# cf_assessments

status: Documented Pending Approval
assessed_at: 2026-03-30T13:02:22.920304Z
created_at: 2026-02-18T16:57:47.441102+00:00
updated_at: 2026-03-30 13:02:22
assessor_notes:
  Found in 5239 para 98 and 172-177. The instruction ties password, foreign-national, and access-control procedures to specific STIG V-numbers and states how those controls are implemented onboard.


status: Documented Pending Approval
assessed_at: 2026-03-30T13:02:22.920304Z
created_at: 2026-02-18T16:57:47.455397+00:00
updated_at: 2026-03-30 13:02:22
assessor_notes:
  Found in 5239 para 60-78. Chapter 1 establishes the CCB process, approval workflow, testing requirements, and documented configuration control for shipboard changes.


status: Documented Pending Approval
assessed_at: 2026-03-30T13:02:22.920304Z
created_at: 2026-02-18T16:57:47.457340+00:00
updated_at: 2026-03-30 13:02:22
assessor_notes:
  Found in 5239 para 276-295 and 322-326. Chapter 6 defines the vulnerability management process, assigns ISSM and admin responsibilities, and requires recurring VRAM and compliance reporting.


# tradsec_assessments

status: Documented Pending Approval
document_ref: 5510 para 302
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 302. COMSEC holdings aboard USNS MONTFORD POINT are limited to SECRET and below per DD-254. The Emergency Action Plan (EAP) / Emergency Destruction Plan (EDP) is maintained in the COMSEC Binder in the Communications Module.


status: Documented Pending Approval
document_ref: 5510 para 395
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 395. In the event of an emergency requiring the shut-down of IT equipment onboard USNS MONTFORD POINT, the EO will shut down all equipment using SOP for shutting down the shack and then will open the circuit breaker that feed.


status: Documented Pending Approval
document_ref: 5510 para 418
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 418. All crew members onboard USNS MONTFORD POINT that process and/or handle national security information must be aware of the presence of crew members that are not cleared to gain access to classified information and/or mat.


status: Documented Pending Approval
document_ref: 5239 para 173
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5239 para 173. No access to GENSER SIPRNET will be granted to FNs. FN access to classified networks is authorized only through an approved REL network.


status: Documented Pending Approval
document_ref: 5239 para 172
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5239 para 172. FN access to MSC NIPRNET is not allowed by ATO. Access would require an update to the enclave accreditation package and approval by the Navy Authorizing Official (NAO) before it is granted.


status: Documented Pending Approval
document_ref: 5510 para 134
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 134. Badging System. The Master/OIC authorizing general visiting/open house constitutes a waiver for visitor badge requirements.


status: Documented Pending Approval
document_ref: 5239 para 177
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5239 para 177. Operational requirements to work or communicate with FNs must be vetted through MSC N6 and the MSC Command Security Manager (CSM).


status: Documented Pending Approval
document_ref: 5510 para 428
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 428. If the EO notices suspicious activity on any MSC network or system (such as abnormally slow response time, spam email flooding the system or excessive browser popups), the EO will notify MSC Afloat IA immediately via ema.


status: Documented Pending Approval
document_ref: 5510 para 101
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 101. Personnel assigned onboard the ship who require access (whether escorted or unescorted) to the ship’s Communications Module will be screened against relevant databases at Defense Information System for Security (DISS), a.


status: Documented Pending Approval
document_ref: 5510 para 501
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 501. USNS MONTFORD POINT will follow the guidance contained in DISA’s Cyber Awareness Challenge regarding the protection of Mobile Devices while traveling.


status: Documented Pending Approval
document_ref: 5510 para 539
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 539. GPS on Mobile Devices. Many mobile devices and applications can track your location without your knowledge or consent. Stop and think before using a mobile device. Mobile device tracking can.


status: Documented Pending Approval
document_ref: 5510 para 451
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 451. It is USNS MONTFORD POINT policy that the use of personal electronic devices within USNS MONTFORD POINT restricted spaces is prohibited.


status: Documented Pending Approval
document_ref: 5510 para 386
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 386. USNS MONTFORD POINT approves and monitors nonlocal maintenance and diagnostic activities. USNS MONTFORD POINT.


status: Documented Pending Approval
document_ref: 5510 para 173
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 173. Safeguarding. Classified material will be stored in a GSA approved safe when not in use. Retention of classified material will be kept to a minimum and will be maintained until its purpose has been served.


