Model Overview: Difference between revisions

From CMMC Toolkit Wiki
Jump to navigation Jump to search
← Older editNewer edit →
VisualWikitext
Importing content from PDF File: https://dodcio.defense.gov/Portals/0/Documents/CMMC/ModelOverviewv2.pdf
No edit summary
Line 1: Line 1:
'''Source of Reference: The official [https://dodcio.defense.gov/CMMC/Documentation/ Model Overview] from the Department of Defense Chief Information Officer (DoD CIO).'''
'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Model Overview] from the Department of Defense Chief Information Officer (DoD CIO).'''


For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.
For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.


== Access Control (AC) ==
== NOTICES ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_AC.L1-3.1.1_Details|AC.L1-3.1.1]]'''
''Authorized Access Control''


Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing CMMC security requirements under the law or departmental policies.
* FAR Clause 52.204-21 b.1.i
* NIST SP 800-171 Rev 2 3.1.1
|'''[[Practice_AC.L2-3.1.3_Details|AC.L2-3.1.3]]'''
''Control CUI Flow''


Control the flow of CUI in accordance with approved authorizations.
DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.
* NIST SP 800-171 Rev 2 3.1.3
|
|-
|'''[[Practice_AC.L1-3.1.2_Details|AC.L1-3.1.2]]'''
''Transaction & Function Control''


Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
== 1. Introduction ==
* FAR Clause 52.204-21 b.1.ii
The theft of intellectual property and sensitive information from all industrial sectors because of malicious cyber activity threatens economic security and national security. The Council of Economic Advisors estimates that malicious cyber activity cost the U.S. economy between $57 billion and $109 billion in 2016 [1]. The Center for Strategic and International Studies estimates that the total global cost of cybercrime was as high as $600 billion in 2017 [2]. Over a ten-year period, that burden would equate to an estimated $570 billion to $1.09 trillion dollars in costs.
* NIST SP 800-171 Rev 2 3.1.2
|'''[[Practice_AC.L2-3.1.4_Details|AC.L2-3.1.4]]'''
''Separation of Duties''


Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
Malicious cyber actors have targeted and continue to target the Defense Industrial Base (DIB) sector and the Department of Defense (DoD) supply chain. These attacks not only focus on the large prime contractors, but also target subcontractors that make up the lower tiers of the DoD supply chain. Many of these subcontractors are small entities that provide critical support and innovation. Overall, the DIB sector consists of over 220,000 companies<ref>Based on information from the Federal Procurement Data System, the average number of unique prime contractors is approximately 212,657 and the number of known unique subcontractors is approximately 8,309. (FPDS from FY18-FY21).</ref> that process, store, or transmit Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) in support of the warfighter and contribute towards the research, engineering, development, acquisition, production, delivery, sustainment, and operations of DoD systems, networks, installations, capabilities, and services. The aggregate loss of intellectual property and controlled unclassified information from the DoD supply chain can undercut U.S. technical advantages and innovation, as well as significantly increase the risk to national security.
* NIST SP 800-171 Rev 2 3.1.4
|
|-
|'''[[Practice_AC.L1-3.1.20_Details|AC.L1-3.1.20]]'''
''External Connections''


Verify and control/limit connections to and use of external information systems.
As part of multiple lines of effort focused on the security and resiliency of the DIB sector, the DoD is working with industry to enforce the safeguarding requirements of the following types of unclassified information within the supply chain:
* FAR Clause 52.204-21 b.1.iii
* ''Federal Contract Information (FCI):'' is defined in 32 CFR § 170.4 and 48 CFR 4.1901 [3].
* NIST SP 800-171 Rev 2 3.1.20
* ''Controlled Unclassified Information (CUI):'' is defined in 32 CFR § 2002.4 (h) [4].
|'''[[Practice_AC.L2-3.1.5_Details|AC.L2-3.1.5]]'''
''Least Privilege''


Employ the principle of least privilege, including for specific security functions and privileged accounts.
To this end, the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&amp;S)) and DoD Chief Information Officer (CIO) have developed the Cybersecurity Maturity Model Certification (CMMC) in concert with DoD stakeholders, University Affiliated Research Centers (UARCs), Federally Funded Research and Development Centers (FFRDCs), and the DIB sector.
* NIST SP 800-171 Rev 2 3.1.5
 
|
This document focuses on the Cybersecurity Maturity Model Certification (CMMC) Model as set forth in section 170.14 of title 32, Code of Federal Regulations (CFR). The model incorporates the security requirements from: 1) FAR 52.204-21, ''Basic Safeguarding of Covered Contractor Information Systems'', 2) NIST SP 800-171 Rev 2, ''Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations'', and 3) a subset of the requirements from NIST SP 800-172, ''Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171''. The CMMC Program is designed to provide increased assurance to the DoD that defense contractors and subcontractors are compliant with information protection requirements for FCI and CUI, and are protecting such information at a level commensurate with risk from cybersecurity threats, including Advanced Persistent Threats (APTs).
|-
 
|'''[[Practice_AC.L1-3.1.22_Details|AC.L1-3.1.22]]'''
When implementing the CMMC model, an organization can achieve a specific CMMC level for its entire enterprise network or for a particular enclave(s), depending on where the information to be protected is handled and stored.
''Control Public Information''


Control information posted or processed on publicly accessible information systems.
=== 1.1 Document Organization ===
* FAR Clause 52.204-21 b.1.iv
Section 2 presents the CMMC Model and each of its elements in detail.[[Model Overview#Appendix A|Appendix A]] provides the model as a matrix and maps the CMMC model to other secondary sources. [[Model Overview#Appendix B|Appendix B]] lists the abbreviations and acronyms. Finally, [[Model Overview#Appendix C|Appendix C]] provides the references contained in this document.
* NIST SP 800-171 Rev 2 3.1.22
|'''[[Practice_AC.L2-3.1.6_Details|AC.L2-3.1.6]]'''
''Non-Privileged Account Use''


Use non-privileged accounts or roles when accessing nonsecurity functions.
=== 1.2 Supporting Documents ===
* NIST SP 800-171 Rev 2 3.1.6
This document is supported by multiple companion documents that provide additional information. The ''CMMC Assessment Guides'' present assessment objectives, discussion, examples, potential assessment considerations, and key references for each CMMC security requirement. The ''CMMC Scoping Guides'' provide additional guidance on how to correctly scope an assessment. The ''CMMC Hashing Guide'' provides information on how to create the hash to validate the integrity of archived assessment artifacts.
|
|-
|
|'''[[Practice_AC.L2-3.1.7_Details|AC.L2-3.1.7]]'''
''Privileged Functions''


Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
These supplemental documents are intended to provide explanatory information to assist organizations with implementing and assessing the security requirements covered by CMMC in 32 CFR § 170. The documents are not prescriptive and their use is optional. Implementation of security requirements by following any examples is not a guarantee of compliance with any CMMC security requirement or objective.
* NIST SP 800-171 Rev 2 3.1.7
|
|-
|
|'''[[Practice_AC.L2-3.1.8_Details|AC.L2-3.1.8]]'''
''Unsuccessful Logon Attempts''


Limit unsuccessful logon attempts.
== 2. CMMC Model ==
* NIST SP 800-171 Rev 2 3.1.8
=== 2.1 Overview ===
|
The CMMC Model incorporates the security requirements from: 1) FAR 52.204-21, ''Basic Safeguarding of Covered Contractor Information Systems'', 2) NIST SP 800-171 Rev 2, ''Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations'', and 3) a subset of the requirements from NIST SP 800-172, ''Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800—171.'' These source documents may be revised in the future, however the CMMC security requirements will remain unchanged until the CMMC final rule is published. Any further modifications to the CMMC rule will follow appropriate rulemaking procedures.
|-
|
|'''[[Practice_AC.L2-3.1.9_Details|AC.L2-3.1.9]]'''
''Privacy & Security Notices''


Provide privacy and security notices consistent with applicable CUI rules.
The CMMC Model consists of domains that map to the Security Requirement Families defined in NIST SP 800-171 Rev 2.
* NIST SP 800-171 Rev 2 3.1.9
 
|
=== 2.2 CMMC Levels ===
|-
There are three levels within CMMC – Level 1, Level 2, and Level 3.
|
 
|'''[[Practice_AC.L2-3.1.10_Details|AC.L2-3.1.10]]'''
==== 2.2.1 Descriptions ====
''Session Lock''
The CMMC model measures the implementation of cybersecurity requirements at three levels. Each level is independent and consists of a set of CMMC security requirements as set forth in 32 CFR § 170.14 (c):
* Level 1 Requirements. The security requirements in Level 1 are those set forth in FAR clause 52.204-21(b)(1)(i) – (b)(1)(xv).
* Level 2 Requirements. The security requirements in Level 2 are identical to the requirements in NIST SP 800-171 Rev 2.
* Level 3 Requirements. The security requirements in Level 3 are derived from NIST SP 800-172 with DoD-approved parameters where applicable, as identified in 32 CFR § 170.14(c)(4). DoD defined selections and parameters for the NIST SP 800-172 requirements are italicized, where applicable.


Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
==== 2.2.2 CMMC Overview ====
* NIST SP 800-171 Rev 2 3.1.10
'''Figure 1. CMMC Level Overview'''
|
|-
|
|'''[[Practice_AC.L2-3.1.11_Details|AC.L2-3.1.11]]'''
''Session Termination''


Terminate (automatically) a user session after a defined condition.
==== 2.2.3 Level 1 ====
* NIST SP 800-171 Rev 2 3.1.11
Level 1 focuses on the protection of FCI and consists of the security requirements that correspond to the 15 basic safeguarding requirements specified in 48 CFR 52.204-21, commonly referred to as the FAR Clause.
|
|-
|
|'''[[Practice_AC.L2-3.1.12_Details|AC.L2-3.1.12]]'''
''Control Remote Access''


Monitor and control remote access sessions.
==== 2.2.4 Level 2 ====
* NIST SP 800-171 Rev 2 3.1.12
Level 2 focuses on the protection of CUI and incorporates the 110 security requirements specified in NIST SP 800-171 Rev 2.  
|
|-
|
|'''[[Practice_AC.L2-3.1.13_Details|AC.L2-3.1.13]]'''
''Remote Access Confidentiality''


Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
==== 2.2.5 Level 3 ====
* NIST SP 800-171 Rev 2 3.1.13
Level 3 focuses on the protection of CUI and encompasses a subset of the NIST SP 800-172 security requirements [5] with DoD-approved parameters. DoD-approved parameters are denoted with underlining in section 2.4.1 below.
|
|-
|
|'''[[Practice_AC.L2-3.1.14_Details|AC.L2-3.1.14]]'''
''Remote Access Routing''


Route remote access via managed access
=== 2.3 CMMC Domains ===
control points.
The CMMC model consists of 14 domains that align with the families specified in NIST SP 800-171 Rev 2. These domains and their abbreviations are as follows:
* NIST SP 800-171 Rev 2 3.1.14
* Access Control (AC)<br />
|
* Awareness &amp; Training (AT)<br />
|-
* Audit &amp; Accountability (AU)<br />
|
* Configuration Management (CM)<br />
|'''[[Practice_AC.L2-3.1.15_Details|AC.L2-3.1.15]]'''
* Identification &amp; Authentication (IA)<br />
''Privileged Remote Access''
* Incident Response (IR)<br />
* Maintenance (MA)<br />
* Media Protection (MP)<br />
* Personnel Security (PS)<br />
* Physical Protection (PE)<br />
* Risk Assessment (RA)<br />
* Security Assessment (CA)<br />
* System and Communications Protection (SC)<br />
* System and Information Integrity (SI)
 
=== 2.4 CMMC Security Requirements ===
==== 2.4.1. List of Security Requirements ====
This subsection itemizes the security requirements for each domain and at each level. Each requirement has a requirement identification number in the format – '''DD.L#-REQ''' – where:
* DD is the two-letter domain abbreviation;
* L# is the level number; and
* REQ is the FAR Clause 52.204-21 paragraph number, NIST SP 800-171 Rev 2, or NIST SP800-172 security requirement number.
 
Below the identification number, a short name identifier is provided for each requirement, meant to be used for quick reference only. Finally, each requirement has a complete requirement statement.


Authorize remote execution of privileged commands and remote access to security-relevant information.
'''ACCESS CONTROL (AC)''' '''Level 1 '''
* NIST SP 800-171 Rev 2 3.1.15
|
|-
|
|'''[[Practice_AC.L2-3.1.16_Details|AC.L2-3.1.16]]'''
''Wireless Access Authorization''


Authorize wireless access prior to allowing
'''Description '''
such connections.
* NIST SP 800-171 Rev 2 3.1.16
|
|-
|
|'''[[Practice_AC.L2-3.1.17_Details|AC.L2-3.1.17]]'''
''Wireless Access Protection''


Protect wireless access using authentication and encryption.
'''AC.L1-b.1.i '''
* NIST SP 800-171 Rev 2 3.1.17
|
|-
|
|'''[[Practice_AC.L2-3.1.18_Details|AC.L2-3.1.18]]'''
''Mobile Device Connection''


Control connection of mobile devices.
''Authorized Access Control [FCI Data]''
* NIST SP 800-171 Rev 2 3.1.18
|
|-
|
|'''[[Practice_AC.L2-3.1.19_Details|AC.L2-3.1.19]]'''
''Encrypt CUI on Mobile''


Encrypt CUI on mobile devices and mobile computing platforms.
''' '''
* NIST SP 800-171 Rev 2 3.1.19
|
|-
|
|'''[[Practice_AC.L2-3.1.21_Details|AC.L2-3.1.21]]'''
''Portable Storage Use''
Limit use of portable storage devices on external systems.
* NIST SP 800-171 Rev 2 3.1.21
|
|}


== Awareness and Training (AT) ==
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). '''AC.L1-b.1.ii '''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_AT.L2-3.2.1_Details|AT.L2-3.2.1]]'''
''Role-Based Risk Awareness''


Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and
''Transaction &amp; Function Control [FCI ''
procedures related to the security of those systems.
* NIST SP 800-171 Rev 2 3.2.1
|
|-
|
|'''[[Practice_AT.L2-3.2.2_Details|AT.L2-3.2.2]]'''
''Role-Based Training''


Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
''Data]''
* NIST SP 800-171 Rev 2 3.2.2
 
|
''' '''
|-
 
|
Limit information system access to the types of transactions and functions that authorized users are permitted to execute. '''AC.L1-b.1.iii '''
|'''[[Practice_AT.L2-3.2.3_Details|AT.L2-3.2.3]]'''
''Insider Threat Awareness''


Provide security awareness training on recognizing and reporting potential indicators of insider threat.
''External Connections [FCI Data]''
* NIST SP 800-171 Rev 2 3.2.3
|
|}


== Audit and Accountability (AU) ==
''' '''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_AU.L2-3.3.1_Details|AU.L2-3.3.1]]'''
''System Auditing''


Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Verify and control/limit connections to and use of external information systems. '''AC.L1-b.1.iv '''
* NIST SP 800-171 Rev 2 3.3.1
|
|-
|
|'''[[Practice_AU.L2-3.3.2_Details|AU.L2-3.3.2]]'''
''User Accountability''


Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
''Control Public Information [FCI Data]''
• NIST SP 800-171 Rev 2 3.3.2
|
|-
|
|'''[[Practice_AU.L2-3.3.3_Details|AU.L2-3.3.3]]'''
''Event Review''


Review and update logged events.
''' '''
* NIST SP 800-171 Rev 2 3.3.3
|
|-
|
|'''[[Practice_AU.L2-3.3.4_Details|AU.L2-3.3.4]]'''
''Audit Failure Alerting''


Alert in the event of an audit logging process failure.
Control information posted or processed on publicly accessible information systems. '''Level 2 '''
* NIST SP 800-171 Rev 2 3.3.4
|
|-
|
|'''[[Practice_AU.L2-3.3.5_Details|AU.L2-3.3.5]]'''
''Audit Correlation''


Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
'''Description '''
* NIST SP 800-171 Rev 2 3.3.5
|
|-
|
|'''[[Practice_AU.L2-3.3.6_Details|AU.L2-3.3.6]]'''
''Reduction & Reporting''


Provide audit record reduction and report generation to support on-demand analysis and reporting.
'''AC.L2-3.1.1''''' ''
* NIST SP 800-171 Rev 2 3.3.6
|
|-
|
|'''[[Practice_AU.L2-3.3.7_Details|AU.L2-3.3.7]]'''
''Authoritative Time Source''


Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
''Authorized Access Control [CUI Data] ''
* NIST SP 800-171 Rev 2 3.3.7
 
|
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
|-
 
|
''' '''
|'''[[Practice_AU.L2-3.3.8_Details|AU.L2-3.3.8]]'''
''Audit Protection''


Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
'''AC.L2-3.1.2 '''
* NIST SP 800-171 Rev 2 3.3.8
|
|-
|
|'''[[Practice_AU.L2-3.3.9_Details|AU.L2-3.3.9]]'''
''Audit Management''


Limit management of audit logging functionality to a subset of privileged users.
''Transaction &amp; Function Control [CUI ''
* NIST SP 800-171 Rev 2 3.3.9
|
|}


== Configuration Management (CM) ==
''Data]''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_CM.L2-3.4.1_Details|CM.L2-3.4.1]]'''
''System Baselining''


Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
''' '''
* NIST SP 800-171 Rev 2 3.4.1
|
|-
|
|'''[[Practice_CM.L2-3.4.2_Details|CM.L2-3.4.2]]'''
''Security Configuration Enforcement''


Establish and enforce security configuration settings for information technology products employed in organizational systems.
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
* NIST SP 800-171 Rev 2 3.4.2
|
|-
|
|'''[[Practice_CM.L2-3.4.3_Details|CM.L2-3.4.3]]'''
''System Change Management''


Track, review, approve or disapprove, and log changes to organizational systems.
''' '''
* NIST SP 800-171 Rev 2 3.4.3
|
|-
|
|'''[[Practice_CM.L2-3.4.4_Details|CM.L2-3.4.4]]'''
''Security Impact Analysis''


Analyze the security impact of changes prior to implementation.
'''AC.L2-3.1.3 '''
* NIST SP 800-171 Rev 2 3.4.4
|
|-
|
|'''[[Practice_CM.L2-3.4.5_Details|CM.L2-3.4.5]]'''
''Access Restrictions for Change''


Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
''Control CUI Flow''
* NIST SP 800-171 Rev 2 3.4.5
|
|-
|
|'''[[Practice_CM.L2-3.4.6_Details|CM.L2-3.4.6]]'''
''Least Functionality''


Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
''' '''
* NIST SP 800-171 Rev 2 3.4.6
|
|-
|
|'''[[Practice_CM.L2-3.4.7_Details|CM.L2-3.4.7]]'''
''Nonessential Functionality''


Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
Control the flow of CUI in accordance with approved authorizations. '''AC.L2-3.1.4 '''
* NIST SP 800-171 Rev 2 3.4.7
|
|-
|
|'''[[Practice_CM.L2-3.4.8_Details|CM.L2-3.4.8]]'''
''Application Execution Policy''


Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
''Separation of Duties''
* NIST SP 800-171 Rev 2 3.4.8
 
|
''' '''
|-
 
|
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
|'''[[Practice_CM.L2-3.4.9_Details|CM.L2-3.4.9]]'''
''User-Installed Software''


Control and monitor user-installed software.
* NIST SP 800-171 Rev 2 3.4.9
|
|}


== Identification and Authentication (IA) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_IA.L1-3.5.1_Details|IA.L1-3.5.1]]'''
''Identification''


Identify information system users, processes acting on behalf of users, or devices.
* FAR Clause 52.204-21 b.1.v
* NIST SP 800-171 Rev 2 3.5.1
|'''[[Practice_IA.L2-3.5.3_Details|IA.L2-3.5.3]]'''
''Multifactor Authentication''


Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
* NIST SP 800-171 Rev 2 3.5.3
|
|-
|'''[[Practice_IA.L1-3.5.2_Details|IA.L1-3.5.2]]'''
''Authentication''


Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
* FAR Clause 52.204-21 b.1.vi
* NIST SP 800-171 Rev 2 3.5.2
|'''[[Practice_IA.L2-3.5.4_Details|IA.L2-3.5.4]]'''
''Replay-Resistant Authentication''


Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 7 '''AC.L2-3.1.5 '''
* NIST SP 800-171 Rev 2 3.5.4
|
|-
|
|'''[[Practice_IA.L2-3.5.5_Details|IA.L2-3.5.5]]'''
''Identifier Reuse''


Prevent reuse of identifiers for a defined period.
''Least Privilege''
* NIST SP 800-171 Rev 2 3.5.5
|
|-
|
|'''[[Practice_IA.L2-3.5.6_Details|IA.L2-3.5.6]]'''
''Identifier Handling''


Disable identifiers after a defined period of inactivity.
''' '''
* NIST SP 800-171 Rev 2 3.5.6
|
|-
|
|'''[[Practice_IA.L2-3.5.7_Details|IA.L2-3.5.7]]'''
''Password Complexity''


Enforce a minimum password complexity and change of characters when new passwords are created.
Employ the principle of least privilege, including for specific security functions and privileged accounts. '''AC.L2-3.1.6 '''
* NIST SP 800-171 Rev 2 3.5.7
|
|-
|
|'''[[Practice_IA.L2-3.5.8_Details|IA.L2-3.5.8]]'''
''Password Reuse''


Prohibit password reuse for a specified number of generations.
''Non-Privileged Account Use''
* NIST SP 800-171 Rev 2 3.5.8
|
|-
|
|'''[[Practice_IA.L2-3.5.9_Details|IA.L2-3.5.9]]'''
''Temporary Passwords''


Allow temporary password use for system logons with an immediate change to a permanent password.
''' '''
* NIST SP 800-171 Rev 2 3.5.9
|
|-
|
|'''[[Practice_IA.L2-3.5.10_Details|IA.L2-3.5.10]]'''
''Cryptographically-Protected Passwords''


Store and transmit only cryptographically protected passwords.
Use non-privileged accounts or roles when accessing nonsecurity functions. '''AC.L2-3.1.7 '''
* NIST SP 800-171 Rev 2 3.5.10
|
|-
|
|'''[[Practice_IA.L2-3.5.11_Details|IA.L2-3.5.11]]'''
''Obscure Feedback''


Obscure feedback of authentication information.
''Privileged Functions''
* NIST SP 800-171 Rev 2 3.5.11
 
|
''' '''
|}


== Incident Response (IR) ==
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. '''AC.L2-3.1.8 '''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_IR.L2-3.6.1_Details|IR.L2-3.6.1]]'''
''Incident Handling''


Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
''Unsuccessful Logon Attempts''
* NIST SP 800-171 Rev 2 3.6.1
|
|-
|
|'''[[Practice_IR.L2-3.6.2_Details|IR.L2-3.6.2]]'''
''Incident Reporting''


Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
''' '''
* NIST SP 800-171 Rev 2 3.6.2
|
|-
|
|'''[[Practice_IR.L2-3.6.3_Details|IR.L2-3.6.3]]'''
''Incident Response Testing''


Test the organizational incident response capability.
Limit unsuccessful logon attempts. '''AC.L2-3.1.9 '''
* NIST SP 800-171 Rev 2 3.6.3
|
|}


== Maintenance (MA) ==
''Privacy &amp; Security Notices''
{|class="wikitable" style="width: 85%;"
 
! style="width: 33%"| Level 1
''' '''
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_MA.L2-3.7.1_Details|MA.L2-3.7.1]]'''
''Perform Maintenance''


Perform maintenance on organizational systems.
Provide privacy and security notices consistent with applicable CUI rules. '''AC.L2-3.1.10 '''
* NIST SP 800-171 Rev 2 3.7.1
|
|-
|
|'''[[Practice_MA.L2-3.7.2_Details|MA.L2-3.7.2]]'''
''System Maintenance Control''


Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
''Session Lock''
* NIST SP 800-171 Rev 2 3.7.2
|
|-
|
|'''[[Practice_MA.L2-3.7.3_Details|MA.L2-3.7.3]]'''
''Equipment Sanitization''


Ensure equipment removed for off-site maintenance is sanitized of any CUI.
''' '''
* NIST SP 800-171 Rev 2 3.7.3
|
|-
|
|'''[[Practice_MA.L2-3.7.4_Details|MA.L2-3.7.4]]'''
''Media Inspection''


Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. '''AC.L2-3.1.11 '''
* NIST SP 800-171 Rev 2 3.7.4
 
|
''Session Termination''
|-
|
|'''[[Practice_MA.L2-3.7.5_Details|MA.L2-3.7.5]]'''
''Nonlocal Maintenance''


Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
''' '''
* NIST SP 800-171 Rev 2 3.7.5
|
|-
|
|'''[[Practice_MA.L2-3.7.6_Details|MA.L2-3.7.6]]'''
''Maintenance Personnel''


Supervise the maintenance activities of maintenance personnel without required access authorization.
Terminate (automatically) a user session after a defined condition. '''AC.L2-3.1.12 '''
* NIST SP 800-171 Rev 2 3.7.6
|
|}


== Media Protection (MP) ==
''Control Remote Access''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_MP.L1-3.8.3_Details|MP.L1-3.8.3]]'''
''Media Disposal''


Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
''' '''
* FAR Clause 52.204-21 b.1.vii
* NIST SP 800-171 Rev 2 3.8.3
|'''[[Practice_MP.L2-3.8.1_Details|MP.L2-3.8.1]]'''
''Media Protection''


Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
Monitor and control remote access sessions. '''AC.L2-3.1.13 '''
* NIST SP 800-171 Rev 2 3.8.1
|
|-
|
|'''[[Practice_MP.L2-3.8.2_Details|MP.L2-3.8.2]]'''
''Media Access''


Limit access to CUI on system media to authorized users.
''Remote Access Confidentiality''
* NIST SP 800-171 Rev 2 3.8.2
|
|-
|
|'''[[Practice_MP.L2-3.8.4_Details|MP.L2-3.8.4]]'''
''Media Markings''


Mark media with necessary CUI markings and distribution limitations.
''' '''
* NIST SP 800-171 Rev 2 3.8.4
|
|-
|
|'''[[Practice_MP.L2-3.8.5_Details|MP.L2-3.8.5]]'''
''Media Accountability''


Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. '''AC.L2-3.1.14 '''
* NIST SP 800-171 Rev 2 3.8.5
|
|-
|
|'''[[Practice_MP.L2-3.8.6_Details|MP.L2-3.8.6]]'''
''Portable Storage Encryption''


Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
''Remote Access Routing''
* NIST SP 800-171 Rev 2 3.8.6
|
|-
|
|'''[[Practice_MP.L2-3.8.7_Details|MP.L2-3.8.7]]'''
''Removable Media''


Control the use of removable media on system components.
''' '''
* NIST SP 800-171 Rev 2 3.8.7
 
|
Route remote access via managed access control points. '''AC.L2-3.1.15 '''
|-
 
|
''Privileged Remote Access''
|'''[[Practice_MP.L2-3.8.8_Details|MP.L2-3.8.8]]'''
''Shared Media''


Prohibit the use of portable storage devices when such devices have no identifiable owner.
''' '''
* NIST SP 800-171 Rev 2 3.8.8
|
|-
|
|'''[[Practice_MP.L2-3.8.9_Details|MP.L2-3.8.9]]'''
''Protect Backups''


Protect the confidentiality of backup CUI at storage locations.
Authorize remote execution of privileged commands and remote access to security-relevant information. '''AC.L2-3.1.16 '''
* NIST SP 800-171 Rev 2 3.8.9
|
|}


== Personnel Security (PS) ==
''Wireless Access Authorization''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_PS.L2-3.9.1_Details|PS.L2-3.9.1]]'''
''Screen Individuals''


Screen individuals prior to authorizing access to organizational systems containing CUI.
''' '''
* NIST SP 800-171 Rev 2 3.9.1
|
|-
|
|'''[[Practice_PS.L2-3.9.2_Details|PS.L2-3.9.2]]'''
''Personnel Actions''


Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
Authorize wireless access prior to allowing such connections. '''AC.L2-3.1.17 '''
* NIST SP 800-171 Rev 2 3.9.2
|
|}


== Physical Protection (PE) ==
''Wireless Access Protection''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_PE.L1-3.10.1_Details|PE.L1-3.10.1]]'''
''Limit Physical Access''


Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
''' '''
* FAR Clause 52.204-21 b.1.viii
* NIST SP 800-171 Rev 2 3.10.1
|'''[[Practice_PE.L2-3.10.2_Details|PE.L2-3.10.2]]'''
''Monitor Facility''


Protect and monitor the physical facility and support infrastructure for organizational systems.
Protect wireless access using authentication and encryption. '''AC.L2-3.1.18 '''
* NIST SP 800-171 Rev 2 3.10.2
|
|-
|'''[[Practice_PE.L1-3.10.3_Details|PE.L1-3.10.3]]'''
''Escort Visitors''


Escort visitors and monitor visitor activity.
''Mobile Device Connection''
* FAR Clause 52.204-21 Partial b.1.ix
* NIST SP 800-171 Rev 2 3.10.3
|'''[[Practice_PE.L2-3.10.6_Details|PE.L2-3.10.6]]'''
''Alternative Work Sites''


Enforce safeguarding measures for CUI at alternate work sites.
''' '''
* NIST SP 800-171 Rev 2 3.10.6
 
|
Control connection of mobile devices. '''AC.L2-3.1.19 '''
|-
|'''[[Practice_PE.L1-3.10.4_Details|PE.L1-3.10.4]]'''
''Physical Access Logs''


Maintain audit logs of physical access.
''Encrypt CUI on Mobile''
* FAR Clause 52.204-21 Partial b.1.ix
* NIST SP 800-171 Rev 2 3.10.4
|
|
|-
|'''[[Practice_PE.L1-3.10.5_Details|PE.L1-3.10.5]]'''
''Manage Physical Access''


Control and manage physical access devices.
''' '''
* FAR Clause 52.204-21 Partial b.1.ix
* NIST SP 800-171 Rev 2 3.10.5
|
|
|}


== Risk Assessment (RA) ==
Encrypt CUI on mobile devices and mobile computing platforms. '''AC.L2-3.1.20 '''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_RA.L2-3.11.1_Details|RA.L2-3.11.1]]'''
''Risk Assessments''


Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
''External Connections [CUI Data]''
* NIST SP 800-171 Rev 2 3.11.1
 
|
''' '''
|-
|
|'''[[Practice_RA.L2-3.11.2_Details|RA.L2-3.11.2]]'''
''Vulnerability Scan''


Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
Verify and control/limit connections to and use of external systems. '''AC.L2-3.1.21 '''
* NIST SP 800-171 Rev 2 3.11.2
|
|-
|
|'''[[Practice_RA.L2-3.11.3_Details|RA.L2-3.11.3]]'''
''Vulnerability Remediation''


