CMMC Level 2 Certification Assessments

Cybersecurity Maturity Model Certification (CMMC) Program Reporting and Recordkeeping Requirements Information Collection

ModelOverview_MasterV2.1_Draft_Clean_20230706

CMMC Level 2 Certification Assessments

OMB: 0704-0677

Document [docx]
Download: docx | pdf




Shape1 Shape2

Version 2.1 - DRAFT | July 2023

Cybersecurity Maturity Model Certification (CMMC)
Model Overview


NOTICES

The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing CMMC requirements under the law or departmental policies.

[DISTRIBUTION STATEMENT A] Approved for public release.

Table of Contents


  1. Introduction

The theft of intellectual property and sensitive information from all industrial sectors because of malicious cyber activity threatens economic security and national security. The Council of Economic Advisors estimates that malicious cyber activity cost the U.S. economy between $57 billion and $109 billion in 2016 [1]. The Center for Strategic and International Studies estimates that the total global cost of cybercrime was as high as $600 billion in 2017 [2]. Over a ten-year period, that burden would equate to an estimated $570 billion to $1.09 trillion dollars in costs.

Malicious cyber actors have targeted and continue to target the Defense Industrial Base (DIB) sector and the Department of Defense (DoD) supply chain. These attacks not only focus on the large prime contractors, but also target subcontractors that make up the lower tiers of the DoD supply chain. Many of these subcontractors are small entities that provide critical support and innovation. Overall, the DIB sector consists of over 220,000 companies1 that process, store, or transmit CUI or FCI in support the warfighter and contribute towards the research, engineering, developmentf, acquisition, production, delivery, sustainment, and operations of DoD systems, networks, installations, capabilities, and services. The aggregate loss of intellectual property and controlled unclassified information from the DoD supply chain can undercut U.S. technical advantages and innovation, as well as significantly increase the risk to national security.

As part of multiple lines of effort focused on the security and resiliency of the DIB sector, the DoD is working with industry to enhance the protection of the following types of unclassified information within the supply chain:

  • Federal Contract Information (FCI): is defined in 32 CFR § 170.4 and 48 CFR 4.1901. [3].

  • Controlled Unclassified Information (CUI): is defined in 32 CFR § 2002.4 (h).[4].

To this end, the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) and DoD Chief Information Officer (CIO) have developed Cybersecurity Maturity Model Certification (CMMC) in concert with DoD stakeholders, University Affiliated Research Centers (UARCs), Federally Funded Research and Development Centers (FFRDCs), and the DIB sector.

This document focuses on the Cybersecurity Maturity Model Certification (CMMC) Program as set forth in section 170.30 of title 32, Code of Federal Regulations (CFR). The model incorporates the security requirements from: 1) FAR 52.204-21 (“Basic Safeguarding of Covered Contractor Information Systems”), 2) NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and 3) a subset of the requirements from NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171. The CMMC Program is designed to provide increased assurance to the DoD that defense contractors and subcontractors are compliant with information protection requirements for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) and are protecting such information at a level commensurate with risk from cybersecurity threats, including Advanced Persistent Threats (APTs). .

When implementing the CMMC model, an organization can achieve a specific CMMC level for its entire enterprise network or for a particular enclave(s), depending on where the information to be protected is handled and stored.

    1. Document Organization

Section 2 presents the CMMC Model and each of its elements in detail. Appendix A provides the model as a matrix. 0 maps the CMMC model to other secondary sources. Appendix B lists the abbreviations and acronyms. Finally, Appendix C provides the references contained in this document.

    1. Supporting Documents

This document is supported by multiple companion documents that provide additional information. CMMC Assessment Guides present assessment objectives, discussion, examples, potential assessment considerations, and key references for each CMMC requirement. The Scoping Guides provide additional guidance on how to correctly scope an assessment. The CMMC Artifact Hashing Tool User Guide provides information on how to create the hash to validate the integrity of archived assessment artifacts.

These supplemental documents are intended to provide explanatory information to assist organizations with implementing and assessing the security requirements covered by CMMC in 32 CFR § 170. The documents are not prescriptive and their use is optional. Implementation of security requirements by following any examples is not a guarantee of compliance with any CMMC requirement or objective.

  1. CMMC Model

    1. Overview

The CMMC Model incorporates the security requirements from: 1) FAR 52.204-21 (“Basic Safeguarding of Covered Contractor Information Systems”), 2) NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and 3) a subset of the requirements from NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800—171.

The CMMC Model consists of domains that map to the Control Families defined in NIST SP 800-171.

    1. CMMC Levels

There are three levels within CMMC – Level 1, Level 2, and Level 3

      1. Descriptions

The CMMC model measures the implementation of cybersecurity requirements at three levels. Each level is independent and consists of a set of CMMC requirements as set forth in 32 CFR § 170.14 (c):

  • CMMC Level 1 Requirements. The security requirements in CMMC Level 1 are those set forth in FAR clause 52.204-21(b)(1)(i) – (b)(1)(xv).

  • CMMC Level 2 Requirements. The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171.

  • CMMC Level 3 Requirements. The security requirements in CMMC Level 3 are derived from NIST SP 800-172 with DoD-approved parameters where applicable, as identified in the following table. DoD defined selections and parameters for the NIST SP 800-172 requirements are underlined, where applicable

  • .

      1. CMMC Overview

Figure 1 provides an overview of the CMMC Levels.

Figure 1. CMMC Level Overview

      1. CMMC Level 1

Level 1 focuses on the protection of FCI and consists of the requirements that correspond to the 15 basic safeguarding requirements specified in 48 CFR 52.204-21, commonly referred to as the FAR Clause [3].

      1. CMMC Level 2

Level 2 focuses on the protection of CUI and incorporates the 110 security requirements specified in NIST SP 800‑171 Rev 2 [4].

      1. CMMC Level 3

Level 3 focuses on the protection of CUI and encompasses a subset of the NIST SP 800-172 security requirements [5] with DoD-approved parameters. DoD-approved parameters are denoted with underlining.

