List all the derived security requirements in the Access Control section of the NIST SP 800-171 revision 2 document.
 3.1.3: Control the flow of CUI in accordance with approved authorizations.
 3.1.4: Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
 3.1.5: Employ the principle of least privilege, including for specific security functions and privileged accounts.
 3.1.6: Use non-privileged accounts or roles when accessing nonsecurity functions.
 3.1.7: Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
 3.1.8: Limit unsuccessful logon attempts.
 3.1.9: Provide privacy and security notices consistent with applicable CUI rules.
 3.1.10: Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
 3.1.11: Terminate (automatically) a user session after a defined condition.
 3.1.12: Monitor and control remote access sessions.
 3.1.13: Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
 3.1.14: Route remote access via managed access control points.
 3.1.15: Authorize remote execution of privileged commands and remote access to security-relevant information.
 3.1.16: Authorize wireless access prior to allowing such connections.
 3.1.17: Protect wireless access using authentication and encryption.
 3.1.18: Control connection of mobile devices.
 3.1.19: Encrypt CUI on mobile devices and mobile computing platforms.
 3.1.20: Verify and control/limit connections to and use of external systems.
 3.1.21: Limit use of portable storage devices on external systems.
 3.1.22: Control CUI posted or processed on publicly accessible systems.
Here are the derived security requirements:
 3.1.3: Control the flow of CUI in accordance with approved authorizations.
 3.1.4: Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
 3.1.5: Employ the principle of least privilege, including for specific security functions and privileged accounts.
 3.1.6: Use non-privileged accounts or roles when accessing nonsecurity functions.
 3.1.7: Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
 3.1.8: Limit unsuccessful logon attempts.
 3.1.9: Provide privacy and security notices consistent with applicable CUI rules.
 3.1.10: Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
 3.1.11: Terminate (automatically) a user session after a defined condition.
 3.1.12: Monitor and control remote access sessions.
 3.1.13: Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
 3.1.14: Route remote access via managed access control points.
 3.1.15: Authorize remote execution of privileged commands and remote access to security-relevant information.
 3.1.16: Authorize wireless access prior to allowing such connections.
 3.1.17: Protect wireless access using authentication and encryption.
 3.1.18: Control connection of mobile devices.
 3.1.19: Encrypt CUI on mobile devices and mobile computing platforms.
 3.1.20: Verify and control/limit connections to and use of external systems.
 3.1.21: Limit use of portable storage devices on external systems.
 3.1.22: Control CUI posted or processed on publicly accessible systems.