Do you maintain a current list of who has access to each information system (servers, shared drives, applications)?

When someone leaves the organization or changes roles, is their system access revoked within 24 hours?

Do you control remote access to your network — who can connect from outside, and how?

Has every person who handles CUI received role-specific training on what CUI is and how to handle it?

Do you verify competency after training — not just attendance, but understanding?

Do you retrain when procedures change, or only on an annual cycle?

Do your servers, workstations, and network devices generate logs of user login activity, file access, and configuration changes?

Are those logs retained for a defined period and protected from modification or deletion?

Does anyone review the logs — on a schedule, or only after an incident?

Do you maintain a documented baseline of your IT environment — what hardware, what software, what versions are running?

Do changes to system configurations (software installs, updates, network changes) go through a review and approval process?

Are unauthorized changes detected and addressed?

Does every person who accesses your network have a unique user account — no shared logins, no generic accounts?

Is multi-factor authentication enabled for network access and remote access?

Do you enforce password complexity and expiration policies across all systems that touch CUI?

If an employee clicked a phishing link or connected an unauthorized device, would they know whom to report it to?

Do you have a documented procedure for responding to an information security incident — containment, investigation, corrective action?

Have you ever tested the procedure — through a tabletop exercise, a drill, or a real incident?

Do you schedule and document maintenance on IT systems — patching, updates, hardware replacement — the same way you schedule equipment calibration?

When maintenance is performed remotely (by a vendor or contractor), do you control and monitor the session?

After maintenance, do you verify the system is functioning correctly before returning it to production use?

Do you have a policy for how USB drives, external hard drives, and portable media are used in your facility?

When a hard drive or device that has stored CUI is decommissioned, do you sanitize or destroy it — and document the disposal?

Is CUI encrypted when stored on laptops, removable media, or portable devices?

Do you conduct background screening before granting access to CUI or CUI-bearing systems?

When someone transfers to a different role, do you review and adjust their information access to match the new role?

Do you have a documented offboarding process that includes revoking all information system access?

Are the rooms or areas where CUI is processed or stored (server rooms, network closets, designated workstations) physically restricted to authorized personnel?

Are visitors escorted in areas where CUI is accessible?

Do you maintain access logs for restricted areas — who entered, when?

Have you identified the specific threats to your organization's CUI — who would want it, and how they might try to get it?

Have you assessed the vulnerabilities in your current IT environment — unpatched systems, weak configurations, gaps in controls?

Do you reassess risk periodically, or only when something goes wrong?

Have you conducted an internal audit of your information protection controls in the past twelve months?

When the audit identifies findings, do the findings enter your corrective action system with assigned owners and due dates?

Do you track corrective actions to verified closure — the same way you track quality audit findings?

Is your network segmented so that systems processing CUI are separated from general-purpose systems and guest networks?

Is CUI encrypted in transit — email, file transfers, remote access sessions?

Do you monitor and control communications at your network boundary — inbound and outbound?

Is antivirus or endpoint protection installed and current on every system that processes CUI?

Do you scan for vulnerabilities on a defined schedule — and remediate findings within a defined timeline?

Do you monitor your systems for signs of unauthorized access or anomalous behavior — and who reviews the alerts?