Level 2 Assessment Guide - Revision history

David at 01:30, 2 March 2026

2026-03-02T01:30:21Z

← Older revision		Revision as of 01:30, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 2 Assessment Guide Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 2 Assessment Guide Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us]. Thank you.

	== NOTICES ==		== NOTICES ==

David: /* SC.L2-3.13.4 – Shared Resource Control */

2025-08-16T23:32:59Z

SC.L2-3.13.4 – Shared Resource Control

← Older revision		Revision as of 23:32, 16 August 2025
Line 1,350:		Line 1,350:
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
	: [a] unauthorized and unintended information transfer via shared system resources is		: [a] unauthorized and unintended information transfer via shared system resources is prevented.
	prevented.
	\|-		\|-
	\|[[Practice_SC.L2-3.13.4_Details\|More Practice Details...]]		\|[[Practice_SC.L2-3.13.4_Details\|More Practice Details...]]

David: /* IA.L2-3.5.8 – Password Reuse */

2025-08-16T21:37:12Z

IA.L2-3.5.8 – Password Reuse

← Older revision		Revision as of 21:37, 16 August 2025
Line 836:		Line 836:
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
	: [a] the number of generations during which a password cannot be reused is specified and [b] reuse of passwords is prohibited during the specified number of generations.		: [a] the number of generations during which a password cannot be reused is specified; and
			: [b] reuse of passwords is prohibited during the specified number of generations.
	\|-		\|-
	\|[[Practice_IA.L2-3.5.8_Details\|More Practice Details...]]		\|[[Practice_IA.L2-3.5.8_Details\|More Practice Details...]]

David: /* AT.L2-3.2.2 – Role-Based Training */

2025-05-14T16:02:08Z

AT.L2-3.2.2 – Role-Based Training

← Older revision		Revision as of 16:02, 14 May 2025
Line 463:		Line 463:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
	Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.\|-		Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''

David: /* SI.L2-3.14.2 – Malicious Code ProTection [CUI Data] */

2025-05-13T22:48:23Z

SI.L2-3.14.2 – Malicious Code ProTection [CUI Data]

← Older revision		Revision as of 22:48, 13 May 2025
Line 1,515:		Line 1,515:
	\|}		\|}

	=== SI.L2-3.14.2 – Malicious Code ~~ProTection~~ [CUI Data] ===		=== SI.L2-3.14.2 – Malicious Code Protection [CUI Data] ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''

David: /* CA.L2-3.12.4 – System Security Plan = */

2025-05-10T00:35:10Z

CA.L2-3.12.4 – System Security Plan =

← Older revision		Revision as of 00:35, 10 May 2025
Line 1,277:		Line 1,277:
	\|}		\|}

	=== CA.L2-3.12.4 – System Security Plan ====		=== CA.L2-3.12.4 – System Security Plan ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''

David: /* MP.L2-3.8.8 – Shared Media */

2025-04-11T16:00:19Z

MP.L2-3.8.8 – Shared Media

← Older revision		Revision as of 16:00, 11 April 2025
Line 1,078:		Line 1,078:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
	Prohibit the use of portable storage devices when such devices have no identifiable owner.~~ASSESSMENT OBJECTIVES'''~~		Prohibit the use of portable storage devices when such devices have no identifiable owner.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''

David: /* System and Communications Protection (SC) */

2025-03-20T23:44:50Z

System and Communications Protection (SC)

Show changes

David: /* Security Assessment (CA) */

2025-03-20T23:32:27Z

Security Assessment (CA)

← Older revision		Revision as of 23:32, 20 March 2025
Line 1,241:		Line 1,241:

	== Security Assessment (CA) ==		== Security Assessment (CA) ==
	~~=== Level 2 CA Practices ===~~		=== CA.L2-3.12.1 – Security Control Assessment ===
	==== CA.L2-3.12.1 – ~~SECURITY CONTROL ASSESSMENT =~~===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,250:		Line 1,249:
	: [a] the frequency of security control assessments is defined; and		: [a] the frequency of security control assessments is defined; and
	: [b] security controls are assessed with the defined frequency to determine if the controls are effective in their application.		: [b] security controls are assessed with the defined frequency to determine if the controls are effective in their application.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''5'''~~
	\|-		\|-
	\|[[Practice_CA.L2-3.12.1_Details\|More Practice Details...]]		\|[[Practice_CA.L2-3.12.1_Details\|More Practice Details...]]
	\|}		\|}

	==== CA.L2-3.12.2 – ~~PLAN OF ACTION =~~===		=== CA.L2-3.12.2 – Operational Plan of Action ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,265:		Line 1,262:
	: [b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities; and		: [b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities; and
	: [c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.		: [c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''3'''~~
	\|-		\|-
	\|[[Practice_CA.L2-3.12.2_Details\|More Practice Details...]]		\|[[Practice_CA.L2-3.12.2_Details\|More Practice Details...]]
	\|}		\|}

	==== CA.L2-3.12.3 – ~~SECURITY CONTROL MONITORING =~~===		=== CA.L2-3.12.3 – Security Control Monitoring ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,278:		Line 1,273:
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
	: [a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.		: [a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''5'''~~
	\|-		\|-
	\|[[Practice_CA.L2-3.12.3_Details\|More Practice Details...]]		\|[[Practice_CA.L2-3.12.3_Details\|More Practice Details...]]
	\|}		\|}

	==== CA.L2-3.12.4 – ~~SYSTEM SECURITY PLAN~~ ====		=== CA.L2-3.12.4 – System Security Plan ====
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,298:		Line 1,291:
	: [g] the frequency to update the system security plan is defined; and		: [g] the frequency to update the system security plan is defined; and
	: [h] system security plan is updated with the defined frequency.		: [h] system security plan is updated with the defined frequency.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''NA'''~~
	\|-		\|-
	\|[[Practice_CA.L2-3.12.4_Details\|More Practice Details...]]		\|[[Practice_CA.L2-3.12.4_Details\|More Practice Details...]]