status: Documented Pending Approval
document_ref: 5510 para 439
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 439. The following security measures will be implemented and adhered to for the operation and maintenance of designated Classified storage area onboard USNS MONTFORD POINT.


status: Documented Pending Approval
document_ref: 5510 para 314
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 314. IAW DoD Manual 5200.01, Volume 3, DoD Information Security Program: Protection of Classified Information, Enclosure 5, the Master, USNS MONTFORD POINT is responsible for evaluating and documenting the security posture of.


status: Documented Pending Approval
document_ref: 5510 para 203
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 203. Electronically Transmitted Messages. Classified information resident in an electronic environment, and retained as permanent records, must be marked, as would any other classified document. Email.


status: Documented Pending Approval
document_ref: 5510 para 178
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 178. DOD policy is to maximize the availability of information consistent with the restraints necessary to protect national security, U.S.


status: Documented Pending Approval
document_ref: 5510 para 111
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 111. Requirements for Access. Individuals will be allowed access to classified information only if they.


status: Documented Pending Approval
document_ref: 5510 para 172
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 172. All USNS MONTFORD POINT personnel are responsible for safeguarding classified material under their cognizance.


status: Documented Pending Approval
document_ref: 5510 para 406
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 406. USNS MONTFORD POINT limits access to unauthorized personnel to information displayed on classified monitors/displays to ensure there is no loss or compromise of classified information.


status: Documented Pending Approval
document_ref: 5510 para 349
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 349. IAW DoDM 5200.01, USNS MONTFORD POINT has established a system of security checks at the close of each duty day to ensure that any area where classified information is used or stored is secure.


status: Documented Pending Approval
document_ref: 5510 para 214
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 214. Reproduction. To ensure the equipment in use meets the standards for reproduction, all printers will be affixed with a Standard Form (SF) 707, Secret Classification Label.


status: Documented Pending Approval
document_ref: 5510 para 258
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 258. Destruction. All paper products, regardless of classification, are shredded using a NSA approved shredder, or disposed of by placing the items in a burn bag.


status: Documented Pending Approval
document_ref: 5510 para 226
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 226. Annual Review (Command "Clean Out" Day). At least annually, the Master will designate a classified material "clean out" day.


status: Documented Pending Approval
document_ref: 5510 para 431
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 431. The EO will follow all direction given regarding the spillage (i. e., disconnect the computer from the network; re-image the workstation). The EO will report all actions taken.


status: Documented Pending Approval
document_ref: 5510 para 224
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 224. Security Classification Guides (SCGs). The use of SCGs are required when drafting classified correspondence or messages.


status: Documented Pending Approval
document_ref: 5510 para 167
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 167. The Master and FSO are responsible for establishing a security education program. The FSO will maintain records of all security briefings conducted.


status: Documented Pending Approval
document_ref: 5510 para 247
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 247. CUI Encryption of Data at Rest. USNS MONTFORD POINT handles CUI data in an approved manner to alleviate the risk of loss or compromise of sensitive information.


status: Documented Pending Approval
document_ref: 5510 para 248
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 248. CUI should not be on any publicly accessible websites; at minimum, posting CUI should be on certificate-based sites. (i.e., SharePoint).


status: Documented Pending Approval
document_ref: 5510 para 168
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 168. Orientation/Indoctrination Briefing. All personnel must check in with the Mate in charge of Orientation regardless of job or security clearance status, to receive an orientation briefing upon signing on the vessel.


status: Documented Pending Approval
document_ref: 5510 para 169
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 169. Annual Refresher Briefings. All personnel are provided an annual refresher briefing by the FSO or the Master.


status: Documented Pending Approval
document_ref: 5510 para 110
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 110. Personnel Security Clearances. Access to classified material requires a favorably adjudicated background investigation in Defense Information Security System (DISS).


status: Documented Pending Approval
document_ref: 5510 para 338
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 338. Master, USNS MONTFORD POINT will ensure cleared employees who leave the company or whose clearance is terminated receive a termination briefing and notifying the FSO. The briefing shall.


status: Documented Pending Approval
document_ref: 5510 para 117
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 117. The specified control procedures will help ensure security is maintained and privacy to the ship’s crew is provided. The entire ship is considered off-limits to all personnel except those authorized to board.