Remediate vulnerabilities in accordance with risk assessments.
''Portable Storage Use''
* NIST SP 800-171 Rev 2 3.11.3
|
|}


== Security Assessment (CA) ==
''' '''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_CA.L2-3.12.1_Details|CA.L2-3.12.1]]'''
''Security Control Assessment''


Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
Limit use of portable storage devices on external systems. '''AC.L2-3.1.22''''' ''
* NIST SP 800-171 Rev 2 3.12.1
 
|
''Control Public Information [CUI Data] ''
|-
 
|
Control CUI posted or processed on publicly accessible systems.
|'''[[Practice_CA.L2-3.12.2_Details|CA.L2-3.12.2]]'''
''Plan of Action''


Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
* NIST SP 800-171 Rev 2 3.12.2
|
|-
|
|'''[[Practice_CA.L2-3.12.3_Details|CA.L2-3.12.3]]'''
''Security Control Monitoring''


Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
* NIST SP 800-171 Rev 2 3.12.3
|
|-
|
|'''[[Practice_CA.L2-3.12.4_Details|CA.L2-3.12.4]]'''
''System Security Plan''


Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
* NIST SP 800-171 Rev 2 3.12.4
|
|}


== System and Communications Protection (SC) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_SC.L1-3.13.1_Details|SC.L1-3.13.1]]'''
''Boundary Protection''


Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
* FAR Clause 52.204-21 b.1.x
* NIST SP 800-171 Rev 2 3.13.1
|'''[[Practice_SC.L2-3.13.2_Details|SC.L2-3.13.2]]'''
''Security Engineering''


Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 8 '''Level 3 '''
* NIST SP 800-171 Rev 2 3.13.2
 
|
'''Description '''
|-
|'''[[Practice_SC.L1-3.13.5_Details|SC.L1-3.13.5]]'''
''Public-Access System Separation''


Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
'''AC.L3-3.1.2e '''
* FAR Clause 52.204-21 b.1.xi
* NIST SP 800-171 Rev 2 3.13.5
|'''[[Practice_SC.L2-3.13.3_Details|SC.L2-3.13.3]]'''
''Role Separation''


Separate user functionality from system management functionality.
''Organizationally Controlled Assets''
* NIST SP 800-171 Rev 2 3.13.3
|
|-
|
|'''[[Practice_SC.L2-3.13.4_Details|SC.L2-3.13.4]]'''
''Shared Resource Control''


Prevent unauthorized and unintended information transfer via shared system resources.
''' '''
* NIST SP 800-171 Rev 2 3.13.4
|
|-
|
|'''[[Practice_SC.L2-3.13.6_Details|SC.L2-3.13.6]]'''
''Network Communication by Exception''


Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization. '''AC.L3-3.1.3e '''
* NIST SP 800-171 Rev 2 3.13.6
|
|-
|
|'''[[Practice_SC.L2-3.13.7_Details|SC.L2-3.13.7]]'''
''Split Tunneling''


Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
''Secured Information Transfer''
* NIST SP 800-171 Rev 2 3.13.7
 
|
''' '''
|-
 
|
Employ secure information transfer solutions to control information flows between security domains on connected systems. '''AWARENESS AND TRAINING (AT)''' '''Level 2 '''
|'''[[Practice_SC.L2-3.13.8_Details|SC.L2-3.13.8]]'''
''Data in Transit''


Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
'''Description '''
* NIST SP 800-171 Rev 2 3.13.8
|
|-
|
|'''[[Practice_SC.L2-3.13.9_Details|SC.L2-3.13.9]]'''
''Connections Termination''


Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
'''AT.L2-3.2.1 '''
* NIST SP 800-171 Rev 2 3.13.9
|
|-
|
|'''[[Practice_SC.L2-3.13.10_Details|SC.L2-3.13.10]]'''
''Key Management''


Establish and manage cryptographic keys for cryptography employed in organizational systems.
''Role-Based Risk Awareness'' Inform managers, systems administrators, and users of organizational systems of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. '''AT.L2-3.2.2 '''
* NIST SP 800-171 Rev 2 3.13.10
|
|-
|
|'''[[Practice_SC.L2-3.13.11_Details|SC.L2-3.13.11]]'''
''CUI Encryption''


Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
''Role-Based Training'' Train personnel to carry out their assigned information security-related duties and responsibilities. '''AT.L2-3.2.3 '''
* NIST SP 800-171 Rev 2 3.13.11
|
|-
|
|'''[[Practice_SC.L2-3.13.12_Details|SC.L2-3.13.12]]'''
''Collaborative Device Control''


Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
''Insider Threat Awareness''
* NIST SP 800-171 Rev 2 3.13.12
|
|-
|
|'''[[Practice_SC.L2-3.13.13_Details|SC.L2-3.13.13]]'''
''Mobile Code''


Control and monitor the use of mobile code.
''' '''
* NIST SP 800-171 Rev 2 3.13.13
|
|-
|
|'''[[Practice_SC.L2-3.13.14_Details|SC.L2-3.13.14]]'''
''Voice over Internet Protocol''


Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
Provide security awareness training on recognizing and reporting potential indicators of insider threat. '''Level 3 '''
* NIST SP 800-171 Rev 2 3.13.14
|
|-
|
|'''[[Practice_SC.L2-3.13.15_Details|SC.L2-3.13.15]]'''
''Communications Authenticity''


Protect the authenticity of communications sessions.
'''Description '''
* NIST SP 800-171 Rev 2 3.13.15
|
|-
|
|'''[[Practice_SC.L2-3.13.16_Details|SC.L2-3.13.16]]'''
''Data at Rest''


Protect the confidentiality of CUI at rest.
'''AT.L3-3.2.1e '''
* NIST SP 800-171 Rev 2 3.13.16
 
|
''Advanced Threat Awareness''
|}


== System and Information Integrity (SI) ==
''' '''
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_SI.L1-3.14.1_Details|SI.L1-3.14.1]]'''
''Flaw Remediation''


Identify, report, and correct information and information system flaws in a timely manner.
Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat. '''AT.L3-3.2.2e '''
* FAR Clause 52.204-21 b.1.xii
* NIST SP 800-171 Rev 2 3.14.1
|'''[[Practice_SI.L2-3.14.3_Details|SI.L2-3.14.3]]'''
''Security Alerts & Advisories''


Monitor system security alerts and advisories and take action in response.
''Practical Training Exercises''
* NIST SP 800-171 Rev 2 3.14.3
|
|-
|'''[[Practice_SI.L1-3.14.2_Details|SI.L1-3.14.2]]'''
''Malicious Code Protection''


Provide protection from malicious code at appropriate locations within organizational information systems.
''' '''
* FAR Clause 52.204-21 b.1.xiii
* NIST SP 800-171 Rev 2 3.14.2
|'''[[Practice_SI.L2-3.14.6_Details|SI.L2-3.14.6]]'''
''Monitor Communications for Attacks''


Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors. '''AUDIT AND ACCOUNTABILITY (AU)''' '''Level 2 '''
* NIST SP 800-171 Rev 2 3.14.6
|
|-
|'''[[Practice_SI.L1-3.14.4_Details|SI.L1-3.14.4]]'''
''Update Malicious Code Protection''


Update malicious code protection mechanisms when new releases are available.
'''Description '''
* FAR Clause 52.204-21 b.1.xiv
* NIST SP 800-171 Rev 2 3.14.4
|'''[[Practice_SI.L2-3.14.7_Details|SI.L2-3.14.7]]'''
''Identify Unauthorized Use''


Identify unauthorized use of organizational systems.
'''AU.L2-3.3.1 '''
* NIST SP 800-171 Rev 2 3.14.7
|
|-
|'''[[Practice_SI.L1-3.14.5_Details|SI.L1-3.14.5]]'''
''System & File Scanning''


Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
''System Auditing''
* FAR Clause 52.204-21 b.1.xv
* NIST SP 800-171 Rev 2 3.14.5
|
|}


''' '''


Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. '''AU.L2-3.3.2 '''


''User Accountability''


''' '''


Uniquely trace the actions of individual system users, so they can be held accountable for their actions. '''AU.L2-3.3.3 '''


''Event Review''


Version 2.13 | September 2024
''' '''


DoD-CIO-00001 (ZRIN 0790-ZA17)
Review and update logged events.


'''Cybersecurity Maturity Model '''


'''Certification (CMMC) Model '''


'''Overview '''


24-T-2765




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 9 '''AU.L2-3.3.4 '''


''Audit Failure Alerting''


''' '''


Alert in the event of an audit logging process failure. '''AU.L2-3.3.5 '''


''Audit Correlation''


''' '''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. '''AU.L2-3.3.6 '''


ii
''Reduction &amp; Reporting''


NOTICES
''' '''


The contents of this document do not have the force and effect of law and are not meant to
Provide audit record reduction and report generation to support on-demand analysis and reporting. '''AU.L2-3.3.7 '''


bind the public in any way. This document is intended only to provide clarity to the public
''Authoritative Time Source''


regarding existing CMMC security requirements under the law or departmental policies.
''' '''


DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. '''AU.L2-3.3.8 '''


''Audit Protection''


''' '''


Protect audit information and audit logging tools from unauthorized access, modification, and deletion. '''AU.L2-3.3.9''' ''Audit Management'' Limit management of audit logging functionality to a subset of privileged users. '''CONFIGURATION MANAGEMENT (CM)''' '''Level 2 '''


'''Description '''


'''CM.L2-3.4.1'''


''System Baselining''


Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. '''CM.L2-3.4.2'''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
''Security Configuration Enforcement''


iii
Establish and enforce security configuration settings for information technology products employed in organizational systems. '''CM.L2-3.4.3'''


TABLE OF CONTENTS
''System Change Management''


[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#4|'''1. Introduction ........................................................................................................................ 1''' ]]
Track, review, approve or disapprove, and log changes to organizational systems. '''CM.L2-3.4.4'''


[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#5|1.1 Document Organization ....................................................................................................... 2 <br />
''Security Impact Analysis''
1.2 Supporting Documents ........................................................................................................ 2 ]]


[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|'''2. CMMC Model ...................................................................................................................... 3''' ]]
Analyze the security impact of changes prior to implementation. '''CM.L2-3.4.5'''


[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2.1 Overview .............................................................................................................................. 3 <br />
''Access Restrictions for Change''
2.2 CMMC Levels ........................................................................................................................ 3 <br />
]][[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#8|2.3 CMMC Domains ................................................................................................................... 5 <br />
]][[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#9|2.4 CMMC Security Requirements ............................................................................................. 6 ]]


[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#21|'''Appendix A. CMMC Model Matrix ......................................................................................... 18''' ]]
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. '''CM.L2-3.4.6'''


[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#42|'''Appendix B. Abbreviations and Acronyms ............................................................................. 39''' ]]
''Least Functionality''


[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#44|'''Appendix C. References ......................................................................................................... 41''' ]]
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. '''CM.L2-3.4.7'''


''Nonessential Functionality''


Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. '''CM.L2-3.4.8'''


''Application Execution Policy''


Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. '''CM.L2-3.4.9'''


''User-Installed Software''


Control and monitor user-installed software.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13


1


1. Introduction


The theft of intellectual property and sensitive information from all industrial sectors because


of malicious cyber activity threatens economic security and national security. The Council of
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 10 '''Level 3 '''


Economic Advisors estimates that malicious cyber activity cost the U.S. economy between $57
'''Description '''


billion and $109  billion in 2016 [1]. The Center for Strategic and International Studies
'''CM.L3-3.4.1e'''


estimates that the total global cost of cybercrime was as high as $600 billion in 2017 [2]. Over
''Authoritative Repository''


a ten-year period, that burden would equate to an estimated $570 billion to $1.09 trillion
Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components. '''CM.L3-3.4.2e'''


dollars in costs.
''Automated Detection &amp; Remediation''


Malicious cyber actors have targeted  and continue to target the Defense Industrial Base
Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a quarantine or remediation network to facilitate patching, re-configuration, or other mitigations. '''CM.L3-3.4.3e'''


(DIB) sector and the Department of Defense (DoD) supply chain. These attacks not only focus
''Automated Inventory''


on the large prime contractors, but also target subcontractors that make up the lower tiers
Employ automated discovery and management tools to maintain an up-to-


of the DoD supply chain. Many of these subcontractors are small entities that provide critical
date, complete, accurate, and readily available inventory of system components. '''IDENTIFICATION AND AUTHENTICATION (IA)''' '''Level 1 '''


support and innovation. Overall, the DIB sector consists of over 220,000 companies[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#4|1]] that
'''Description '''


process, store, or transmit Controlled Unclassified Information (CUI) or Federal Contract
'''IA.L1-b.1.v '''


Information (FCI)  in support of the warfighter and contribute towards the research,  
''Identification [FCI Data]'' Identify information system users, processes acting on behalf of users, or devices. '''IA.L1-b.1.vi '''


engineering, development, acquisition, production, delivery, sustainment, and operations of
''Authentication [FCI Data]'' Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. '''Level 2 '''


DoD systems, networks, installations, capabilities, and services. The aggregate loss of
'''Description '''


intellectual property and controlled unclassified information from the DoD supply chain can
'''IA.L2-3.5.1 '''


undercut U.S. technical advantages and innovation, as well as significantly increase the risk
''Identification [CUI Data]''


to national security.
''' '''


As part of multiple lines of effort focused on the security and resiliency of the DIB sector, the
Identify system users, processes acting on behalf of users, and devices. '''IA.L2-3.5.2 '''


DoD is working with industry to enforce the safeguarding requirements of the following
''Authentication [CUI Data]''


types of unclassified information within the supply chain:
''' '''


•
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.


''Federal Contract Information (FCI''): is defined in 32 CFR § 170.4 and 48 CFR 4.1901 [3].
''' '''


•
'''IA.L2-3.5.3 '''


''Controlled Unclassified Information (CUI):'' is defined in 32 CFR § 2002.4 (h) [4].
''Multifactor Authentication''


To this end, the Office of the Under Secretary of Defense for Acquisition and Sustainment
''' '''


(OUSD(A&amp;S)) and DoD Chief Information Officer (CIO) have developed the Cybersecurity
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. '''IA.L2-3.5.4 '''


Maturity Model Certification (CMMC) in concert with DoD stakeholders, University Affiliated
''Replay-Resistant Authentication''


Research Centers (UARCs), Federally Funded Research and Development Centers (FFRDCs),
''' '''


and the DIB sector.  
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. '''IA.L2-3.5.5 '''


This document focuses on the Cybersecurity Maturity Model Certification (CMMC) Model as
''Identifier Reuse''


set forth in section 170.14  of title 32, Code of Federal Regulations  (CFR).  The model
''' '''


1
Prevent reuse of identifiers for a defined period. '''IA.L2-3.5.6 '''


Based on information from the Federal Procurement Data System, the average number of unique prime contractors
''Identifier Handling''


is approximately 212,657 and the number of known unique subcontractors is approximately 8,309. (FPDS from
''' '''


FY18-FY21).  
Disable identifiers after a defined period of inactivity. '''IA.L2-3.5.7 '''


''Password Complexity''


''' '''


Enforce a minimum password complexity and change of characters when new passwords are created. '''IA.L2-3.5.8 '''


''Password Reuse''


''' '''


Prohibit password reuse for a specified number of generations. '''IA.L2-3.5.9 '''


''Temporary Passwords''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
''' '''


2
Allow temporary password use for system logons with an immediate change to a permanent password.


incorporates the security requirements from: 1) FAR 52.204-21, ''Basic Safeguarding of Covered <br />
Contractor Information Systems'', 2) NIST SP 800-171 Rev 2, ''Protecting Controlled Unclassified <br />
Information in Nonfederal Systems and Organizations'', and 3) a subset of the requirements from


NIST SP 800-172,  ''Enhanced Security Requirements for Protecting Controlled Unclassified <br />
Information: A Supplement to NIST Special Publication 800-171''.  The CMMC Program is


designed to provide increased assurance to the DoD that defense contractors and


subcontractors are compliant with information protection requirements for FCI and CUI, and


are protecting such information at a level commensurate with risk from cybersecurity


threats, including Advanced Persistent Threats (APTs).  
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 11 '''IA.L2-3.5.10 '''


When implementing the CMMC model, an organization can achieve a specific CMMC level for
''Cryptographically-Protected ''


its entire enterprise network or for  a  particular enclave(s), depending on where the
''Passwords''


information to be protected is handled and stored.
''' '''


1.1
Store and transmit only cryptographically protected passwords. '''IA.L2-3.5.11 '''


Document Organization
''Obscure Feedback''


Section[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6| 2 ]]presents the CMMC Model and each of its elements in detail.[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#21| Appendix A ]]provides
''' '''


the model as a matrix and maps the CMMC model to other secondary sources[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#42|. Appendix B ]]
Obscure feedback of authentication information. '''Level 3 '''


lists the abbreviations and acronyms. Finally,[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#44| Appendix C ]]provides the references contained
'''Description '''


in this document.  
'''IA.L3-3.5.1e '''


1.2
''Bidirectional Authentication''


Supporting Documents
''' '''


This document is supported by multiple companion  documents  that  provide  additional
Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant. '''IA.L3-3.5.3e '''


information.  The  ''CMMC'' ''Assessment Guides''  present assessment objectives, discussion,
''Block Untrusted Assets''


examples, potential assessment considerations, and key references for each CMMC security
''' '''


requirement. The  ''CMMC Scoping Guides'' provide additional guidance on how to correctly
Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile. '''INCIDENT RESPONSE (IR)''' '''Level 2 '''


scope an assessment. The ''CMMC Hashing Guide'' provides information on how to create the
'''Description '''


hash to validate the integrity of archived assessment artifacts.  
'''IR.L2-3.6.1 '''


These supplemental documents are intended to provide explanatory information to assist
''Incident Handling'' Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. '''IR.L2-3.6.2 '''


organizations with implementing and assessing the security requirements covered by CMMC
''Incident Reporting''


in 32 CFR  § 170. The  documents are not prescriptive and their use is optional.
''' '''


Implementation of security requirements by following any examples is not a guarantee of
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. '''IR.L2-3.6.3 '''


compliance with any CMMC security requirement or objective.
''Incident Response Testing''


''' '''


Test the organizational incident response capability. '''Level 3 '''


'''Description '''


'''IR.L3-3.6.1e '''


''Security Operations Center''


''' '''


Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff. '''IR.L3-3.6.2e '''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
''Cyber Incident Response Team''


3
''' '''


2. CMMC Model
Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours. '''MAINTENANCE (MA)''' '''Level 2 '''


2.1 Overview
'''Description '''


The CMMC Model incorporates the security requirements from: 1) FAR 52.204-21,  ''Basic ''
'''MA.L2-3.7.1 '''


''Safeguarding of Covered Contractor Information Systems'', 2) NIST SP 800-171  Rev 2,
''Perform Maintenance'' Perform maintenance on organizational systems. '''MA.L2-3.7.2 '''


''Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations'', and  
''System Maintenance Control'' Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. '''MA.L2-3.7.3 '''


3) a subset of the requirements from NIST SP 800-172, ''Enhanced Security Requirements for''
''Equipment Sanitization''


''Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication<br />
''' '''
800—171.  ''These source documents may be revised in the future, however the CMMC


security requirements will remain unchanged until the CMMC final rule is published. Any
Sanitize equipment removed for off-site maintenance of any CUI.  


further modifications to the CMMC rule will follow appropriate rulemaking procedures.


The CMMC Model consists of domains that map to the Security Requirement Families defined


in NIST SP 800-171 Rev 2.


2.2 CMMC Levels


There are three levels within CMMC – Level 1, Level 2, and Level 3.


2.2.1 Descriptions
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 12 '''MA.L2-3.7.4 '''


The CMMC model measures  the implementation of  cybersecurity  requirements at  three
''Media Inspection''


levels. Each level is independent and consists of a set of CMMC security requirements as set
''' '''


forth in 32 CFR § 170.14 (c):
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. '''MA.L2-3.7.5 '''


• Level 1 Requirements. The security requirements in Level 1 are those set forth in FAR
''Nonlocal Maintenance''


clause 52.204-21(b)(1)(i) – (b)(1)(xv).
''' '''


• Level  2 Requirements. The security requirements in Level  2 are identical to the
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. '''MA.L2-3.7.6 '''


requirements in NIST SP 800-171 Rev 2.
''Maintenance Personnel''


• Level 3 Requirements. The security requirements in Level 3 are derived from NIST SP
''' '''


800-172 with DoD-approved parameters where applicable, as identified in 32 CFR §
Supervise the maintenance activities of maintenance personnel without required access authorization. '''MEDIA PROTECTION (MP)''' '''Level 1 '''


170.14(c)(4).  DoD defined selections and parameters for the NIST SP 800-172
'''Description '''


requirements are italicized, where applicable.
'''MP.L1-b.1.vii '''


''Media Disposal [FCI Data]'' Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. '''Level 2 '''


'''Description '''


'''MP.L2-3.8.1 '''


''Media Protection'' Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. '''MP.L2-3.8.2 '''


''Media Access'' Limit access to CUI on system media to authorized users. '''MP.L2-3.8.3 '''


''Media Disposal [CUI Data]''


''' '''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
Sanitize or destroy system media containing CUI before disposal or release for reuse. '''MP.L2-3.8.4 '''


4
''Media Markings''


2.2.2 CMMC Overview
''' '''


[[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#7|Figure 1 ]]provides an overview of the CMMC Levels.  
Mark media with necessary CUI markings and distribution limitations. '''MP.L2-3.8.5 '''


'''Figure 1. CMMC Level Overview '''
''Media Accountability''


2.2.3 Level 1
''' '''


Level 1 focuses on the protection of FCI and consists of the security requirements that
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. '''MP.L2-3.8.6 '''


correspond to the 15 basic safeguarding requirements specified in 48 CFR 52.204-21,
''Portable Storage Encryption''


commonly referred to as the FAR Clause.
''' '''


2.2.4 Level 2
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. '''MP.L2-3.8.7 '''


Level 2 focuses on the protection of CUI and incorporates the 110 security requirements
''Removable Media'' Control the use of removable media on system components. '''MP.L2-3.8.8 '''


specified in NIST SP 800-171 Rev 2.
''Shared Media''


''' '''


Prohibit the use of portable storage devices when such devices have no identifiable owner. '''MP.L2-3.8.9 '''


''Protect Backups''


''' '''


Protect the confidentiality of backup CUI at storage locations. '''PERSONNEL SECURITY (PS)''' '''Level 2 '''


'''Description '''


'''PS.L2-3.9.1 '''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
''Screen Individuals'' Screen individuals prior to authorizing access to organizational systems containing CUI.  


5


2.2.5. Level 3


Level 3 focuses on the protection of CUI and encompasses a subset of the NIST SP 800-


172  security  requirements  [5]  with DoD-approved  parameters.  DoD-approved


parameters are denoted with underlining in section 2.4.1 below.


2.3 CMMC Domains
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 13 '''PS.L2-3.9.2 '''


The CMMC model consists of 14  domains  that align with the families specified in NIST
''Personnel Actions'' Protect organizational systems containing CUI during and after personnel actions such as terminations and transfers. '''Level 3 '''


SP 800-171 Rev 2. These domains and their abbreviations are as follows:
'''Description '''


• Access Control (AC)<br />
'''PS.L3-3.9.2e '''
• Awareness &amp; Training (AT)<br />
• Audit &amp; Accountability (AU)<br />
• Configuration Management (CM)<br />
• Identification &amp; Authentication (IA)<br />
• Incident Response (IR)<br />
• Maintenance (MA)<br />
• Media Protection (MP)<br />
• Personnel Security (PS)<br />
• Physical Protection (PE)<br />
• Risk Assessment (RA)<br />
• Security Assessment (CA)<br />
• System and Communications Protection (SC)<br />
• System and Information Integrity (SI)


''Adverse Information''


''' '''


Protect organizational systems when adverse information develops or is obtained about individuals with access to CUI. '''PHYSICAL PROTECTION (PE)''' '''Level 1 '''


'''Description '''


'''PE.L1-b.1.viii '''


''Limit Physical Access [FCI Data]'' Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. '''PE.L1-b.1.ix '''


''Manage Visitors &amp; Physical Access ''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
''[FCI Data]'' Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. '''Level 2 '''


6
'''Description '''


2.4 CMMC Security Requirements
'''PE.L2-3.10.1 '''


2.4.1. List of Security Requirements
''Limit Physical Access [CUI Data]''


This subsection itemizes the security requirements for each domain and at each level. Each
''' '''


requirement has a requirement identification number in the format''' '''–''' DD.L#-REQ '''–''' '''where:
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.


• DD is the two-letter domain abbreviation;<br />
''' '''
• L# is the level number; and<br />
• REQ is the FAR Clause 52.204-21 paragraph number, NIST SP 800-171 Rev 2, or NIST SP


800-172 security requirement number.
'''PE.L2-3.10.2 '''


Below the identification number, a short name identifier is provided for each requirement,
''Monitor Facility'' Protect and monitor the physical facility and support infrastructure for organizational systems. '''PE.L2-3.10.3 '''


meant to be used for quick reference only. Finally, each requirement  has a complete
''Escort Visitors [CUI Data]''


requirement statement.
''' '''


'''ACCESS CONTROL (AC)'''  
Escort visitors and monitor visitor activity. '''PE.L2-3.10.4 '''


'''Level 1 '''
''Physical Access Logs [CUI Data]''


'''Description '''
''' '''


'''AC.L1-b.1.i '''
Maintain audit logs of physical access. '''PE.L2-3.10.5 '''


''Authorized Access Control [FCI Data]''
''Manage Physical Access [CUI Data]''


''' '''
''' '''


Limit information system access to authorized users, processes acting on
Control and manage physical access devices. '''PE.L2-3.10.6 '''


behalf of authorized users, or devices (including other information systems).
''Alternative Work Sites''


'''AC.L1-b.1.ii '''
''' '''


''Transaction &amp; Function Control [FCI ''
Enforce safeguarding measures for CUI at alternate work sites. '''RISK ASSESSMENT (RA)''' '''Level 2 '''


''Data]''
'''Description '''


''' '''
'''RA.L2-3.11.1 '''


Limit information system access to the types of transactions and functions
''Risk Assessments'' Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. '''RA.L2-3.11.2 '''


that authorized users are permitted to execute.  
''Vulnerability Scan'' Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.  


'''AC.L1-b.1.iii '''


''External Connections [FCI Data]''


''' '''


Verify and control/limit connections to and use of external information


systems.


'''AC.L1-b.1.iv '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 14 '''RA.L2-3.11.3 '''


''Control Public Information [FCI Data]''
''Vulnerability Remediation'' Remediate vulnerabilities in accordance with risk assessments. '''Level 3 '''


''' '''
'''Description '''


Control information posted or processed on publicly accessible information
'''RA.L3-3.11.1e '''


systems.
''Threat-Informed Risk Assessment''


'''Level 2 '''
''' '''


'''Description '''
Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities. '''RA.L3-3.11.2e '''


'''AC.L2-3.1.1''''' ''
''Threat Hunting''


''Authorized Access Control [CUI Data] ''
''' '''


Limit system access to authorized users, processes acting on behalf of
Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. '''RA.L3-3.11.3e '''


authorized users, and devices (including other systems).
''Advanced Risk Identification''


''' '''
''' '''


'''AC.L2-3.1.2 '''
Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components. '''RA.L3-3.11.4e '''


''Transaction &amp; Function Control [CUI ''
''Security Solution Rationale''
 
''Data]''


''' '''
''' '''


Limit system access to the types of transactions and functions that
Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination. '''RA.L3-3.11.5e '''


authorized users are permitted to execute.
''Security Solution Effectiveness''


''' '''
''' '''


'''AC.L2-3.1.3 '''
Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence. '''RA.L3-3.11.6e '''


''Control CUI Flow''
''Supply Chain Risk Response''


''' '''
''' '''


Control the flow of CUI in accordance with approved authorizations.  
Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. '''RA.L3-3.11.7e '''


'''AC.L2-3.1.4 '''
''Supply Chain Risk Plan''
 
''Separation of Duties''


''' '''
''' '''


Separate the duties of individuals to reduce the risk of malevolent activity
Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident. '''SECURITY ASSESSMENT (CA)''' '''Level 2 '''


without collusion.
'''Description '''


'''CA.L2-3.12.1 '''


''Security Control Assessment'' Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. '''CA.L2-3.12.2 '''


''Operational Plan of Action'' Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. '''CA.L2-3.12.3 '''


''Security Control Monitoring''


''' '''


Monitor security controls on an ongoing basis to determine the continued effectiveness of the controls. '''CA.L2-3.12.4 '''


''System Security Plan''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
''' '''


7
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.


'''AC.L2-3.1.5 '''


''Least Privilege''


''' '''


Employ the principle of least privilege, including for specific security


functions and privileged accounts.


'''AC.L2-3.1.6 '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 15 '''Level 3 '''


''Non-Privileged Account Use''
'''Description '''


''' '''
'''CA.L3-3.12.1e '''


Use non-privileged accounts or roles when accessing nonsecurity functions.
''Penetration Testing''


'''AC.L2-3.1.7 '''
''' '''


''Privileged Functions''
Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts. '''SYSTEM AND COMMUNICATIONS PROTECTION (SC)''' '''Level 1 '''


''' '''
'''Description '''


Prevent non-privileged users from executing privileged functions and
'''SC.L1-b.1.x '''


capture the execution of such functions in audit logs.  
''Boundary Protection [FCI Data]'' Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. '''SC.L1-b.1.xi '''


'''AC.L2-3.1.8 '''
''Public-Access System Separation ''


''Unsuccessful Logon Attempts''
''[FCI Data]'' Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. '''Level 2 '''


''' '''
'''Description '''


Limit unsuccessful logon attempts.  
'''SC.L2-3.13.1 '''


'''AC.L2-3.1.9 '''
''Boundary Protection [CUI Data]''
 
''Privacy &amp; Security Notices''


''' '''
''' '''


Provide privacy and security notices consistent with applicable CUI rules.  
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.


'''AC.L2-3.1.10 '''
''' '''


''Session Lock''
'''SC.L2-3.13.2 '''


''' '''
''Security Engineering'' Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. '''SC.L2-3.13.3 '''


Use session lock with pattern-hiding displays to prevent access and viewing
''Role Separation'' Separate user functionality from system management functionality. '''SC.L2-3.13.4 '''


of data after a period of inactivity.  
''Shared Resource Control'' Prevent unauthorized and unintended information transfer via shared system resources. '''SC.L2-3.13.5 '''


'''AC.L2-3.1.11 '''
''Public-Access System Separation ''


''Session Termination''
''[CUI Data]''


''' '''
''' '''


Terminate (automatically) a user session after a defined condition.  
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. '''SC.L2-3.13.6 '''
 
''Network Communication by ''
 
''Exception'' Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). '''SC.L2-3.13.7 '''


'''AC.L2-3.1.12 '''
''Split Tunneling'' Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). '''SC.L2-3.13.8 '''


''Control Remote Access''
''Data in Transit'' Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.


