Level 3 Assessment Guide - Revision history

David at 01:30, 2 March 2026

2026-03-02T01:30:43Z

← Older revision		Revision as of 01:30, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 3 Assessment Guide Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Resources-Documentation/ CMMC Level 3 Assessment Guide Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us]. Thank you.

	== NOTICES ==		== NOTICES ==

David: /* Appendix A – Acronyms and Abbreviations */

2025-03-28T03:17:59Z

Appendix A – Acronyms and Abbreviations

Show changes

David: /* System and Information Integrity (SI) */

2025-03-28T03:06:39Z

System and Information Integrity (SI)

← Older revision		Revision as of 03:06, 28 March 2025
Line 464:		Line 464:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Verify the integrity of <u>security critical and essential software</u> using root of trust mechanisms or cryptographic signatures.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [ODP1] Security critical or essential software is defined;
			: [a] Root of trust mechanisms or cryptographic signatures are identified; and
			: [b] The integrity of <u>security critical and essential software</u> is verified using root of trust mechanisms or cryptographic signatures.
	\|-		\|-
	\|[[Practice_SI.L3-3.14.1e_Details\|More Practice Details...]]		\|[[Practice_SI.L3-3.14.1e_Details\|More Practice Details...]]
Line 472:		Line 477:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Ensure that <u>specialized assets including IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment</u> are included in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [a] <u>Specialized assets including IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment</u> are included in the scope of the specified enhanced security requirements; and
			: [b] Systems and system components that are not included in specialized assets including IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment are segregated in purpose-specific networks.
	\|-		\|-
	\|[[Practice_SI.L3-3.14.3e_Details\|More Practice Details...]]		\|[[Practice_SI.L3-3.14.3e_Details\|More Practice Details...]]
Line 480:		Line 489:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Use threat indicator information and effective mitigations obtained from, <u>at a minimum, open or commercial sources, and any DoD-provided sources</u>, to guide and inform intrusion detection and threat hunting.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [ODP1] External organizations from which to obtain threat indicator information and effective mitigations are defined;
			: [a] Threat indicator information is identified;
			: [b] Effective mitigations are identified;
			: [c] Intrusion detection approaches are identified;
			: [d] Threat hunting activities are identified; and
			: [e] Threat indicator information and effective mitigations obtained from, <u>at a minimum, open or commercial sources and any DoD-provided sources</u>, are used to guide and inform intrusion detection and threat hunting.
	\|-		\|-
	\|[[Practice_SI.L3-3.14.6e_Details\|More Practice Details...]]		\|[[Practice_SI.L3-3.14.6e_Details\|More Practice Details...]]

David: /* SC.L3-3.13.4e – isolation */

2025-03-28T02:44:07Z

SC.L3-3.13.4e – isolation

← Older revision		Revision as of 02:44, 28 March 2025
Line 448:		Line 448:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Employ <u>physical isolation techniques or logical isolation techniques or both</u> in organizational systems and system components.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [ODP1] One or more of the following is/are selected: physical isolation techniques; logical isolation techniques;
			: [ODP2] Physical isolation techniques are defined (if selected);
			: [ODP3] Logical isolation techniques are defined (if selected);
			: [a] <u>Physical isolation techniques or logical isolation techniques or both</u> are employed in organizational systems and system components.
	\|-		\|-
	\|[[Practice_SC.L3-3.13.4e_Details\|More Practice Details...]]		\|[[Practice_SC.L3-3.13.4e_Details\|More Practice Details...]]

David: /* CA.L3-3.12.1e – Penetration Testing */

2025-03-28T02:35:56Z

CA.L3-3.12.1e – Penetration Testing

← Older revision		Revision as of 02:35, 28 March 2025
Line 433:		Line 433:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Conduct penetration testing <u>at least annually or when significant security changes are made to the system</u>, leveraging automated scanning tools and ad hoc tests using subject matter experts.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [a] Automated scanning tools are identified;
			: [b] Ad hoc tests using subject matter experts are identified; and
			: [c] Penetration testing is conducted <u>at least annually or when significant security changes are made to the system</u>, leveraging automated scanning tools and ad hoc tests using subject matter experts.
	\|-		\|-
	\|[[Practice_CA.L3-3.12.1e_Details\|More Practice Details...]]		\|[[Practice_CA.L3-3.12.1e_Details\|More Practice Details...]]