    1. CMMC Domains

The CMMC model consists of 14 domains that align with the families specified in NIST SP 800‑171. These domains and their abbreviations are as follows:

  • Access Control (AC)

  • Awareness & Training (AT)

  • Audit & Accountability (AU)

  • Configuration Management (CM)

  • Identification & Authentication (IA)

  • Incident Response (IR)

  • Maintenance (MA)

  • Media Protection (MP)

  • Personnel Security (PS)

  • Physical Protection (PE)

  • Risk Assessment (RA)

  • Security Assessment (CA)

  • System and Communications Protection (SC)

  • System and Information Integrity (SI)

    1. CMMC Requirements

      1. List of Requirements

This subsection itemizes the requirements for each domain and at each level. Each requirement has a requirement identification number in the format DD.L#-REQ where:

  • DD is the two-letter domain abbreviation;

  • L# is the level number; and

  • REQ is the FAR Clause 52.204-21 paragraph number, NIST SP 800-171 Rev 2, or NIST SP 800-172 security requirement number.

Below the identification number, a short name identifier is provided for each requirement, meant to be used for quick reference only. Finally, each requirement has a complete requirement statement.

Access Control (AC)

Level 1


AC.L1-b.1.i
Authorized Access Control (FCI)

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

AC.L1-b.1.ii
Transaction & Function Control (FCI)

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

AC.L1-b.1.iii
External Connections (FCI)

Verify and control/limit connections to and use of external information systems.

AC.L1-b.1.iv
Control Public Information (FCI)

Control information posted or processed on publicly accessible information systems.

Level 2


AC.L2-3.1.1
Authorized Access Control (CUI)

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

AC.L2-3.1.2
Transaction & Function Control (CUI)

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

AC.L2-3.1.3
Control CUI Flow

Control the flow of CUI in accordance with approved authorizations.

AC.L2-3.1.4
Separation of Duties

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

AC.L2-3.1.5
Least Privilege

Employ the principle of least privilege, including for specific security functions and privileged accounts.

AC.L2-3.1.6
Non-Privileged Account Use

Use non-privileged accounts or roles when accessing nonsecurity functions.

AC.L2-3.1.7
Privileged Functions

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

AC.L2-3.1.8
Unsuccessful Logon Attempts

Limit unsuccessful logon attempts.

AC.L2-3.1.9
Privacy & Security Notices

Provide privacy and security notices consistent with applicable CUI rules.

AC.L2-3.1.10
Session Lock

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

AC.L2-3.1.11
Session Termination

Terminate (automatically) a user session after a defined condition.

AC.L2-3.1.12
Control Remote Access

Monitor and control remote access sessions.

AC.L2-3.1.13
Remote Access Confidentiality

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

AC.L2-3.1.14
Remote Access Routing

Route remote access via managed access control points.

AC.L2-3.1.15
Privileged Remote Access

Authorize remote execution of privileged commands and remote access to security-relevant information.

AC.L2-3.1.16
Wireless Access Authorization

Authorize wireless access prior to allowing such connections.

AC.L2-3.1.17
Wireless Access Protection

Protect wireless access using authentication and encryption.

AC.L2-3.1.18
Mobile Device Connection

Control connection of mobile devices.

AC.L2-3.1.19
Encrypt CUI on Mobile

Encrypt CUI on mobile devices and mobile computing platforms.

AC.L2-3.1.20
External Connections (CUI)

Verify and control/limit connections to and use of external systems.

AC.L2-3.1.21
Portable Storage Use

Limit use of portable storage devices on external systems.

AC.L2-3.1.22
Control Public Information (CUI)

Control CUI posted or processed on publicly accessible systems.

Level 3


AC.L3-3.1.2e
Organizationally Controlled Assets

Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization.

AC.L3-3.1.3e
Secured Information Transfer

Employ secure information transfer solutions to control information flows between security domains on connected systems.

Awareness and Training (AT)

Level 2


AT.L2-3.2.1
Role-Based Risk Awareness

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

AT.L2-3.2.2
Role-Based Training

Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.

AT.L2-3.2.3
Insider Threat Awareness

Provide security awareness training on recognizing and reporting potential indicators of insider threat.

Level 3


AT.L3-3.2.1e
Advanced Threat Awareness

Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat.

AT.L3-3.2.2e
Practical Training Exercises

Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.

Audit and Accountability (AU)

Level 2


AU.L2-3.3.1
System Auditing

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

AU.L2-3.3.2
User Accountability

Ensure that the actions of individual system users, can be uniquely traced to those users so they can be held accountable for their actions.

AU.L2-3.3.3
Event Review

Review and update logged events.

AU.L2-3.3.4
Audit Failure Alerting

Alert in the event of an audit logging process failure.

AU.L2-3.3.5
Audit Correlation

Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

AU.L2-3.3.6
Reduction & Reporting

Provide audit record reduction and report generation to support on-demand analysis and reporting.

AU.L2-3.3.7
Authoritative Time Source

Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

AU.L2-3.3.8
Audit Protection

Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

AU.L2-3.3.9
Audit Management

Limit management of audit logging functionality to a subset of privileged users.

Configuration Management (CM)

Level 2


CM.L2-3.4.1
System Baselining

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

CM.L2-3.4.2
Security Configuration Enforcement

Establish and enforce security configuration settings for information technology products employed in organizational systems.

CM.L2-3.4.3
System Change Management

Track, review, approve or disapprove, and log changes to organizational systems.

CM.L2-3.4.4
Security Impact Analysis

Analyze the security impact of changes prior to implementation.

CM.L2-3.4.5
Access Restrictions for Change

Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.

CM.L2-3.4.6
Least Functionality

Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

CM.L2-3.4.7
Nonessential Functionality

Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

CM.L2-3.4.8
Application Execution Policy

Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

CM.L2-3.4.9
User-Installed Software

Control and monitor user-installed software.

Level 3


CM.L3-3.4.1e
Authoritative Repository

Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components.

CM.L3-3.4.2e
Automated Detection & Remediation

Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a quarantine or remediation network to facilitate patching, re-configuration, or other mitigations.

CM.L3-3.4.3e
Automated Inventory

Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.

Identification and Authentication (IA)

Level 1


IA.L1-b.1.v
Identification (FCI)

Identify information system users, processes acting on behalf of users, or devices.

