.5, 3.3.7
NIST 800-171 Rev 3: 3.14.7<\/td>Detect<\/td><\/tr> Inventory<\/strong><\/td> On setup<\/td> Add endpoint to asset inventory.<\/td> Policy 1035<\/a>
NIST 800-171 Rev 3: 3.4.1<\/td>Identify<\/td><\/tr> Incident<\/strong><\/td> Continuous<\/td> Report an incident that meets medium or higher cyber incident severity criteria. Refer to UW System IR plan<\/a>.<\/td> Policy 1033<\/a>
NIST 800-171 Rev 3: 3.6.2<\/td>Respond<\/td><\/tr> VPN<\/strong><\/td> On setup<\/td> Enable workstation VPN.<\/td> Policy 1038<\/a>
NIST 800-171 Rev 3: 3.13.8<\/td>Protect<\/td><\/tr> Security Risks<\/strong><\/td> Continuous<\/td> Capture security risks via methods such as vulnerability scanning, incident response, SIEM alert, and vendor notifications.<\/td> Policy 1039<\/a>
NIST 800-171 Rev 3: 3.11.2, 3.6.1, 3.14.7<\/td>Protect<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/div><\/details>\n<\/div>\n\n\n\n \nServers<\/strong> \u2013 On-premises, IaaS, PaaS, virtual, and hybrid environments<\/summary>
\n<\/p>\n\n\n\n
Control<\/strong><\/th> Frequency<\/strong><\/th> What to do<\/strong><\/th> References<\/strong><\/th> CSF Function<\/strong><\/th><\/tr><\/thead> Accounts and Authorizations<\/strong><\/td> On creation or change<\/td> Use only UW-authorized accounts and identity providers.
Use Single Sign-On (SSO) by an institution authorized identity provider, when available.
Apply security controls aligned with standard, privileged, and highly privileged authorizations.<\/td>Policy 1030<\/a>
NIST 800-171 Rev 3: 3.1.1, 3.1.2, 3.1.5, 3.5.1, 3.5.5<\/td>Protect<\/td><\/tr> Privileged Authorizations<\/strong><\/td> On assignment<\/td> Privileged authorizations require separate accounts or RBAC, with identities verified through in-person or equivalent assurance methods.
Highly privileged authorizations must also use a separate account or PAM workflows.
Highly privileged authorizations require approval from the Data Steward(s) responsible for the associated IT Asset(s).<\/td>Policy 1030<\/a>
NIST 800-171 Rev 3: 3.1.6, 3.1.7, 3.13.3<\/td>Protect<\/td><\/tr> Attestation for Service Account Access<\/strong><\/td> Annually<\/td> Authorizations must be reviewed annually for all service accounts.<\/td> Policy 1030<\/a>
NIST 800-171 Rev 3 3.1.2<\/td>Protect<\/td><\/tr> Operating System<\/strong><\/td> Ongoing maintenance<\/td> Maintain supported operating systems.<\/td> Policy 1036<\/a>
NIST 800-171 Rev 3: 3.4.2<\/td>Protect<\/td><\/tr> Configurations<\/strong><\/td> On setup and review<\/td> Enable host firewall.
Disable remote access protocols (RDP, SSH), by default.
Activate screen lock after 15 minutes of inactivity.<\/td>Policy 1036<\/a>
NIST 800-171 Rev 3: 3.4.2, 3.4.6, 3.4.7<\/td>Protect<\/td><\/tr> Malware Protection<\/strong><\/td> Continuous monitoring<\/td> Protect against malware using host-based and institutionally managed software.<\/td> Policy 1042<\/a>
NIST 800-171 Rev 3: 3.14.2, 3.14.4<\/td>Protect<\/td><\/tr> Vulnerability Scanning<\/strong><\/td> Monthly\/Quarterly\/Ad-hoc<\/td> Configure servers for scheduled vulnerability scans.
Monthly for high risk or high impact, quarterly for other systems, include authenticated internal scanning for maximum visibility<\/strong>.
Perform ad hoc scans after environmental changes.<\/td>Policy 1042<\/a>
NIST 800-171 Rev 3: 3.14.1, 3.14.5, 3.4.7<\/td>Protect<\/td><\/tr> Patching<\/strong><\/td> Ongoing<\/td> Prioritize server patching based on importance.
Follow remediation timelines and CVSS ratings.<\/td>Policy 1042<\/a>
NIST 800-171 Rev 3: 3.14.1<\/td>Protect<\/td><\/tr> Infected Device<\/strong><\/td> On detection<\/td> Isolate the server from the network until triaged.<\/td> Policy 1036<\/a>
NIST 800-171 Rev 3: 3.14.3<\/td>Protect<\/td><\/tr> Logging and Monitoring<\/strong><\/td> Continuous<\/td> Create logs for monitoring, investigation, reporting unauthorized activity.
For high impact services the logs must include security events and must be transferred to a managed logging service.<\/strong>
Logs must be monitored locally or centrally.