David: /* RA.L3-3.11.7e – Supply Chain Risk Plan */

2025-03-28T01:45:07Z

RA.L3-3.11.7e – Supply Chain Risk Plan

← Older revision		Revision as of 01:45, 28 March 2025
Line 417:		Line 417:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
	Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.		Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan <u>at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident</u>.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
Line 424:		Line 424:
	: [b] Organizational systems and system components to include in a supply chain risk management plan are identified;		: [b] Organizational systems and system components to include in a supply chain risk management plan are identified;
	: [c] A plan for managing supply chain risks associated with organizational systems and system components is developed; and		: [c] A plan for managing supply chain risks associated with organizational systems and system components is developed; and
	: [d] The plan for managing supply chain risks is updated at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.		: [d] The plan for managing supply chain risks is updated <u>at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident</u>.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.7e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.7e_Details\|More Practice Details...]]

David: /* RA.L3-3.11.5e – Security Solution Effectiveness */

2025-03-28T01:43:49Z

RA.L3-3.11.5e – Security Solution Effectiveness

← Older revision		Revision as of 01:43, 28 March 2025
Line 388:		Line 388:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
	Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.		Assess the effectiveness of security solutions <u>at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident</u>, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
Line 395:		Line 395:
	: [b] Current and accumulated threat intelligence is identified;		: [b] Current and accumulated threat intelligence is identified;
	: [c] Anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence is identified; and		: [c] Anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence is identified; and
	: [d] The effectiveness of security solutions is assessed at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.		: [d] The effectiveness of security solutions is assessed <u>at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident</u>, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.5e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.5e_Details\|More Practice Details...]]
	\|}		\|}

	=== RA.L3-3.11.6e – Supply Chain Risk Response ===		=== RA.L3-3.11.6e – Supply Chain Risk Response ===
	{\|class="wikitable"		{\|class="wikitable"

David: /* Risk Assessment (RA) */

2025-03-28T01:42:17Z

Risk Assessment (RA)

← Older revision		Revision as of 01:42, 28 March 2025
Line 331:		Line 331:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Employ <u>threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources</u>, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [ODP1] Sources of threat intelligence are defined;
			: [a] A risk assessment methodology is identified;
			: [b] <u>Threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources</u>, are employed as part of a risk assessment to guide and inform the development of organizational systems and security architectures;
			: [c] <u>Threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources</u>, are employed as part of a risk assessment to guide and inform the selection of security solutions;
			: [d] <u>Threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources</u>, are employed as part of a risk assessment to guide and inform system monitoring activities;
			: [e] <u>Threat intelligence, at a minimum from open or commercial sources</u>, and any DoD-provided sources, are employed as part of a risk assessment to guide and inform threat hunting activities; and
			: [f] <u>Threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources</u>, are employed as part of a risk assessment to guide and inform response and recovery activities.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.1e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.1e_Details\|More Practice Details...]]
Line 339:		Line 348:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Conduct cyber threat hunting activities <u>on an on-going aperiodic basis or when indications warrant</u>, to search for indicators of compromise in <u>organizational systems</u> and detect, track, and disrupt threats that evade existing controls.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [ODP4] Organizational systems to search for indicators of compromise are defined;
			: [a] Indicators of compromise are identified;
			: [b] Cyber threat hunting activities are conducted <u>on an on-going aperiodic basis or when indications warrant</u>, to search for indicators of compromise in <u>organizational systems</u>; and
			: [c] Cyber threat hunting activities are conducted on an on-going aperiodic basis or when indications warrant, to detect, track, and disrupt threats that evade existing controls.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.2e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.2e_Details\|More Practice Details...]]
Line 347:		Line 362:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [a] Advanced automation and analytics capabilities to predict and identify risks to organizations, systems, and system components are identified;
			: [b] Analysts to predict and identify risks to organizations, systems, and system components are identified; and
			: [c] Advanced automation and analytics capabilities are employed in support of analysts to predict and identify risks to organizations, systems, and system components.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.3e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.3e_Details\|More Practice Details...]]
Line 355:		Line 375:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [a] The system security plan documents or references the security solution selected;
			: [b] The system security plan documents or references the rationale for the security solution; and
			: [c] The system security plan documents or references the risk determination.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.4e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.4e_Details\|More Practice Details...]]
Line 363:		Line 388:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [a] Security solutions are identified;
			: [b] Current and accumulated threat intelligence is identified;
			: [c] Anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence is identified; and
			: [d] The effectiveness of security solutions is assessed at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.5e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.5e_Details\|More Practice Details...]]
Line 371:		Line 402:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [a] Supply chain risks associated with organizational systems and system components are identified;
			: [b] Supply chain risks associated with organizational systems and system components are assessed;
			: [c] Supply chain risks associated with organizational systems and system components are responded to; and
			: [d] Supply chain risks associated with organizational systems and system components are monitored.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.6e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.6e_Details\|More Practice Details...]]
Line 379:		Line 416:
	{\|class="wikitable"		{\|class="wikitable"
	\|'''SECURITY REQUIREMENT'''		\|'''SECURITY REQUIREMENT'''
			Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.
	\|-		\|-
	\|'''ASSESSMENT OBJECTIVES'''		\|'''ASSESSMENT OBJECTIVES'''
			Determine if:
			: [a] Supply chain risks associated with organizational systems and system components are identified;
			: [b] Organizational systems and system components to include in a supply chain risk management plan are identified;
			: [c] A plan for managing supply chain risks associated with organizational systems and system components is developed; and
			: [d] The plan for managing supply chain risks is updated at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.
	\|-		\|-
	\|[[Practice_RA.L3-3.11.7e_Details\|More Practice Details...]]		\|[[Practice_RA.L3-3.11.7e_Details\|More Practice Details...]]

