Map your security controls to TIC 3.0 capabilities with clarity

TIC 3.0 is the third version of the US federal Trusted Internet Connections initiative, run by CISA. Rather than forcing all agency internet traffic through a small number of physical access points, it lets agencies secure traffic flexibly across cloud, branch office and remote user environments. It does this through a Security Capabilities Catalog, reference architecture and use cases that describe the security capabilities agencies should apply at policy enforcement points and across the enterprise.

Federal civilian executive branch agencies in the United States must implement TIC, under OMB Memorandum M-19-26. Private companies are not directly regulated by TIC 3.0, but cloud service providers, managed security providers and network vendors that serve federal agencies are often asked to show how their services support the TIC 3.0 security capabilities an agency needs for its chosen use case.

The TIC 3.0 Security Capabilities Catalog contains universal security capabilities, which apply across an agency's whole enterprise, and policy enforcement point (PEP) security capabilities, which apply at specific points in the network. PEP capabilities are organised into 12 groups: Files, Email, Web, Networking, Resiliency, Domain Name System, Intrusion Detection, Enterprise, Unified Communications and Collaboration, Data Protection, Services and Identity. Agencies select the capabilities that fit each use case.

CISA publishes use cases that show how agencies can apply TIC 3.0 in common network scenarios. The published use cases cover the Traditional TIC model, Branch Office, Remote User and Cloud deployments. Each use case describes the security patterns involved and lists which universal and PEP security capabilities are applicable, so an agency can combine use cases to match its own architecture.

No. TIC 3.0 is not a certification scheme and there is no TIC 3.0 certificate that a company can obtain. Agencies are responsible for implementing the capabilities that apply to their environment and reporting through federal oversight processes. Vendors commonly publish mappings that show how their products support specific TIC 3.0 capabilities, which agencies then use when designing their architecture.

TIC 3.0 complements other federal requirements rather than replacing them. FedRAMP authorises cloud services, while TIC 3.0 guides how agencies secure the network traffic to and from those services. CISA maps TIC 3.0 capabilities to the NIST Cybersecurity Framework, and its emphasis on identity, data protection and continuous monitoring supports federal zero trust strategies. Controls you already run for ISO 27001 or NIST 800-53 often provide useful evidence.

There is no fixed timeline, because effort depends on how many use cases apply, how many policy enforcement points you operate and how mature your logging, identity and data protection controls already are. Organisations with strong existing security programmes, such as NIST 800-53 or ISO 27001, usually find many universal capabilities partly in place, which shortens the work considerably.

TIC 3.0 is mapped in OneClickComply's control library and is available on request, rather than being a live framework you can switch on today. If you need it, OneClickComply can map the TIC 3.0 capabilities to the controls you already run, so evidence collected for frameworks such as NIST 800-53, FedRAMP or ISO 27001 counts towards TIC 3.0 too. Contact the team to discuss your requirements.