Keep logs for at least 30 days.<\/td>Policy 1041<\/a>
NIST 800-171 Rev 3: 3.1.7, 3.3.1, 3.3.5, 3.3.7
NIST 800-171 Rev 3: 3.14.7<\/td>Detect<\/td><\/tr> Inventory<\/strong><\/td> On setup<\/td> Add server to asset inventory.<\/td> Policy 1035<\/a>
NIST 800-171 Rev 3: 3.4.1<\/td>Identify<\/td><\/tr> Incident<\/strong><\/td> Continuous<\/td> Report an incident that meets medium or higher cyber incident severity criteria. Refer to UW System IR plan<\/a>.<\/td> Policy 1033<\/a>
NIST 800-171 Rev 3: 3.6.2<\/td>Respond<\/td><\/tr> Security Risks<\/strong><\/td> Continuous<\/td> Capture security risks via methods such as vulnerability scanning, incident response, SIEM alert, and vendor notifications.<\/td> Policy 1039<\/a>
NIST 800-171 Rev 3: 3.11.2, 3.6.1, 3.14.7<\/td>Protect<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n <\/p>\n<\/div><\/details>\n\n\n\n
Applications<\/strong> \u2013 On-premises, SaaS, and hybrid systems<\/summary>
\n<\/p>\n\n\n\n
Control<\/strong><\/th> Frequency<\/strong><\/th> What to do<\/strong><\/th> References<\/strong><\/th> CSF Function<\/strong><\/th><\/tr><\/thead> Accounts and Authorizations<\/strong><\/strong><\/td> On creation or change<\/td> Use only UW-authorized accounts and identity providers.
Use Single Sign-On (SSO) by an institution authorized identity provider, when available.
Apply security controls aligned with standard, privileged, and highly privileged authorizations.<\/td>Policy 1030<\/a>
NIST 800-171 Rev 3: 3.1.1, 3.1.2, 3.1.5, 3.5.1, 3.5.5<\/td>Protect<\/td><\/tr> Privileged Authorizations<\/strong><\/td> On assignment<\/td> Privileged authorizations require separate accounts or RBAC, with identities verified through in-person or equivalent assurance methods.
Highly privileged authorizations must also use a separate account or PAM workflows.
Highly privileged authorizations require approval from the Data Steward(s) responsible for the associated IT Asset(s).<\/td>Policy 1030<\/a>
NIST 800-171 Rev 3: 3.1.6, 3.1.7, 3.13.3<\/td>Protect<\/td><\/tr> Attestation for Service Account Access<\/strong><\/td> Annually<\/td> Authorizations must be reviewed annually for all service accounts.<\/td> Policy 1030<\/a>
NIST 800-171 Rev 3 3.1.2<\/td>Protect<\/td><\/tr> Vulnerability Scanning<\/strong><\/td> Monthly\/Quarterly\/Ad-hoc<\/td> Configure applications for scheduled vulnerability scans.
Monthly for high risk or high impact, quarterly for other systems, include authenticated internal scanning for maximum visibility<\/strong>.
Perform ad hoc scans after environmental changes.<\/td>Policy 1042<\/a>
NIST 800-171 Rev 3: 3.14.1, 3.14.5, 3.4.7<\/td>Protect<\/td><\/tr> Patching<\/strong><\/td> Ongoing<\/td> Prioritize application patching based on importance.
Follow remediation timelines and CVSS ratings.<\/td>Policy 1042<\/a>
NIST 800-171 Rev 3: 3.14.1<\/td>Protect<\/td><\/tr> Infected Application<\/strong><\/td> On detection<\/td> Isolate the application from the network until triaged.<\/td> Policy 1036<\/a>
NIST 800-171 Rev 3: 3.14.3<\/td>Protect<\/td><\/tr> Logging and Monitoring<\/strong><\/td> Continuous<\/td> Create logs for monitoring, investigation, reporting unauthorized activity.
For high impact services the logs must include security events and must be transferred to a managed logging service.<\/strong>
Logs must be monitored locally or centrally.
Keep logs for at least 30 days.<\/td>Policy 1041<\/a>
NIST 800-171 Rev 3: 3.1.7, 3.3.1, 3.3.5, 3.3.7
NIST 800-171 Rev 3: 3.14.7<\/td>Detect<\/td><\/tr> Inventory<\/strong><\/td> On setup<\/td> Add application to inventory.<\/td> Policy 1035<\/a>
NIST 800-171 Rev 3: 3.4.1<\/td>Identify<\/td><\/tr> Incident<\/strong><\/td> Continuous<\/td> Report an incident that meets medium or higher cyber incident severity criteria. Refer to UW System IR plan<\/a>.<\/td> Policy 1033<\/a>
NIST 800-171 Rev 3: 3.6.2<\/td>Respond<\/td><\/tr> Security Risks<\/strong><\/td> Continuous<\/td> Capture security risks via methods such as vulnerability scanning, incident response, SIEM alert, and vendor notifications.<\/td> Policy 1039<\/a>
NIST 800-171 Rev 3: 3.11.2, 3.6.1, 3.14.7<\/td>Protect<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n <\/p>\n<\/div><\/details>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"
The UWSA Policy Controls Website is a web-based tool designed to help users efficiently understand and apply UWSA information security policy requirements. This interface offers a structured view of policy […]<\/p>\n","protected":false},"author":6783,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-189","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.wisconsin.edu\/information-security\/wp-json\/wp\/v2\/pages\/189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wisconsin.edu\/information-security\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.wisconsin.edu\/information-security\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.wisconsin.edu\/information-security\/wp-json\/wp\/v2\/users\/6783"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wisconsin.edu\/information-security\/wp-json\/wp\/v2\/comments?post=189"}],"version-history":[{"count":40,"href":"https:\/\/www.wisconsin.edu\/information-security\/wp-json\/wp\/v2\/pages\/189\/revisions"}],"predecessor-version":[{"id":248,"href":"https:\/\/www.wisconsin.edu\/information-security\/wp-json\/wp\/v2\/pages\/189\/revisions\/248"}],"wp:attachment":[{"href":"https:\/\/www.wisconsin.edu\/information-security\/wp-json\/wp\/v2\/media?parent=189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Servers<\/strong> \u2013 Including on-premises, IaaS, PaaS, virtual, and hybrid environments<\/li>\n\n\n\n