status: Documented Pending Approval
document_ref: 5510 para 153
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 153. Procedures when in a Shipyard. When an MSC vessel is in a commercial repair facility, the shipyard is required to have a badging system for its workforce.


status: Documented Pending Approval
document_ref: 5510 para 100
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 100. IAW COMSCINST 5530.3(series), Military Sealift Command Afloat Force Protection and Chemical, Biological, Radiological, and Nuclear Defense Program, USNS MONTFORD POINT has control procedures specified to help ensure secu.


status: Documented Pending Approval
document_ref: 5510 para 447
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 447. Penetration testing will be conducted onboard USNS MONTFORD POINT, and testing will be done periodically, unannounced attempts to penetrate key computing facilities.


status: Documented Pending Approval
document_ref: 5510 para 83
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 83. Pursuant to SECNAVINST 5510.30C, Department of the Navy Personnel Security Program, and SECNAVINST 5510.36B, the Master, USNS MONTFORD POINT(T-ESD-1) is responsible for the implementation of an effective Personnel and In.


status: Documented Pending Approval
document_ref: 5510 para 551
assessed_at: 2026-03-30T13:03:45.874389+00:00
created_at: 2026-03-30 12:45:55
updated_at: 2026-03-30 13:03:45
assessor_notes:
  Found in 5510 para 551. All personnel will receive Counter-Intelligence and Awareness training (CIAR) within 30 days of initial assignment or employment to the USNS MONTFORD POINT and every 12 months thereafter.


# cnd_rows

group_label: Discovery Scan Operations
scoring_key: SCANNING_REMEDIATION:R17
row_type: measure
notes: Scanning & Remediation measure row 17
measure_text:
  Site executes discovery operational scanning of their entire IP space (including unused IPs) every 30 days to identify authorized and unauthorized devices.


group_label: Active (over-the-wire) Scanning Operations
scoring_key: SCANNING_REMEDIATION:R21
row_type: measure
notes: Scanning & Remediation measure row 21
measure_text:
  Site executes Active Vulnerability Scanning every 7 days on all non-agent installed/enabled endpoints.


group_label: Active (over-the-wire) Scanning Operations
scoring_key: SCANNING_REMEDIATION:R25
row_type: measure
notes: Scanning & Remediation measure row 25
measure_text:
  The local administrators ensure appropriate authentication access and credentials are provided to achieve a 98% authentication rate on the CSI scans?


group_label: Scanning Tool Hygiene and Operator Training
scoring_key: SCANNING_REMEDIATION:R33
row_type: measure
notes: Scanning & Remediation measure row 33
measure_text:
  All non-admin operators/analysts have current certificate of completions for the ACAS operator's course.


group_label: Terrain Identification and Coverage
scoring_key: SCANNING_REMEDIATION:R36
row_type: measure
notes: Scanning & Remediation measure row 36
measure_text:
  Site has separate asset lists for all Program Managed systems (PMs) and Tenant Organization(s), and this IP Space is documented.


group_label: Terrain Identification and Coverage
scoring_key: SCANNING_REMEDIATION:R38
row_type: measure
notes: Scanning & Remediation measure row 38
measure_text:
  The Network Operations Team as well as Local ISSM verify the accuracy of their IP space documentation by signature.


group_label: Digital Signature Policy is implemented in accordance with DOD policies and directives
scoring_key: PKI:R12
row_type: measure
notes: PKI measure row 12
measure_text:
  Digital signature policy must require all emails sent from a DoD owned system or account, which contain an embedded hyperlink and/or attachment, use digital signatures


group_label: User Based Enforcement is implemented in accordance with DoD policies and directives
scoring_key: PKI:R14
row_type: measure
notes: PKI measure row 14
measure_text:
  All Windows Active Directory accounts using CAC, PIV compliant hardware token, or ALT are configured to use UBE and "Smart card is required for Interactive logon" on each account in Windows Active Directory environment is enabled


group_label: Password Security is implemented in accordance with DOD policies and directives
scoring_key: PKI:R19
row_type: measure
notes: PKI measure row 19
measure_text:
  Password security policy of at least a 14 character password for all accounts (privileged and non-privileged) that are not UBE


group_label: Password Security is implemented in accordance with DOD policies and directives
scoring_key: PKI:R20
row_type: measure
notes: PKI measure row 20
measure_text:
  Password security policy for annual password change or when an administrator leaves that had knowledge of the password for WSA