IA.L1-b.1.vi
Authentication (FCI)

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Level 2


IA.L2-3.5.1
Identification (CUI)

Identify system users, processes acting on behalf of users, and devices.

IA.L2-3.5.2
Authentication (CUI)

Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

IA.L2-3.5.3
Multifactor Authentication

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

IA.L2-3.5.4
Replay-Resistant Authentication

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

IA.L2-3.5.5
Identifier Reuse

Prevent reuse of identifiers for a defined period.

IA.L2-3.5.6
Identifier Handling

Disable identifiers after a defined period of inactivity.

IA.L2-3.5.7
Password Complexity

Enforce a minimum password complexity and change of characters when new passwords are created.

IA.L2-3.5.8
Password Reuse

Prohibit password reuse for a specified number of generations.

IA.L2-3.5.9
Temporary Passwords

Allow temporary password use for system logons with an immediate change to a permanent password.

IA.L2-3.5.10
Cryptographically-Protected Passwords

Store and transmit only cryptographically protected passwords.

IA.L2-3.5.11
Obscure Feedback

Obscure feedback of authentication information.

Level 3


IA.L3-3.5.1e
Bidirectional Authentication

Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant.

IA.L3-3.5.3e
Block Untrusted Assets

Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile.

Incident Response (IR)

Level 2


IR.L2-3.6.1
Incident Handling

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

IR.L2-3.6.2
Incident Reporting

Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

IR.L2-3.6.3
Incident Response Testing

Test the organizational incident response capability.

Level 3


IR.L3-3.6.1e
Security Operations Center

Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff.

IR.L3-3.6.2e
Cyber Incident Response Team

Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours.

Maintenance (MA)

Level 2


MA.L2-3.7.1
Perform Maintenance

Perform maintenance on organizational systems.

MA.L2-3.7.2
System Maintenance Control

Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

MA.L2-3.7.3
Equipment Sanitization

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

MA.L2-3.7.4
Media Inspection

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

MA.L2-3.7.5
Nonlocal Maintenance

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

MA.L2-3.7.6
Maintenance Personnel

Supervise the maintenance activities of maintenance personnel without required access authorization.

Media Protection (MP)

Level 1


MP.L1-b.1.vii
Media Disposal (FCI)

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

Level 2


MP.L2-3.8.1
Media Protection

Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

MP.L2-3.8.2
Media Access

Limit access to CUI on system media to authorized users.

MP.L2-3.8.3
Media Disposal (CUI)

Sanitize or destroy system media containing CUI before disposal or release for reuse.

MP.L2-3.8.4
Media Markings

Mark media with necessary CUI markings and distribution limitations.

MP.L2-3.8.5
Media Accountability

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

MP.L2-3.8.6
Portable Storage Encryption

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

MP.L2-3.8.7
Removable Media

Control the use of removable media on system components.

MP.L2-3.8.8
Shared Media

Prohibit the use of portable storage devices when such devices have no identifiable owner.

MP.L2-3.8.9
Protect Backups

Protect the confidentiality of backup CUI at storage locations.

Personnel Security (PS)

Level 2


PS.L2-3.9.1
Screen Individuals

Screen individuals prior to authorizing access to organizational systems containing CUI.

PS.L2-3.9.2
Personnel Actions

Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

Level 3


PS.L3-3.9.2e
Adverse Information

Ensure that organizational systems are protected if adverse information develops or is obtained about individuals with access to CUI.

Physical Protection (PE)

Level 1


PE.L1-b.1.viii
Limit Physical Access (FCI)

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

PE.L1-b.1.ix
Manage Visitors & Physical Access (FCI)

Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

Level 2


PE.L2-3.10.1
Limit Physical Access (CUI)

Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.

PE.L2-3.10.2
Monitor Facility

Protect and monitor the physical facility and support infrastructure for organizational systems.

PE.L2-3.10.3
Escort Visitors (CUI)

Escort visitors and monitor visitor activity.

PE.L2-3.10.4
Physical Access Logs (CUI)

Maintain audit logs of physical access.

PE.L2-3.10.5
Manage Physical Access (CUI)

Control and manage physical access devices.

PE.L2-3.10.6
Alternative Work Sites

Enforce safeguarding measures for CUI at alternate work sites.

Risk Assessment (RA)

Level 2


RA.L2-3.11.1
Risk Assessments

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

RA.L2-3.11.2
Vulnerability Scan

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

RA.L2-3.11.3
Vulnerability Remediation

Remediate vulnerabilities in accordance with risk assessments.

Level 3


RA.L3-3.11.1e
Threat-Informed Risk Assessment

Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.

RA.L3-3.11.2e
Threat Hunting

Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls.

RA.L3-3.11.3e
Advanced Risk Identification

Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components.

RA.L3-3.11.4e
Security Solution Rationale

Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.

RA.L3-3.11.5e
Security Solution Effectiveness

Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.

RA.L3-3.11.6e
Supply Chain Risk Response

Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.

RA.L3-3.11.7e
Supply Chain Risk Plan

Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.

Security Assessment (CA)

Level 2


CA.L2-3.12.1
Security Control Assessment

Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

CA.L2-3.12.2
Plan of Action

Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.

CA.L2-3.12.3
Security Control Monitoring

Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

CA.L2-3.12.4
System Security Plan

Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

Level 3


CA.L3-3.12.1e
Penetration Testing

Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts.

System and Communications Protection (SC)

Level 1


SC.L1-b.1.x
Boundary Protection (FCI)

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

SC.L1-b.1.xi
Public-Access System Separation (FCI)

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Level 2


SC.L2-3.13.1
Boundary Protection (CUI)

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

SC.L2-3.13.2
Security Engineering

Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

SC.L2-3.13.3
Role Separation

Separate user functionality from system management functionality.

SC.L2-3.13.4
Shared Resource Control

Prevent unauthorized and unintended information transfer via shared system resources.

SC.L2-3.13.5
Public-Access System Separation (CUI)

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

SC.L2-3.13.6
Network Communication by Exception

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

SC.L2-3.13.7
Split Tunneling

Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

SC.L2-3.13.8
Data in Transit

Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

SC.L2-3.13.9
Connections Termination

Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

SC.L2-3.13.10
Key Management

Establish and manage cryptographic keys for cryptography employed in organizational systems.