''' '''


Monitor and control remote access sessions.


'''AC.L2-3.1.13 '''


''Remote Access Confidentiality''


''' '''


Employ cryptographic mechanisms to protect the confidentiality of remote
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 16 '''SC.L2-3.13.9 '''


access sessions.  
''Connections Termination'' Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. '''SC.L2-3.13.10 '''


'''AC.L2-3.1.14 '''
''Key Management'' Establish and manage cryptographic keys for cryptography employed in organizational systems. '''SC.L2-3.13.11 '''


''Remote Access Routing''
''CUI Encryption''


''' '''
''' '''


Route remote access via managed access control points.  
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. '''SC.L2-3.13.12 '''


'''AC.L2-3.1.15 '''
''Collaborative Device Control''
 
''Privileged Remote Access''


''' '''
''' '''


Authorize remote execution of privileged commands and remote access to  
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. '''SC.L2-3.13.13 '''


security-relevant information.  
''Mobile Code'' Control and monitor the use of mobile code. '''SC.L2-3.13.14 '''


'''AC.L2-3.1.16 '''
''Voice over Internet Protocol'' Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. '''SC.L2-3.13.15 '''


''Wireless Access Authorization''
''Communications Authenticity'' Protect the authenticity of communications sessions. '''SC.L2-3.13.16 '''


''' '''
''Data at Rest'' Protect the confidentiality of CUI at rest. '''Level 3 '''


Authorize wireless access prior to allowing such connections.
'''Description '''


'''AC.L2-3.1.17 '''
'''SC.L3-3.13.4e '''


''Wireless Access Protection''
''Isolation''


''' '''
''' '''


Protect wireless access using authentication and encryption.  
Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components. '''SYSTEM AND INFORMATION INTEGRITY (SI)''' '''Level 1 '''


'''AC.L2-3.1.18 '''
'''Description '''


''Mobile Device Connection''
'''SI.L1-b.1.xii '''


''' '''
''Flaw Remediation [FCI Data]'' Identify, report, and correct information and information system flaws in a timely manner. '''SI.L1-b.1.xiii '''


Control connection of mobile devices.  
''Malicious Code Protection [FCI Data]'' Provide protection from malicious code at appropriate locations within organizational information systems. '''SI.L1-b.1.xiv '''


'''AC.L2-3.1.19 '''
''Update Malicious Code Protection ''


''Encrypt CUI on Mobile''
''[FCI Data]'' Update malicious code protection mechanisms when new releases are available. '''SI.L1-b.1.xv '''


''' '''
''System &amp; File Scanning [FCI Data]'' Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. '''Level 2 '''


Encrypt CUI on mobile devices and mobile computing platforms.
'''Description '''


'''AC.L2-3.1.20 '''
'''SI.L2-3.14.1 '''


''External Connections [CUI Data]''
''Flaw Remediation [CUI Data]''


''' '''
''' '''


Verify and control/limit connections to and use of external systems.  
Identify, report, and correct system flaws in a timely manner. '''SI.L2-3.14.2 '''
 
''Malicious Code Protection [CUI ''
 
''Data] ''
 
Provide protection from malicious code at designated locations within organizational systems.  


'''AC.L2-3.1.21 '''


''Portable Storage Use''


''' '''


Limit use of portable storage devices on external systems.


'''AC.L2-3.1.22''''' ''


''Control Public Information [CUI Data] ''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 17 '''SI.L2-3.14.3 '''


Control CUI posted or processed on publicly accessible systems.  
''Security Alerts &amp; Advisories'' Monitor system security alerts and advisories and take action in response. '''SI.L2-3.14.4 '''


''Update Malicious Code Protection ''


''[CUI Data]''


''' '''


Update malicious code protection mechanisms when new releases are available. '''SI.L2-3.14.5 '''


''System &amp; File Scanning [CUI Data]''


''' '''


Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. '''SI.L2-3.14.6 '''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
''Monitor Communications for ''


8
''Attacks'' Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. '''SI.L2-3.14.7 '''


'''Level 3 '''
''Identify Unauthorized Use'' Identify unauthorized use of organizational systems. '''Level 3 '''


'''Description '''
'''Description '''


'''AC.L3-3.1.2e '''
'''SI.L3-3.14.1e '''


''Organizationally Controlled Assets''
''Integrity Verification''


''' '''
''' '''


Restrict access to systems and system components to only those
Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures. '''SI.L3-3.14.3e '''


information resources that are owned, provisioned, or issued by the
''Specialized Asset Security''


organization.
''' '''


'''AC.L3-3.1.3e '''
Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks. '''SI.L3-3.14.6e '''


''Secured Information Transfer''
''Threat-Guided Intrusion Detection''


''' '''
''' '''


Employ  secure information transfer solutions  to control information
Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting.


flows between security domains on connected systems.


'''AWARENESS AND TRAINING (AT)'''


'''Level 2 '''


'''Description '''


'''AT.L2-3.2.1 '''


''Role-Based Risk Awareness''  
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 18 Appendix A. CMMC Model Matrix This appendix presents the model in matrix form by domain. The three columns list the associated security requirements for each CMMC level. Each level is independent and consists of a set of CMMC security requirements: • Level 1: the ''basic safeguarding requirements'' for FCI specified in FAR Clause 52.204-21.<br />
• Level 2: the ''security requirements'' for CUI specified in NIST SP 800-171 Rev 2 per DFARS


Inform  managers, systems  administrators, and users of organizational
Clause 252.204-7012


systems of the security risks associated with their activities and of the
• Level 3: selected ''enhanced'' ''security requirements'' for CUI specified in NIST SP 800-172


applicable policies, standards, and procedures related to the security of
with DoD-approved parameters where applicable.


those systems.  
Each requirement is contained in a single cell. The requirement identification number is bolded at the top of each cell. The next line contains the requirement short name identifier, in ''italics'', which is meant to be used for quick reference only. Below the short name is the complete CMMC security requirement statement. Some Level 3 requirement statements contain a DoD-approved parameter, which is underlined. Finally, the bulleted list at the bottom contains the FAR Clause 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172 reference as appropriate.  


'''AT.L2-3.2.2 '''


''Role-Based Training''


Train  personnel  to carry out their assigned information security-related


duties and responsibilities.


'''AT.L2-3.2.3 '''


''Insider Threat Awareness''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 19 '''ACCESS CONTROL (AC)''' '''Level 1 '''


''' '''
'''Level 2 '''


Provide security awareness training on recognizing and reporting potential
'''Level 3 '''


indicators of insider threat.  
'''AC.L1-b.1.i''' ''Authorized Access Control [FCI Data]'' Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). • FAR Clause 52.204-21 b.1.i


'''Level 3 '''
• NIST SP 800-171 Rev 2 3.1.1


'''Description '''
'''AC.L2-3.1.1''' ''Authorized Access Control [CUI Data]'' Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). • NIST SP 800-171 Rev 2 3.1.1


'''AT.L3-3.2.1e '''
• FAR Clause 52.204-21 b.1.i


''Advanced Threat Awareness''
'''AC.L3-3.1.2e''' ''Organizationally Controlled Assets'' Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization. • NIST SP 800-172 3.1.2e


''' '''
'''AC.L1-b.1.ii'''


Provide awareness training upon initial hire, following a significant cyber
''Transaction &amp; Function Control [FCI Data]''


event, and at least annually, focused on recognizing and responding to  
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.


threats from social engineering, advanced persistent threat actors,
• FAR Clause 52.204-21 b.1.ii


breaches, and suspicious behaviors; update the training at least annually or
• NIST SP 800-171 Rev 2 3.1.2


when there are significant changes to the threat.  
'''AC.L2-3.1.2''' ''Transaction &amp; Function Control [CUI Data]'' Limit system access to the types of transactions and functions that authorized users are permitted to execute. • NIST SP 800-171 Rev 2 3.1.2


'''AT.L3-3.2.2e '''
• FAR Clause 52.204-21 b.1.ii '''AC.L3-3.1.3e''' ''Secured Information Transfer'' Employ secure information transfer solutions to control information flows between security domains on connected systems. • NIST SP 800-172 3.1.3e


''Practical Training Exercises''
'''AC.L1-b.1.iii''' ''External Connections [FCI Data]'' Verify and control/limit connections to and use of external information systems. • FAR Clause 52.204-21 b.1.iii • NIST SP 800-171 Rev 2 3.1.20


''' '''
'''AC.L2-3.1.3''' ''Control CUI Flow'' Control the flow of CUI in accordance with approved authorizations. • NIST SP 800-171 Rev 2 3.1.3


Include practical exercises in awareness training for all users, tailored by
'''AC.L1-b.1.iv''' ''Control Public Information [FCI Data]'' Control information posted or processed on publicly accessible information systems. • FAR Clause 52.204-21 b.1.iv • NIST SP 800-171 Rev 2 3.1.22


roles, to include general users, users with specialized roles, and privileged
'''AC.L2-3.1.4''' ''Separation of Duties'' Separate the duties of individuals to reduce the risk of malevolent activity without collusion. • NIST SP 800-171 Rev 2 3.1.4<br />
'''AC.L2-3.1.5''' ''Least Privilege'' Employ the principle of least privilege, including for specific security functions and privileged accounts. • NIST SP 800-171 Rev 2 3.1.5<br />
'''AC.L2-3.1.6''' ''Non-Privileged Account Use'' Use non-privileged accounts or roles when accessing nonsecurity functions. • NIST SP 800-171 Rev 2 3.1.6<br />
'''AC.L2-3.1.7''' ''Privileged Functions'' Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. • NIST SP 800-171 Rev 2 3.1.7<br />
'''AC.L2-3.1.8''' ''Unsuccessful Logon Attempts'' Limit unsuccessful logon attempts. • NIST SP 800-171 Rev 2 3.1.8 <br />
'''AC.L2-3.1.9''' ''Privacy &amp; Security Notices'' Provide privacy and security notices consistent with applicable CUI rules. • NIST SP 800-171 Rev 2 3.1.9


users, that are aligned with current threat scenarios and provide feedback


to individuals involved in the training and their supervisors.


'''AUDIT AND ACCOUNTABILITY (AU)'''


'''Level 2 '''


'''Description '''


'''AU.L2-3.3.1 '''


''System Auditing''


''' '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 20 '''Level 1 '''


Create and retain system audit logs and records to the extent needed to
'''Level 2 '''


enable the monitoring, analysis, investigation, and reporting of unlawful or
'''Level 3 '''


unauthorized system activity.  
'''AC.L2-3.1.10''' ''Session Lock'' Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. • NIST SP 800-171 Rev 2 3.1.10<br />
'''AC.L2-3.1.11''' ''Session Termination'' Terminate (automatically) a user session after a defined condition. • NIST SP 800-171 Rev 2 3.1.11<br />
'''AC.L2-3.1.12''' ''Control Remote Access'' Monitor and control remote access sessions. • NIST SP 800-171 Rev 2 3.1.12<br />
'''AC.L2-3.1.13''' ''Remote Access Confidentiality'' Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. • NIST SP 800-171 Rev 2 3.1.13<br />
'''AC.L2-3.1.14''' ''Remote Access Routing'' Route remote access via managed access control points. • NIST SP 800-171 Rev 2 3.1.14<br />
'''AC.L2-3.1.15''' ''Privileged Remote Access'' Authorize remote execution of privileged commands and remote access to security-


'''AU.L2-3.3.2 '''
relevant information. • NIST SP 800-171 Rev 2 3.1.15<br />
'''AC.L2-3.1.16''' ''Wireless Access Authorization'' Authorize wireless access prior to allowing such connections. • NIST SP 800-171 Rev 2 3.1.16<br />
'''AC.L2-3.1.17''' ''Wireless Access Protection'' Protect wireless access using authentication and encryption. • NIST SP 800-171 Rev 2 3.1.17<br />
'''AC.L2-3.1.18''' ''Mobile Device Connection'' Control connection of mobile devices. • NIST SP 800-171 Rev 2 3.1.18<br />
'''AC.L2-3.1.19''' ''Encrypt CUI on Mobile'' Encrypt CUI on mobile devices and mobile computing platforms. • NIST SP 800-171 Rev 2 3.1.19<br />
'''AC.L2-3.1.20''' ''External Connections [CUI Data]'' Verify and control/limit connections to and use of external systems. • NIST SP 800-171 Rev 2 3.1.20


''User Accountability''
• FAR Clause 52.204-21 b.1.iii


''' '''
''' '''


Uniquely trace the actions of individual system users, so they can be held


accountable for their actions.


'''AU.L2-3.3.3 '''


''Event Review''


''' '''


Review and update logged events.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 21 '''Level 1 '''


'''Level 2 '''


'''Level 3 '''


'''AC.L2-3.1.21''' ''Portable Storage Use'' Limit use of portable storage devices on external systems. • NIST SP 800-171 Rev 2 3.1.21<br />
'''AC.L2-3.1.22''' ''Control Public Information [CUI Data]'' Control CUI posted or processed on publicly accessible systems. • NIST SP 800-171 Rev 2 3.1.22


• FAR Clause 52.204-21 b.1.iv


''' '''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13


9


'''AU.L2-3.3.4 '''


''Audit Failure Alerting''


''' '''


Alert in the event of an audit logging process failure.


'''AU.L2-3.3.5 '''


''Audit Correlation''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 22 '''AWARENESS AND TRAINING (AT)''' '''Level 1 '''


''' '''
'''Level 2 '''


Correlate audit record  review, analysis, and reporting processes for
'''Level 3 '''


investigation and response to indications of unlawful, unauthorized,  
'''AT.L2-3.2.1''' ''Role-Based Risk Awareness'' Inform managers, systems administrators, and users of organizational systems of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. • NIST SP 800-171 Rev 2 3.2.1


suspicious, or unusual activity.
'''AT.L3-3.2.1e''' ''Advanced Threat Awareness'' Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually


'''AU.L2-3.3.6 '''
''' '''or when there are significant changes to the threat. • NIST SP 800-172 3.2.1e


''Reduction &amp; Reporting''
'''AT.L2-3.2.2''' ''Role-Based Training'' Train personnel to carry out their assigned information security-related duties and responsibilities. • NIST SP 800-171 Rev 2 3.2.2


''' '''
'''AT.L3-3.2.2e''' ''Practical Training Exercises'' Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors. • NIST SP 800-172 3.2.2e


Provide audit record reduction and report generation to support on-demand
'''AT.L2-3.2.3''' ''Insider Threat Awareness'' Provide security awareness training on recognizing and reporting potential indicators of insider threat. • NIST SP 800-171 Rev 2 3.2.3


analysis and reporting.


'''AU.L2-3.3.7 '''


''Authoritative Time Source''


''' '''


Provide a system capability that compares and synchronizes internal system


clocks with an authoritative source to generate time stamps for audit


records.


'''AU.L2-3.3.8 '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 23 '''AUDIT AND ACCOUNTABILITY (AU)''' '''Level 1 '''


''Audit Protection''
'''Level 2 '''
 
'''Level 3 '''
 
'''AU.L2-3.3.1''' ''System Auditing'' Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. • NIST SP 800-171 Rev 2 3.3.1<br />
'''AU.L2-3.3.2''' ''User Accountability'' Uniquely track the actions of individual system users, so they can be held accountable for their actions. • NIST SP 800-171 Rev 2 3.3.2<br />
'''AU.L2-3.3.3''' ''Event Review'' Review and update logged events. • NIST SP 800-171 Rev 2 3.3.3<br />
'''AU.L2-3.3.4''' ''Audit Failure Alerting'' Alert in the event of an audit logging process failure. • NIST SP 800-171 Rev 2 3.3.4<br />
'''AU.L2-3.3.5''' ''Audit Correlation'' Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. • NIST SP 800-171 Rev 2 3.3.5<br />
'''AU.L2-3.3.6''' ''Reduction &amp; Reporting'' Provide audit record reduction and report generation to support on-demand analysis and reporting. • NIST SP 800-171 Rev 2 3.3.6<br />
'''AU.L2-3.3.7''' ''Authoritative Time Source'' Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. • NIST SP 800-171 Rev 2 3.3.7<br />
'''AU.L2-3.3.8''' ''Audit Protection'' Protect audit information and audit logging tools from unauthorized access, modification, and deletion. • NIST SP 800-171 Rev 2 3.3.8<br />
'''AU.L2-3.3.9''' ''Audit Management'' Limit management of audit logging functionality to a subset of privileged users. • NIST SP 800-171 Rev 2 3.3.9


''' '''


Protect audit information and audit logging tools from unauthorized access,


modification, and deletion.


'''AU.L2-3.3.9'''


''Audit Management''


Limit management of audit logging functionality to a subset of privileged


users.


'''CONFIGURATION MANAGEMENT (CM)'''  
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 24 '''CONFIGURATION MANAGEMENT (CM)''' '''Level 1 '''


'''Level 2 '''
'''Level 2 '''


'''Description '''
'''Level 3 '''


'''CM.L2-3.4.1'''
'''CM.L2-3.4.1'''


''System Baselining''
''System Baselining'' Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. • NIST SP 800-171 Rev 2 3.4.1


Establish and maintain baseline configurations and inventories of
'''CM.L3-3.4.1e'''


organizational systems (including hardware, software, firmware, and  
''Authoritative Repository'' Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components. • NIST SP 800-172 3.4.1e


documentation) throughout the respective system development life cycles.  
'''CM.L2-3.4.2'''


'''CM.L2-3.4.2'''
''Security Configuration Enforcement'' Establish and enforce security configuration settings for information technology products employed in organizational systems. • NIST SP 800-171 Rev 2 3.4.2


''Security Configuration Enforcement''
'''CM.L3-3.4.2e'''


Establish and enforce security configuration settings for information
''Automated Detection &amp; Remediation'' Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a


technology products employed in organizational systems.  
quarantine or remediation network to facilitate patching, re-configuration, or other mitigations. • NIST SP 800-172 3.4.2e


'''CM.L2-3.4.3'''
'''CM.L2-3.4.3'''


''System Change Management''
''System Change Management'' Track, review, approve or disapprove, and log
 
changes to organizational systems. • NIST SP 800-171 Rev 2 3.4.3


Track, review, approve or disapprove, and log changes to organizational
'''CM.L3-3.4.3e'''


systems.
''Automated Inventory'' Employ automated discovery and management tools to maintain an up-to-


'''CM.L2-3.4.4'''
date, complete, accurate, and readily available inventory of system components.


''Security Impact Analysis''
• NIST SP 800-172 3.4.3e


Analyze the security impact of changes prior to implementation.  
'''CM.L2-3.4.4'''


''Security Impact Analysis'' Analyze the security impact of changes prior to implementation. • NIST SP 800-171 Rev 2 3.4.4<br />
'''CM.L2-3.4.5'''
'''CM.L2-3.4.5'''


''Access Restrictions for Change''
''Access Restrictions for Change'' Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational


Define, document, approve, and enforce physical and logical access
systems. • NIST SP 800-171 Rev 2 3.4.5<br />
'''CM.L2-3.4.6'''


restrictions associated with changes to organizational systems.  
''Least Functionality'' Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. • NIST SP 800-171 Rev 2 3.4.6<br />
'''CM.L2-3.4.7'''


'''CM.L2-3.4.6'''
''Nonessential Functionality'' Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. • NIST SP 800-171 Rev 2 3.4.7


''Least Functionality''


Employ the principle of least functionality by configuring organizational


systems to provide only essential capabilities.


'''CM.L2-3.4.7'''


''Nonessential Functionality''


Restrict, disable, or prevent the use of nonessential programs, functions,


ports, protocols, and services.


'''CM.L2-3.4.8'''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 25 '''Level 1 '''


''Application Execution Policy''
'''Level 2 '''


Apply deny-by-exception (blacklisting) policy to prevent the use of
'''Level 3 '''


unauthorized software or deny-all, permit-by-exception (whitelisting) policy
'''CM.L2-3.4.8'''


to allow the execution of authorized software.
''Application Execution Policy'' Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of


authorized software. • NIST SP 800-171 Rev 2 3.4.8<br />
'''CM.L2-3.4.9'''
'''CM.L2-3.4.9'''


''User-Installed Software''
''User-Installed Software'' Control and monitor user-installed software.


Control and monitor user-installed software.  
• NIST SP 800-171 Rev 2 3.4.9




Line 1,890: Line 1,272:




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13  
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 26 '''IDENTIFICATION AND AUTHENTICATION (IA)''' '''Level 1 '''


10
'''Level 2 '''


'''Level 3 '''
'''Level 3 '''


'''Description '''
'''IA.L1-b.1.v''' ''Identification [FCI Data]'' Identify information system users, processes acting on behalf of users, or devices. • FAR Clause 52.204-21 b.1.v • NIST SP 800-171 Rev 2 3.5.1
 
'''IA.L2-3.5.1''' ''Identification [CUI Data]'' Identify system users, processes acting on behalf of users, and devices. • NIST SP 800-171 Rev 2 3.5.1


'''CM.L3-3.4.1e'''
• FAR Clause 52.204-21 b.1.v '''IA.L3-3.5.1e''' ''Bidirectional Authentication'' Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant. • NIST SP 800-172 3.5.1e


''Authoritative Repository''
'''IA.L1-b.1.vi''' ''Authentication [FCI Data]'' Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. • FAR Clause 52.204-21 b.1.vi


Establish and maintain an authoritative source and repository to provide a
• NIST SP 800-171 Rev 2 3.5.2


trusted source and accountability for approved and implemented system
'''IA.L2-3.5.2''' ''Authentication [CUI Data]'' Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. • NIST SP 800-171 Rev 2 3.5.2


components.  
• FAR Clause 52.204-21 b.1.vi


'''CM.L3-3.4.2e'''
'''IA.L3-3.5.3e''' ''Block Untrusted Assets'' Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile. • NIST SP 800-172 3.5.3e


''Automated Detection &amp; Remediation''
'''IA.L2-3.5.3''' ''Multifactor Authentication'' Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. • NIST SP 800-171 Rev 2 3.5.3<br />
'''IA.L2-3.5.4''' ''Replay-Resistant Authentication'' Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. • NIST SP 800-171 Rev 2 3.5.4<br />
'''IA.L2-3.5.5''' ''Identifier Reuse'' Prevent reuse of identifiers for a defined period. • NIST SP 800-171 Rev 2 3.5.5<br />
'''IA.L2-3.5.6''' ''Identifier Handling'' Disable identifiers after a defined period of inactivity. • NIST SP 800-171 Rev 2 3.5.6<br />
'''IA.L2-3.5.7''' ''Password Complexity'' Enforce a minimum password complexity and change of characters when new passwords are created. • NIST SP 800-171 Rev 2 3.5.7<br />
'''IA.L2-3.5.8''' ''Password Reuse'' Prohibit password reuse for a specified number of generations. • NIST SP 800-171 Rev 2 3.5.8<br />
'''IA.L2-3.5.9''' ''Temporary Passwords'' Allow temporary password use for system logons with an immediate change to a permanent password. • NIST SP 800-171 Rev 2 3.5.9


Employ automated mechanisms to detect misconfigured or unauthorized


system components; after detection, remove the components or place the


components in a quarantine or remediation network to facilitate patching,


re-configuration, or other mitigations.


'''CM.L3-3.4.3e'''


''Automated Inventory''


Employ automated discovery and management tools to maintain an up-to-


date, complete, accurate, and readily available inventory of system
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 27 '''Level 1 '''


components.
'''Level 2 '''


'''IDENTIFICATION AND AUTHENTICATION (IA)'''  
'''Level 3 '''


'''Level 1 '''
'''IA.L2-3.5.10''' ''Cryptographically-Protected Passwords'' Store and transmit only cryptographically-


'''Description '''
protected passwords. • NIST SP 800-171 Rev 2 3.5.10<br />
'''IA.L2-3.5.11''' ''Obscure Feedback'' Obscure feedback of authentication information. • NIST SP 800-171 Rev 2 3.5.11


'''IA.L1-b.1.v '''


''Identification [FCI Data]''


Identify information system users, processes acting on behalf of users, or


devices.


'''IA.L1-b.1.vi '''


''Authentication [FCI Data]''


Authenticate (or verify) the identities of those users, processes, or devices,


as a prerequisite to allowing access to organizational information systems.  
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 28 '''INCIDENT RESPONSE (IR)''' '''Level 1 '''


'''Level 2 '''
'''Level 2 '''


'''Description '''
'''Level 3 '''


'''IA.L2-3.5.1 '''
'''IR.L2-3.6.1''' ''Incident Handling'' Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. • NIST SP 800-171 Rev 2 3.6.1


''Identification [CUI Data]''
'''IR.L3-3.6.1e''' ''Security Operations Center'' Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff. • NIST SP 800-172 3.6.1e


''' '''
'''IR.L2-3.6.2''' ''Incident Reporting'' Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. • NIST SP 800-171 Rev 2 3.6.2


Identify system users, processes acting on behalf of users, and devices.  
'''IR.L3-3.6.2e''' ''Cyber Incident Response Team'' Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours. • NIST SP 800-172 3.6.2e


'''IA.L2-3.5.2 '''
'''IR.L2-3.6.3''' ''Incident Response Testing'' Test the organizational incident response capability. • NIST SP 800-171 Rev 2 3.6.3


''Authentication [CUI Data]''


''' '''


Authenticate (or verify) the identities of users, processes, or devices, as a


prerequisite to allowing access to organizational systems.


''' '''


'''IA.L2-3.5.3 '''


''Multifactor Authentication''


''' '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 29 '''MAINTENANCE (MA)''' '''Level 1 '''


Use multifactor authentication for local and network access to privileged
'''Level 2 '''


accounts and for network access to non-privileged accounts.
'''Level 3 '''


'''IA.L2-3.5.4 '''
'''MA.L2-3.7.1''' ''Perform Maintenance'' Perform maintenance on organizational systems. • NIST SP 800-171 Rev 2 3.7.1<br />
'''MA.L2-3.7.2''' ''System Maintenance Control'' Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. • NIST SP 800-171 Rev 2 3.7.2<br />
'''MA.L2-3.7.3''' ''Equipment Sanitization'' Sanitize equipment removed for off-site maintenance of any CUI. • NIST SP 800-171 Rev 2 3.7.3<br />
'''MA.L2-3.7.4''' ''Media Inspection'' Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. • NIST SP 800-171 Rev 2 3.7.4<br />
'''MA.L2-3.7.5''' ''Nonlocal Maintenance'' Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. • NIST SP 800-171 Rev 2 3.7.5<br />
'''MA.L2-3.7.6''' ''Maintenance Personnel'' Supervise the maintenance activities of maintenance personnel without required access authorization. • NIST SP 800-171 Rev 2 3.7.6


''Replay-Resistant Authentication''


''' '''


Employ replay-resistant authentication mechanisms for network access to


privileged and non-privileged accounts.


'''IA.L2-3.5.5 '''


''Identifier Reuse''


''' '''


Prevent reuse of identifiers for a defined period.  
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 30 '''MEDIA PROECTION (MP)''' '''Level 1 '''


'''IA.L2-3.5.6 '''
'''Level 2 '''


''Identifier Handling''
'''Level 3 '''


''' '''
'''MP.L1-b.1.vii''' ''Media Disposal [FCI Data]'' Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. • FAR Clause 52.204-21 b.1.vii


Disable identifiers after a defined period of inactivity.  
• NIST SP 800-171 Rev 2 3.8.3


'''IA.L2-3.5.7 '''
'''MP.L2-3.8.1''' ''Media Protection'' Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. • NIST SP 800-171 Rev 2 3.8.1


''Password Complexity''
'''MP.L2-3.8.2''' ''Media Access'' Limit access to CUI on system media to authorized users. • NIST SP 800-171 Rev 2 3.8.2<br />
'''MP.L2-3.8.3''' ''Media Disposal [CUI Data]'' Sanitize or destroy system media containing CUI before disposal or release for reuse. • NIST SP 800-171 Rev 2 3.8.3


''' '''
• FAR Clause 52.204-21 b.1.vii<br />
'''MP.L2-3.8.4''' ''Media Markings'' Mark media with necessary CUI markings and distribution limitations. • NIST SP 800-171 Rev 2 3.8.4<br />
'''MP.L2-3.8.5''' ''Media Accountability'' Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. • NIST SP 800-171 Rev 2 3.8.5


Enforce a minimum password complexity and change of characters when  
'''MP.L2-3.8.6''' ''Portable Storage Encryption'' Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. • NIST SP 800-171 Rev 2 3.8.6<br />
'''MP.L2-3.8.7''' ''Removable Media'' Control the use of removable media on system components. • NIST SP 800-171 Rev 2 3.8.7<br />
'''MP.L2-3.8.8''' ''Shared Media'' Prohibit the use of portable storage devices when such devices have no identifiable owner. • NIST SP 800-171 Rev 2 3.8.8<br />
'''MP.L2-3.8.9''' ''Protect Backups'' Protect the confidentiality of backup CUI at storage locations. • NIST SP 800-171 Rev 2 3.8.9


new passwords are created.


'''IA.L2-3.5.8 '''


''Password Reuse''


''' '''


Prohibit password reuse for a specified number of generations.


