Model Overview - Revision history

David at 01:33, 2 March 2026

2026-03-02T01:33:12Z

← Older revision		Revision as of 01:33, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Model Overview Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Model Overview Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us]. Thank you.

	== NOTICES ==		== NOTICES ==

David: /* System and Information Integrity (SI) */

2025-03-25T03:51:32Z

System and Information Integrity (SI)

← Older revision		Revision as of 03:51, 25 March 2025
Line 906:		Line 906:
	\|-		\|-
	\|		\|
	'''SI.L3-3.14.1e'''<br>''Integrity Verification''		'''[[ Practice_SI.L3-3.14.1e_Details \| SI.L3-3.14.1e ]]'''<br>''Integrity Verification''
	\|		\|
	Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures.		Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures.
	\|-		\|-
	\|		\|
	'''SI.L3-3.14.3e'''<br>''Specialized Asset Security''		'''[[ Practice_SI.L3-3.14.3e_Details \| SI.L3-3.14.3e ]]'''<br>''Specialized Asset Security''
	\|		\|
	Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks.		Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks.
	\|-		\|-
	\|		\|
	'''SI.L3-3.14.6e'''<br>''Threat-Guided Intrusion Detection''		'''[[ Practice_SI.L3-3.14.6e_Details \| SI.L3-3.14.6e ]]'''<br>''Threat-Guided Intrusion Detection''
	\|		\|
	Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting.		Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting.

David: /* System and Communications Protection (SC) */

2025-03-25T03:50:36Z

System and Communications Protection (SC)

← Older revision		Revision as of 03:50, 25 March 2025
Line 834:		Line 834:
	\|-		\|-
	\|		\|
	'''SC.L3-3.13.4e'''<br>''Isolation''		'''[[ Practice_SC.L3-3.13.4e_Details \| SC.L3-3.13.4e ]]'''<br>''Isolation''
	\|		\|
	Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components.		Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components.

David: /* Security Assessment (CA) */

2025-03-25T03:50:03Z

Security Assessment (CA)

← Older revision		Revision as of 03:50, 25 March 2025
Line 727:		Line 727:
	\|-		\|-
	\|		\|
	'''CA.L3-3.12.1e'''<br>''Penetration Testing''		'''[[ Practice_CA.L3-3.12.1e_Details \| CA.L3-3.12.1e ]]'''<br>''Penetration Testing''
	\|		\|
	Conduct penetration testing <u>at least annually or when significant security changes are made to the system</u>, leveraging automated scanning tools and ad hoc tests using subject matter experts.		Conduct penetration testing <u>at least annually or when significant security changes are made to the system</u>, leveraging automated scanning tools and ad hoc tests using subject matter experts.

David: /* Risk Assessment (RA) */

2025-03-25T03:49:39Z

Risk Assessment (RA)

← Older revision		Revision as of 03:49, 25 March 2025
Line 662:		Line 662:
	\|-		\|-
	\|		\|
	'''RA.L3-3.11.1e'''<br>''Threat-Informed Risk Assessment''		'''[[ Practice_RA.L3-3.11.1e_Details \| RA.L3-3.11.1e ]]'''<br>''Threat-Informed Risk Assessment''
	\|		\|
	Employ <u>threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources</u>, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.		Employ <u>threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources</u>, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.
	\|-		\|-
	\|		\|
	'''RA.L3-3.11.2e'''<br>''Threat Hunting''		'''[[ Practice_RA.L3-3.11.2e_Details \| RA.L3-3.11.2e ]]'''<br>''Threat Hunting''
	\|		\|
	Conduct cyber threat hunting activities <u>on an on-going aperiodic basis or when indications warrant</u>, to search for indicators of compromise in <u>organizational systems</u> and detect, track, and disrupt threats that evade existing controls.		Conduct cyber threat hunting activities <u>on an on-going aperiodic basis or when indications warrant</u>, to search for indicators of compromise in <u>organizational systems</u> and detect, track, and disrupt threats that evade existing controls.
	\|-		\|-
	\|		\|
	'''RA.L3-3.11.3e'''<br>''Advanced Risk Identification''		'''[[ Practice_RA.L3-3.11.3e_Details \| RA.L3-3.11.3e ]]'''<br>''Advanced Risk Identification''
	\|		\|
	Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components.		Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components.
	\|-		\|-
	\|		\|
	'''RA.L3-3.11.4e'''<br>''Security Solution Rationale''		'''[[ Practice_RA.L3-3.11.4e_Details \| RA.L3-3.11.4e ]]'''<br>''Security Solution Rationale''
	\|		\|
	Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.		Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.
	\|-		\|-
	\|		\|
	'''RA.L3-3.11.5e'''<br>''Security Solution Effectiveness''		'''[[ Practice_RA.L3-3.11.5e_Details \| RA.L3-3.11.5e ]]'''<br>''Security Solution Effectiveness''
	\|		\|
	Assess the effectiveness of security solutions <u>at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident</u>, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.		Assess the effectiveness of security solutions <u>at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident</u>, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
	\|-		\|-
	\|		\|
	'''RA.L3-3.11.6e'''<br>''Supply Chain Risk Response''		'''[[ Practice_RA.L3-3.11.6e_Details \| RA.L3-3.11.6e ]]'''<br>''Supply Chain Risk Response''
	\|		\|
	Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.		Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.
	\|-		\|-
	\|		\|
	'''RA.L3-3.11.7e'''<br>''Supply Chain Risk Plan''		'''[[ Practice_RA.L3-3.11.7e_Details \| RA.L3-3.11.7e ]]'''<br>''Supply Chain Risk Plan''
	\|		\|
	Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan <u>at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident</u>.		Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan <u>at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident</u>.