SC.L2-3.13.11
CUI Encryption

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

SC.L2-3.13.12
Collaborative Device Control

Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.

SC.L2-3.13.13
Mobile Code

Control and monitor the use of mobile code.

SC.L2-3.13.14
Voice over Internet Protocol

Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.

SC.L2-3.13.15
Communications Authenticity

Protect the authenticity of communications sessions.

SC.L2-3.13.16
Data at Rest

Protect the confidentiality of CUI at rest.

Level 3


SC.L3-3.13.4e
Isolation

Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components.

System and Information Integrity (SI)

Level 1


SI.L1-b.1.xii
Flaw Remediation (FCI)

Identify, report, and correct information and information system flaws in a timely manner.

SI.L1-b.1.xiii
Malicious Code Protection (FCI)

Provide protection from malicious code at appropriate locations within organizational information systems.

SI.L1-b.1.xiv
Update Malicious Code Protection (FCI)

Update malicious code protection mechanisms when new releases are available.

SI.L1-b.1.xv
System & File Scanning (FCI)

Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Level 2


SI.L2-3.14.1
Flaw Remediation (CUI)

Identify, report, and correct system flaws in a timely manner.

SI.L2-3.14.2
Malicious Code Protection (CUI)

Provide protection from malicious code at designated locations within organizational systems.

SI.L2-3.14.3
Security Alerts & Advisories

Monitor system security alerts and advisories and take action in response.

SI.L2-3.14.4
Update Malicious Code Protection (CUI)

Update malicious code protection mechanisms when new releases are available.

SI.L2-3.14.5
System & File Scanning (CUI)

Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

SI.L2-3.14.6
Monitor Communications for Attacks

Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

SI.L2-3.14.7
Identify Unauthorized Use

Identify unauthorized use of organizational systems.

Level 3


SI.L3-3.14.1e
Integrity Verification

Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures.

SI.L3-3.14.3e
Specialized Asset Security

Ensure that specialized assets including IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment are included in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks.

SI.L3-3.14.6e
Threat-Guided Intrusion Detection

Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting.



            1. CMMC Model Matrix

This appendix presents the model in matrix form by domain. The three columns list the associated requirements for each CMMC level. Each level is independent and consists of a set of CMMC requirements:

  • Level 1: the basic safeguarding requirements for FCI specified in FAR Clause 52.204-21.

  • Level 2: the security requirements for CUI specified in NIST SP 800-171 Rev 2 per DFARS Clause 252.204-7012 [3, 4, 5].

  • Level 3: a subset of the enhanced security requirements for CUI specified in NIST SP 800-172 [5] with DoD-approved parameters where applicable.

Each requirement is contained in a single cell. The requirement identification number is bolded at the top of each cell. The next line contains the requirement short name identifier, in italics, which is meant to be used for quick reference only. Below the short name is the complete CMMC requirement statement. Some Level 3 requirement statements contain a DoD-approved parameter, which is underlined. Finally, the bulleted list at the bottom contains the FAR Clause 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172 reference as appropriate.

Access Control (AC)

Level 1

Level 2

Level 3

AC.L1-b.1.i
Authorized Access Control (FCI)
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
• FAR Clause 52.204-21 b.1.i
• NIST SP 800-171 Rev 2 3.1.1

AC.L2-3.1.1
Authorized Access Control (CUI)
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
• NIST SP 800-171 Rev 2 3.1.1
• FAR Clause 52.204-21 b.1.i

AC.L3-3.1.2e
Organizationally Controlled Assets
Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization.
• NIST SP 800-172 3.1.2e

AC.L1-b.1.ii
Transaction & Function Control (FCI)
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
• FAR Clause 52.204-21 b.1.ii
• NIST SP 800-171 Rev 2 3.1.2

AC.L2-3.1.2
Transaction & Function Control (CUI)
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
• NIST SP 800-171 Rev 2 3.1.2
• FAR Clause 52.204-21 b.1.ii

AC.L3-3.1.3e
Secured Information Transfer
Employ 
secure information transfer solutions to control information flows between security domains on connected systems.
• NIST SP 800-172 3.1.3e

AC.L1-b.1.iii
External Connections (FCI)
Verify and control/limit connections to and use of external information systems.
• FAR Clause 52.204-21 b.1.iii
• NIST SP 800-171 Rev 2 3.1.20

AC.L2-3.1.3
Control CUI Flow
Control the flow of CUI in accordance with approved authorizations.
• NIST SP 800-171 Rev 2 3.1.3


AC.L1-b.1.iv
Control Public Information (FCI)
Control information posted or processed on publicly accessible information systems.
• FAR Clause 52.204-21 b.1.iv
• NIST SP 800-171 Rev 2 3.1.22

AC.L2-3.1.4
Separation of Duties
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
• NIST SP 800-171 Rev 2 3.1.4



AC.L2-3.1.5
Least Privilege
Employ the principle of least privilege, including for specific security functions and privileged accounts.
• NIST SP 800-171 Rev 2 3.1.5



AC.L2-3.1.6
Non-Privileged Account Use
Use non-privileged accounts or roles when accessing nonsecurity functions.
• NIST SP 800-171 Rev 2 3.1.6



AC.L2-3.1.7
Privileged Functions
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
• NIST SP 800-171 Rev 2 3.1.7


 

AC.L2-3.1.8
Unsuccessful Logon Attempts
Limit unsuccessful logon attempts.
• NIST SP 800-171 Rev 2 3.1.8


 

AC.L2-3.1.9
Privacy & Security Notices
Provide privacy and security notices consistent with applicable CUI rules.
• NIST SP 800-171 Rev 2 3.1.9



AC.L2-3.1.10
Session Lock
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
• NIST SP 800-171 Rev 2 3.1.10


 

AC.L2-3.1.11
Session Termination
Terminate (automatically) a user session after a defined condition.
• NIST SP 800-171 Rev 2 3.1.11


 

AC.L2-3.1.12
Control Remote Access
Monitor and control remote access sessions.
• NIST SP 800-171 Rev 2 3.1.12


 

AC.L2-3.1.13
Remote Access Confidentiality
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
• NIST SP 800-171 Rev 2 3.1.13


 