'''IA.L2-3.5.9 '''


''Temporary Passwords''


''' '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 31 '''PERSONNEL SECURITY (PS)''' '''Level 1 '''


Allow temporary password use for system logons with an immediate change
'''Level 2 '''


to a permanent password.
'''Level 3 '''


'''PS.L2-3.9.1''' ''Screen Individuals'' Screen individuals prior to authorizing access to organizational systems containing CUI. • NIST SP 800-171 Rev 2 3.9.1


'''PS.L3-3.9.2e''' ''Adverse Information'' Protect organizational systems when adverse information develops or is obtained about individuals with access to CUI. • NIST SP 800-172 3.9.2e


'''PS.L2-3.9.2''' ''Personnel Actions'' Protect organizational systems containing CUI during and after personnel actions such as terminations and transfers. • NIST SP 800-171 Rev 2 3.9.2




Line 2,047: Line 1,417:




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13


11


'''IA.L2-3.5.10 '''


''Cryptographically-Protected ''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 32 '''PHYSICAL PROTECTION (PE)''' '''Level 1 '''


''Passwords''
'''Level 2 '''


''' '''
'''Level 3 '''


Store and transmit only cryptographically protected passwords.  
'''PE.L1-b.1.viii''' ''Limit Physical Access [FCI Data]'' Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. • FAR Clause 52.204-21 b.1.viii • NIST SP 800-171 Rev 2 3.10.1


'''IA.L2-3.5.11 '''
'''PE.L2-3.10.1''' ''Limit Physical Access [CUI Data]'' Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. • NIST SP 800-171 Rev 2 3.10.1


''Obscure Feedback''
• FAR Clause 52.204-21 b.1.viii '''PE.L1-b.1.ix''' ''Manage Visitors &amp; Physical Access [FCI Data]'' Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. • FAR Clause 52.204-21 Partial b.1.ix


''' '''
• NIST SP 800-171 Rev 2 3.10.3


Obscure feedback of authentication information.  
• NIST SP 800-171 Rev 2 3.10.4


'''Level 3 '''
• NIST SP 800-171 Rev 2 3.10.5


'''Description '''
'''PE.L2-3.10.2''' ''Monitor Facility'' Protect and monitor the physical facility and support infrastructure for organizational systems. • NIST SP 800-171 Rev 2 3.10.2


'''IA.L3-3.5.1e '''
'''PE.L2-3.10.3''' ''Escort Visitors [CUI Data]'' Escort visitors and monitor visitor activity. • NIST SP 800-171 Rev 2 3.10.3


''Bidirectional Authentication''
• FAR Clause 52.204-21 Partial b.1.ix<br />
'''PE.L2-3.10.4''' ''Physical Access Logs [CUI Data]'' Maintain audit logs of physical access. • NIST SP 800-171 Rev 2 3.10.4


''' '''
• FAR Clause 52.204-21 Partial b.1.ix<br />
'''PE.L2-3.10.5''' ''Manage Physical Access [CUI Data]'' Control and manage physical access devices. • NIST SP 800-171 Rev 2 3.10.5


Identify and authenticate systems and system components, where possible,
• FAR Clause 52.204-21 Partial b.1.ix<br />
'''PE.L2-3.10.6''' ''Alternative Work Sites'' Enforce safeguarding measures for CUI at alternate work sites. • NIST SP 800-171 Rev 2 3.10.6


before establishing a network connection using bidirectional authentication


that is cryptographically based and replay resistant.


'''IA.L3-3.5.3e '''


''Block Untrusted Assets''


''' '''


Employ automated or manual/procedural mechanisms to prohibit system


components from connecting to organizational systems unless the


components are known, authenticated, in a properly configured state, or in
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 33 '''RISK ASSESSMENT (RA)''' '''Level 1 '''


a trust profile.
'''Level 2 '''


'''INCIDENT RESPONSE (IR)'''  
'''Level 3 '''


'''Level 2 '''
'''RA.L2-3.11.1''' ''Risk Assessments'' Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. • NIST SP 800-171 Rev 2 3.11.1


'''Description '''
'''RA.L3-3.11.1e''' ''Threat-Informed Risk Assessment'' Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities. • NIST SP 800-172 3.11.1e


'''IR.L2-3.6.1 '''
'''RA.L2-3.11.2''' ''Vulnerability Scan'' Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. • NIST SP 800-171 Rev 2 3.11.2


''Incident Handling''  
'''RA.L3-3.11.2e''' ''Threat Hunting'' Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. • NIST SP 800-172 3.11.2e


Establish an operational incident-handling capability for organizational
'''RA.L2-3.11.3''' ''Vulnerability Remediation'' Remediate vulnerabilities in accordance with risk assessments. • NIST SP 800-171 Rev 2 3.11.3


systems that includes preparation, detection, analysis, containment,  
'''RA.L3-3.11.3e''' ''Advanced Risk Identification'' Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components. • NIST SP 800-172 3.11.3e<br />
'''RA.L3-3.11.4e''' ''Security Solution Rationale'' Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination. • NIST SP 800-172 3.11.4e<br />
'''RA.L3-3.11.5e''' ''Security Solution Effectiveness'' Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence. • NIST SP 800-172 3.11.5e<br />
'''RA.L3-3.11.6e''' ''Supply Chain Risk Response'' Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. • NIST SP 800-172 3.11.6e


recovery, and user response activities.


'''IR.L2-3.6.2 '''


''Incident Reporting''


''' '''


Track,  document, and report incidents to designated officials and/or


authorities both internal and external to the organization.


'''IR.L2-3.6.3 '''


''Incident Response Testing''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 34 '''Level 1 '''


''' '''
'''Level 2 '''
 
Test the organizational incident response capability.


'''Level 3 '''
'''Level 3 '''


'''Description '''
'''RA.L3-3.11.7e''' ''Supply Chain Risk Plan'' Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident. • NIST SP 800-172 3.11.7e


'''IR.L3-3.6.1e '''


''Security Operations Center''


''' '''


Establish and maintain a security operations center capability that operates


24/7, with allowance for remote/on-call staff.


'''IR.L3-3.6.2e '''


''Cyber Incident Response Team''


''' '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 35 '''SECURITY ASSESSMENT (CA)''' '''Level 1 '''


Establish and maintain a cyber incident response team that can be deployed
'''Level 2 '''


by the organization within 24 hours.
'''Level 3 '''


'''MAINTENANCE (MA)'''  
'''CA.L2-3.12.1''' ''Security Control Assessment'' Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. • NIST SP 800-171 Rev 2 3.12.1


'''Level 2 '''
'''CA.L3-3.12.1e''' ''Penetration Testing'' Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts. • NIST SP 800-172 3.12.1e


'''Description '''
'''CA.L2-3.12.2''' ''Operational Plan of Action'' Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. • NIST SP 800-171 Rev 2 3.12.2<br />
'''CA.L2-3.12.3''' ''Security Control Monitoring'' Monitor security controls on an ongoing basis to determine the continued effectiveness of the controls. • NIST SP 800-171 Rev 2 3.12.3<br />
'''CA.L2-3.12.4''' ''System Security Plan'' Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. • NIST SP 800-171 Rev 2 3.12.4


'''MA.L2-3.7.1 '''


''Perform Maintenance''


Perform maintenance on organizational systems.


'''MA.L2-3.7.2 '''


''System Maintenance Control''


Provide controls on the tools, techniques, mechanisms, and personnel used


to conduct system maintenance.


'''MA.L2-3.7.3 '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 36 '''SYSTEM AND COMMUNICATIONS PROTECTION (SC)''' '''Level 1 '''


''Equipment Sanitization''
'''Level 2 '''


''' '''
'''Level 3 '''


Sanitize equipment removed for off-site maintenance of any CUI.  
'''SC.L1-b.1.x''' ''Boundary Protection [FCI Data]'' Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. • FAR Clause 52.204-21 b.1.x


• NIST SP 800-171 Rev 2 3.13.1


'''SC.L2-3.13.1''' ''Boundary Protection [CUI Data]'' Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. • NIST SP 800-171 Rev 2 3.13.1


• FAR Clause 52.204-21 b.1.x


'''SC.L3-3.13.4e''' ''Isolation'' Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components. • NIST SP 800-172 3.13.4e


'''SC.L1-b.1.xi''' ''Public-Access System Separation [FCI Data]'' Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. • FAR Clause 52.204-21 b.1.xi


• NIST SP 800-171 Rev 2 3.13.5


'''SC.L2-3.13.2''' ''Security Engineering'' Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. • NIST SP 800-171 Rev 2 3.13.2<br />
'''SC.L2-3.13.3''' ''Role Separation'' Separate user functionality from system management functionality. • NIST SP 800-171 Rev 2 3.13.3<br />
'''SC.L2-3.13.4''' ''Shared Resource Control'' Prevent unauthorized and unintended information transfer via shared system resources. • NIST SP 800-171 Rev 2 3.13.4<br />
'''SC.L2-3.13.5''' ''Public-Access System Separation [CUI Data]'' Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. • NIST SP 800-171 Rev 2 3.13.5


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13  
• FAR Clause 52.204-21 b.1.xi<br />
'''SC.L2-3.13.6''' ''Network Communication by Exception'' Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). • NIST SP 800-171 Rev 2 3.13.6<br />
'''SC.L2-3.13.7''' ''Split Tunneling'' Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). • NIST SP 800-171 Rev 2 3.13.7


12


'''MA.L2-3.7.4 '''


''Media Inspection''


''' '''


Check media containing diagnostic and test programs for malicious code


before the media are used in organizational systems.


'''MA.L2-3.7.5 '''


''Nonlocal Maintenance''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 37 '''Level 1 '''


''' '''
'''Level 2 '''


Require multifactor authentication to establish nonlocal maintenance
'''Level 3 '''


sessions via external network connections and terminate such connections
'''SC.L2-3.13.8''' ''Data in Transit'' Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. • NIST SP 800-171 Rev 2 3.13.8<br />
'''SC.L2-3.13.9''' ''Connections Termination'' Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. • NIST SP 800-171 Rev 2 3.13.9<br />
'''SC.L2-3.13.10''' ''Key Management'' Establish and manage cryptographic keys for cryptography employed in organizational systems. • NIST SP 800-171 Rev 2 3.13.10<br />
'''SC.L2-3.13.11''' ''CUI Encryption'' Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. • NIST SP 800-171 Rev 2 3.13.11<br />
'''SC.L2-3.13.12''' ''Collaborative Device Control'' Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. • NIST SP 800-171 Rev 2 3.13.12<br />
'''SC.L2-3.13.13''' ''Mobile Code'' Control and monitor the use of mobile code. • NIST SP 800-171 Rev 2 3.13.13<br />
'''SC.L2-3.13.14''' ''Voice over Internet Protocol'' Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. • NIST SP 800-171 Rev 2 3.13.14<br />
'''SC.L2-3.13.15''' ''Communications Authenticity'' Protect the authenticity of communications sessions. • NIST SP 800-171 Rev 2 3.13.15<br />
'''SC.L2-3.13.16''' ''Data at Rest'' Protect the confidentiality of CUI at rest. • NIST SP 800-171 Rev 2 3.13.16


when nonlocal maintenance is complete.


'''MA.L2-3.7.6 '''


''Maintenance Personnel''


''' '''


Supervise the maintenance activities of maintenance personnel without


required access authorization.


'''MEDIA PROTECTION (MP)'''


'''Level 1 '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 38 '''SYSTEM AND INFORMATION INTEGRITY (SI)''' '''Level 1 '''


'''Description '''
'''Level 2 '''


'''MP.L1-b.1.vii '''
'''Level 3 '''


''Media Disposal [FCI Data]''  
'''SI.L1-b.1.xii''' ''Flaw Remediation [FCI Data]'' Identify, report, and correct information and information system flaws in a timely manner. • FAR Clause 52.204-21 b.1.xii • NIST SP 800-171 Rev 2 3.14.1


Sanitize or destroy information system media containing Federal Contract
'''SI.L2-3.14.1''' ''Flaw Remediation [CUI Data]'' Identify, report, and correct system flaws in a timely manner. • NIST SP 800-171 Rev 2 3.14.1


Information before disposal or release for reuse.  
• FAR Clause 52.204-21 b.1.xii '''SI.L3-3.14.1e''' ''Integrity Verification'' Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures. • NIST SP 800-172 3.14.1e


'''Level 2 '''
'''SI.L1-b.1.xiii''' ''Malicious Code Protection [FCI Data]'' Provide protection from malicious code at appropriate locations within organizational information systems. • FAR Clause 52.204-21 b.1.xiii • NIST SP 800-171 Rev 2 3.14.2


'''Description '''
'''SI.L2-3.14.2''' ''Malicious Code Protection [CUI Data]'' Provide protection from malicious code at designated locations within organizational systems. • NIST SP 800-171 Rev 2 3.14.2


'''MP.L2-3.8.1 '''
• FAR Clause 52.204-21 b.1.xiii '''SI.L3-3.14.3e''' ''Specialized Asset Security'' Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks. • NIST SP 800-172 3.14.3e


''Media Protection''  
'''SI.L1-b.1.xiv''' ''Update Malicious Code Protection [FCI Data]'' Update malicious code protection mechanisms when new releases are available. • FAR Clause 52.204-21 b.1.xiv • NIST SP 800-171 Rev 2 3.14.4


Protect (i.e., physically control and securely store) system media containing
'''SI.L2-3.14.3''' ''Security Alerts &amp; Advisories'' Monitor system security alerts and advisories and take action in response. • NIST SP 800-171 Rev 2 3.14.3


CUI, both paper and digital.  
'''SI.L3-3.14.6e''' ''Threat-Guided Intrusion Detection'' Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting. • NIST SP 800-172 3.14.6e


'''MP.L2-3.8.2 '''
'''SI.L1-b.1.xv''' ''System &amp; File Scanning [FCI Data]'' Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. • FAR Clause 52.204-21 b.1.xv • NIST SP 800-171 Rev 2 3.14.5


''Media Access''  
'''SI.L2-3.14.4''' ''Update Malicious Code Protection [CUI Data]'' Update malicious code protection mechanisms when new releases are available. • NIST SP 800-171 Rev 2 3.14.4


Limit access to CUI on system media to authorized users.  
• FAR Clause 52.204-21 b.1.xiv '''SI.L2-3.14.5''' ''System &amp; File Scanning [CUI Data]'' Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. • NIST SP 800-171 Rev 2 3.14.5


'''MP.L2-3.8.3 '''
• FAR Clause 52.204-21 b.1.xv <br />
'''SI.L2-3.14.6''' ''Monitor Communications for Attacks'' Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. • NIST SP 800-171 Rev 2 3.14.6<br />
'''SI.L2-3.14.7''' ''Identify Unauthorized Use'' Identify unauthorized use of organizational systems. • NIST SP 800-171 Rev 2 3.14.7


''Media Disposal [CUI Data]''


''' '''


Sanitize or destroy system media containing CUI before disposal or release


for reuse.


'''MP.L2-3.8.4 '''


''Media Markings''


''' '''


Mark media with necessary CUI markings and distribution limitations.
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 39 Appendix B. Abbreviations and Acronyms The following is a list of acronyms used in the CMMC model. <br />
AC Access Control APT Advanced Persistent Threat AT Awareness and Training AU Audit and Accountability CA Security Assessment CFR Code of Federal Regulations CM Configuration Management CMMC Cybersecurity Maturity Model Certification CUI Controlled Unclassified Information DFARS Defense Federal Acquisition Regulation Supplement DIB Defense Industrial Base DoD Department of Defense FAR Federal Acquisition Regulation FCI Federal Contract Information FFRDC Federally Funded Research and Development Center FIPS Federal Information Processing Standard IA Identification and Authentication IR Incident Response L# Level Number MA Maintenance MP Media Protection N/A Not Applicable (NA) NIST National Institute of Standards and Technology OUSD A&amp;S Office of the Under Secretary of Defense for Acquisition and Sustainment PE Physical Protection PS Personnel Security PUB Publication Rev Revision RA Risk Assessment SC System and Communications Protection SI System and Information Integrity SP Special Publication UARC University Affiliated Research Center


'''MP.L2-3.8.5 '''


''Media Accountability''


''' '''


Control access to media containing CUI and maintain accountability for


media during transport outside of controlled areas.


'''MP.L2-3.8.6 '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 40 U.S. United States VoIP Voice over Internet Protocol Vol. Volume


''Portable Storage Encryption''


''' '''


Implement cryptographic mechanisms to protect the confidentiality of CUI


stored on digital media during transport unless otherwise protected by


alternative physical safeguards.


'''MP.L2-3.8.7 '''
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 41 Appendix C. References 1. U.S. Executive Office of the President, Council of Economic Advisers (CEA), ''The Cost of''


''Removable Media''  
''Malicious Cyber Activity to the U.S. Economy'', available online at


Control the use of removable media on system components.
https://www.whitehouse.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-


'''MP.L2-3.8.8 '''
Cyber-Activity-to-the-U.S.-Economy.pdf, February 2018


''Shared Media''
2. Center for Strategic and International Studies (CSIS) and McAfee, ''Economic Impact of''


''' '''
''Cybercrime - No Slowing Down'', February 2018


Prohibit the use of portable storage devices when such devices have no
3. 48 Code of Federal Regulations (CFR) 52.204-21, ''Basic Safeguarding of Covered''


identifiable owner.
''Contractor Information Systems'', Federal Acquisition Regulation (FAR), 1 Oct 2016


'''MP.L2-3.8.9 '''
4. NIST Special Publication (SP) 800-171 Revision (Rev) 2, ''Protecting Controlled''


''Protect Backups''
''Unclassified Information in Nonfederal Systems and Organizations'', U.S. Department of


''' '''
Commerce National Institute of Standards and Technology (NIST), December 2016


Protect the confidentiality of backup CUI at storage locations.
(updated June 2018)


'''PERSONNEL SECURITY (PS)'''  
5. NIST SP 800-172, ''Enhanced Security Requirements for Protecting Controlled Unclassified''


'''Level 2 '''
''Information: A Supplement to NIST Special Publication 800-171'', U.S. Department of


'''Description '''
Commerce National Institute of Standards and Technology (NIST), February 2021


'''PS.L2-3.9.1 '''


''Screen Individuals''


Screen individuals prior to authorizing access to organizational systems


containing CUI.








Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 42 ''This page intentionally left blank. ''








Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13


13


'''PS.L2-3.9.2 '''


''Personnel Actions''


Protect organizational systems containing CUI during and after personnel
 


actions such as terminations and transfers.


'''Level 3 '''


'''Description '''
= Document Outline =


'''PS.L3-3.9.2e '''
* [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#4|1. Introduction]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#5|1.1 Document Organization]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#5|1.2 Supporting Documents]]
* [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2. CMMC Model]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2.1 Overview]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2.2 CMMC Levels]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2.2.1 Descriptions]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#7|2.2.2 CMMC Overview]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#7|2.2.3 Level 1]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#7|2.2.4 Level 2]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#8|2.2.5. Level 3]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#8|2.3 CMMC Domains]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#9|2.4 CMMC Security Requirements]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#9|2.4.1. List of Security Requirements]]
**** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#21|Appendix A. CMMC Model Matrix]]
**** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#42|Appendix B. Abbreviations and Acronyms]]
**** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#44|Appendix C. References]]


''Adverse Information''


''' '''
-----


Protect  organizational systems when  adverse information develops or is
Original source: https://dodcio.defense.gov/Portals/0/Documents/CMMC/ModelOverviewv2.pdf


obtained about individuals with access to CUI.


'''PHYSICAL PROTECTION (PE)'''


'''Level 1 '''


'''Description '''


'''PE.L1-b.1.viii '''


''Limit Physical Access [FCI Data]''


Limit physical access to organizational information systems, equipment, and


the respective operating environments to authorized individuals.


'''PE.L1-b.1.ix '''
== Access Control (AC) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_AC.L1-3.1.1_Details|AC.L1-3.1.1]]'''
''Authorized Access Control''


''Manage Visitors &amp; Physical Access ''
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
* FAR Clause 52.204-21 b.1.i
* NIST SP 800-171 Rev 2 3.1.1
|'''[[Practice_AC.L2-3.1.3_Details|AC.L2-3.1.3]]'''
''Control CUI Flow''


''[FCI Data]''  
Control the flow of CUI in accordance with approved authorizations.
* NIST SP 800-171 Rev 2 3.1.3
|
|-
|'''[[Practice_AC.L1-3.1.2_Details|AC.L1-3.1.2]]'''
''Transaction & Function Control''


Escort visitors and monitor visitor activity; maintain audit logs of physical
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
* FAR Clause 52.204-21 b.1.ii
* NIST SP 800-171 Rev 2 3.1.2
|'''[[Practice_AC.L2-3.1.4_Details|AC.L2-3.1.4]]'''
''Separation of Duties''


access; and control and manage physical access devices.  
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
* NIST SP 800-171 Rev 2 3.1.4
|
|-
|'''[[Practice_AC.L1-3.1.20_Details|AC.L1-3.1.20]]'''
''External Connections''


'''Level 2 '''
Verify and control/limit connections to and use of external information systems.
* FAR Clause 52.204-21 b.1.iii
* NIST SP 800-171 Rev 2 3.1.20
|'''[[Practice_AC.L2-3.1.5_Details|AC.L2-3.1.5]]'''
''Least Privilege''


'''Description '''
Employ the principle of least privilege, including for specific security functions and privileged accounts.
* NIST SP 800-171 Rev 2 3.1.5
|
|-
|'''[[Practice_AC.L1-3.1.22_Details|AC.L1-3.1.22]]'''
''Control Public Information''


'''PE.L2-3.10.1 '''
Control information posted or processed on publicly accessible information systems.
* FAR Clause 52.204-21 b.1.iv
* NIST SP 800-171 Rev 2 3.1.22
|'''[[Practice_AC.L2-3.1.6_Details|AC.L2-3.1.6]]'''
''Non-Privileged Account Use''


''Limit Physical Access [CUI Data]''
Use non-privileged accounts or roles when accessing nonsecurity functions.
* NIST SP 800-171 Rev 2 3.1.6
|
|-
|
|'''[[Practice_AC.L2-3.1.7_Details|AC.L2-3.1.7]]'''
''Privileged Functions''


''' '''
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
* NIST SP 800-171 Rev 2 3.1.7
|
|-
|
|'''[[Practice_AC.L2-3.1.8_Details|AC.L2-3.1.8]]'''
''Unsuccessful Logon Attempts''


Limit physical access to organizational systems, equipment, and the
Limit unsuccessful logon attempts.
* NIST SP 800-171 Rev 2 3.1.8
|
|-
|
|'''[[Practice_AC.L2-3.1.9_Details|AC.L2-3.1.9]]'''
''Privacy & Security Notices''


respective operating environments to authorized individuals.
Provide privacy and security notices consistent with applicable CUI rules.
* NIST SP 800-171 Rev 2 3.1.9
|
|-
|
|'''[[Practice_AC.L2-3.1.10_Details|AC.L2-3.1.10]]'''
''Session Lock''


''' '''
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
* NIST SP 800-171 Rev 2 3.1.10
|
|-
|
|'''[[Practice_AC.L2-3.1.11_Details|AC.L2-3.1.11]]'''
''Session Termination''


'''PE.L2-3.10.2 '''
Terminate (automatically) a user session after a defined condition.
* NIST SP 800-171 Rev 2 3.1.11
|
|-
|
|'''[[Practice_AC.L2-3.1.12_Details|AC.L2-3.1.12]]'''
''Control Remote Access''


''Monitor Facility''  
Monitor and control remote access sessions.
* NIST SP 800-171 Rev 2 3.1.12
|
|-
|
|'''[[Practice_AC.L2-3.1.13_Details|AC.L2-3.1.13]]'''
''Remote Access Confidentiality''


Protect and monitor the physical facility and support infrastructure for
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
* NIST SP 800-171 Rev 2 3.1.13
|
|-
|
|'''[[Practice_AC.L2-3.1.14_Details|AC.L2-3.1.14]]'''
''Remote Access Routing''


organizational systems.  
Route remote access via managed access
 
control points.
'''PE.L2-3.10.3 '''
* NIST SP 800-171 Rev 2 3.1.14
 
|
''Escort Visitors [CUI Data]''
|-
|
|'''[[Practice_AC.L2-3.1.15_Details|AC.L2-3.1.15]]'''
''Privileged Remote Access''


''' '''
Authorize remote execution of privileged commands and remote access to security-relevant information.
* NIST SP 800-171 Rev 2 3.1.15
|
|-
|
|'''[[Practice_AC.L2-3.1.16_Details|AC.L2-3.1.16]]'''
''Wireless Access Authorization''


Escort visitors and monitor visitor activity.  
Authorize wireless access prior to allowing
such connections.
* NIST SP 800-171 Rev 2 3.1.16
|
|-
|
|'''[[Practice_AC.L2-3.1.17_Details|AC.L2-3.1.17]]'''
''Wireless Access Protection''


'''PE.L2-3.10.4 '''
Protect wireless access using authentication and encryption.
* NIST SP 800-171 Rev 2 3.1.17
|
|-
|
|'''[[Practice_AC.L2-3.1.18_Details|AC.L2-3.1.18]]'''
''Mobile Device Connection''


''Physical Access Logs [CUI Data]''
Control connection of mobile devices.
* NIST SP 800-171 Rev 2 3.1.18
|
|-
|
|'''[[Practice_AC.L2-3.1.19_Details|AC.L2-3.1.19]]'''
''Encrypt CUI on Mobile''


''' '''
Encrypt CUI on mobile devices and mobile computing platforms.
* NIST SP 800-171 Rev 2 3.1.19
|
|-
|
|'''[[Practice_AC.L2-3.1.21_Details|AC.L2-3.1.21]]'''
''Portable Storage Use''
Limit use of portable storage devices on external systems.
* NIST SP 800-171 Rev 2 3.1.21
|
|}


Maintain audit logs of physical access.  
== Awareness and Training (AT) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_AT.L2-3.2.1_Details|AT.L2-3.2.1]]'''
''Role-Based Risk Awareness''


'''PE.L2-3.10.5 '''
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and
procedures related to the security of those systems.
* NIST SP 800-171 Rev 2 3.2.1
|
|-
|
|'''[[Practice_AT.L2-3.2.2_Details|AT.L2-3.2.2]]'''
''Role-Based Training''


''Manage Physical Access [CUI Data]''
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
 
* NIST SP 800-171 Rev 2 3.2.2
''' '''
|
|-
|
|'''[[Practice_AT.L2-3.2.3_Details|AT.L2-3.2.3]]'''
''Insider Threat Awareness''


Control and manage physical access devices.  
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
* NIST SP 800-171 Rev 2 3.2.3
|
|}


'''PE.L2-3.10.6 '''
== Audit and Accountability (AU) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_AU.L2-3.3.1_Details|AU.L2-3.3.1]]'''
''System Auditing''


''Alternative Work Sites''
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
* NIST SP 800-171 Rev 2 3.3.1
|
|-
|
|'''[[Practice_AU.L2-3.3.2_Details|AU.L2-3.3.2]]'''
''User Accountability''


''' '''
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
• NIST SP 800-171 Rev 2 3.3.2
|
|-
|
|'''[[Practice_AU.L2-3.3.3_Details|AU.L2-3.3.3]]'''
''Event Review''


Enforce safeguarding measures for CUI at alternate work sites.  
Review and update logged events.
 
* NIST SP 800-171 Rev 2 3.3.3
'''RISK ASSESSMENT (RA)'''  
|
 
|-
'''Level 2 '''
|
|'''[[Practice_AU.L2-3.3.4_Details|AU.L2-3.3.4]]'''
''Audit Failure Alerting''


'''Description '''
Alert in the event of an audit logging process failure.
* NIST SP 800-171 Rev 2 3.3.4
|
|-
|
|'''[[Practice_AU.L2-3.3.5_Details|AU.L2-3.3.5]]'''
''Audit Correlation''


'''RA.L2-3.11.1 '''
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
* NIST SP 800-171 Rev 2 3.3.5
|
|-
|
|'''[[Practice_AU.L2-3.3.6_Details|AU.L2-3.3.6]]'''
''Reduction & Reporting''


''Risk Assessments''  
Provide audit record reduction and report generation to support on-demand analysis and reporting.
* NIST SP 800-171 Rev 2 3.3.6
|
|-
|
|'''[[Practice_AU.L2-3.3.7_Details|AU.L2-3.3.7]]'''
''Authoritative Time Source''


Periodically assess the risk to organizational operations (including mission,
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
* NIST SP 800-171 Rev 2 3.3.7
|
|-
|
|'''[[Practice_AU.L2-3.3.8_Details|AU.L2-3.3.8]]'''
''Audit Protection''


functions, image, or reputation), organizational assets, and individuals,
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
* NIST SP 800-171 Rev 2 3.3.8
|
|-
|
|'''[[Practice_AU.L2-3.3.9_Details|AU.L2-3.3.9]]'''
''Audit Management''


resulting from the operation of organizational systems and the associated
Limit management of audit logging functionality to a subset of privileged users.
* NIST SP 800-171 Rev 2 3.3.9
|
|}


processing, storage, or transmission of CUI.  
== Configuration Management (CM) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_CM.L2-3.4.1_Details|CM.L2-3.4.1]]'''
''System Baselining''


'''RA.L2-3.11.2 '''
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
* NIST SP 800-171 Rev 2 3.4.1
|
|-
|
|'''[[Practice_CM.L2-3.4.2_Details|CM.L2-3.4.2]]'''
''Security Configuration Enforcement''


''Vulnerability Scan''  
Establish and enforce security configuration settings for information technology products employed in organizational systems.
* NIST SP 800-171 Rev 2 3.4.2
|
|-
|
|'''[[Practice_CM.L2-3.4.3_Details|CM.L2-3.4.3]]'''
''System Change Management''


Scan for vulnerabilities in organizational systems and applications
Track, review, approve or disapprove, and log changes to organizational systems.
 
* NIST SP 800-171 Rev 2 3.4.3
periodically and when new vulnerabilities affecting those systems and
|
 
|-
applications are identified.  
|
|'''[[Practice_CM.L2-3.4.4_Details|CM.L2-3.4.4]]'''
''Security Impact Analysis''


Analyze the security impact of changes prior to implementation.
* NIST SP 800-171 Rev 2 3.4.4
|
|-
|
|'''[[Practice_CM.L2-3.4.5_Details|CM.L2-3.4.5]]'''
''Access Restrictions for Change''


Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
* NIST SP 800-171 Rev 2 3.4.5
|
|-
|
|'''[[Practice_CM.L2-3.4.6_Details|CM.L2-3.4.6]]'''
''Least Functionality''


Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
* NIST SP 800-171 Rev 2 3.4.6
|
|-
|
|'''[[Practice_CM.L2-3.4.7_Details|CM.L2-3.4.7]]'''
''Nonessential Functionality''


Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
* NIST SP 800-171 Rev 2 3.4.7
|
|-
|
|'''[[Practice_CM.L2-3.4.8_Details|CM.L2-3.4.8]]'''
''Application Execution Policy''


Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
* NIST SP 800-171 Rev 2 3.4.8
|
|-
|
|'''[[Practice_CM.L2-3.4.9_Details|CM.L2-3.4.9]]'''
''User-Installed Software''


Control and monitor user-installed software.
* NIST SP 800-171 Rev 2 3.4.9
|
|}


== Identification and Authentication (IA) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_IA.L1-3.5.1_Details|IA.L1-3.5.1]]'''
''Identification''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
Identify information system users, processes acting on behalf of users, or devices.
* FAR Clause 52.204-21 b.1.v
* NIST SP 800-171 Rev 2 3.5.1
|'''[[Practice_IA.L2-3.5.3_Details|IA.L2-3.5.3]]'''
''Multifactor Authentication''


14
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
* NIST SP 800-171 Rev 2 3.5.3
|
|-
|'''[[Practice_IA.L1-3.5.2_Details|IA.L1-3.5.2]]'''
''Authentication''


'''RA.L2-3.11.3 '''
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
* FAR Clause 52.204-21 b.1.vi
* NIST SP 800-171 Rev 2 3.5.2
|'''[[Practice_IA.L2-3.5.4_Details|IA.L2-3.5.4]]'''
''Replay-Resistant Authentication''


''Vulnerability Remediation''  
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
 
* NIST SP 800-171 Rev 2 3.5.4
Remediate vulnerabilities in accordance with risk assessments.
|
|-
|
|'''[[Practice_IA.L2-3.5.5_Details|IA.L2-3.5.5]]'''
''Identifier Reuse''


'''Level 3 '''
Prevent reuse of identifiers for a defined period.
* NIST SP 800-171 Rev 2 3.5.5
|
|-
|
|'''[[Practice_IA.L2-3.5.6_Details|IA.L2-3.5.6]]'''
''Identifier Handling''


'''Description '''
Disable identifiers after a defined period of inactivity.
* NIST SP 800-171 Rev 2 3.5.6
|
|-
|
|'''[[Practice_IA.L2-3.5.7_Details|IA.L2-3.5.7]]'''
''Password Complexity''


'''RA.L3-3.11.1e '''
Enforce a minimum password complexity and change of characters when new passwords are created.
* NIST SP 800-171 Rev 2 3.5.7
|
|-
|
|'''[[Practice_IA.L2-3.5.8_Details|IA.L2-3.5.8]]'''
''Password Reuse''


''Threat-Informed Risk Assessment''
Prohibit password reuse for a specified number of generations.
 