David: /* Media Protection (MP) */

2025-03-20T23:19:34Z

Media Protection (MP)

← Older revision		Revision as of 23:19, 20 March 2025
Line 992:		Line 992:

	== Media Protection (MP) ==		== Media Protection (MP) ==
	==== MP.L2-3.8.1 – ~~MEDIA PROTECTION =~~===		=== MP.L2-3.8.1 – Media Protection ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,002:		Line 1,002:
	: [c] paper media containing CUI is securely stored; and		: [c] paper media containing CUI is securely stored; and
	: [d] digital media containing CUI is securely stored.		: [d] digital media containing CUI is securely stored.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''3'''~~
	\|-		\|-
	\|[[Practice_MP.L2-3.8.1_Details\|More Practice Details...]]		\|[[Practice_MP.L2-3.8.1_Details\|More Practice Details...]]
	\|}		\|}

	==== MP.L2-3.8.2 – ~~MEDIA ACCESS =~~===		=== MP.L2-3.8.2 – Media Access ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,015:		Line 1,013:
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
	: [a] access to CUI on system media is limited to authorized users.		: [a] access to CUI on system media is limited to authorized users.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''3'''~~
	\|-		\|-
	\|[[Practice_MP.L2-3.8.2_Details\|More Practice Details...]]		\|[[Practice_MP.L2-3.8.2_Details\|More Practice Details...]]
Line 1,033:		Line 1,029:
	\|}		\|}

	==== MP.L2-3.8.4 – ~~MEDIA MARKINGS =~~===		=== MP.L2-3.8.4 – Media Markings ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,041:		Line 1,037:
	: [a] media containing CUI is marked with applicable CUI markings; and		: [a] media containing CUI is marked with applicable CUI markings; and
	: [b] media containing CUI is marked with distribution limitations.		: [b] media containing CUI is marked with distribution limitations.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''1'''~~
	\|-		\|-
	\|[[Practice_MP.L2-3.8.4_Details\|More Practice Details...]]		\|[[Practice_MP.L2-3.8.4_Details\|More Practice Details...]]
	\|}		\|}

	==== MP.L2-3.8.5 – ~~MEDIA ACCOUNTABILITY =~~===		=== MP.L2-3.8.5 – Media Accountability ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,055:		Line 1,049:
	: [a] access to media containing CUI is controlled; and		: [a] access to media containing CUI is controlled; and
	: [b] accountability for media containing CUI is maintained during transport outside of controlled areas.		: [b] accountability for media containing CUI is maintained during transport outside of controlled areas.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''1'''~~
	\|-		\|-
	\|[[Practice_MP.L2-3.8.5_Details\|More Practice Details...]]		\|[[Practice_MP.L2-3.8.5_Details\|More Practice Details...]]
	\|}		\|}

	==== MP.L2-3.8.6 – ~~PORTABLE STORAGE ENCRYPTION =~~===		=== MP.L2-3.8.6 – Portable Storage Encryption ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,068:		Line 1,060:
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
	: [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.		: [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''1'''~~
	\|-		\|-
	\|[[Practice_MP.L2-3.8.6_Details\|More Practice Details...]]		\|[[Practice_MP.L2-3.8.6_Details\|More Practice Details...]]
	\|}		\|}

	==== MP.L2-3.8.7 – ~~REMOVEABLE MEDIA =~~===		=== MP.L2-3.8.7 – Removable Media ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,081:		Line 1,071:
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
	: [a] the use of removable media on system components is controlled.		: [a] the use of removable media on system components is controlled.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''5'''~~
	\|-		\|-
	\|[[Practice_MP.L2-3.8.7_Details\|More Practice Details...]]		\|[[Practice_MP.L2-3.8.7_Details\|More Practice Details...]]
	\|}		\|}

	==== MP.L2-3.8.8 – ~~SHARED MEDIA =~~===		=== MP.L2-3.8.8 – Shared Media ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,094:		Line 1,082:
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
	: [a] the use of portable storage devices is prohibited when such devices have no identifiable owner.		: [a] the use of portable storage devices is prohibited when such devices have no identifiable owner.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''3'''~~
	\|-		\|-
	\|[[Practice_MP.L2-3.8.8_Details\|More Practice Details...]]		\|[[Practice_MP.L2-3.8.8_Details\|More Practice Details...]]
	\|}		\|}

	==== MP.L2-3.8.9 – ~~PROTECT BACKUPS =~~===		=== MP.L2-3.8.9 – Protect Backups ===
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
Line 1,107:		Line 1,093:
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
	: [a] the confidentiality of backup CUI is protected at storage locations.		: [a] the confidentiality of backup CUI is protected at storage locations.
	\|-
	~~\|[[DoD_Assessment_Methodology\|DoD Assessment Scoring Value]]: '''1'''~~
	\|-		\|-
	\|[[Practice_MP.L2-3.8.9_Details\|More Practice Details...]]		\|[[Practice_MP.L2-3.8.9_Details\|More Practice Details...]]