AC.L2-3.1.14
Remote Access Routing
Route remote access via managed access control points.
• NIST SP 800-171 Rev 2 3.1.14


 

AC.L2-3.1.15
Privileged Remote Access
Authorize remote execution of privileged commands and remote access to security-relevant information.
• NIST SP 800-171 Rev 2 3.1.15


 

AC.L2-3.1.16
Wireless Access Authorization
Authorize wireless access prior to allowing such connections.
• NIST SP 800-171 Rev 2 3.1.16


 

AC.L2-3.1.17
Wireless Access Protection
Protect wireless access using authentication and encryption.
• NIST SP 800-171 Rev 2 3.1.17


 

AC.L2-3.1.18
Mobile Device Connection
Control connection of mobile devices.
• NIST SP 800-171 Rev 2 3.1.18


 

AC.L2-3.1.19
Encrypt CUI on Mobile
Encrypt CUI on mobile devices and mobile computing platforms.
• NIST SP 800-171 Rev 2 3.1.19


 

AC.L2-3.1.20
External Connections (CUI)
Verify and control/limit connections to and use of external systems.
• NIST SP 800-171 Rev 2 3.1.20
• FAR Clause 52.204-21 b.1.iii


 

AC.L2-3.1.21
Portable Storage Use
Limit use of portable storage devices on external systems.
• NIST SP 800-171 Rev 2 3.1.21


 

AC.L2-3.1.22
Control Public Information (CUI)
Control CUI posted or processed on publicly accessible systems.
• NIST SP 800-171 Rev 2 3.1.22
• FAR Clause 52.204-21 b.1.iv





Awareness and Training (AT)

Level 1

Level 2

Level 3

 

AT.L2-3.2.1
Role-Based Risk Awareness
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
• NIST SP 800-171 Rev 2 3.2.1

AT.L3-3.2.1e
Advanced Threat Awareness
Provide awareness training
upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat.
• NIST SP 800-172 3.2.1e


AT.L2-3.2.2
Role-Based Training
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
• NIST SP 800-171 Rev 2 3.2.2

AT.L3-3.2.2e
Practical Training Exercises
Include practical exercises in awareness training for
all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.
• NIST SP 800-172 3.2.2e

 

AT.L2-3.2.3
Insider Threat Awareness
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
• NIST SP 800-171 Rev 2 3.2.3


aUDIT AND aCCOUNTABILITY (au)

Level 1

Level 2

Level 3

 

AU.L2-3.3.1
System Auditing
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
• NIST SP 800-171 Rev 2 3.3.1


 

AU.L2-3.3.2
User Accountability
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
• NIST SP 800-171 Rev 2 3.3.2


 

AU.L2-3.3.3
Event Review
Review and update logged events.
• NIST SP 800-171 Rev 2 3.3.3


 

AU.L2-3.3.4
Audit Failure Alerting
Alert in the event of an audit logging process failure.
• NIST SP 800-171 Rev 2 3.3.4


 

AU.L2-3.3.5
Audit Correlation
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
• NIST SP 800-171 Rev 2 3.3.5


 

AU.L2-3.3.6
Reduction & Reporting
Provide audit record reduction and report generation to support on-demand analysis and reporting.
• NIST SP 800-171 Rev 2 3.3.6


 

AU.L2-3.3.7
Authoritative Time Source
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
• NIST SP 800-171 Rev 2 3.3.7


 

AU.L2-3.3.8
Audit Protection
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
• NIST SP 800-171 Rev 2 3.3.8


 

AU.L2-3.3.9
Audit Management
Limit management of audit logging functionality to a subset of privileged users. 
• NIST SP 800-171 Rev 2 3.3.9


Configuration Management (CM)

Level 1

Level 2

Level 3

 

CM.L2-3.4.1
System Baselining
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
• NIST SP 800-171 Rev 2 3.4.1

CM.L3-3.4.1e
Authoritative Repository
Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components.
• NIST SP 800-172 3.4.1e

 

CM.L2-3.4.2
Security Configuration Enforcement
Establish and enforce security configuration settings for information technology products employed in organizational systems.
• NIST SP 800-171 Rev 2 3.4.2

CM.L3-3.4.2e
Automated Detection & Remediation
Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection,
remove the components or place the components in a quarantine or remediation network to facilitate patching, re-configuration, or other mitigations.
• NIST SP 800-172 3.4.2e

 

CM.L2-3.4.3
System Change Management
Track, review, approve or disapprove, and log changes to organizational systems.
• NIST SP 800-171 Rev 2 3.4.3

CM.L3-3.4.3e
Automated Inventory
Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.
• NIST SP 800-172 3.4.3e

 

CM.L2-3.4.4
Security Impact Analysis
Analyze the security impact of changes prior to implementation.
• NIST SP 800-171 Rev 2 3.4.4


 

CM.L2-3.4.5
Access Restrictions for Change
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
• NIST SP 800-171 Rev 2 3.4.5


 

CM.L2-3.4.6
Least Functionality
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
• NIST SP 800-171 Rev 2 3.4.6


 

CM.L2-3.4.7
Nonessential Functionality
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
• NIST SP 800-171 Rev 2 3.4.7


 

CM.L2-3.4.8
Application Execution Policy
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
• NIST SP 800-171 Rev 2 3.4.8


 

CM.L2-3.4.9
User-Installed Software
Control and monitor user-installed software.
• NIST SP 800-171 Rev 2 3.4.9


Identification and Authentication (IA)

Level 1

Level 2

Level 3

IA.L1-b.1.v
Identification (FCI)
Identify information system users, processes acting on behalf of users, or devices.
• FAR Clause 52.204-21 b.1.v
• NIST SP 800-171 Rev 2 3.5.1

IA.L2-3.5.1
Identification (CUI)
Identify system users, processes acting on behalf of users, and devices.
• NIST SP 800-171 Rev 2 3.5.1
• FAR Clause 52.204-21 b.1.v

IA.L3-3.5.1e
Bidirectional Authentication
Identify and authenticate
systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant.
• NIST SP 800-172 3.5.1e

IA.L1-b.1.vi
Authentication (FCI)
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
• FAR Clause 52.204-21 b.1.vi
• NIST SP 800-171 Rev 2 3.5.2