* NIST SP 800-171 Rev 2 3.5.8
''' '''
|
|-
|
|'''[[Practice_IA.L2-3.5.9_Details|IA.L2-3.5.9]]'''
''Temporary Passwords''


Employ threat intelligence, at a minimum from open or commercial sources,
Allow temporary password use for system logons with an immediate change to a permanent password.
* NIST SP 800-171 Rev 2 3.5.9
|
|-
|
|'''[[Practice_IA.L2-3.5.10_Details|IA.L2-3.5.10]]'''
''Cryptographically-Protected Passwords''


and any DoD-provided sources, as part of a risk assessment to guide and
Store and transmit only cryptographically protected passwords.
* NIST SP 800-171 Rev 2 3.5.10
|
|-
|
|'''[[Practice_IA.L2-3.5.11_Details|IA.L2-3.5.11]]'''
''Obscure Feedback''


inform the development of organizational systems, security architectures,
Obscure feedback of authentication information.
* NIST SP 800-171 Rev 2 3.5.11
|
|}


selection of security solutions, monitoring, threat hunting, and response and
== Incident Response (IR) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_IR.L2-3.6.1_Details|IR.L2-3.6.1]]'''
''Incident Handling''


recovery activities.  
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
 
* NIST SP 800-171 Rev 2 3.6.1
'''RA.L3-3.11.2e '''
|
 
|-
''Threat Hunting''
|
|'''[[Practice_IR.L2-3.6.2_Details|IR.L2-3.6.2]]'''
''Incident Reporting''


''' '''
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
* NIST SP 800-171 Rev 2 3.6.2
|
|-
|
|'''[[Practice_IR.L2-3.6.3_Details|IR.L2-3.6.3]]'''
''Incident Response Testing''


Conduct cyber threat hunting activities on an on-going aperiodic basis or
Test the organizational incident response capability.
* NIST SP 800-171 Rev 2 3.6.3
|
|}


when indications warrant, to search for indicators of compromise in
== Maintenance (MA) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_MA.L2-3.7.1_Details|MA.L2-3.7.1]]'''
''Perform Maintenance''


organizational systems and detect, track, and disrupt threats that evade
Perform maintenance on organizational systems.
* NIST SP 800-171 Rev 2 3.7.1
|
|-
|
|'''[[Practice_MA.L2-3.7.2_Details|MA.L2-3.7.2]]'''
''System Maintenance Control''


existing controls.  
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
 
* NIST SP 800-171 Rev 2 3.7.2
'''RA.L3-3.11.3e '''
|
|-
|
|'''[[Practice_MA.L2-3.7.3_Details|MA.L2-3.7.3]]'''
''Equipment Sanitization''


''Advanced Risk Identification''
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
* NIST SP 800-171 Rev 2 3.7.3
|
|-
|
|'''[[Practice_MA.L2-3.7.4_Details|MA.L2-3.7.4]]'''
''Media Inspection''


''' '''
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
* NIST SP 800-171 Rev 2 3.7.4
|
|-
|
|'''[[Practice_MA.L2-3.7.5_Details|MA.L2-3.7.5]]'''
''Nonlocal Maintenance''


Employ advanced automation and analytics capabilities in support of
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
* NIST SP 800-171 Rev 2 3.7.5
|
|-
|
|'''[[Practice_MA.L2-3.7.6_Details|MA.L2-3.7.6]]'''
''Maintenance Personnel''


analysts to predict and identify risks to organizations, systems, and system
Supervise the maintenance activities of maintenance personnel without required access authorization.
* NIST SP 800-171 Rev 2 3.7.6
|
|}


components.
== Media Protection (MP) ==
 
{|class="wikitable" style="width: 85%;"
'''RA.L3-3.11.4e '''
! style="width: 33%"| Level 1
 
! style="width: 33%"| Level 2
''Security Solution Rationale''
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_MP.L1-3.8.3_Details|MP.L1-3.8.3]]'''
''Media Disposal''


''' '''
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
* FAR Clause 52.204-21 b.1.vii
* NIST SP 800-171 Rev 2 3.8.3
|'''[[Practice_MP.L2-3.8.1_Details|MP.L2-3.8.1]]'''
''Media Protection''


Document or reference in the system security plan the security solution
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
* NIST SP 800-171 Rev 2 3.8.1
|
|-
|
|'''[[Practice_MP.L2-3.8.2_Details|MP.L2-3.8.2]]'''
''Media Access''


selected, the rationale for the security solution, and the risk determination.  
Limit access to CUI on system media to authorized users.
* NIST SP 800-171 Rev 2 3.8.2
|
|-
|
|'''[[Practice_MP.L2-3.8.4_Details|MP.L2-3.8.4]]'''
''Media Markings''


'''RA.L3-3.11.5e '''
Mark media with necessary CUI markings and distribution limitations.
* NIST SP 800-171 Rev 2 3.8.4
|
|-
|
|'''[[Practice_MP.L2-3.8.5_Details|MP.L2-3.8.5]]'''
''Media Accountability''


''Security Solution Effectiveness''
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
* NIST SP 800-171 Rev 2 3.8.5
|
|-
|
|'''[[Practice_MP.L2-3.8.6_Details|MP.L2-3.8.6]]'''
''Portable Storage Encryption''


''' '''
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
* NIST SP 800-171 Rev 2 3.8.6
|
|-
|
|'''[[Practice_MP.L2-3.8.7_Details|MP.L2-3.8.7]]'''
''Removable Media''


Assess the effectiveness of security solutions at least annually or upon
Control the use of removable media on system components.
* NIST SP 800-171 Rev 2 3.8.7
|
|-
|
|'''[[Practice_MP.L2-3.8.8_Details|MP.L2-3.8.8]]'''
''Shared Media''


receipt of relevant cyber threat information, or in response to a relevant
Prohibit the use of portable storage devices when such devices have no identifiable owner.
* NIST SP 800-171 Rev 2 3.8.8
|
|-
|
|'''[[Practice_MP.L2-3.8.9_Details|MP.L2-3.8.9]]'''
''Protect Backups''


cyber incident, to address anticipated risk to organizational systems and the  
Protect the confidentiality of backup CUI at storage locations.
* NIST SP 800-171 Rev 2 3.8.9
|
|}


organization based on current and accumulated threat intelligence.
== Personnel Security (PS) ==
 
{|class="wikitable" style="width: 85%;"
'''RA.L3-3.11.6e '''
! style="width: 33%"| Level 1
 
! style="width: 33%"| Level 2
''Supply Chain Risk Response''
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_PS.L2-3.9.1_Details|PS.L2-3.9.1]]'''
''Screen Individuals''


''' '''
Screen individuals prior to authorizing access to organizational systems containing CUI.
* NIST SP 800-171 Rev 2 3.9.1
|
|-
|
|'''[[Practice_PS.L2-3.9.2_Details|PS.L2-3.9.2]]'''
''Personnel Actions''


Assess, respond to, and monitor supply chain risks associated with
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
* NIST SP 800-171 Rev 2 3.9.2
|
|}


organizational systems and system components.  
== Physical Protection (PE) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_PE.L1-3.10.1_Details|PE.L1-3.10.1]]'''
''Limit Physical Access''


'''RA.L3-3.11.7e '''
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
* FAR Clause 52.204-21 b.1.viii
* NIST SP 800-171 Rev 2 3.10.1
|'''[[Practice_PE.L2-3.10.2_Details|PE.L2-3.10.2]]'''
''Monitor Facility''


''Supply Chain Risk Plan''
Protect and monitor the physical facility and support infrastructure for organizational systems.
* NIST SP 800-171 Rev 2 3.10.2
|
|-
|'''[[Practice_PE.L1-3.10.3_Details|PE.L1-3.10.3]]'''
''Escort Visitors''


''' '''
Escort visitors and monitor visitor activity.
* FAR Clause 52.204-21 Partial b.1.ix
* NIST SP 800-171 Rev 2 3.10.3
|'''[[Practice_PE.L2-3.10.6_Details|PE.L2-3.10.6]]'''
''Alternative Work Sites''


Develop a plan for managing supply chain risks associated with
Enforce safeguarding measures for CUI at alternate work sites.
* NIST SP 800-171 Rev 2 3.10.6
|
|-
|'''[[Practice_PE.L1-3.10.4_Details|PE.L1-3.10.4]]'''
''Physical Access Logs''


organizational systems and system components; update the plan at least
Maintain audit logs of physical access.
* FAR Clause 52.204-21 Partial b.1.ix
* NIST SP 800-171 Rev 2 3.10.4
|
|
|-
|'''[[Practice_PE.L1-3.10.5_Details|PE.L1-3.10.5]]'''
''Manage Physical Access''


annually, and upon receipt of relevant cyber threat information, or in
Control and manage physical access devices.
* FAR Clause 52.204-21 Partial b.1.ix
* NIST SP 800-171 Rev 2 3.10.5
|
|
|}


response to a relevant cyber incident.
== Risk Assessment (RA) ==
 
{|class="wikitable" style="width: 85%;"
'''SECURITY ASSESSMENT (CA)'''  
! style="width: 33%"| Level 1
 
! style="width: 33%"| Level 2
'''Level 2 '''
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_RA.L2-3.11.1_Details|RA.L2-3.11.1]]'''
''Risk Assessments''


'''Description '''
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
* NIST SP 800-171 Rev 2 3.11.1
|
|-
|
|'''[[Practice_RA.L2-3.11.2_Details|RA.L2-3.11.2]]'''
''Vulnerability Scan''


'''CA.L2-3.12.1 '''
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
* NIST SP 800-171 Rev 2 3.11.2
|
|-
|
|'''[[Practice_RA.L2-3.11.3_Details|RA.L2-3.11.3]]'''
''Vulnerability Remediation''


''Security Control Assessment''
Remediate vulnerabilities in accordance with risk assessments.
* NIST SP 800-171 Rev 2 3.11.3
|
|}


Periodically assess the security controls in organizational systems to
== Security Assessment (CA) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|
|'''[[Practice_CA.L2-3.12.1_Details|CA.L2-3.12.1]]'''
''Security Control Assessment''


determine if the controls are effective in their application.  
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
 
* NIST SP 800-171 Rev 2 3.12.1
'''CA.L2-3.12.2 '''
|
 
|-
''Operational Plan of Action''
|
 
|'''[[Practice_CA.L2-3.12.2_Details|CA.L2-3.12.2]]'''
Develop and implement plans of action designed to correct deficiencies and
''Plan of Action''
 
reduce or eliminate vulnerabilities in organizational systems.
 
'''CA.L2-3.12.3 '''


Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
* NIST SP 800-171 Rev 2 3.12.2
|
|-
|
|'''[[Practice_CA.L2-3.12.3_Details|CA.L2-3.12.3]]'''
''Security Control Monitoring''
''Security Control Monitoring''


''' '''
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
 
* NIST SP 800-171 Rev 2 3.12.3
Monitor security controls on an ongoing basis to determine the continued  
|
 
|-
effectiveness of the controls.  
|
 
|'''[[Practice_CA.L2-3.12.4_Details|CA.L2-3.12.4]]'''
'''CA.L2-3.12.4 '''
 
''System Security Plan''
''System Security Plan''


''' '''
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
* NIST SP 800-171 Rev 2 3.12.4
|
|}


Develop, document, and periodically update system security plans that
== System and Communications Protection (SC) ==
 
{|class="wikitable" style="width: 85%;"
describe system boundaries, system environments of operation, how
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_SC.L1-3.13.1_Details|SC.L1-3.13.1]]'''
''Boundary Protection''


security requirements are implemented, and the relationships with or
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
* FAR Clause 52.204-21 b.1.x
* NIST SP 800-171 Rev 2 3.13.1
|'''[[Practice_SC.L2-3.13.2_Details|SC.L2-3.13.2]]'''
''Security Engineering''


connections to other systems.  
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
* NIST SP 800-171 Rev 2 3.13.2
|
|-
|'''[[Practice_SC.L1-3.13.5_Details|SC.L1-3.13.5]]'''
''Public-Access System Separation''


Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
* FAR Clause 52.204-21 b.1.xi
* NIST SP 800-171 Rev 2 3.13.5
|'''[[Practice_SC.L2-3.13.3_Details|SC.L2-3.13.3]]'''
''Role Separation''


Separate user functionality from system management functionality.
* NIST SP 800-171 Rev 2 3.13.3
|
|-
|
|'''[[Practice_SC.L2-3.13.4_Details|SC.L2-3.13.4]]'''
''Shared Resource Control''


Prevent unauthorized and unintended information transfer via shared system resources.
* NIST SP 800-171 Rev 2 3.13.4
|
|-
|
|'''[[Practice_SC.L2-3.13.6_Details|SC.L2-3.13.6]]'''
''Network Communication by Exception''


Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
* NIST SP 800-171 Rev 2 3.13.6
|
|-
|
|'''[[Practice_SC.L2-3.13.7_Details|SC.L2-3.13.7]]'''
''Split Tunneling''


Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
* NIST SP 800-171 Rev 2 3.13.7
|
|-
|
|'''[[Practice_SC.L2-3.13.8_Details|SC.L2-3.13.8]]'''
''Data in Transit''


Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
* NIST SP 800-171 Rev 2 3.13.8
|
|-
|
|'''[[Practice_SC.L2-3.13.9_Details|SC.L2-3.13.9]]'''
''Connections Termination''


Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
* NIST SP 800-171 Rev 2 3.13.9
|
|-
|
|'''[[Practice_SC.L2-3.13.10_Details|SC.L2-3.13.10]]'''
''Key Management''


Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13  
Establish and manage cryptographic keys for cryptography employed in organizational systems.
* NIST SP 800-171 Rev 2 3.13.10
|
|-
|
|'''[[Practice_SC.L2-3.13.11_Details|SC.L2-3.13.11]]'''
''CUI Encryption''


15
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
* NIST SP 800-171 Rev 2 3.13.11
|
|-
|
|'''[[Practice_SC.L2-3.13.12_Details|SC.L2-3.13.12]]'''
''Collaborative Device Control''


'''Level 3 '''
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
* NIST SP 800-171 Rev 2 3.13.12
|
|-
|
|'''[[Practice_SC.L2-3.13.13_Details|SC.L2-3.13.13]]'''
''Mobile Code''


'''Description '''
Control and monitor the use of mobile code.
* NIST SP 800-171 Rev 2 3.13.13
|
|-
|
|'''[[Practice_SC.L2-3.13.14_Details|SC.L2-3.13.14]]'''
''Voice over Internet Protocol''


'''CA.L3-3.12.1e '''
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
* NIST SP 800-171 Rev 2 3.13.14
|
|-
|
|'''[[Practice_SC.L2-3.13.15_Details|SC.L2-3.13.15]]'''
''Communications Authenticity''


''Penetration Testing''
Protect the authenticity of communications sessions.
 
* NIST SP 800-171 Rev 2 3.13.15
''' '''
|
|-
|
|'''[[Practice_SC.L2-3.13.16_Details|SC.L2-3.13.16]]'''
''Data at Rest''


Conduct penetration testing at least annually or when significant security
Protect the confidentiality of CUI at rest.
* NIST SP 800-171 Rev 2 3.13.16
|
|}


changes are made to the system, leveraging automated scanning tools and  
== System and Information Integrity (SI) ==
{|class="wikitable" style="width: 85%;"
! style="width: 33%"| Level 1
! style="width: 33%"| Level 2
! style="width: 33%"| Level 3 (TBD)
|-
|'''[[Practice_SI.L1-3.14.1_Details|SI.L1-3.14.1]]'''
''Flaw Remediation''


ad hoc tests using subject matter experts.  
Identify, report, and correct information and information system flaws in a timely manner.
* FAR Clause 52.204-21 b.1.xii
* NIST SP 800-171 Rev 2 3.14.1
|'''[[Practice_SI.L2-3.14.3_Details|SI.L2-3.14.3]]'''
''Security Alerts & Advisories''


'''SYSTEM AND COMMUNICATIONS PROTECTION (SC)'''  
Monitor system security alerts and advisories and take action in response.
* NIST SP 800-171 Rev 2 3.14.3
|
|-
|'''[[Practice_SI.L1-3.14.2_Details|SI.L1-3.14.2]]'''
''Malicious Code Protection''


'''Level 1 '''
Provide protection from malicious code at appropriate locations within organizational information systems.
* FAR Clause 52.204-21 b.1.xiii
* NIST SP 800-171 Rev 2 3.14.2
|'''[[Practice_SI.L2-3.14.6_Details|SI.L2-3.14.6]]'''
''Monitor Communications for Attacks''


'''Description '''
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
 
* NIST SP 800-171 Rev 2 3.14.6
'''SC.L1-b.1.x '''
|
|-
|'''[[Practice_SI.L1-3.14.4_Details|SI.L1-3.14.4]]'''
''Update Malicious Code Protection''


''Boundary Protection [FCI Data]''  
Update malicious code protection mechanisms when new releases are available.
* FAR Clause 52.204-21 b.1.xiv
* NIST SP 800-171 Rev 2 3.14.4
|'''[[Practice_SI.L2-3.14.7_Details|SI.L2-3.14.7]]'''
''Identify Unauthorized Use''


Monitor, control, and protect organizational communications (i.e.,
Identify unauthorized use of organizational systems.
* NIST SP 800-171 Rev 2 3.14.7
|
|-
|'''[[Practice_SI.L1-3.14.5_Details|SI.L1-3.14.5]]'''
''System & File Scanning''


information transmitted or received by organizational information systems)
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
 
* FAR Clause 52.204-21 b.1.xv
at the external boundaries and key internal boundaries of the information
* NIST SP 800-171 Rev 2 3.14.5
 
|
systems.  
|}
 
'''SC.L1-b.1.xi '''
 
''Public-Access System Separation ''
 
''[FCI Data]''
 
Implement subnetworks for publicly accessible system components that are


physically or logically separated from internal networks.
== Notes ==
 
<references />
'''Level 2 '''
 
'''Description '''
 
'''SC.L2-3.13.1 '''
 
''Boundary Protection [CUI Data]''
 
''' '''
 
Monitor, control, and protect organizational communications (i.e.,
 
information transmitted or received by organizational information systems)
 
at the external boundaries and key internal boundaries of the information
 
systems.
 
''' '''
 
'''SC.L2-3.13.2 '''
 
''Security Engineering''
 
Employ architectural designs, software development techniques, and
 
systems engineering principles that promote effective information security
 
within organizational systems.
 
'''SC.L2-3.13.3 '''
 
''Role Separation''
 
Separate user functionality from system management functionality.
 
'''SC.L2-3.13.4 '''
 
''Shared Resource Control''
 
Prevent unauthorized and unintended information transfer via shared
 
system resources.
 
'''SC.L2-3.13.5 '''
 
''Public-Access System Separation ''
 
''[CUI Data]''
 
''' '''
 
Implement subnetworks for publicly accessible system components that are
 
physically or logically separated from internal networks.
 
'''SC.L2-3.13.6 '''
 
''Network Communication by ''
 
''Exception''
 
Deny network communications traffic by default and allow network
 
communications traffic by exception (i.e., deny all, permit by exception).
 
'''SC.L2-3.13.7 '''
 
''Split Tunneling''
 
Prevent remote devices from simultaneously establishing non-remote
 
connections with organizational systems and communicating via some other
 
connection to resources in external networks (i.e., split tunneling).
 
'''SC.L2-3.13.8 '''
 
''Data in Transit''
 
Implement cryptographic mechanisms to prevent unauthorized disclosure of
 
CUI during transmission unless otherwise protected by alternative physical
 
safeguards.
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
16
 
'''SC.L2-3.13.9 '''
 
''Connections Termination''
 
Terminate network connections associated with communications sessions at
 
the end of the sessions or after a defined period of inactivity.
 
'''SC.L2-3.13.10 '''
 
''Key Management''
 
Establish and manage cryptographic keys for cryptography employed in
 
organizational systems.
 
'''SC.L2-3.13.11 '''
 
''CUI Encryption''
 
''' '''
 
Employ FIPS-validated cryptography when used to protect the confidentiality
 
of CUI.
 
'''SC.L2-3.13.12 '''
 
''Collaborative Device Control''
 
''' '''
 
Prohibit remote activation of collaborative computing devices and provide
 
indication of devices in use to users present at the device.
 
'''SC.L2-3.13.13 '''
 
''Mobile Code''
 
Control and monitor the use of mobile code.
 
'''SC.L2-3.13.14 '''
 
''Voice over Internet Protocol''
 
Control and monitor the use of Voice over Internet Protocol (VoIP)
 
technologies.
 
'''SC.L2-3.13.15 '''
 
''Communications Authenticity''
 
Protect the authenticity of communications sessions.
 
'''SC.L2-3.13.16 '''
 
''Data at Rest''
 
Protect the confidentiality of CUI at rest.
 
'''Level 3 '''
 
'''Description '''
 
'''SC.L3-3.13.4e '''
 
''Isolation''
 
''' '''
 
Employ physical isolation techniques or logical isolation techniques or both
 
in organizational systems and system components.
 
'''SYSTEM AND INFORMATION INTEGRITY (SI)'''
 
'''Level 1 '''
 
'''Description '''
 
'''SI.L1-b.1.xii '''
 
''Flaw Remediation [FCI Data]''
 
Identify, report, and correct information and information system flaws in a
 
timely manner.
 
'''SI.L1-b.1.xiii '''
 
''Malicious Code Protection [FCI Data]''
 
Provide protection from malicious code at appropriate locations within
 
organizational information systems.
 
'''SI.L1-b.1.xiv '''
 
''Update Malicious Code Protection ''
 
''[FCI Data]''
 
Update malicious code protection mechanisms when new releases are
 
available.
 
'''SI.L1-b.1.xv '''
 
''System &amp; File Scanning [FCI Data]''
 
Perform periodic scans of the information system and real-time scans of files
 
from external sources as files are downloaded, opened, or executed.
 
'''Level 2 '''
 
'''Description '''
 
'''SI.L2-3.14.1 '''
 
''Flaw Remediation [CUI Data]''
 
''' '''
 
Identify, report, and correct system flaws in a timely manner.
 
'''SI.L2-3.14.2 '''
 
''Malicious Code Protection [CUI ''
 
''Data] ''
 
Provide protection from malicious code at designated locations within
 
organizational systems.
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
17
 
'''SI.L2-3.14.3 '''
 
''Security Alerts &amp; Advisories''
 
Monitor system security alerts and advisories and take action in response.
 
'''SI.L2-3.14.4 '''
 
''Update Malicious Code Protection ''
 
''[CUI Data]''
 
''' '''
 
Update malicious code protection mechanisms when new releases are
 
available.
 
'''SI.L2-3.14.5 '''
 
''System &amp; File Scanning [CUI Data]''
 
''' '''
 
Perform periodic scans of organizational systems and real-time scans of files
 
from external sources as files are downloaded, opened, or executed.
 
'''SI.L2-3.14.6 '''
 
''Monitor Communications for ''
 
''Attacks''
 
Monitor organizational systems, including inbound and outbound
 
communications traffic, to detect attacks and indicators of potential attacks.
 
'''SI.L2-3.14.7 '''
 
''Identify Unauthorized Use''
 
Identify unauthorized use of organizational systems.
 
'''Level 3 '''
 
'''Description '''
 
'''SI.L3-3.14.1e '''
 
''Integrity Verification''
 
''' '''
 
Verify the integrity of security critical and essential software using root of
 
trust mechanisms or cryptographic signatures.
 
'''SI.L3-3.14.3e '''
 
''Specialized Asset Security''
 
''' '''
 
Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information
 
Systems and test equipment in the scope of the specified enhanced security
 
requirements or are segregated in purpose-specific networks.
 
'''SI.L3-3.14.6e '''
 
''Threat-Guided Intrusion Detection''
 
''' '''
 
Use threat indicator information and effective mitigations obtained from, at
 
a minimum, open or commercial sources, and any DoD-provided sources, to
 
guide and inform intrusion detection and threat hunting.
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
18
 
Appendix A. CMMC Model Matrix
 
This appendix presents the model in matrix form by domain. The three columns list the
 
associated  security  requirements  for each CMMC  level.  Each level is independent and
 
consists of a set of CMMC security requirements:
 
• Level 1: the ''basic safeguarding requirements'' for FCI specified in FAR Clause 52.204-21.<br />
• Level 2: the ''security requirements'' for CUI specified in NIST SP 800-171 Rev 2 per DFARS
 
Clause 252.204-7012
 
• Level 3: selected ''enhanced'' ''security requirements'' for CUI specified in NIST SP 800-172
 
with DoD-approved parameters where applicable.
 
Each requirement is contained in a single cell. The requirement identification number is
 
bolded at the top of each cell. The next line contains the requirement short name identifier,
 
in ''italics'', which is meant to be used for quick reference only. Below the short name is the
 
complete CMMC security  requirement  statement.  Some Level 3 requirement  statements
 
contain a DoD-approved  parameter, which is underlined.  Finally, the bulleted list at the
 
bottom contains the FAR Clause 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172
 
reference as appropriate.
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
19
 
'''ACCESS CONTROL (AC)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''AC.L1-b.1.i'''
 
''Authorized Access Control [FCI Data]''
 
Limit information system access to
 
authorized users, processes acting on behalf
 
of authorized users, or devices (including
 
other information systems).
 
• FAR Clause 52.204-21 b.1.i
 
• NIST SP 800-171 Rev 2 3.1.1
 
'''AC.L2-3.1.1'''
 
''Authorized Access Control [CUI Data]''
 
Limit system access to authorized users,
 
processes acting on behalf of authorized
 
users, and devices (including other systems).
 
• NIST SP 800-171 Rev 2 3.1.1
 
• FAR Clause 52.204-21 b.1.i
 
'''AC.L3-3.1.2e'''
 
''Organizationally Controlled Assets''
 
Restrict access to systems and system
 
components to only those information
 
resources that are owned, provisioned, or
 
issued by the organization.
 
• NIST SP 800-172 3.1.2e
 
'''AC.L1-b.1.ii'''
 
 
''Transaction &amp; Function Control [FCI Data]''
 
Limit information system access to the types
 
of transactions and functions that authorized
 
users are permitted to execute.
 
• FAR Clause 52.204-21 b.1.ii
 
• NIST SP 800-171 Rev 2 3.1.2
 
'''AC.L2-3.1.2'''
 
''Transaction &amp; Function Control [CUI Data]''
 
Limit system access to the types of
 
transactions and functions that authorized
 
users are permitted to execute.
 
• NIST SP 800-171 Rev 2 3.1.2
 
• FAR Clause 52.204-21 b.1.ii
 
'''AC.L3-3.1.3e'''
 
''Secured Information Transfer''
 
Employ secure information transfer solutions
 
to control information flows between
 
security domains on connected systems.
 
• NIST SP 800-172 3.1.3e
 
'''AC.L1-b.1.iii'''
 
''External Connections [FCI Data]''
 
Verify and control/limit connections to and
 
use of external information systems. 
 
• FAR Clause 52.204-21 b.1.iii
 
• NIST SP 800-171 Rev 2 3.1.20
 
'''AC.L2-3.1.3'''
 
''Control CUI Flow''
 
Control the flow of CUI in accordance with
 
approved authorizations. 
 
• NIST SP 800-171 Rev 2 3.1.3
 
'''AC.L1-b.1.iv'''
 
''Control Public Information [FCI Data]''
 
Control information posted or processed on
 
publicly accessible information systems.
 
• FAR Clause 52.204-21 b.1.iv
 
• NIST SP 800-171 Rev 2 3.1.22
 
'''AC.L2-3.1.4'''
 
''Separation of Duties''
 
Separate the duties of individuals to reduce
 
the risk of malevolent activity without
 
collusion.
 
• NIST SP 800-171 Rev 2 3.1.4<br />
'''AC.L2-3.1.5'''
 
''Least Privilege''
 
Employ the principle of least privilege,
 
including for specific security functions and
 
privileged accounts.
 
• NIST SP 800-171 Rev 2 3.1.5<br />
'''AC.L2-3.1.6'''
 
''Non-Privileged Account Use''
 
Use non-privileged accounts or roles when
 
accessing nonsecurity functions.
 
• NIST SP 800-171 Rev 2 3.1.6<br />
'''AC.L2-3.1.7'''
 
''Privileged Functions''
 
Prevent non-privileged users from executing
 
privileged functions and capture the
 
execution of such functions in audit logs.
 
• NIST SP 800-171 Rev 2 3.1.7<br />
'''AC.L2-3.1.8'''
 
''Unsuccessful Logon Attempts''
 
Limit unsuccessful logon attempts. 
 
• NIST SP 800-171 Rev 2 3.1.8 <br />
'''AC.L2-3.1.9'''
 
''Privacy &amp; Security Notices''
 
Provide privacy and security notices
 
consistent with applicable CUI rules.
 
• NIST SP 800-171 Rev 2 3.1.9
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
20
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''AC.L2-3.1.10'''
 
''Session Lock''
 
Use session lock with pattern-hiding displays
 
to prevent access and viewing of data after a
 
period of inactivity. 
 
• NIST SP 800-171 Rev 2 3.1.10<br />
'''AC.L2-3.1.11'''
 
''Session Termination''
 
Terminate (automatically) a user session
 
after a defined condition.
 
• NIST SP 800-171 Rev 2 3.1.11<br />
'''AC.L2-3.1.12'''
 
''Control Remote Access''
 
Monitor and control remote access sessions.
 
• NIST SP 800-171 Rev 2 3.1.12<br />
'''AC.L2-3.1.13'''
 
''Remote Access Confidentiality''
 
Employ cryptographic mechanisms to protect
 
the confidentiality of remote access sessions.
 