David at 01:40, 27 March 2025

2025-03-27T01:40:05Z

Show changes

David at 03:39, 26 March 2025

2025-03-26T03:39:00Z

← Older revision		Revision as of 03:39, 26 March 2025
Line 3,493:		Line 3,493:
	XDR		XDR

	Extended Detection and Response		Extended Detection and Response




















	~~Appendix A – Acronyms and Abbreviations~~

	~~'''CMMC Assessment Guide – Level 3 '''\|''' Version 2.13 '''~~

	85

	~~''' '''~~

	~~''This page intentionally left blank. ''~~
























	~~= Document Outline =~~

	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#5\|Introduction]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#5\|Level 3 Description]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#6\|Purpose and Audience]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#6\|Document Organization]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#8\|Assessment and Certification]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#8\|Assessment Scope]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#9\|CMMC-Custom Terms]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#12\|Assessment Criteria and Methodology]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#13\|Criteria]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#13\|Methodology]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#14\|Who Is Interviewed]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#14\|What Is Examined]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#15\|What Is Tested]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#15\|Assessment Findings]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#17\|Requirement Descriptions]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#19\|Access Control (AC)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#24\|Awareness and Training (AT)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#29\|Configuration Management (CM)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#38\|Identification and Authentication (IA)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#44\|Incident Response (IR)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#50\|Personnel Security (PS)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#52\|Risk Assessment (RA)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#71\|Security Assessment (CA)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#74\|System and Communications Protection (SC)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#77\|System and Information Integrity (SI)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#87\|Appendix A – Acronyms and Abbreviations]]


	~~-----~~

	~~Original source: https://dodcio.defense.gov/Portals/0/Documents/CMMC/AssessmentGuideL3v2.pdf~~

← Older revision		Revision as of 03:39, 26 March 2025
Line 3,493:		Line 3,493:
	XDR		XDR

	Extended Detection and Response		Extended Detection and Response




















	~~Appendix A – Acronyms and Abbreviations~~

	~~'''CMMC Assessment Guide – Level 3 '''\|''' Version 2.13 '''~~

	85

	~~''' '''~~

	~~''This page intentionally left blank. ''~~
























	~~= Document Outline =~~

	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#5\|Introduction]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#5\|Level 3 Description]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#6\|Purpose and Audience]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#6\|Document Organization]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#8\|Assessment and Certification]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#8\|Assessment Scope]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#9\|CMMC-Custom Terms]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#12\|Assessment Criteria and Methodology]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#13\|Criteria]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#13\|Methodology]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#14\|Who Is Interviewed]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#14\|What Is Examined]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#15\|What Is Tested]]
	** [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#15\|Assessment Findings]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#17\|Requirement Descriptions]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#19\|Access Control (AC)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#24\|Awareness and Training (AT)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#29\|Configuration Management (CM)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#38\|Identification and Authentication (IA)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#44\|Incident Response (IR)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#50\|Personnel Security (PS)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#52\|Risk Assessment (RA)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#71\|Security Assessment (CA)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#74\|System and Communications Protection (SC)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#77\|System and Information Integrity (SI)]]
	* [[6198c0a322e23aa1e1020689fc487ef0dcad6945.html#87\|Appendix A – Acronyms and Abbreviations]]


	~~-----~~

	~~Original source: https://dodcio.defense.gov/Portals/0/Documents/CMMC/AssessmentGuideL3v2.pdf~~