IA.L2-3.5.2
Authentication (CUI)
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
• NIST SP 800-171 Rev 2 3.5.2
• FAR Clause 52.204-21 b.1.vi

IA.L3-3.5.3e
Block Untrusted Assets
Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile.
• NIST SP 800-172 3.5.3e

 

IA.L2-3.5.3
Multifactor Authentication
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
• NIST SP 800-171 Rev 2 3.5.3


 

IA.L2-3.5.4
Replay-Resistant Authentication
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
• NIST SP 800-171 Rev 2 3.5.4


 

IA.L2-3.5.5
Identifier Reuse
Prevent reuse of identifiers for a defined period.
• NIST SP 800-171 Rev 2 3.5.5


 

IA.L2-3.5.6
Identifier Handling
Disable identifiers after a defined period of inactivity.
• NIST SP 800-171 Rev 2 3.5.6


 

IA.L2-3.5.7
Password Complexity
Enforce a minimum password complexity and change of characters when new passwords are created.
• NIST SP 800-171 Rev 2 3.5.7


 

IA.L2-3.5.8
Password Reuse
Prohibit password reuse for a specified number of generations.
• NIST SP 800-171 Rev 2 3.5.8


 

IA.L2-3.5.9
Temporary Passwords
Allow temporary password use for system logons with an immediate change to a permanent password.
• NIST SP 800-171 Rev 2 3.5.9


 

IA.L2-3.5.10
Cryptographically-Protected Passwords
Store and transmit only cryptographically-protected passwords.
• NIST SP 800-171 Rev 2 3.5.10


 

IA.L2-3.5.11
Obscure Feedback
Obscure feedback of authentication information.
• NIST SP 800-171 Rev 2 3.5.11


Incident Response (IR)

Level 1

Level 2

Level 3

 

IR.L2-3.6.1
Incident Handling
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
• NIST SP 800-171 Rev 2 3.6.1

IR.L3-3.6.1e
Security Operations Center
Establish and maintain a security operations center capability that operates
24/7, with allowance for remote/on-call staff.
• NIST SP 800-172 3.6.1e


IR.L2-3.6.2
Incident Reporting
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
• NIST SP 800-171 Rev 2 3.6.2

IR.L3-3.6.2e
Cyber Incident Response Team
Establish and maintain a cyber incident response team that can be deployed by the organization within
24 hours.
• NIST SP 800-172 3.6.2e


IR.L2-3.6.3
Incident Response Testing
Test the organizational incident response capability.
• NIST SP 800-171 Rev 2 3.6.3


Maintenance (MA)

Level 1

Level 2

Level 3

 

MA.L2-3.7.1
Perform Maintenance
Perform maintenance on organizational systems.
• NIST SP 800-171 Rev 2 3.7.1


 

MA.L2-3.7.2
System Maintenance Control
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
• NIST SP 800-171 Rev 2 3.7.2


 

MA.L2-3.7.3
Equipment Sanitization
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
• NIST SP 800-171 Rev 2 3.7.3


 

MA.L2-3.7.4
Media Inspection
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
• NIST SP 800-171 Rev 2 3.7.4


 

MA.L2-3.7.5
Nonlocal Maintenance
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
• NIST SP 800-171 Rev 2 3.7.5


 

MA.L2-3.7.6
Maintenance Personnel
Supervise the maintenance activities of maintenance personnel without required access authorization.
• NIST SP 800-171 Rev 2 3.7.6


Media Proection (MP)

Level 1

Level 2

Level 3

MP.L1-b.1.vii
Media Disposal (FCI)
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
• FAR Clause 52.204-21 b.1.vii
• NIST SP 800-171 Rev 2 3.8.3

MP.L2-3.8.1
Media Protection
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
• NIST SP 800-171 Rev 2 3.8.1


 

MP.L2-3.8.2
Media Access
Limit access to CUI on system media to authorized users.
• NIST SP 800-171 Rev 2 3.8.2


 

MP.L2-3.8.3
Media Disposal (CUI)
Sanitize or destroy system media containing CUI before disposal or release for reuse.
• NIST SP 800-171 Rev 2 3.8.3
• FAR Clause 52.204-21 b.1.vii


 

MP.L2-3.8.4
Media Markings
Mark media with necessary CUI markings and distribution limitations.
• NIST SP 800-171 Rev 2 3.8.4


 

MP.L2-3.8.5
Media Accountability
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
• NIST SP 800-171 Rev 2 3.8.5


 

MP.L2-3.8.6
Portable Storage Encryption
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
• NIST SP 800-171 Rev 2 3.8.6


 

MP.L2-3.8.7
Removable Media
Control the use of removable media on system components.
• NIST SP 800-171 Rev 2 3.8.7


 

MP.L2-3.8.8
Shared Media
Prohibit the use of portable storage devices when such devices have no identifiable owner.
• NIST SP 800-171 Rev 2 3.8.8


 

MP.L2-3.8.9
Protect Backups
Protect the confidentiality of backup CUI at storage locations.
• NIST SP 800-171 Rev 2 3.8.9


Personnel Security (PS)

Level 1

Level 2

Level 3


PS.L2-3.9.1
Screen Individuals
Screen individuals prior to authorizing access to organizational systems containing CUI.
• NIST SP 800-171 Rev 2 3.9.1

PS.L3-3.9.2e
Adverse Information
Ensure that organizational systems are protected if adverse information develops or is obtained about individuals with access to CUI.
• NIST SP 800-172 3.9.2e


PS.L2-3.9.2
Personnel Actions
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
• NIST SP 800-171 Rev 2 3.9.2


Physical Protection (PE)

Level 1

Level 2

Level 3

PE.L1-b.1.viii
Limit Physical Access (FCI)
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
• FAR Clause 52.204-21 b.1.viii
• NIST SP 800-171 Rev 2 3.10.1

PE.L2-3.10.1
Limit Physical Access (CUI)
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
• NIST SP 800-171 Rev 2 3.10.1
• FAR Clause 52.204-21 b.1.viii