• NIST SP 800-171 Rev 2 3.1.13<br />
'''AC.L2-3.1.14'''
 
''Remote Access Routing''
 
Route remote access via managed access
 
control points.
 
• NIST SP 800-171 Rev 2 3.1.14<br />
'''AC.L2-3.1.15'''
 
''Privileged Remote Access''
 
Authorize remote execution of privileged
 
commands and remote access to security-
 
relevant information.
 
• NIST SP 800-171 Rev 2 3.1.15<br />
'''AC.L2-3.1.16'''
 
''Wireless Access Authorization''
 
Authorize wireless access prior to allowing
 
such connections.
 
• NIST SP 800-171 Rev 2 3.1.16<br />
'''AC.L2-3.1.17'''
 
''Wireless Access Protection''
 
Protect wireless access using authentication
 
and encryption.
 
• NIST SP 800-171 Rev 2 3.1.17<br />
'''AC.L2-3.1.18'''
 
''Mobile Device Connection''
 
Control connection of mobile devices.
 
• NIST SP 800-171 Rev 2 3.1.18<br />
'''AC.L2-3.1.19'''
 
''Encrypt CUI on Mobile''
 
Encrypt CUI on mobile devices and mobile
 
computing platforms.
 
• NIST SP 800-171 Rev 2 3.1.19<br />
'''AC.L2-3.1.20'''
 
''External Connections [CUI Data]''
 
Verify and control/limit connections to and
 
use of external systems.
 
• NIST SP 800-171 Rev 2 3.1.20
 
• FAR Clause 52.204-21 b.1.iii
 
''' '''
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
21
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''AC.L2-3.1.21'''
 
''Portable Storage Use''
 
Limit use of portable storage devices on
 
external systems.
 
• NIST SP 800-171 Rev 2 3.1.21<br />
'''AC.L2-3.1.22'''
 
''Control Public Information [CUI Data]''
 
Control CUI posted or processed on publicly
 
accessible systems.
 
• NIST SP 800-171 Rev 2 3.1.22
 
• FAR Clause 52.204-21 b.1.iv
 
''' '''
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
22
 
'''AWARENESS AND TRAINING (AT)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''AT.L2-3.2.1'''
 
''Role-Based Risk Awareness''
 
Inform managers, systems administrators,
 
and users of organizational systems of the
 
security risks associated with their activities
 
and of the applicable policies, standards, and
 
procedures related to the security of those
 
systems.
 
• NIST SP 800-171 Rev 2 3.2.1
 
'''AT.L3-3.2.1e'''
 
''Advanced Threat Awareness''
 
Provide awareness training upon initial hire,
 
following a significant cyber event, and at
 
least annually, focused on recognizing and
 
responding to threats from social
 
engineering, advanced persistent threat
 
actors, breaches, and suspicious behaviors;
 
update the training at least annually
 
''' '''or when
 
there are significant changes to the threat.
 
• NIST SP 800-172 3.2.1e
 
'''AT.L2-3.2.2'''
 
''Role-Based Training''
 
Train personnel to carry out their assigned
 
information security-related duties and
 
responsibilities.
 
• NIST SP 800-171 Rev 2 3.2.2
 
'''AT.L3-3.2.2e'''
 
''Practical Training Exercises''
 
Include practical exercises in awareness
 
training for all users, tailored by roles, to
 
include general users, users with specialized
 
roles, and privileged users, that are aligned
 
with current threat scenarios and provide
 
feedback to individuals involved in the
 
training and their supervisors.
 
• NIST SP 800-172 3.2.2e
 
'''AT.L2-3.2.3'''
 
''Insider Threat Awareness''
 
Provide security awareness training on
 
recognizing and reporting potential indicators
 
of insider threat.
 
• NIST SP 800-171 Rev 2 3.2.3
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
23
 
'''AUDIT AND ACCOUNTABILITY (AU)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''AU.L2-3.3.1'''
 
''System Auditing''
 
Create and retain system audit logs and
 
records to the extent needed to enable the
 
monitoring, analysis, investigation, and
 
reporting of unlawful or unauthorized system
 
activity.
 
• NIST SP 800-171 Rev 2 3.3.1<br />
'''AU.L2-3.3.2'''
 
''User Accountability''
 
Uniquely track the actions of individual
 
system users, so they can be held
 
accountable for their actions.
 
• NIST SP 800-171 Rev 2 3.3.2<br />
'''AU.L2-3.3.3'''
 
''Event Review''
 
Review and update logged events.
 
• NIST SP 800-171 Rev 2 3.3.3<br />
'''AU.L2-3.3.4'''
 
''Audit Failure Alerting''
 
Alert in the event of an audit logging process
 
failure.
 
• NIST SP 800-171 Rev 2 3.3.4<br />
'''AU.L2-3.3.5'''
 
''Audit Correlation''
 
Correlate audit record review, analysis, and
 
reporting processes for investigation and
 
response to indications of unlawful,
 
unauthorized, suspicious, or unusual activity.
 
• NIST SP 800-171 Rev 2 3.3.5<br />
'''AU.L2-3.3.6'''
 
''Reduction &amp; Reporting''
 
Provide audit record reduction and report
 
generation to support on-demand analysis
 
and reporting.
 
• NIST SP 800-171 Rev 2 3.3.6<br />
'''AU.L2-3.3.7'''
 
''Authoritative Time Source''
 
Provide a system capability that compares
 
and synchronizes internal system clocks with
 
an authoritative source to generate time
 
stamps for audit records.
 
• NIST SP 800-171 Rev 2 3.3.7<br />
'''AU.L2-3.3.8'''
 
''Audit Protection''
 
Protect audit information and audit logging
 
tools from unauthorized access, modification,
 
and deletion.
 
• NIST SP 800-171 Rev 2 3.3.8<br />
'''AU.L2-3.3.9'''
 
''Audit Management''
 
Limit management of audit logging
 
functionality to a subset of privileged users.
 
• NIST SP 800-171 Rev 2 3.3.9
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
24
 
'''CONFIGURATION MANAGEMENT (CM)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''CM.L2-3.4.1'''
 
''System Baselining''
 
Establish and maintain baseline
 
configurations and inventories of
 
organizational systems (including hardware,
 
software, firmware, and documentation)
 
throughout the respective system
 
development life cycles.
 
• NIST SP 800-171 Rev 2 3.4.1
 
'''CM.L3-3.4.1e'''
 
''Authoritative Repository''
 
Establish and maintain an authoritative
 
source and repository to provide a trusted
 
source and accountability for approved and
 
implemented system components.
 
• NIST SP 800-172 3.4.1e
 
'''CM.L2-3.4.2'''
 
''Security Configuration Enforcement''
 
Establish and enforce security configuration
 
settings for information technology products
 
employed in organizational systems.
 
• NIST SP 800-171 Rev 2 3.4.2
 
'''CM.L3-3.4.2e'''
 
''Automated Detection &amp; Remediation''
 
Employ automated mechanisms to detect
 
misconfigured or unauthorized system
 
components; after detection, remove the
 
components or place the components in a
 
quarantine or remediation network to
 
facilitate patching, re-configuration, or other
 
mitigations.
 
• NIST SP 800-172 3.4.2e
 
'''CM.L2-3.4.3'''
 
''System Change Management''
 
Track, review, approve or disapprove, and log
 
changes to organizational systems.
 
• NIST SP 800-171 Rev 2 3.4.3
 
'''CM.L3-3.4.3e'''
 
''Automated Inventory''
 
Employ automated discovery and
 
management tools to maintain an up-to-
 
date, complete, accurate, and readily
 
available inventory of system components.
 
• NIST SP 800-172 3.4.3e
 
'''CM.L2-3.4.4'''
 
''Security Impact Analysis''
 
Analyze the security impact of changes prior
 
to implementation.
 
• NIST SP 800-171 Rev 2 3.4.4<br />
'''CM.L2-3.4.5'''
 
''Access Restrictions for Change''
 
Define, document, approve, and enforce
 
physical and logical access restrictions
 
associated with changes to organizational
 
systems.
 
• NIST SP 800-171 Rev 2 3.4.5<br />
'''CM.L2-3.4.6'''
 
''Least Functionality''
 
Employ the principle of least functionality by
 
configuring organizational systems to provide
 
only essential capabilities.
 
• NIST SP 800-171 Rev 2 3.4.6<br />
'''CM.L2-3.4.7'''
 
''Nonessential Functionality''
 
Restrict, disable, or prevent the use of
 
nonessential programs, functions, ports,
 
protocols, and services.
 
• NIST SP 800-171 Rev 2 3.4.7
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
25
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''CM.L2-3.4.8'''
 
''Application Execution Policy''
 
Apply deny-by-exception (blacklisting) policy
 
to prevent the use of unauthorized software
 
or deny-all, permit-by-exception
 
(whitelisting) policy to allow the execution of
 
authorized software.
 
• NIST SP 800-171 Rev 2 3.4.8<br />
'''CM.L2-3.4.9'''
 
''User-Installed Software''
 
Control and monitor user-installed software.
 
• NIST SP 800-171 Rev 2 3.4.9
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
26
 
'''IDENTIFICATION AND AUTHENTICATION (IA)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''IA.L1-b.1.v'''
 
''Identification [FCI Data]''
 
Identify information system users, processes
 
acting on behalf of users, or devices.
 
• FAR Clause 52.204-21 b.1.v
 
• NIST SP 800-171 Rev 2 3.5.1
 
'''IA.L2-3.5.1'''
 
''Identification [CUI Data]''
 
Identify system users, processes acting on
 
behalf of users, and devices.
 
• NIST SP 800-171 Rev 2 3.5.1
 
• FAR Clause 52.204-21 b.1.v
 
'''IA.L3-3.5.1e'''
 
''Bidirectional Authentication''
 
Identify and authenticate systems and
 
system components, where possible, before
 
establishing a network connection using
 
bidirectional authentication that is
 
cryptographically based and replay resistant.
 
• NIST SP 800-172 3.5.1e
 
'''IA.L1-b.1.vi'''
 
''Authentication [FCI Data]''
 
Authenticate (or verify) the identities of
 
those users, processes, or devices, as a
 
prerequisite to allowing access to
 
organizational information systems.
 
• FAR Clause 52.204-21 b.1.vi
 
• NIST SP 800-171 Rev 2 3.5.2
 
'''IA.L2-3.5.2'''
 
''Authentication [CUI Data]''
 
Authenticate (or verify) the identities of
 
users, processes, or devices, as a prerequisite
 
to allowing access to organizational systems.
 
• NIST SP 800-171 Rev 2 3.5.2
 
• FAR Clause 52.204-21 b.1.vi
 
'''IA.L3-3.5.3e'''
 
''Block Untrusted Assets''
 
Employ automated or manual/procedural
 
mechanisms to prohibit system components
 
from connecting to organizational systems
 
unless the components are known,
 
authenticated, in a properly configured state,
 
or in a trust profile.
 
• NIST SP 800-172 3.5.3e
 
'''IA.L2-3.5.3'''
 
''Multifactor Authentication''
 
Use multifactor authentication for local and
 
network access to privileged accounts and for
 
network access to non-privileged accounts.
 
• NIST SP 800-171 Rev 2 3.5.3<br />
'''IA.L2-3.5.4'''
 
''Replay-Resistant Authentication''
 
Employ replay-resistant authentication
 
mechanisms for network access to privileged
 
and non-privileged accounts.
 
• NIST SP 800-171 Rev 2 3.5.4<br />
'''IA.L2-3.5.5'''
 
''Identifier Reuse''
 
Prevent reuse of identifiers for a defined
 
period.
 
• NIST SP 800-171 Rev 2 3.5.5<br />
'''IA.L2-3.5.6'''
 
''Identifier Handling''
 
Disable identifiers after a defined period of
 
inactivity.
 
• NIST SP 800-171 Rev 2 3.5.6<br />
'''IA.L2-3.5.7'''
 
''Password Complexity''
 
Enforce a minimum password complexity and
 
change of characters when new passwords
 
are created.
 
• NIST SP 800-171 Rev 2 3.5.7<br />
'''IA.L2-3.5.8'''
 
''Password Reuse''
 
Prohibit password reuse for a specified
 
number of generations.
 
• NIST SP 800-171 Rev 2 3.5.8<br />
'''IA.L2-3.5.9'''
 
''Temporary Passwords''
 
Allow temporary password use for system
 
logons with an immediate change to a
 
permanent password.
 
• NIST SP 800-171 Rev 2 3.5.9
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
27
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''IA.L2-3.5.10'''
 
''Cryptographically-Protected Passwords''
 
Store and transmit only cryptographically-
 
protected passwords.
 
• NIST SP 800-171 Rev 2 3.5.10<br />
'''IA.L2-3.5.11'''
 
''Obscure Feedback''
 
Obscure feedback of authentication
 
information.
 
• NIST SP 800-171 Rev 2 3.5.11
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
28
 
'''INCIDENT RESPONSE (IR)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''IR.L2-3.6.1'''
 
''Incident Handling''
 
Establish an operational incident-handling
 
capability for organizational systems that
 
includes preparation, detection, analysis,
 
containment, recovery, and user response
 
activities.
 
• NIST SP 800-171 Rev 2 3.6.1
 
'''IR.L3-3.6.1e'''
 
''Security Operations Center''
 
Establish and maintain a security operations
 
center capability that operates 24/7, with
 
allowance for remote/on-call staff.
 
• NIST SP 800-172 3.6.1e
 
'''IR.L2-3.6.2'''
 
''Incident Reporting''
 
Track, document, and report incidents to
 
designated officials and/or authorities both
 
internal and external to the organization.
 
• NIST SP 800-171 Rev 2 3.6.2
 
'''IR.L3-3.6.2e'''
 
''Cyber Incident Response Team''
 
Establish and maintain a cyber incident
 
response team that can be deployed by the
 
organization within 24 hours.
 
• NIST SP 800-172 3.6.2e
 
'''IR.L2-3.6.3'''
 
''Incident Response Testing''
 
Test the organizational incident response
 
capability.
 
• NIST SP 800-171 Rev 2 3.6.3
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
29
 
'''MAINTENANCE (MA)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''MA.L2-3.7.1'''
 
''Perform Maintenance''
 
Perform maintenance on organizational
 
systems.
 
• NIST SP 800-171 Rev 2 3.7.1<br />
'''MA.L2-3.7.2'''
 
''System Maintenance Control''
 
Provide controls on the tools, techniques,
 
mechanisms, and personnel used to conduct
 
system maintenance.
 
• NIST SP 800-171 Rev 2 3.7.2<br />
'''MA.L2-3.7.3'''
 
''Equipment Sanitization''
 
Sanitize equipment removed for off-site
 
maintenance of any CUI.
 
• NIST SP 800-171 Rev 2 3.7.3<br />
'''MA.L2-3.7.4'''
 
''Media Inspection''
 
Check media containing diagnostic and test
 
programs for malicious code before the
 
media are used in organizational systems.
 
• NIST SP 800-171 Rev 2 3.7.4<br />
'''MA.L2-3.7.5'''
 
''Nonlocal Maintenance''
 
Require multifactor authentication to
 
establish nonlocal maintenance sessions via
 
external network connections and terminate
 
such connections when nonlocal
 
maintenance is complete.
 
• NIST SP 800-171 Rev 2 3.7.5<br />
'''MA.L2-3.7.6'''
 
''Maintenance Personnel''
 
Supervise the maintenance activities of
 
maintenance personnel without required
 
access authorization.
 
• NIST SP 800-171 Rev 2 3.7.6
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
30
 
'''MEDIA PROECTION (MP)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''MP.L1-b.1.vii'''
 
''Media Disposal [FCI Data]''
 
Sanitize or destroy information system media
 
containing Federal Contract Information
 
before disposal or release for reuse.
 
• FAR Clause 52.204-21 b.1.vii
 
• NIST SP 800-171 Rev 2 3.8.3
 
'''MP.L2-3.8.1'''
 
''Media Protection''
 
Protect (i.e., physically control and securely
 
store) system media containing CUI, both
 
paper and digital.
 
• NIST SP 800-171 Rev 2 3.8.1
 
'''MP.L2-3.8.2'''
 
''Media Access''
 
Limit access to CUI on system media to
 
authorized users.
 
• NIST SP 800-171 Rev 2 3.8.2<br />
'''MP.L2-3.8.3'''
 
''Media Disposal [CUI Data]''
 
Sanitize or destroy system media containing
 
CUI before disposal or release for reuse.
 
• NIST SP 800-171 Rev 2 3.8.3
 
• FAR Clause 52.204-21 b.1.vii<br />
'''MP.L2-3.8.4'''
 
''Media Markings''
 
Mark media with necessary CUI markings and
 
distribution limitations.
 
• NIST SP 800-171 Rev 2 3.8.4<br />
'''MP.L2-3.8.5'''
 
''Media Accountability''
 
Control access to media containing CUI and
 
maintain accountability for media during
 
transport outside of controlled areas.
 
• NIST SP 800-171 Rev 2 3.8.5
 
'''MP.L2-3.8.6'''
 
''Portable Storage Encryption''
 
Implement cryptographic mechanisms to
 
protect the confidentiality of CUI stored on
 
digital media during transport unless
 
otherwise protected by alternative physical
 
safeguards.
 
• NIST SP 800-171 Rev 2 3.8.6<br />
'''MP.L2-3.8.7'''
 
''Removable Media''
 
Control the use of removable media on
 
system components.
 
• NIST SP 800-171 Rev 2 3.8.7<br />
'''MP.L2-3.8.8'''
 
''Shared Media''
 
Prohibit the use of portable storage devices
 
when such devices have no identifiable
 
owner.
 
• NIST SP 800-171 Rev 2 3.8.8<br />
'''MP.L2-3.8.9'''
 
''Protect Backups''
 
Protect the confidentiality of backup CUI at
 
storage locations. 
 
• NIST SP 800-171 Rev 2 3.8.9
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
31
 
'''PERSONNEL SECURITY (PS)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''PS.L2-3.9.1'''
 
''Screen Individuals''
 
Screen individuals prior to authorizing access
 
to organizational systems containing CUI.
 
• NIST SP 800-171 Rev 2 3.9.1
 
'''PS.L3-3.9.2e'''
 
''Adverse Information''
 
Protect organizational systems when adverse
 
information develops or is obtained about
 
individuals with access to CUI.
 
• NIST SP 800-172 3.9.2e
 
'''PS.L2-3.9.2'''
 
''Personnel Actions''
 
Protect organizational systems containing
 
CUI during and after personnel actions such
 
as terminations and transfers.
 
• NIST SP 800-171 Rev 2 3.9.2
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
32
 
'''PHYSICAL PROTECTION (PE)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''PE.L1-b.1.viii'''
 
''Limit Physical Access [FCI Data]''
 
Limit physical access to organizational
 
information systems, equipment, and the
 
respective operating environments to
 
authorized individuals.
 
• FAR Clause 52.204-21 b.1.viii
 
• NIST SP 800-171 Rev 2 3.10.1
 
'''PE.L2-3.10.1'''
 
''Limit Physical Access [CUI Data]''
 
Limit physical access to organizational
 
systems, equipment, and the respective
 
operating environments to authorized
 
individuals.
 
• NIST SP 800-171 Rev 2 3.10.1
 
• FAR Clause 52.204-21 b.1.viii
 
'''PE.L1-b.1.ix'''
 
''Manage Visitors &amp; Physical Access [FCI Data]''
 
Escort visitors and monitor visitor activity;
 
maintain audit logs of physical access; and
 
control and manage physical access devices. 
 
• FAR Clause 52.204-21 Partial b.1.ix
 
• NIST SP 800-171 Rev 2 3.10.3
 
• NIST SP 800-171 Rev 2 3.10.4
 
• NIST SP 800-171 Rev 2 3.10.5
 
'''PE.L2-3.10.2'''
 
''Monitor Facility''
 
Protect and monitor the physical facility and
 
support infrastructure for organizational
 
systems.
 
• NIST SP 800-171 Rev 2 3.10.2
 
'''PE.L2-3.10.3'''
 
''Escort Visitors [CUI Data]''
 
Escort visitors and monitor visitor activity.
 
• NIST SP 800-171 Rev 2 3.10.3
 
• FAR Clause 52.204-21 Partial b.1.ix<br />
'''PE.L2-3.10.4'''
 
''Physical Access Logs [CUI Data]''
 
Maintain audit logs of physical access.
 
• NIST SP 800-171 Rev 2 3.10.4
 
• FAR Clause 52.204-21 Partial b.1.ix<br />
'''PE.L2-3.10.5'''
 
''Manage Physical Access [CUI Data]''
 
Control and manage physical access devices.
 
• NIST SP 800-171 Rev 2 3.10.5
 
• FAR Clause 52.204-21 Partial b.1.ix<br />
'''PE.L2-3.10.6'''
 
''Alternative Work Sites''
 
Enforce safeguarding measures for CUI at
 
alternate work sites.
 
• NIST SP 800-171 Rev 2 3.10.6
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
33
 
'''RISK ASSESSMENT (RA)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''RA.L2-3.11.1'''
 
''Risk Assessments''
 
Periodically assess the risk to organizational
 
operations (including mission, functions,
 
image, or reputation), organizational assets,
 
and individuals, resulting from the operation
 
of organizational systems and the associated
 
processing, storage, or transmission of CUI.
 
• NIST SP 800-171 Rev 2 3.11.1
 
'''RA.L3-3.11.1e'''
 
''Threat-Informed Risk Assessment''
 
Employ threat intelligence, at a minimum
 
from open or commercial sources, and any
 
DoD-provided sources, as part of a risk
 
assessment to guide and inform the
 
development of organizational systems,
 
security architectures, selection of security
 
solutions, monitoring, threat hunting, and
 
response and recovery activities.
 
• NIST SP 800-172 3.11.1e
 
'''RA.L2-3.11.2'''
 
''Vulnerability Scan''
 
Scan for vulnerabilities in organizational
 
systems and applications periodically and
 
when new vulnerabilities affecting those
 
systems and applications are identified.
 
• NIST SP 800-171 Rev 2 3.11.2
 
'''RA.L3-3.11.2e'''
 
''Threat Hunting''
 
Conduct cyber threat hunting activities on an
 
on-going aperiodic basis or when indications
 
warrant, to search for indicators of
 
compromise in organizational systems and
 
detect, track, and disrupt threats that evade
 
existing controls.
 
• NIST SP 800-172 3.11.2e
 
'''RA.L2-3.11.3'''
 
''Vulnerability Remediation''
 
Remediate vulnerabilities in accordance with
 
risk assessments.
 
• NIST SP 800-171 Rev 2 3.11.3
 
'''RA.L3-3.11.3e'''
 
''Advanced Risk Identification''
 
Employ advanced automation and analytics
 
capabilities in support of analysts to predict
 
and identify risks to organizations, systems,
 
and system components.
 
• NIST SP 800-172 3.11.3e<br />
'''RA.L3-3.11.4e'''
 
''Security Solution Rationale''
 
Document or reference in the system
 
security plan the security solution selected,
 
the rationale for the security solution, and
 
the risk determination.
 
• NIST SP 800-172 3.11.4e<br />
'''RA.L3-3.11.5e'''
 
''Security Solution Effectiveness''
 
Assess the effectiveness of security solutions
 
at least annually or upon receipt of relevant
 
cyber threat information, or in response to a
 
relevant cyber incident, to address
 
anticipated risk to organizational systems and
 
the organization based on current and
 
accumulated threat intelligence.
 
• NIST SP 800-172 3.11.5e<br />
'''RA.L3-3.11.6e'''
 
''Supply Chain Risk Response''
 
Assess, respond to, and monitor supply chain
 
risks associated with organizational systems
 
and system components.
 
• NIST SP 800-172 3.11.6e
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
34
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''RA.L3-3.11.7e'''
 
''Supply Chain Risk Plan''
 
Develop a plan for managing supply chain
 
risks associated with organizational systems
 
and system components; update the plan at
 
least annually, and upon receipt of relevant
 
cyber threat information, or in response to a
 
relevant cyber incident.
 
• NIST SP 800-172 3.11.7e
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
35
 
'''SECURITY ASSESSMENT (CA)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''CA.L2-3.12.1'''
 
''Security Control Assessment''
 
Periodically assess the security controls in
 
organizational systems to determine if the
 
controls are effective in their application.
 
• NIST SP 800-171 Rev 2 3.12.1
 
'''CA.L3-3.12.1e'''
 
''Penetration Testing''
 
Conduct penetration testing at least annually
 
or when significant security changes are
 
made to the system, leveraging automated
 
scanning tools and ad hoc tests using subject
 
matter experts.
 
• NIST SP 800-172 3.12.1e
 
'''CA.L2-3.12.2'''
 
''Operational Plan of Action''
 
Develop and implement plans of action
 
designed to correct deficiencies and reduce
 
or eliminate vulnerabilities in organizational
 
systems.
 
• NIST SP 800-171 Rev 2 3.12.2<br />
'''CA.L2-3.12.3'''
 
''Security Control Monitoring''
 
Monitor security controls on an ongoing basis
 
to determine the continued effectiveness of
 
the controls.
 
• NIST SP 800-171 Rev 2 3.12.3<br />
'''CA.L2-3.12.4'''
 
''System Security Plan''
 
Develop, document, and periodically update
 
system security plans that describe system
 
boundaries, system environments of
 
operation, how security requirements are
 
implemented, and the relationships with or
 
connections to other systems.
 
• NIST SP 800-171 Rev 2 3.12.4
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
36
 
'''SYSTEM AND COMMUNICATIONS PROTECTION (SC)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''SC.L1-b.1.x'''
 
''Boundary Protection [FCI Data]''
 
Monitor, control, and protect organizational
 
communications (i.e., information
 
transmitted or received by organizational
 
information systems) at the external
 
boundaries and key internal boundaries of
 
the information systems.
 
• FAR Clause 52.204-21 b.1.x
 
• NIST SP 800-171 Rev 2 3.13.1
 
'''SC.L2-3.13.1'''
 
''Boundary Protection [CUI Data]''
 
Monitor, control, and protect organizational
 
communications (i.e., information
 
transmitted or received by organizational
 
information systems) at the external
 
boundaries and key internal boundaries of
 
the information systems.
 
• NIST SP 800-171 Rev 2 3.13.1
 
• FAR Clause 52.204-21 b.1.x
 
'''SC.L3-3.13.4e'''
 
''Isolation''
 
Employ physical isolation techniques or
 
logical isolation techniques or both in
 
organizational systems and system
 
components.
 
• NIST SP 800-172 3.13.4e
 
'''SC.L1-b.1.xi'''
 
''Public-Access System Separation [FCI Data]''
 
Implement subnetworks for publicly
 
accessible system components that are
 
physically or logically separated from internal
 
networks.
 
• FAR Clause 52.204-21 b.1.xi
 
• NIST SP 800-171 Rev 2 3.13.5
 
'''SC.L2-3.13.2'''
 
''Security Engineering''
 
Employ architectural designs, software
 
development techniques, and systems
 
engineering principles that promote effective
 
information security within organizational
 
systems.
 
• NIST SP 800-171 Rev 2 3.13.2<br />
'''SC.L2-3.13.3'''
 
''Role Separation''
 
Separate user functionality from system
 
management functionality.
 
• NIST SP 800-171 Rev 2 3.13.3<br />
'''SC.L2-3.13.4'''
 
''Shared Resource Control''
 
Prevent unauthorized and unintended
 
information transfer via shared system
 
resources.
 
• NIST SP 800-171 Rev 2 3.13.4<br />
'''SC.L2-3.13.5'''
 
''Public-Access System Separation [CUI Data]''
 
Implement subnetworks for publicly
 
accessible system components that are
 
physically or logically separated from internal
 
networks.
 
• NIST SP 800-171 Rev 2 3.13.5
 
• FAR Clause 52.204-21 b.1.xi<br />
'''SC.L2-3.13.6'''
 
''Network Communication by Exception''
 
Deny network communications traffic by
 
default and allow network communications
 
traffic by exception (i.e., deny all, permit by
 
exception).
 
• NIST SP 800-171 Rev 2 3.13.6<br />
'''SC.L2-3.13.7'''
 
''Split Tunneling''
 
Prevent remote devices from simultaneously
 
establishing non-remote connections with
 
organizational systems and communicating
 
via some other connection to resources in
 
external networks (i.e., split tunneling).
 
• NIST SP 800-171 Rev 2 3.13.7
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
37
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''SC.L2-3.13.8'''
 
''Data in Transit''
 
Implement cryptographic mechanisms to
 
prevent unauthorized disclosure of CUI
 
during transmission unless otherwise
 
protected by alternative physical safeguards.
 
• NIST SP 800-171 Rev 2 3.13.8<br />
'''SC.L2-3.13.9'''
 
''Connections Termination''
 
Terminate network connections associated
 
with communications sessions at the end of
 
the sessions or after a defined period of
 
inactivity.
 
• NIST SP 800-171 Rev 2 3.13.9<br />
'''SC.L2-3.13.10'''
 
''Key Management''
 
Establish and manage cryptographic keys for
 
cryptography employed in organizational
 
systems.
 
• NIST SP 800-171 Rev 2 3.13.10<br />
'''SC.L2-3.13.11'''
 
''CUI Encryption''
 
Employ FIPS-validated cryptography when
 
used to protect the confidentiality of CUI.
 
• NIST SP 800-171 Rev 2 3.13.11<br />
'''SC.L2-3.13.12'''
 
''Collaborative Device Control''
 
Prohibit remote activation of collaborative
 
computing devices and provide indication of
 
devices in use to users present at the device.
 
• NIST SP 800-171 Rev 2 3.13.12<br />
'''SC.L2-3.13.13'''
 
''Mobile Code''
 
Control and monitor the use of mobile code.
 
• NIST SP 800-171 Rev 2 3.13.13<br />
'''SC.L2-3.13.14'''
 
''Voice over Internet Protocol''
 
Control and monitor the use of Voice over
 
Internet Protocol (VoIP) technologies.
 
• NIST SP 800-171 Rev 2 3.13.14<br />
'''SC.L2-3.13.15'''
 
''Communications Authenticity''
 
Protect the authenticity of communications
 
sessions.
 
• NIST SP 800-171 Rev 2 3.13.15<br />
'''SC.L2-3.13.16'''
 
''Data at Rest''
 
Protect the confidentiality of CUI at rest.
 
• NIST SP 800-171 Rev 2 3.13.16
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
38
 
'''SYSTEM AND INFORMATION INTEGRITY (SI)'''
 
'''Level 1 '''
 
'''Level 2 '''
 
'''Level 3 '''
 
'''SI.L1-b.1.xii'''
 
''Flaw Remediation [FCI Data]''
 
Identify, report, and correct information and
 
information system flaws in a timely manner.
 
