NIST 800-171 Control #3.3.4