PE.L1-b.1.ix
Manage Visitors & Physical Access (FCI)
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
• FAR Clause 52.204-21 Partial b.1.ix
• NIST SP 800-171 Rev 2 3.10.3
• NIST SP 800-171 Rev 2 3.10.4
• NIST SP 800-171 Rev 2 3.10.5

PE.L2-3.10.2
Monitor Facility
Protect and monitor the physical facility and support infrastructure for organizational systems.
• NIST SP 800-171 Rev 2 3.10.2


 

PE.L2-3.10.3
Escort Visitors (CUI)
Escort visitors and monitor visitor activity.
• NIST SP 800-171 Rev 2 3.10.3
• FAR Clause 52.204-21 Partial b.1.ix


 

PE.L2-3.10.4
Physical Access Logs (CUI)
Maintain audit logs of physical access.
• NIST SP 800-171 Rev 2 3.10.4
• FAR Clause 52.204-21 Partial b.1.ix


 

PE.L2-3.10.5
Manage Physical Access (CUI)
Control and manage physical access devices.
• NIST SP 800-171 Rev 2 3.10.5
• FAR Clause 52.204-21 Partial b.1.ix


 

PE.L2-3.10.6
Alternative Work Sites
Enforce safeguarding measures for CUI at alternate work sites.
• NIST SP 800-171 Rev 2 3.10.6


Risk Assessment (RA)

Level 1

Level 2

Level 3

 

RA.L2-3.11.1
Risk Assessments
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
• NIST SP 800-171 Rev 2 3.11.1

RA.L3-3.11.1e
Threat-Informed Risk Assessment
Employ
threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.
• NIST SP 800-172 3.11.1e

 

RA.L2-3.11.2
Vulnerability Scan
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. 
• NIST SP 800-171 Rev 2 3.11.2

RA.L3-3.11.2e
Threat Hunting
Conduct cyber threat hunting activities
on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls.
• NIST SP 800-172 3.11.2e

 

RA.L2-3.11.3
Vulnerability Remediation
Remediate vulnerabilities in accordance with risk assessments.
• NIST SP 800-171 Rev 2 3.11.3

RA.L3-3.11.3e
Advanced Risk Identification
Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components.
• NIST SP 800-172 3.11.3e

 

 

RA.L3-3.11.4e
Security Solution Rationale
Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.
• NIST SP 800-172 3.11.4e

 

 

RA.L3-3.11.5e
Security Solution Effectiveness
Assess the effectiveness of security solutions
at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
• NIST SP 800-172 3.11.5e

 

 

RA.L3-3.11.6e
Supply Chain Risk Response
Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.
• NIST SP 800-172 3.11.6e

 

 

RA.L3-3.11.7e
Supply Chain Risk Plan
Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan
at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.
• NIST SP 800-172 3.11.7e

Security Assessment (CA)

Level 1

Level 2

Level 3

 

CA.L2-3.12.1
Security Control Assessment
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. 
• NIST SP 800-171 Rev 2 3.12.1

CA.L3-3.12.1e
Penetration Testing
Conduct penetration testing
at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts.
• NIST SP 800-172 3.12.1e

 

CA.L2-3.12.2
Plan of Action
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
• NIST SP 800-171 Rev 2 3.12.2


 

CA.L2-3.12.3
Security Control Monitoring
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. 
• NIST SP 800-171 Rev 2 3.12.3


 

CA.L2-3.12.4
System Security Plan
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
• NIST SP 800-171 Rev 2 3.12.4


System and Communications Protection (SC)

Level 1

Level 2

Level 3

SC.L1-b.1.x
Boundary Protection (FCI)
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
• FAR Clause 52.204-21 b.1.x
• NIST SP 800-171 Rev 2 3.13.1

SC.L2-3.13.1
Boundary Protection (CUI)
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
• NIST SP 800-171 Rev 2 3.13.1
• FAR Clause 52.204-21 b.1.x

SC.L3-3.13.4e
Isolation
Employ
physical isolation techniques or logical isolation techniques or both in organizational systems and system components.
• NIST SP 800-172 3.13.4e

SC.L1-b.1.xi
Public-Access System Separation (FCI)
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
• FAR Clause 52.204-21 b.1.xi
• NIST SP 800-171 Rev 2 3.13.5

SC.L2-3.13.2
Security Engineering
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
• NIST SP 800-171 Rev 2 3.13.2


 

SC.L2-3.13.3
Role Separation
Separate user functionality from system management functionality.
• NIST SP 800-171 Rev 2 3.13.3


 

SC.L2-3.13.4
Shared Resource Control
Prevent unauthorized and unintended information transfer via shared system resources.
• NIST SP 800-171 Rev 2 3.13.4


 

SC.L2-3.13.5
Public-Access System Separation (CUI)
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
• NIST SP 800-171 Rev 2 3.13.5
• FAR Clause 52.204-21 b.1.xi


 

SC.L2-3.13.6
Network Communication by Exception
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
• NIST SP 800-171 Rev 2 3.13.6


 

SC.L2-3.13.7
Split Tunneling
Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
• NIST SP 800-171 Rev 2 3.13.7


 

SC.L2-3.13.8
Data in Transit
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
• NIST SP 800-171 Rev 2 3.13.8


 

SC.L2-3.13.9
Connections Termination
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
• NIST SP 800-171 Rev 2 3.13.9


 

SC.L2-3.13.10
Key Management
Establish and manage cryptographic keys for cryptography employed in organizational systems.
• NIST SP 800-171 Rev 2 3.13.10


 

SC.L2-3.13.11
CUI Encryption
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
• NIST SP 800-171 Rev 2 3.13.11


 

SC.L2-3.13.12
Collaborative Device Control
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
• NIST SP 800-171 Rev 2 3.13.12


 

SC.L2-3.13.13
Mobile Code
Control and monitor the use of mobile code.
• NIST SP 800-171 Rev 2 3.13.13


 

SC.L2-3.13.14
Voice over Internet Protocol
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
• NIST SP 800-171 Rev 2 3.13.14


 

SC.L2-3.13.15
Communications Authenticity
Protect the authenticity of communications sessions.
• NIST SP 800-171 Rev 2 3.13.15


 

SC.L2-3.13.16
Data at Rest
Protect the confidentiality of CUI at rest.
• NIST SP 800-171 Rev 2 3.13.16