• FAR Clause 52.204-21 b.1.xii
 
• NIST SP 800-171 Rev 2 3.14.1
 
'''SI.L2-3.14.1'''
 
''Flaw Remediation [CUI Data]''
 
Identify, report, and correct system flaws in a
 
timely manner.
 
• NIST SP 800-171 Rev 2 3.14.1
 
• FAR Clause 52.204-21 b.1.xii
 
'''SI.L3-3.14.1e'''
 
''Integrity Verification''
 
Verify the integrity of security critical and
 
essential software using root of trust
 
mechanisms or cryptographic signatures.
 
• NIST SP 800-172 3.14.1e
 
'''SI.L1-b.1.xiii'''
 
''Malicious Code Protection [FCI Data]''
 
Provide protection from malicious code at
 
appropriate locations within organizational
 
information systems.
 
• FAR Clause 52.204-21 b.1.xiii
 
• NIST SP 800-171 Rev 2 3.14.2
 
'''SI.L2-3.14.2'''
 
''Malicious Code Protection [CUI Data]''
 
Provide protection from malicious code at
 
designated locations within organizational
 
systems.
 
• NIST SP 800-171 Rev 2 3.14.2
 
• FAR Clause 52.204-21 b.1.xiii
 
'''SI.L3-3.14.3e'''
 
''Specialized Asset Security''
 
Include specialized assets such as IoT, IIoT,
 
OT, GFE, Restricted Information Systems and
 
test equipment in the scope of the specified
 
enhanced security requirements or are
 
segregated in purpose-specific networks. 
 
• NIST SP 800-172 3.14.3e
 
'''SI.L1-b.1.xiv'''
 
''Update Malicious Code Protection [FCI Data]''
 
Update malicious code protection
 
mechanisms when new releases are
 
available.
 
• FAR Clause 52.204-21 b.1.xiv
 
• NIST SP 800-171 Rev 2 3.14.4
 
'''SI.L2-3.14.3'''
 
''Security Alerts &amp; Advisories''
 
Monitor system security alerts and advisories
 
and take action in response.
 
• NIST SP 800-171 Rev 2 3.14.3
 
'''SI.L3-3.14.6e'''
 
''Threat-Guided Intrusion Detection''
 
Use threat indicator information and
 
effective mitigations obtained from, at a
 
minimum, open or commercial sources, and
 
any DoD-provided sources, to guide and
 
inform intrusion detection and threat
 
hunting.
 
• NIST SP 800-172 3.14.6e
 
'''SI.L1-b.1.xv'''
 
''System &amp; File Scanning [FCI Data]''
 
Perform periodic scans of the information
 
system and real-time scans of files from
 
external sources as files are downloaded,
 
opened, or executed.
 
• FAR Clause 52.204-21 b.1.xv
 
• NIST SP 800-171 Rev 2 3.14.5
 
'''SI.L2-3.14.4'''
 
''Update Malicious Code Protection [CUI Data]''
 
Update malicious code protection
 
mechanisms when new releases are
 
available.
 
• NIST SP 800-171 Rev 2 3.14.4
 
• FAR Clause 52.204-21 b.1.xiv
 
'''SI.L2-3.14.5'''
 
''System &amp; File Scanning [CUI Data]''
 
Perform periodic scans of organizational
 
systems and real-time scans of files from
 
external sources as files are downloaded,
 
opened, or executed.
 
• NIST SP 800-171 Rev 2 3.14.5
 
• FAR Clause 52.204-21 b.1.xv <br />
'''SI.L2-3.14.6'''
 
''Monitor Communications for Attacks''
 
Monitor organizational systems, including
 
inbound and outbound communications
 
traffic, to detect attacks and indicators of
 
potential attacks.
 
• NIST SP 800-171 Rev 2 3.14.6<br />
'''SI.L2-3.14.7'''
 
''Identify Unauthorized Use''
 
Identify unauthorized use of organizational
 
systems. 
 
• NIST SP 800-171 Rev 2 3.14.7
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
39
 
Appendix B. Abbreviations and Acronyms
 
The following is a list of acronyms used in the CMMC model. <br />
AC
 
Access Control
 
APT
 
Advanced Persistent Threat
 
AT
 
Awareness and Training
 
AU
 
Audit and Accountability
 
CA
 
Security Assessment
 
CFR
 
Code of Federal Regulations
 
CM
 
Configuration Management
 
CMMC
 
Cybersecurity Maturity Model Certification
 
CUI
 
Controlled Unclassified Information
 
DFARS
 
Defense Federal Acquisition Regulation Supplement
 
DIB
 
Defense Industrial Base
 
DoD
 
Department of Defense
 
FAR
 
Federal Acquisition Regulation
 
FCI
 
Federal Contract Information
 
FFRDC
 
Federally Funded Research and Development Center
 
FIPS
 
Federal Information Processing Standard
 
IA
 
Identification and Authentication
 
IR
 
Incident Response
 
L#
 
Level Number
 
MA
 
Maintenance
 
MP
 
Media Protection
 
N/A
 
Not Applicable (NA)
 
NIST
 
National Institute of Standards and Technology
 
OUSD A&amp;S
 
Office of the Under Secretary of Defense for Acquisition and
 
Sustainment
 
PE
 
Physical Protection
 
PS
 
Personnel Security
 
PUB
 
Publication
 
Rev
 
Revision
 
RA
 
Risk Assessment
 
SC
 
System and Communications Protection
 
SI
 
System and Information Integrity
 
SP
 
Special Publication
 
UARC
 
University Affiliated Research Center
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
40
 
U.S.
 
United States
 
VoIP
 
Voice over Internet Protocol
 
Vol.
 
Volume
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
41
 
Appendix C. References
 
1. U.S. Executive Office of the President, Council of Economic Advisers (CEA), ''The Cost of''
 
''Malicious Cyber Activity to the U.S. Economy'', available online at
 
https://www.whitehouse.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-
 
Cyber-Activity-to-the-U.S.-Economy.pdf, February 2018
 
2. Center for Strategic and International Studies (CSIS) and McAfee, ''Economic Impact of''
 
''Cybercrime - No Slowing Down'', February 2018
 
3. 48 Code of Federal Regulations (CFR) 52.204-21, ''Basic Safeguarding of Covered''
 
''Contractor Information Systems'', Federal Acquisition Regulation (FAR), 1 Oct 2016
 
4. NIST Special Publication (SP) 800-171 Revision (Rev) 2, ''Protecting Controlled''
 
''Unclassified Information in Nonfederal Systems and Organizations'', U.S. Department of
 
Commerce National Institute of Standards and Technology (NIST), December 2016
 
(updated June 2018)
 
5. NIST SP 800-172, ''Enhanced Security Requirements for Protecting Controlled Unclassified''
 
''Information: A Supplement to NIST Special Publication 800-171'', U.S. Department of
 
Commerce National Institute of Standards and Technology (NIST), February 2021
 
 
 
 
 
 
 
 
Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13
 
42
 
''This page intentionally left blank. ''
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
= Document Outline =
 
* [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#4|1. Introduction]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#5|1.1 Document Organization]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#5|1.2 Supporting Documents]]
* [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2. CMMC Model]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2.1 Overview]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2.2 CMMC Levels]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#6|2.2.1 Descriptions]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#7|2.2.2 CMMC Overview]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#7|2.2.3 Level 1]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#7|2.2.4 Level 2]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#8|2.2.5. Level 3]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#8|2.3 CMMC Domains]]
** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#9|2.4 CMMC Security Requirements]]
*** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#9|2.4.1. List of Security Requirements]]
**** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#21|Appendix A. CMMC Model Matrix]]
**** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#42|Appendix B. Abbreviations and Acronyms]]
**** [[1dce2d5a871a06301b3b98b554dfccecca1987d9.html#44|Appendix C. References]]
 
 
-----
 
Original source: https://dodcio.defense.gov/Portals/0/Documents/CMMC/ModelOverviewv2.pdf

Revision as of 19:01, 25 February 2025

Source of Reference: The official CMMC Model Overview from the Department of Defense Chief Information Officer (DoD CIO).

For inquiries and reporting errors on this wiki, please contact us. Thank you.

NOTICES

The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing CMMC security requirements under the law or departmental policies.

DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.

1. Introduction

The theft of intellectual property and sensitive information from all industrial sectors because of malicious cyber activity threatens economic security and national security. The Council of Economic Advisors estimates that malicious cyber activity cost the U.S. economy between $57 billion and $109 billion in 2016 [1]. The Center for Strategic and International Studies estimates that the total global cost of cybercrime was as high as $600 billion in 2017 [2]. Over a ten-year period, that burden would equate to an estimated $570 billion to $1.09 trillion dollars in costs.

Malicious cyber actors have targeted and continue to target the Defense Industrial Base (DIB) sector and the Department of Defense (DoD) supply chain. These attacks not only focus on the large prime contractors, but also target subcontractors that make up the lower tiers of the DoD supply chain. Many of these subcontractors are small entities that provide critical support and innovation. Overall, the DIB sector consists of over 220,000 companies[1] that process, store, or transmit Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) in support of the warfighter and contribute towards the research, engineering, development, acquisition, production, delivery, sustainment, and operations of DoD systems, networks, installations, capabilities, and services. The aggregate loss of intellectual property and controlled unclassified information from the DoD supply chain can undercut U.S. technical advantages and innovation, as well as significantly increase the risk to national security.

As part of multiple lines of effort focused on the security and resiliency of the DIB sector, the DoD is working with industry to enforce the safeguarding requirements of the following types of unclassified information within the supply chain:

  • Federal Contract Information (FCI): is defined in 32 CFR § 170.4 and 48 CFR 4.1901 [3].
  • Controlled Unclassified Information (CUI): is defined in 32 CFR § 2002.4 (h) [4].

To this end, the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) and DoD Chief Information Officer (CIO) have developed the Cybersecurity Maturity Model Certification (CMMC) in concert with DoD stakeholders, University Affiliated Research Centers (UARCs), Federally Funded Research and Development Centers (FFRDCs), and the DIB sector.

This document focuses on the Cybersecurity Maturity Model Certification (CMMC) Model as set forth in section 170.14 of title 32, Code of Federal Regulations (CFR). The model incorporates the security requirements from: 1) FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, 2) NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and 3) a subset of the requirements from NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171. The CMMC Program is designed to provide increased assurance to the DoD that defense contractors and subcontractors are compliant with information protection requirements for FCI and CUI, and are protecting such information at a level commensurate with risk from cybersecurity threats, including Advanced Persistent Threats (APTs).

When implementing the CMMC model, an organization can achieve a specific CMMC level for its entire enterprise network or for a particular enclave(s), depending on where the information to be protected is handled and stored.

1.1 Document Organization

Section 2 presents the CMMC Model and each of its elements in detail.Appendix A provides the model as a matrix and maps the CMMC model to other secondary sources. Appendix B lists the abbreviations and acronyms. Finally, Appendix C provides the references contained in this document.

1.2 Supporting Documents

This document is supported by multiple companion documents that provide additional information. The CMMC Assessment Guides present assessment objectives, discussion, examples, potential assessment considerations, and key references for each CMMC security requirement. The CMMC Scoping Guides provide additional guidance on how to correctly scope an assessment. The CMMC Hashing Guide provides information on how to create the hash to validate the integrity of archived assessment artifacts.

These supplemental documents are intended to provide explanatory information to assist organizations with implementing and assessing the security requirements covered by CMMC in 32 CFR § 170. The documents are not prescriptive and their use is optional. Implementation of security requirements by following any examples is not a guarantee of compliance with any CMMC security requirement or objective.

2. CMMC Model

2.1 Overview

The CMMC Model incorporates the security requirements from: 1) FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, 2) NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and 3) a subset of the requirements from NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800—171. These source documents may be revised in the future, however the CMMC security requirements will remain unchanged until the CMMC final rule is published. Any further modifications to the CMMC rule will follow appropriate rulemaking procedures.

The CMMC Model consists of domains that map to the Security Requirement Families defined in NIST SP 800-171 Rev 2.

2.2 CMMC Levels

There are three levels within CMMC – Level 1, Level 2, and Level 3.

2.2.1 Descriptions

The CMMC model measures the implementation of cybersecurity requirements at three levels. Each level is independent and consists of a set of CMMC security requirements as set forth in 32 CFR § 170.14 (c):

  • Level 1 Requirements. The security requirements in Level 1 are those set forth in FAR clause 52.204-21(b)(1)(i) – (b)(1)(xv).
  • Level 2 Requirements. The security requirements in Level 2 are identical to the requirements in NIST SP 800-171 Rev 2.
  • Level 3 Requirements. The security requirements in Level 3 are derived from NIST SP 800-172 with DoD-approved parameters where applicable, as identified in 32 CFR § 170.14(c)(4). DoD defined selections and parameters for the NIST SP 800-172 requirements are italicized, where applicable.

2.2.2 CMMC Overview

Figure 1. CMMC Level Overview

2.2.3 Level 1

Level 1 focuses on the protection of FCI and consists of the security requirements that correspond to the 15 basic safeguarding requirements specified in 48 CFR 52.204-21, commonly referred to as the FAR Clause.

2.2.4 Level 2

Level 2 focuses on the protection of CUI and incorporates the 110 security requirements specified in NIST SP 800-171 Rev 2.

2.2.5 Level 3

Level 3 focuses on the protection of CUI and encompasses a subset of the NIST SP 800-172 security requirements [5] with DoD-approved parameters. DoD-approved parameters are denoted with underlining in section 2.4.1 below.

2.3 CMMC Domains

The CMMC model consists of 14 domains that align with the families specified in NIST SP 800-171 Rev 2. These domains and their abbreviations are as follows:

  • Access Control (AC)
  • Awareness & Training (AT)
  • Audit & Accountability (AU)
  • Configuration Management (CM)
  • Identification & Authentication (IA)
  • Incident Response (IR)
  • Maintenance (MA)
  • Media Protection (MP)
  • Personnel Security (PS)
  • Physical Protection (PE)
  • Risk Assessment (RA)
  • Security Assessment (CA)
  • System and Communications Protection (SC)
  • System and Information Integrity (SI)

2.4 CMMC Security Requirements

2.4.1. List of Security Requirements

This subsection itemizes the security requirements for each domain and at each level. Each requirement has a requirement identification number in the format – DD.L#-REQ – where:

  • DD is the two-letter domain abbreviation;
  • L# is the level number; and
  • REQ is the FAR Clause 52.204-21 paragraph number, NIST SP 800-171 Rev 2, or NIST SP800-172 security requirement number.

Below the identification number, a short name identifier is provided for each requirement, meant to be used for quick reference only. Finally, each requirement has a complete requirement statement.

ACCESS CONTROL (AC) Level 1

Description

AC.L1-b.1.i

Authorized Access Control [FCI Data]

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). AC.L1-b.1.ii

Transaction & Function Control [FCI

Data]

Limit information system access to the types of transactions and functions that authorized users are permitted to execute. AC.L1-b.1.iii

External Connections [FCI Data]

Verify and control/limit connections to and use of external information systems. AC.L1-b.1.iv

Control Public Information [FCI Data]

Control information posted or processed on publicly accessible information systems. Level 2

Description

AC.L2-3.1.1

Authorized Access Control [CUI Data]

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

AC.L2-3.1.2

Transaction & Function Control [CUI

Data]

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

AC.L2-3.1.3

Control CUI Flow

Control the flow of CUI in accordance with approved authorizations. AC.L2-3.1.4

Separation of Duties

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 7 AC.L2-3.1.5

Least Privilege

Employ the principle of least privilege, including for specific security functions and privileged accounts. AC.L2-3.1.6

Non-Privileged Account Use

Use non-privileged accounts or roles when accessing nonsecurity functions. AC.L2-3.1.7

Privileged Functions

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. AC.L2-3.1.8

Unsuccessful Logon Attempts

Limit unsuccessful logon attempts. AC.L2-3.1.9

Privacy & Security Notices

Provide privacy and security notices consistent with applicable CUI rules. AC.L2-3.1.10

Session Lock

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. AC.L2-3.1.11

Session Termination

Terminate (automatically) a user session after a defined condition. AC.L2-3.1.12

Control Remote Access

Monitor and control remote access sessions. AC.L2-3.1.13

Remote Access Confidentiality

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. AC.L2-3.1.14

Remote Access Routing

Route remote access via managed access control points. AC.L2-3.1.15

Privileged Remote Access

Authorize remote execution of privileged commands and remote access to security-relevant information. AC.L2-3.1.16

Wireless Access Authorization

Authorize wireless access prior to allowing such connections. AC.L2-3.1.17

Wireless Access Protection

Protect wireless access using authentication and encryption. AC.L2-3.1.18

Mobile Device Connection

Control connection of mobile devices. AC.L2-3.1.19

Encrypt CUI on Mobile

Encrypt CUI on mobile devices and mobile computing platforms. AC.L2-3.1.20

External Connections [CUI Data]

Verify and control/limit connections to and use of external systems. AC.L2-3.1.21

Portable Storage Use

Limit use of portable storage devices on external systems. AC.L2-3.1.22

Control Public Information [CUI Data]

Control CUI posted or processed on publicly accessible systems.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 8 Level 3

Description

AC.L3-3.1.2e

Organizationally Controlled Assets

Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization. AC.L3-3.1.3e

Secured Information Transfer

Employ secure information transfer solutions to control information flows between security domains on connected systems. AWARENESS AND TRAINING (AT) Level 2

Description

AT.L2-3.2.1

Role-Based Risk Awareness Inform managers, systems administrators, and users of organizational systems of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. AT.L2-3.2.2

Role-Based Training Train personnel to carry out their assigned information security-related duties and responsibilities. AT.L2-3.2.3

Insider Threat Awareness

Provide security awareness training on recognizing and reporting potential indicators of insider threat. Level 3

Description

AT.L3-3.2.1e

Advanced Threat Awareness

Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat. AT.L3-3.2.2e

Practical Training Exercises

Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors. AUDIT AND ACCOUNTABILITY (AU) Level 2

Description

AU.L2-3.3.1

System Auditing

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. AU.L2-3.3.2

User Accountability

Uniquely trace the actions of individual system users, so they can be held accountable for their actions. AU.L2-3.3.3

Event Review

Review and update logged events.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 9 AU.L2-3.3.4

Audit Failure Alerting

Alert in the event of an audit logging process failure. AU.L2-3.3.5

Audit Correlation

Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. AU.L2-3.3.6

Reduction & Reporting

Provide audit record reduction and report generation to support on-demand analysis and reporting. AU.L2-3.3.7

Authoritative Time Source

Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. AU.L2-3.3.8

Audit Protection

Protect audit information and audit logging tools from unauthorized access, modification, and deletion. AU.L2-3.3.9 Audit Management Limit management of audit logging functionality to a subset of privileged users. CONFIGURATION MANAGEMENT (CM) Level 2

Description

CM.L2-3.4.1

System Baselining

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. CM.L2-3.4.2

Security Configuration Enforcement

Establish and enforce security configuration settings for information technology products employed in organizational systems. CM.L2-3.4.3

System Change Management

Track, review, approve or disapprove, and log changes to organizational systems. CM.L2-3.4.4

Security Impact Analysis

Analyze the security impact of changes prior to implementation. CM.L2-3.4.5

Access Restrictions for Change

Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. CM.L2-3.4.6

Least Functionality

Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. CM.L2-3.4.7

Nonessential Functionality

Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. CM.L2-3.4.8

Application Execution Policy

Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. CM.L2-3.4.9

User-Installed Software

Control and monitor user-installed software.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 10 Level 3

Description

CM.L3-3.4.1e

Authoritative Repository

Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components. CM.L3-3.4.2e

Automated Detection & Remediation

Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a quarantine or remediation network to facilitate patching, re-configuration, or other mitigations. CM.L3-3.4.3e

Automated Inventory

Employ automated discovery and management tools to maintain an up-to-

date, complete, accurate, and readily available inventory of system components. IDENTIFICATION AND AUTHENTICATION (IA) Level 1

Description

IA.L1-b.1.v

Identification [FCI Data] Identify information system users, processes acting on behalf of users, or devices. IA.L1-b.1.vi

Authentication [FCI Data] Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. Level 2

Description

IA.L2-3.5.1

Identification [CUI Data]

Identify system users, processes acting on behalf of users, and devices. IA.L2-3.5.2

Authentication [CUI Data]

Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

IA.L2-3.5.3

Multifactor Authentication

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. IA.L2-3.5.4

Replay-Resistant Authentication

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. IA.L2-3.5.5

Identifier Reuse

Prevent reuse of identifiers for a defined period. IA.L2-3.5.6

Identifier Handling

Disable identifiers after a defined period of inactivity. IA.L2-3.5.7

Password Complexity

Enforce a minimum password complexity and change of characters when new passwords are created. IA.L2-3.5.8

Password Reuse

Prohibit password reuse for a specified number of generations. IA.L2-3.5.9

Temporary Passwords

Allow temporary password use for system logons with an immediate change to a permanent password.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 11 IA.L2-3.5.10

Cryptographically-Protected

Passwords

Store and transmit only cryptographically protected passwords. IA.L2-3.5.11

Obscure Feedback

Obscure feedback of authentication information. Level 3

Description

IA.L3-3.5.1e

Bidirectional Authentication

Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant. IA.L3-3.5.3e

Block Untrusted Assets

Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile. INCIDENT RESPONSE (IR) Level 2

Description

IR.L2-3.6.1

Incident Handling Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. IR.L2-3.6.2

Incident Reporting

Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. IR.L2-3.6.3

Incident Response Testing

Test the organizational incident response capability. Level 3

Description

IR.L3-3.6.1e

Security Operations Center

Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff. IR.L3-3.6.2e

Cyber Incident Response Team

Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours. MAINTENANCE (MA) Level 2

Description

MA.L2-3.7.1

Perform Maintenance Perform maintenance on organizational systems. MA.L2-3.7.2

System Maintenance Control Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. MA.L2-3.7.3

Equipment Sanitization

Sanitize equipment removed for off-site maintenance of any CUI.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 12 MA.L2-3.7.4

Media Inspection

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. MA.L2-3.7.5

Nonlocal Maintenance

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. MA.L2-3.7.6

Maintenance Personnel

Supervise the maintenance activities of maintenance personnel without required access authorization. MEDIA PROTECTION (MP) Level 1

Description

MP.L1-b.1.vii

Media Disposal [FCI Data] Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. Level 2

Description

MP.L2-3.8.1

Media Protection Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. MP.L2-3.8.2

Media Access Limit access to CUI on system media to authorized users. MP.L2-3.8.3

Media Disposal [CUI Data]

Sanitize or destroy system media containing CUI before disposal or release for reuse. MP.L2-3.8.4

Media Markings

Mark media with necessary CUI markings and distribution limitations. MP.L2-3.8.5

Media Accountability

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. MP.L2-3.8.6

Portable Storage Encryption

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. MP.L2-3.8.7

Removable Media Control the use of removable media on system components. MP.L2-3.8.8

Shared Media

Prohibit the use of portable storage devices when such devices have no identifiable owner. MP.L2-3.8.9

Protect Backups

Protect the confidentiality of backup CUI at storage locations. PERSONNEL SECURITY (PS) Level 2

Description

PS.L2-3.9.1

Screen Individuals Screen individuals prior to authorizing access to organizational systems containing CUI.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 13 PS.L2-3.9.2

Personnel Actions Protect organizational systems containing CUI during and after personnel actions such as terminations and transfers. Level 3

Description

PS.L3-3.9.2e

Adverse Information

Protect organizational systems when adverse information develops or is obtained about individuals with access to CUI. PHYSICAL PROTECTION (PE) Level 1

Description

PE.L1-b.1.viii

Limit Physical Access [FCI Data] Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. PE.L1-b.1.ix

Manage Visitors & Physical Access

[FCI Data] Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. Level 2

Description

PE.L2-3.10.1

Limit Physical Access [CUI Data]

Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.

PE.L2-3.10.2

Monitor Facility Protect and monitor the physical facility and support infrastructure for organizational systems. PE.L2-3.10.3

Escort Visitors [CUI Data]

Escort visitors and monitor visitor activity. PE.L2-3.10.4

Physical Access Logs [CUI Data]

Maintain audit logs of physical access. PE.L2-3.10.5

Manage Physical Access [CUI Data]

Control and manage physical access devices. PE.L2-3.10.6

Alternative Work Sites

Enforce safeguarding measures for CUI at alternate work sites. RISK ASSESSMENT (RA) Level 2

Description

RA.L2-3.11.1

Risk Assessments Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. RA.L2-3.11.2

Vulnerability Scan Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 14 RA.L2-3.11.3

Vulnerability Remediation Remediate vulnerabilities in accordance with risk assessments. Level 3

Description

RA.L3-3.11.1e

Threat-Informed Risk Assessment

Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities. RA.L3-3.11.2e

Threat Hunting

Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. RA.L3-3.11.3e

Advanced Risk Identification

Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components. RA.L3-3.11.4e

Security Solution Rationale

Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination. RA.L3-3.11.5e

Security Solution Effectiveness

Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence. RA.L3-3.11.6e

Supply Chain Risk Response

Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. RA.L3-3.11.7e

Supply Chain Risk Plan

Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident. SECURITY ASSESSMENT (CA) Level 2

Description

CA.L2-3.12.1

Security Control Assessment Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. CA.L2-3.12.2

Operational Plan of Action Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. CA.L2-3.12.3

Security Control Monitoring

Monitor security controls on an ongoing basis to determine the continued effectiveness of the controls. CA.L2-3.12.4

System Security Plan

Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 15 Level 3

Description

CA.L3-3.12.1e

Penetration Testing

Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts. SYSTEM AND COMMUNICATIONS PROTECTION (SC) Level 1

Description

SC.L1-b.1.x

Boundary Protection [FCI Data] Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. SC.L1-b.1.xi

Public-Access System Separation

[FCI Data] Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. Level 2

Description

SC.L2-3.13.1

Boundary Protection [CUI Data]

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

SC.L2-3.13.2

Security Engineering Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. SC.L2-3.13.3

Role Separation Separate user functionality from system management functionality. SC.L2-3.13.4

Shared Resource Control Prevent unauthorized and unintended information transfer via shared system resources. SC.L2-3.13.5

Public-Access System Separation

[CUI Data]

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. SC.L2-3.13.6

Network Communication by

Exception Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). SC.L2-3.13.7

Split Tunneling Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). SC.L2-3.13.8

Data in Transit Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 16 SC.L2-3.13.9

Connections Termination Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. SC.L2-3.13.10

Key Management Establish and manage cryptographic keys for cryptography employed in organizational systems. SC.L2-3.13.11

CUI Encryption

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. SC.L2-3.13.12

Collaborative Device Control

Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. SC.L2-3.13.13

Mobile Code Control and monitor the use of mobile code. SC.L2-3.13.14

Voice over Internet Protocol Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. SC.L2-3.13.15

Communications Authenticity Protect the authenticity of communications sessions. SC.L2-3.13.16

Data at Rest Protect the confidentiality of CUI at rest. Level 3

Description

SC.L3-3.13.4e

Isolation

Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components. SYSTEM AND INFORMATION INTEGRITY (SI) Level 1

Description

SI.L1-b.1.xii

Flaw Remediation [FCI Data] Identify, report, and correct information and information system flaws in a timely manner. SI.L1-b.1.xiii

Malicious Code Protection [FCI Data] Provide protection from malicious code at appropriate locations within organizational information systems. SI.L1-b.1.xiv

Update Malicious Code Protection

[FCI Data] Update malicious code protection mechanisms when new releases are available. SI.L1-b.1.xv

System & File Scanning [FCI Data] Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. Level 2

Description

SI.L2-3.14.1

Flaw Remediation [CUI Data]

Identify, report, and correct system flaws in a timely manner. SI.L2-3.14.2

Malicious Code Protection [CUI

Data]

Provide protection from malicious code at designated locations within organizational systems.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 17 SI.L2-3.14.3

Security Alerts & Advisories Monitor system security alerts and advisories and take action in response. SI.L2-3.14.4

Update Malicious Code Protection

[CUI Data]

Update malicious code protection mechanisms when new releases are available. SI.L2-3.14.5

System & File Scanning [CUI Data]

Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. SI.L2-3.14.6

Monitor Communications for

Attacks Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. SI.L2-3.14.7

Identify Unauthorized Use Identify unauthorized use of organizational systems. Level 3

Description

SI.L3-3.14.1e

Integrity Verification

Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures. SI.L3-3.14.3e

Specialized Asset Security

Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks. SI.L3-3.14.6e

Threat-Guided Intrusion Detection

Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 18 Appendix A. CMMC Model Matrix This appendix presents the model in matrix form by domain. The three columns list the associated security requirements for each CMMC level. Each level is independent and consists of a set of CMMC security requirements: • Level 1: the basic safeguarding requirements for FCI specified in FAR Clause 52.204-21.
• Level 2: the security requirements for CUI specified in NIST SP 800-171 Rev 2 per DFARS

Clause 252.204-7012

• Level 3: selected enhanced security requirements for CUI specified in NIST SP 800-172

with DoD-approved parameters where applicable.

Each requirement is contained in a single cell. The requirement identification number is bolded at the top of each cell. The next line contains the requirement short name identifier, in italics, which is meant to be used for quick reference only. Below the short name is the complete CMMC security requirement statement. Some Level 3 requirement statements contain a DoD-approved parameter, which is underlined. Finally, the bulleted list at the bottom contains the FAR Clause 52.204-21, NIST SP 800-171 Rev 2, and NIST SP 800-172 reference as appropriate.