group_label: Password Security is implemented in accordance with DOD policies and directives
scoring_key: PKI:R21
row_type: measure
notes: PKI measure row 21
measure_text:
  Password security policy for password change every 60 days for all privileged and non-privileged accounts that are not UBE


group_label: Password Security is implemented in accordance with DOD policies and directives
scoring_key: PKI:R22
row_type: measure
notes: PKI measure row 22
measure_text:
  Password security policy for complexity of case sensitive character mix of upper case letter, lower case letters, numbers, and special characters, including at least one of each


group_label: Password Security is implemented in accordance with DOD policies and directives
scoring_key: PKI:R23
row_type: measure
notes: PKI measure row 23
measure_text:
  AD server must have password observation window for account lockout setting set to no more than "60 minutes", account lockout duration is "zero", and account lockout threshold is "greater than zero, but less than four."


group_label: Soft Certificates are implemened in accordance with DOD policies and directives
scoring_key: PKI:R25
row_type: measure
notes: PKI measure row 25
measure_text:
  Software certificate installation files (.p12 or .pfx) that contains the private key corresponding to the DoD trusted certificate are removed from hard drives and any other online storage devices are removed


group_label: Web servers are PKE enables in accordance with DoD policies and directives
scoring_key: PKI:R27
row_type: measure
notes: PKI measure row 27
measure_text:
  All web servers are PKE enables. An exception to this directive is external web servers containing only data approved for public release IAW FARGO 1 Tab E to Annex C to OGS, Paragraph 3.C.1.C.


group_label: User Training
scoring_key: PKI:R29
row_type: measure
notes: PKI measure row 29
measure_text:
  All users must complete DOD Cyber Awareness training to inlcude proper usage of PKI token and role-based training.  This category is "compliant" if 95% of users have completed the training.  Partially compliant if at least 90%.


group_label: User Training on Removable Media
scoring_key: INSIDER_THREAT:R37
row_type: measure
notes: Insider Threat measure row 37
measure_text:
  Ensure acceptable use and approval process of removable media is included in the inspected organizations Network User Training Program


row_type: group_total
notes: Endpoint Security group row 11
group_label:
  EndPoint Security ePO Baseline and Configuration (N/A for Ships Force if ships do not host ePo server, grade POR result only)

measure_text:
  EndPoint Security ePO Baseline and Configuration (N/A for Ships Force if ships do not host ePo server, grade POR result only)

scoring_key:
  ENDPOINT_SECURITY:endpoint_security_epo_baseline_and_configuration_(n_a_for_ships_force_if_ships_do_not_host_epo_server,_grade_por_result_only)


row_type: group_total
notes: Endpoint Security group row 19
group_label:
  EndPoint Security Point Product Deployment (compliant is >=98%, partial compliance is < 98% but >=95%, not compliant is <95%)

measure_text:
  EndPoint Security Point Product Deployment (compliant is >=98%, partial compliance is < 98% but >=95%, not compliant is <95%)

scoring_key:
  ENDPOINT_SECURITY:endpoint_security_point_product_deployment_(compliant_is_>=98%,_partial_compliance_is_<_98%_but_>=95%,_not_compliant_is_<95%)


scoring_key: ENDPOINT_SECURITY:R22
row_type: measure
notes: Endpoint Security measure row 22
group_label:
[cell repeats an earlier one in this file: 125 characters]

measure_text:
  Policy Auditor Advanced Host Assessment (PA AHA) deployed to system at mandated Program of Record version


row_type: group_total
notes: Endpoint Security group row 24
group_label:
  Endpoint Security Client Module Configuration(compliant is >=98%, partial compliance is <98% but >=95%, not compliant is <95%)

measure_text:
  Endpoint Security Client Module Configuration(compliant is >=98%, partial compliance is <98% but >=95%, not compliant is <95%)

scoring_key:
  ENDPOINT_SECURITY:endpoint_security_client_module_configuration(compliant_is_>=98%,_partial_compliance_is_<98%_but_>=95%,_not_compliant_is_<95%)


group_label: HBSS/Endpoint Security Training
scoring_key: ENDPOINT_SECURITY:R41
row_type: measure
notes: Endpoint Security measure row 41
measure_text:
  All personnel responsible for the deployment, implementation, administration, and analysis of HBSS have completed the applicable training