System and Information Integrity (SI)

Level 1

Level 2

Level 3

SI.L1-b.1.xii
Flaw Remediation (FCI)
Identify, report, and correct information and information system flaws in a timely manner.
• FAR Clause 52.204-21 b.1.xii
• NIST SP 800-171 Rev 2 3.14.1

SI.L2-3.14.1
Flaw Remediation (CUI)
Identify, report, and correct system flaws in a timely manner.
• NIST SP 800-171 Rev 2 3.14.1
• FAR Clause 52.204-21 b.1.xii

SI.L3-3.14.1e
Integrity Verification
Verify the integrity of
security critical and essential software using root of trust mechanisms or cryptographic signatures.
• NIST SP 800-172 3.14.1e

SI.L1-b.1.xiii
Malicious Code Protection (FCI)
Provide protection from malicious code at appropriate locations within organizational information systems.
• FAR Clause 52.204-21 b.1.xiii
• NIST SP 800-171 Rev 2 3.14.2

SI.L2-3.14.2
Malicious Code Protection (CUI)
Provide protection from malicious code at designated locations within organizational systems.
• NIST SP 800-171 Rev 2 3.14.2
• FAR Clause 52.204-21 b.1.xiii

SI.L3-3.14.3e
Specialized Asset Security
Ensure that
specialized assets including IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment are included in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks.
• NIST SP 800-172 3.14.3e

SI.L1-b.1.xiv
Update Malicious Code Protection (FCI)
Update malicious code protection mechanisms when new releases are available.
• FAR Clause 52.204-21 b.1.xiv
• NIST SP 800-171 Rev 2 3.14.4

SI.L2-3.14.3
Security Alerts & Advisories
Monitor system security alerts and advisories and take action in response.
• NIST SP 800-171 Rev 2 3.14.3

SI.L3-3.14.6e
Threat-Guided Intrusion Detection
Use threat indicator information and effective mitigations obtained from,
at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting.
• NIST SP 800-172 3.14.6e

SI.L1-b.1.xv
System & File Scanning (FCI)
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
• FAR Clause 52.204-21 b.1.xv
• NIST SP 800-171 Rev 2 3.14.5

SI.L2-3.14.4
Update Malicious Code Protection (CUI)
Update malicious code protection mechanisms when new releases are available.
• NIST SP 800-171 Rev 2 3.14.4
• FAR Clause 52.204-21 b.1.xiv


 

SI.L2-3.14.5
System & File Scanning (CUI)
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
• NIST SP 800-171 Rev 2 3.14.5
• FAR Clause 52.204-21 b.1.xv


 

SI.L2-3.14.6
Monitor Communications for Attacks
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
• NIST SP 800-171 Rev 2 3.14.6


 

SI.L2-3.14.7
Identify Unauthorized Use
Identify unauthorized use of organizational systems.
• NIST SP 800-171 Rev 2 3.14.7





            1. Abbreviations and Acronyms

The following is a list of acronyms used in the CMMC model.

AC Access Control

AES Advanced Encryption Standard

APT Advanced Persistent Threat

AT Awareness and Training

AU Audit and Accountability

BYOD Bring Your Own Device

CA Security Assessment

CFR Code of Federal Regulations

CM Configuration Management

CMMC Cybersecurity Maturity Model Certification

CNSSD Committee on National Security Systems Directive

CNSSI Committee on National Security Systems Instructions

COMSEC Communications Security

CPI Critical Program Information

CSP Credential Service Provider

CUI Controlled Unclassified Information

CVE Common Vulnerabilities and Exposures

DFARS Defense Federal Acquisition Regulation Supplement

DIB Defense Industrial Base

DNS Domain Name System

DoD Department of Defense

DoDI DoD Instruction

DPCI Derived PIV Credential Issuers

E.O. Executive Order

FAR Federal Acquisition Regulation

FCI Federal Contract Information

FIPS Federal Information Processing Standard

IA Identification and Authentication

ICS Industrial Control System

IDPS Intrusion Detection and Prevention Systems

IR Incident Response

ISCM Information Security Continuous Monitoring

ITIL Information Technology Infrastructure Library

L# Level Number

MA Maintenance

MP Media Protection

N/A Not Applicable (NA)

NIST National Institute of Standards and Technology

NISTIR NIST Interagency (or Internal) Report

OS Operating System

OUSD A&S Office of the Under Secretary of Defense for Acquisition and Sustainment

PCI Personal Identity Verification Card Issuers

PE Physical Protection

PIV Personal Identity Verification

PKI Public Key Infrastructure

PS Personnel Security

PUB Publication

Rev Revision

RFC Request for Comments

RA Risk Assessment

RMM Risk Management Model

SC System and Communications Protection

SCRM Supply Chain Risk Management

SI System and Information Integrity

SP Special Publication

SSP Sector Specific Plan

TTP Tactics, Techniques, and Procedures

URL Uniform Resource Locator

U.S. United States

VoIP Voice over Internet Protocol

Vol. Volume



            1. References
  1. U.S. Executive Office of the President, Council of Economic Advisers (CEA). The Cost of Malicious Cyber Activity to the U.S. Economy, available online at https://www.whitehouse.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf, February 2018

  2. Center for Strategic and International Studies (CSIS) and McAfee, Economic Impact of Cybercrime - No Slowing Down, February 2018

  3. 48 Code of Federal Regulations (CFR) 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, Federal Acquisition Regulation (FAR), 1 Oct 2016

  4. NIST Special Publication (SP) 800-171 Revision (Rev) 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, U.S. Department of Commerce National Institute of Standards and Technology (NIST), December 2016 (updated June 2018)

  5. NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171, U.S. Department of Commerce National Institute of Standards and Technology (NIST), February 2021






1 Based on information from the Federal Procurement Data System, the average number of unique prime contractors is approximately 212,657 and the number of known unique subcontractors is approximately 8,309. (FPDS from FY18-FY21).



File Typeapplication/vnd.openxmlformats-officedocument.wordprocessingml.document
AuthorOaks, Amy E.
File Modified0000-00-00
File Created2023-07-29

© 2024 OMB.report | Privacy Policy