David: /* Incident Response (IR) */

2025-03-25T03:47:48Z

Incident Response (IR)

← Older revision		Revision as of 03:47, 25 March 2025
Line 450:		Line 450:
	\|-		\|-
	\|		\|
	'''IR.L3-3.6.1e'''<br>''Security Operations Center''		'''[[ Practice_IR.L3-3.6.1e_Details \| IR.L3-3.6.1e ]]'''<br>''Security Operations Center''
	\|		\|
	Establish and maintain a security operations center capability that operates <u>24/7, with allowance for remote/on-call staff</u>.		Establish and maintain a security operations center capability that operates <u>24/7, with allowance for remote/on-call staff</u>.
	\|-		\|-
	\|		\|
	'''IR.L3-3.6.2e'''<br>''Cyber Incident Response Team''		'''[[ Practice_IR.L3-3.6.2e_Details \| IR.L3-3.6.2e ]]'''<br>''Cyber Incident Response Team''
	\|		\|
	Establish and maintain a cyber incident response team that can be deployed by the organization within <u>24 hours</u>.		Establish and maintain a cyber incident response team that can be deployed by the organization within <u>24 hours</u>.

David: /* Personnel Security (PS) */

2025-03-25T03:40:52Z

Personnel Security (PS)

← Older revision		Revision as of 03:40, 25 March 2025
Line 578:		Line 578:
	\|-		\|-
	\|		\|
	'''PS.L3-3.9.2e'''<br>''Adverse Information''		'''[[ Practice_PS.L3-3.9.2e_Details \| PS.L3-3.9.2e ]]'''<br>''Adverse Information''
	\|		\|
	Protect organizational systems when adverse information develops or is obtained about individuals with access to CUI.		Protect organizational systems when adverse information develops or is obtained about individuals with access to CUI.

David: /* Identification & Authentication (IA) */

2025-03-25T03:40:16Z

Identification & Authentication (IA)

← Older revision		Revision as of 03:40, 25 March 2025
Line 415:		Line 415:
	\|-		\|-
	\|		\|
	'''IA.L3-3.5.1e'''<br>''Bidirectional Authentication''		'''[[ Practice_IA.L3-3.5.1e_Details \| IA.L3-3.5.1e ]]'''<br>''Bidirectional Authentication''
	\|		\|
	Identify and authenticate <u>systems and system components, where possible</u>, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant.		Identify and authenticate <u>systems and system components, where possible</u>, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant.
	\|-		\|-
	\|		\|
	'''IA.L3-3.5.3e'''<br>''Block Untrusted Assets''		'''[[ Practice_IA.L3-3.5.3e_Details \| IA.L3-3.5.3e ]]'''<br>''Block Untrusted Assets''
	\|		\|
	Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile.		Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile.

David: /* Configuration Management (CM) */

2025-03-25T03:39:32Z

Configuration Management (CM)

← Older revision		Revision as of 03:39, 25 March 2025
Line 323:		Line 323:
	\|-		\|-
	\|		\|
	'''CM.L3-3.4.1e'''<br>''Authoritative Repository''		'''[[ Practice_CM.L3-3.4.1e_Details \| CM.L3-3.4.1e ]]'''<br>''Authoritative Repository''
	\|		\|
	Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components.		Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components.
	\|-		\|-
	\|		\|
	'''CM.L3-3.4.2e'''<br>''Automated Detection & Remediation''		'''[[ Practice_CM.L3-3.4.2e_Details \| CM.L3-3.4.2e ]]'''<br>''Automated Detection & Remediation''
	\|		\|
	Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, <u>remove the components or place the components in a quarantine or remediation network</u> to facilitate patching, re-configuration, or other mitigations.		Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, <u>remove the components or place the components in a quarantine or remediation network</u> to facilitate patching, re-configuration, or other mitigations.
	\|-		\|-
	\|		\|
	'''CM.L3-3.4.3e'''<br>''Automated Inventory''		'''[[ Practice_CM.L3-3.4.3e_Details \| CM.L3-3.4.3e ]]'''<br>''Automated Inventory''
	\|		\|
	Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.		Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.

David: /* Awareness & Training (AT) */

2025-03-25T03:38:38Z

Awareness & Training (AT)

← Older revision		Revision as of 03:38, 25 March 2025
Line 205:		Line 205:
	\|-		\|-
	\|		\|
	'''AT.L3-3.2.1e'''<br>''Advanced Threat Awareness''		'''[[ Practice_AT.L3-3.2.1e_Details \| AT.L3-3.2.1e ]]'''<br>''Advanced Threat Awareness''
	\|		\|
	Provide awareness training <u>upon initial hire, following a significant cyber event, and at least annually</u>, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat.		Provide awareness training <u>upon initial hire, following a significant cyber event, and at least annually</u>, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat.
	\|-		\|-
	\|		\|
	'''AT.L3-3.2.2e'''<br>''Practical Training Exercises''		'''[[ Practice_AT.L3-3.2.2e_Details \| AT.L3-3.2.2e ]]'''<br>''Practical Training Exercises''
	\|		\|
	Include practical exercises in awareness training for <u>all users, tailored by roles, to include general users, users with specialized roles, and privileged users</u>, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.		Include practical exercises in awareness training for <u>all users, tailored by roles, to include general users, users with specialized roles, and privileged users</u>, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.