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 19 ACCESS CONTROL (AC) Level 1

Level 2

Level 3

AC.L1-b.1.i Authorized Access Control [FCI Data] Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). • FAR Clause 52.204-21 b.1.i

• NIST SP 800-171 Rev 2 3.1.1

AC.L2-3.1.1 Authorized Access Control [CUI Data] Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). • NIST SP 800-171 Rev 2 3.1.1

• FAR Clause 52.204-21 b.1.i

AC.L3-3.1.2e Organizationally Controlled Assets Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization. • NIST SP 800-172 3.1.2e

AC.L1-b.1.ii 

Transaction & Function Control [FCI Data]

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

• FAR Clause 52.204-21 b.1.ii

• NIST SP 800-171 Rev 2 3.1.2

AC.L2-3.1.2 Transaction & Function Control [CUI Data] Limit system access to the types of transactions and functions that authorized users are permitted to execute. • NIST SP 800-171 Rev 2 3.1.2

• FAR Clause 52.204-21 b.1.ii AC.L3-3.1.3e Secured Information Transfer Employ secure information transfer solutions to control information flows between security domains on connected systems. • NIST SP 800-172 3.1.3e

AC.L1-b.1.iii External Connections [FCI Data] Verify and control/limit connections to and use of external information systems. • FAR Clause 52.204-21 b.1.iii • NIST SP 800-171 Rev 2 3.1.20

AC.L2-3.1.3 Control CUI Flow Control the flow of CUI in accordance with approved authorizations. • NIST SP 800-171 Rev 2 3.1.3

AC.L1-b.1.iv Control Public Information [FCI Data] Control information posted or processed on publicly accessible information systems. • FAR Clause 52.204-21 b.1.iv • NIST SP 800-171 Rev 2 3.1.22

AC.L2-3.1.4 Separation of Duties Separate the duties of individuals to reduce the risk of malevolent activity without collusion. • NIST SP 800-171 Rev 2 3.1.4
AC.L2-3.1.5 Least Privilege Employ the principle of least privilege, including for specific security functions and privileged accounts. • NIST SP 800-171 Rev 2 3.1.5
AC.L2-3.1.6 Non-Privileged Account Use Use non-privileged accounts or roles when accessing nonsecurity functions. • NIST SP 800-171 Rev 2 3.1.6
AC.L2-3.1.7 Privileged Functions Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. • NIST SP 800-171 Rev 2 3.1.7
AC.L2-3.1.8 Unsuccessful Logon Attempts Limit unsuccessful logon attempts. • NIST SP 800-171 Rev 2 3.1.8
AC.L2-3.1.9 Privacy & Security Notices Provide privacy and security notices consistent with applicable CUI rules. • NIST SP 800-171 Rev 2 3.1.9





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 20 Level 1

Level 2

Level 3

AC.L2-3.1.10 Session Lock Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. • NIST SP 800-171 Rev 2 3.1.10
AC.L2-3.1.11 Session Termination Terminate (automatically) a user session after a defined condition. • NIST SP 800-171 Rev 2 3.1.11
AC.L2-3.1.12 Control Remote Access Monitor and control remote access sessions. • NIST SP 800-171 Rev 2 3.1.12
AC.L2-3.1.13 Remote Access Confidentiality Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. • NIST SP 800-171 Rev 2 3.1.13
AC.L2-3.1.14 Remote Access Routing Route remote access via managed access control points. • NIST SP 800-171 Rev 2 3.1.14
AC.L2-3.1.15 Privileged Remote Access Authorize remote execution of privileged commands and remote access to security-

relevant information. • NIST SP 800-171 Rev 2 3.1.15
AC.L2-3.1.16 Wireless Access Authorization Authorize wireless access prior to allowing such connections. • NIST SP 800-171 Rev 2 3.1.16
AC.L2-3.1.17 Wireless Access Protection Protect wireless access using authentication and encryption. • NIST SP 800-171 Rev 2 3.1.17
AC.L2-3.1.18 Mobile Device Connection Control connection of mobile devices. • NIST SP 800-171 Rev 2 3.1.18
AC.L2-3.1.19 Encrypt CUI on Mobile Encrypt CUI on mobile devices and mobile computing platforms. • NIST SP 800-171 Rev 2 3.1.19
AC.L2-3.1.20 External Connections [CUI Data] Verify and control/limit connections to and use of external systems. • NIST SP 800-171 Rev 2 3.1.20

• FAR Clause 52.204-21 b.1.iii





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 21 Level 1

Level 2

Level 3

AC.L2-3.1.21 Portable Storage Use Limit use of portable storage devices on external systems. • NIST SP 800-171 Rev 2 3.1.21
AC.L2-3.1.22 Control Public Information [CUI Data] Control CUI posted or processed on publicly accessible systems. • NIST SP 800-171 Rev 2 3.1.22

• FAR Clause 52.204-21 b.1.iv





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 22 AWARENESS AND TRAINING (AT) Level 1

Level 2

Level 3

AT.L2-3.2.1 Role-Based Risk Awareness Inform managers, systems administrators, and users of organizational systems of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. • NIST SP 800-171 Rev 2 3.2.1

AT.L3-3.2.1e Advanced Threat Awareness Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually

or when there are significant changes to the threat. • NIST SP 800-172 3.2.1e

AT.L2-3.2.2 Role-Based Training Train personnel to carry out their assigned information security-related duties and responsibilities. • NIST SP 800-171 Rev 2 3.2.2

AT.L3-3.2.2e Practical Training Exercises Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors. • NIST SP 800-172 3.2.2e

AT.L2-3.2.3 Insider Threat Awareness Provide security awareness training on recognizing and reporting potential indicators of insider threat. • NIST SP 800-171 Rev 2 3.2.3





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 23 AUDIT AND ACCOUNTABILITY (AU) Level 1

Level 2

Level 3

AU.L2-3.3.1 System Auditing Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. • NIST SP 800-171 Rev 2 3.3.1
AU.L2-3.3.2 User Accountability Uniquely track the actions of individual system users, so they can be held accountable for their actions. • NIST SP 800-171 Rev 2 3.3.2
AU.L2-3.3.3 Event Review Review and update logged events. • NIST SP 800-171 Rev 2 3.3.3
AU.L2-3.3.4 Audit Failure Alerting Alert in the event of an audit logging process failure. • NIST SP 800-171 Rev 2 3.3.4
AU.L2-3.3.5 Audit Correlation Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. • NIST SP 800-171 Rev 2 3.3.5
AU.L2-3.3.6 Reduction & Reporting Provide audit record reduction and report generation to support on-demand analysis and reporting. • NIST SP 800-171 Rev 2 3.3.6
AU.L2-3.3.7 Authoritative Time Source Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. • NIST SP 800-171 Rev 2 3.3.7
AU.L2-3.3.8 Audit Protection Protect audit information and audit logging tools from unauthorized access, modification, and deletion. • NIST SP 800-171 Rev 2 3.3.8
AU.L2-3.3.9 Audit Management Limit management of audit logging functionality to a subset of privileged users. • NIST SP 800-171 Rev 2 3.3.9





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 24 CONFIGURATION MANAGEMENT (CM) Level 1

Level 2

Level 3

CM.L2-3.4.1

System Baselining Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. • NIST SP 800-171 Rev 2 3.4.1

CM.L3-3.4.1e

Authoritative Repository Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components. • NIST SP 800-172 3.4.1e

CM.L2-3.4.2

Security Configuration Enforcement Establish and enforce security configuration settings for information technology products employed in organizational systems. • NIST SP 800-171 Rev 2 3.4.2

CM.L3-3.4.2e

Automated Detection & Remediation Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a

quarantine or remediation network to facilitate patching, re-configuration, or other mitigations. • NIST SP 800-172 3.4.2e

CM.L2-3.4.3

System Change Management Track, review, approve or disapprove, and log

changes to organizational systems. • NIST SP 800-171 Rev 2 3.4.3

CM.L3-3.4.3e

Automated Inventory Employ automated discovery and management tools to maintain an up-to-

date, complete, accurate, and readily available inventory of system components.

• NIST SP 800-172 3.4.3e

CM.L2-3.4.4

Security Impact Analysis Analyze the security impact of changes prior to implementation. • NIST SP 800-171 Rev 2 3.4.4
CM.L2-3.4.5

Access Restrictions for Change Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational

systems. • NIST SP 800-171 Rev 2 3.4.5
CM.L2-3.4.6

Least Functionality Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. • NIST SP 800-171 Rev 2 3.4.6
CM.L2-3.4.7

Nonessential Functionality Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. • NIST SP 800-171 Rev 2 3.4.7





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 25 Level 1

Level 2

Level 3

CM.L2-3.4.8

Application Execution Policy Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of

authorized software. • NIST SP 800-171 Rev 2 3.4.8
CM.L2-3.4.9

User-Installed Software Control and monitor user-installed software.

• NIST SP 800-171 Rev 2 3.4.9





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 26 IDENTIFICATION AND AUTHENTICATION (IA) Level 1

Level 2

Level 3

IA.L1-b.1.v Identification [FCI Data] Identify information system users, processes acting on behalf of users, or devices. • FAR Clause 52.204-21 b.1.v • NIST SP 800-171 Rev 2 3.5.1

IA.L2-3.5.1 Identification [CUI Data] Identify system users, processes acting on behalf of users, and devices. • NIST SP 800-171 Rev 2 3.5.1

• FAR Clause 52.204-21 b.1.v IA.L3-3.5.1e Bidirectional Authentication Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant. • NIST SP 800-172 3.5.1e

IA.L1-b.1.vi Authentication [FCI Data] Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. • FAR Clause 52.204-21 b.1.vi

• NIST SP 800-171 Rev 2 3.5.2

IA.L2-3.5.2 Authentication [CUI Data] Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. • NIST SP 800-171 Rev 2 3.5.2

• FAR Clause 52.204-21 b.1.vi

IA.L3-3.5.3e Block Untrusted Assets Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile. • NIST SP 800-172 3.5.3e

IA.L2-3.5.3 Multifactor Authentication Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. • NIST SP 800-171 Rev 2 3.5.3
IA.L2-3.5.4 Replay-Resistant Authentication Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. • NIST SP 800-171 Rev 2 3.5.4
IA.L2-3.5.5 Identifier Reuse Prevent reuse of identifiers for a defined period. • NIST SP 800-171 Rev 2 3.5.5
IA.L2-3.5.6 Identifier Handling Disable identifiers after a defined period of inactivity. • NIST SP 800-171 Rev 2 3.5.6
IA.L2-3.5.7 Password Complexity Enforce a minimum password complexity and change of characters when new passwords are created. • NIST SP 800-171 Rev 2 3.5.7
IA.L2-3.5.8 Password Reuse Prohibit password reuse for a specified number of generations. • NIST SP 800-171 Rev 2 3.5.8
IA.L2-3.5.9 Temporary Passwords Allow temporary password use for system logons with an immediate change to a permanent password. • NIST SP 800-171 Rev 2 3.5.9





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 27 Level 1

Level 2

Level 3

IA.L2-3.5.10 Cryptographically-Protected Passwords Store and transmit only cryptographically-

protected passwords. • NIST SP 800-171 Rev 2 3.5.10
IA.L2-3.5.11 Obscure Feedback Obscure feedback of authentication information. • NIST SP 800-171 Rev 2 3.5.11





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 28 INCIDENT RESPONSE (IR) Level 1

Level 2

Level 3

IR.L2-3.6.1 Incident Handling Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. • NIST SP 800-171 Rev 2 3.6.1

IR.L3-3.6.1e Security Operations Center Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff. • NIST SP 800-172 3.6.1e

IR.L2-3.6.2 Incident Reporting Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. • NIST SP 800-171 Rev 2 3.6.2

IR.L3-3.6.2e Cyber Incident Response Team Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours. • NIST SP 800-172 3.6.2e

IR.L2-3.6.3 Incident Response Testing Test the organizational incident response capability. • NIST SP 800-171 Rev 2 3.6.3





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 29 MAINTENANCE (MA) Level 1

Level 2

Level 3

MA.L2-3.7.1 Perform Maintenance Perform maintenance on organizational systems. • NIST SP 800-171 Rev 2 3.7.1
MA.L2-3.7.2 System Maintenance Control Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. • NIST SP 800-171 Rev 2 3.7.2
MA.L2-3.7.3 Equipment Sanitization Sanitize equipment removed for off-site maintenance of any CUI. • NIST SP 800-171 Rev 2 3.7.3
MA.L2-3.7.4 Media Inspection Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. • NIST SP 800-171 Rev 2 3.7.4
MA.L2-3.7.5 Nonlocal Maintenance Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. • NIST SP 800-171 Rev 2 3.7.5
MA.L2-3.7.6 Maintenance Personnel Supervise the maintenance activities of maintenance personnel without required access authorization. • NIST SP 800-171 Rev 2 3.7.6





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 30 MEDIA PROECTION (MP) Level 1

Level 2

Level 3

MP.L1-b.1.vii Media Disposal [FCI Data] Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. • FAR Clause 52.204-21 b.1.vii

• NIST SP 800-171 Rev 2 3.8.3

MP.L2-3.8.1 Media Protection Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. • NIST SP 800-171 Rev 2 3.8.1

MP.L2-3.8.2 Media Access Limit access to CUI on system media to authorized users. • NIST SP 800-171 Rev 2 3.8.2
MP.L2-3.8.3 Media Disposal [CUI Data] Sanitize or destroy system media containing CUI before disposal or release for reuse. • NIST SP 800-171 Rev 2 3.8.3

• FAR Clause 52.204-21 b.1.vii
MP.L2-3.8.4 Media Markings Mark media with necessary CUI markings and distribution limitations. • NIST SP 800-171 Rev 2 3.8.4
MP.L2-3.8.5 Media Accountability Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. • NIST SP 800-171 Rev 2 3.8.5

MP.L2-3.8.6 Portable Storage Encryption Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. • NIST SP 800-171 Rev 2 3.8.6
MP.L2-3.8.7 Removable Media Control the use of removable media on system components. • NIST SP 800-171 Rev 2 3.8.7
MP.L2-3.8.8 Shared Media Prohibit the use of portable storage devices when such devices have no identifiable owner. • NIST SP 800-171 Rev 2 3.8.8
MP.L2-3.8.9 Protect Backups Protect the confidentiality of backup CUI at storage locations. • NIST SP 800-171 Rev 2 3.8.9





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 31 PERSONNEL SECURITY (PS) Level 1

Level 2

Level 3

PS.L2-3.9.1 Screen Individuals Screen individuals prior to authorizing access to organizational systems containing CUI. • NIST SP 800-171 Rev 2 3.9.1

PS.L3-3.9.2e Adverse Information Protect organizational systems when adverse information develops or is obtained about individuals with access to CUI. • NIST SP 800-172 3.9.2e

PS.L2-3.9.2 Personnel Actions Protect organizational systems containing CUI during and after personnel actions such as terminations and transfers. • NIST SP 800-171 Rev 2 3.9.2





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 32 PHYSICAL PROTECTION (PE) Level 1

Level 2

Level 3

PE.L1-b.1.viii Limit Physical Access [FCI Data] Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. • FAR Clause 52.204-21 b.1.viii • NIST SP 800-171 Rev 2 3.10.1

PE.L2-3.10.1 Limit Physical Access [CUI Data] Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. • NIST SP 800-171 Rev 2 3.10.1

• FAR Clause 52.204-21 b.1.viii PE.L1-b.1.ix Manage Visitors & Physical Access [FCI Data] Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. • FAR Clause 52.204-21 Partial b.1.ix

• NIST SP 800-171 Rev 2 3.10.3

• NIST SP 800-171 Rev 2 3.10.4

• NIST SP 800-171 Rev 2 3.10.5

PE.L2-3.10.2 Monitor Facility Protect and monitor the physical facility and support infrastructure for organizational systems. • NIST SP 800-171 Rev 2 3.10.2

PE.L2-3.10.3 Escort Visitors [CUI Data] Escort visitors and monitor visitor activity. • NIST SP 800-171 Rev 2 3.10.3

• FAR Clause 52.204-21 Partial b.1.ix
PE.L2-3.10.4 Physical Access Logs [CUI Data] Maintain audit logs of physical access. • NIST SP 800-171 Rev 2 3.10.4

• FAR Clause 52.204-21 Partial b.1.ix
PE.L2-3.10.5 Manage Physical Access [CUI Data] Control and manage physical access devices. • NIST SP 800-171 Rev 2 3.10.5

• FAR Clause 52.204-21 Partial b.1.ix
PE.L2-3.10.6 Alternative Work Sites Enforce safeguarding measures for CUI at alternate work sites. • NIST SP 800-171 Rev 2 3.10.6





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 33 RISK ASSESSMENT (RA) Level 1

Level 2

Level 3

RA.L2-3.11.1 Risk Assessments Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. • NIST SP 800-171 Rev 2 3.11.1

RA.L3-3.11.1e Threat-Informed Risk Assessment Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities. • NIST SP 800-172 3.11.1e

RA.L2-3.11.2 Vulnerability Scan Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. • NIST SP 800-171 Rev 2 3.11.2

RA.L3-3.11.2e Threat Hunting Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. • NIST SP 800-172 3.11.2e

RA.L2-3.11.3 Vulnerability Remediation Remediate vulnerabilities in accordance with risk assessments. • NIST SP 800-171 Rev 2 3.11.3

RA.L3-3.11.3e Advanced Risk Identification Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components. • NIST SP 800-172 3.11.3e
RA.L3-3.11.4e Security Solution Rationale Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination. • NIST SP 800-172 3.11.4e
RA.L3-3.11.5e Security Solution Effectiveness Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence. • NIST SP 800-172 3.11.5e
RA.L3-3.11.6e Supply Chain Risk Response Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. • NIST SP 800-172 3.11.6e





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 34 Level 1

Level 2

Level 3

RA.L3-3.11.7e Supply Chain Risk Plan Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident. • NIST SP 800-172 3.11.7e





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 35 SECURITY ASSESSMENT (CA) Level 1

Level 2

Level 3

CA.L2-3.12.1 Security Control Assessment Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. • NIST SP 800-171 Rev 2 3.12.1

CA.L3-3.12.1e Penetration Testing Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts. • NIST SP 800-172 3.12.1e

CA.L2-3.12.2 Operational Plan of Action Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. • NIST SP 800-171 Rev 2 3.12.2
CA.L2-3.12.3 Security Control Monitoring Monitor security controls on an ongoing basis to determine the continued effectiveness of the controls. • NIST SP 800-171 Rev 2 3.12.3
CA.L2-3.12.4 System Security Plan Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. • NIST SP 800-171 Rev 2 3.12.4





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 36 SYSTEM AND COMMUNICATIONS PROTECTION (SC) Level 1

Level 2

Level 3

SC.L1-b.1.x Boundary Protection [FCI Data] Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. • FAR Clause 52.204-21 b.1.x

• NIST SP 800-171 Rev 2 3.13.1

SC.L2-3.13.1 Boundary Protection [CUI Data] Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. • NIST SP 800-171 Rev 2 3.13.1

• FAR Clause 52.204-21 b.1.x

SC.L3-3.13.4e Isolation Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components. • NIST SP 800-172 3.13.4e

SC.L1-b.1.xi Public-Access System Separation [FCI Data] Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. • FAR Clause 52.204-21 b.1.xi

• NIST SP 800-171 Rev 2 3.13.5

SC.L2-3.13.2 Security Engineering Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. • NIST SP 800-171 Rev 2 3.13.2
SC.L2-3.13.3 Role Separation Separate user functionality from system management functionality. • NIST SP 800-171 Rev 2 3.13.3
SC.L2-3.13.4 Shared Resource Control Prevent unauthorized and unintended information transfer via shared system resources. • NIST SP 800-171 Rev 2 3.13.4
SC.L2-3.13.5 Public-Access System Separation [CUI Data] Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. • NIST SP 800-171 Rev 2 3.13.5

• FAR Clause 52.204-21 b.1.xi
SC.L2-3.13.6 Network Communication by Exception Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). • NIST SP 800-171 Rev 2 3.13.6
SC.L2-3.13.7 Split Tunneling Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). • NIST SP 800-171 Rev 2 3.13.7





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 37 Level 1

Level 2

Level 3

SC.L2-3.13.8 Data in Transit Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. • NIST SP 800-171 Rev 2 3.13.8
SC.L2-3.13.9 Connections Termination Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. • NIST SP 800-171 Rev 2 3.13.9
SC.L2-3.13.10 Key Management Establish and manage cryptographic keys for cryptography employed in organizational systems. • NIST SP 800-171 Rev 2 3.13.10
SC.L2-3.13.11 CUI Encryption Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. • NIST SP 800-171 Rev 2 3.13.11
SC.L2-3.13.12 Collaborative Device Control Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. • NIST SP 800-171 Rev 2 3.13.12
SC.L2-3.13.13 Mobile Code Control and monitor the use of mobile code. • NIST SP 800-171 Rev 2 3.13.13
SC.L2-3.13.14 Voice over Internet Protocol Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. • NIST SP 800-171 Rev 2 3.13.14
SC.L2-3.13.15 Communications Authenticity Protect the authenticity of communications sessions. • NIST SP 800-171 Rev 2 3.13.15
SC.L2-3.13.16 Data at Rest Protect the confidentiality of CUI at rest. • NIST SP 800-171 Rev 2 3.13.16





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 38 SYSTEM AND INFORMATION INTEGRITY (SI) Level 1

Level 2

Level 3

SI.L1-b.1.xii Flaw Remediation [FCI Data] Identify, report, and correct information and information system flaws in a timely manner. • FAR Clause 52.204-21 b.1.xii • NIST SP 800-171 Rev 2 3.14.1

SI.L2-3.14.1 Flaw Remediation [CUI Data] Identify, report, and correct system flaws in a timely manner. • NIST SP 800-171 Rev 2 3.14.1

• FAR Clause 52.204-21 b.1.xii SI.L3-3.14.1e Integrity Verification Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures. • NIST SP 800-172 3.14.1e

SI.L1-b.1.xiii Malicious Code Protection [FCI Data] Provide protection from malicious code at appropriate locations within organizational information systems. • FAR Clause 52.204-21 b.1.xiii • NIST SP 800-171 Rev 2 3.14.2

SI.L2-3.14.2 Malicious Code Protection [CUI Data] Provide protection from malicious code at designated locations within organizational systems. • NIST SP 800-171 Rev 2 3.14.2

• FAR Clause 52.204-21 b.1.xiii SI.L3-3.14.3e Specialized Asset Security Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks. • NIST SP 800-172 3.14.3e

SI.L1-b.1.xiv Update Malicious Code Protection [FCI Data] Update malicious code protection mechanisms when new releases are available. • FAR Clause 52.204-21 b.1.xiv • NIST SP 800-171 Rev 2 3.14.4

SI.L2-3.14.3 Security Alerts & Advisories Monitor system security alerts and advisories and take action in response. • NIST SP 800-171 Rev 2 3.14.3

SI.L3-3.14.6e Threat-Guided Intrusion Detection Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting. • NIST SP 800-172 3.14.6e

SI.L1-b.1.xv System & File Scanning [FCI Data] Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. • FAR Clause 52.204-21 b.1.xv • NIST SP 800-171 Rev 2 3.14.5

SI.L2-3.14.4 Update Malicious Code Protection [CUI Data] Update malicious code protection mechanisms when new releases are available. • NIST SP 800-171 Rev 2 3.14.4

• FAR Clause 52.204-21 b.1.xiv SI.L2-3.14.5 System & File Scanning [CUI Data] Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. • NIST SP 800-171 Rev 2 3.14.5

• FAR Clause 52.204-21 b.1.xv
SI.L2-3.14.6 Monitor Communications for Attacks Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. • NIST SP 800-171 Rev 2 3.14.6
SI.L2-3.14.7 Identify Unauthorized Use Identify unauthorized use of organizational systems. • NIST SP 800-171 Rev 2 3.14.7





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 39 Appendix B. Abbreviations and Acronyms The following is a list of acronyms used in the CMMC model.
AC Access Control APT Advanced Persistent Threat AT Awareness and Training AU Audit and Accountability CA Security Assessment CFR Code of Federal Regulations CM Configuration Management CMMC Cybersecurity Maturity Model Certification CUI Controlled Unclassified Information DFARS Defense Federal Acquisition Regulation Supplement DIB Defense Industrial Base DoD Department of Defense FAR Federal Acquisition Regulation FCI Federal Contract Information FFRDC Federally Funded Research and Development Center FIPS Federal Information Processing Standard IA Identification and Authentication IR Incident Response L# Level Number MA Maintenance MP Media Protection N/A Not Applicable (NA) NIST National Institute of Standards and Technology OUSD A&S Office of the Under Secretary of Defense for Acquisition and Sustainment PE Physical Protection PS Personnel Security PUB Publication Rev Revision RA Risk Assessment SC System and Communications Protection SI System and Information Integrity SP Special Publication UARC University Affiliated Research Center




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 40 U.S. United States VoIP Voice over Internet Protocol Vol. Volume




Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 41 Appendix C. References 1. U.S. Executive Office of the President, Council of Economic Advisers (CEA), The Cost of

Malicious Cyber Activity to the U.S. Economy, available online at

https://www.whitehouse.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-

Cyber-Activity-to-the-U.S.-Economy.pdf, February 2018

2. Center for Strategic and International Studies (CSIS) and McAfee, Economic Impact of

Cybercrime - No Slowing Down, February 2018

3. 48 Code of Federal Regulations (CFR) 52.204-21, Basic Safeguarding of Covered

Contractor Information Systems, Federal Acquisition Regulation (FAR), 1 Oct 2016

4. NIST Special Publication (SP) 800-171 Revision (Rev) 2, Protecting Controlled

Unclassified Information in Nonfederal Systems and Organizations, U.S. Department of

Commerce National Institute of Standards and Technology (NIST), December 2016

(updated June 2018)

5. NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified

Information: A Supplement to NIST Special Publication 800-171, U.S. Department of

Commerce National Institute of Standards and Technology (NIST), February 2021





Cybersecurity Maturity Model Certification (CMMC) Model Overview | Version 2.13 42 This page intentionally left blank.







Document Outline


Original source: https://dodcio.defense.gov/Portals/0/Documents/CMMC/ModelOverviewv2.pdf





Access Control (AC)

Level 1 Level 2 Level 3 (TBD)
AC.L1-3.1.1

Authorized Access Control

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

  • FAR Clause 52.204-21 b.1.i
  • NIST SP 800-171 Rev 2 3.1.1
 AC.L2-3.1.3

Control CUI Flow

Control the flow of CUI in accordance with approved authorizations.

  • NIST SP 800-171 Rev 2 3.1.3
AC.L1-3.1.2

Transaction & Function Control

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

  • FAR Clause 52.204-21 b.1.ii
  • NIST SP 800-171 Rev 2 3.1.2
 AC.L2-3.1.4

Separation of Duties

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

  • NIST SP 800-171 Rev 2 3.1.4
AC.L1-3.1.20

External Connections

Verify and control/limit connections to and use of external information systems.

  • FAR Clause 52.204-21 b.1.iii
  • NIST SP 800-171 Rev 2 3.1.20
 AC.L2-3.1.5

Least Privilege

Employ the principle of least privilege, including for specific security functions and privileged accounts.

  • NIST SP 800-171 Rev 2 3.1.5
AC.L1-3.1.22

Control Public Information

Control information posted or processed on publicly accessible information systems.

  • FAR Clause 52.204-21 b.1.iv
  • NIST SP 800-171 Rev 2 3.1.22
 AC.L2-3.1.6

Non-Privileged Account Use

Use non-privileged accounts or roles when accessing nonsecurity functions.

  • NIST SP 800-171 Rev 2 3.1.6
AC.L2-3.1.7

Privileged Functions

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

  • NIST SP 800-171 Rev 2 3.1.7
AC.L2-3.1.8

Unsuccessful Logon Attempts

Limit unsuccessful logon attempts.

  • NIST SP 800-171 Rev 2 3.1.8
AC.L2-3.1.9

Privacy & Security Notices

Provide privacy and security notices consistent with applicable CUI rules.

  • NIST SP 800-171 Rev 2 3.1.9
AC.L2-3.1.10

Session Lock

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

  • NIST SP 800-171 Rev 2 3.1.10
AC.L2-3.1.11

Session Termination

Terminate (automatically) a user session after a defined condition.

  • NIST SP 800-171 Rev 2 3.1.11
AC.L2-3.1.12

Control Remote Access

Monitor and control remote access sessions.

  • NIST SP 800-171 Rev 2 3.1.12
AC.L2-3.1.13

Remote Access Confidentiality

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

  • NIST SP 800-171 Rev 2 3.1.13
AC.L2-3.1.14

Remote Access Routing

Route remote access via managed access control points.

  • NIST SP 800-171 Rev 2 3.1.14
AC.L2-3.1.15

Privileged Remote Access

Authorize remote execution of privileged commands and remote access to security-relevant information.

  • NIST SP 800-171 Rev 2 3.1.15
AC.L2-3.1.16

Wireless Access Authorization

Authorize wireless access prior to allowing such connections.

  • NIST SP 800-171 Rev 2 3.1.16
AC.L2-3.1.17

Wireless Access Protection

Protect wireless access using authentication and encryption.

  • NIST SP 800-171 Rev 2 3.1.17
AC.L2-3.1.18

Mobile Device Connection

Control connection of mobile devices.

  • NIST SP 800-171 Rev 2 3.1.18
AC.L2-3.1.19

Encrypt CUI on Mobile

Encrypt CUI on mobile devices and mobile computing platforms.

  • NIST SP 800-171 Rev 2 3.1.19
AC.L2-3.1.21

Portable Storage Use Limit use of portable storage devices on external systems.

  • NIST SP 800-171 Rev 2 3.1.21

Awareness and Training (AT)

Level 1 Level 2 Level 3 (TBD)
AT.L2-3.2.1

Role-Based Risk Awareness

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

  • NIST SP 800-171 Rev 2 3.2.1
AT.L2-3.2.2

Role-Based Training

Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.

  • NIST SP 800-171 Rev 2 3.2.2
AT.L2-3.2.3

Insider Threat Awareness

Provide security awareness training on recognizing and reporting potential indicators of insider threat.

  • NIST SP 800-171 Rev 2 3.2.3

Audit and Accountability (AU)

Level 1 Level 2 Level 3 (TBD)
AU.L2-3.3.1

System Auditing

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

  • NIST SP 800-171 Rev 2 3.3.1
AU.L2-3.3.2

User Accountability

Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. • NIST SP 800-171 Rev 2 3.3.2

AU.L2-3.3.3

Event Review

Review and update logged events.

  • NIST SP 800-171 Rev 2 3.3.3
AU.L2-3.3.4

Audit Failure Alerting

Alert in the event of an audit logging process failure.

  • NIST SP 800-171 Rev 2 3.3.4
AU.L2-3.3.5

Audit Correlation

Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

  • NIST SP 800-171 Rev 2 3.3.5
AU.L2-3.3.6

Reduction & Reporting

Provide audit record reduction and report generation to support on-demand analysis and reporting.

  • NIST SP 800-171 Rev 2 3.3.6
AU.L2-3.3.7

Authoritative Time Source

Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

  • NIST SP 800-171 Rev 2 3.3.7
AU.L2-3.3.8

Audit Protection

Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

  • NIST SP 800-171 Rev 2 3.3.8
AU.L2-3.3.9

Audit Management

Limit management of audit logging functionality to a subset of privileged users.

  • NIST SP 800-171 Rev 2 3.3.9

Configuration Management (CM)

Level 1 Level 2 Level 3 (TBD)
CM.L2-3.4.1

System Baselining

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

  • NIST SP 800-171 Rev 2 3.4.1
CM.L2-3.4.2

Security Configuration Enforcement

Establish and enforce security configuration settings for information technology products employed in organizational systems.

  • NIST SP 800-171 Rev 2 3.4.2
CM.L2-3.4.3

System Change Management

Track, review, approve or disapprove, and log changes to organizational systems.

  • NIST SP 800-171 Rev 2 3.4.3
CM.L2-3.4.4

Security Impact Analysis

Analyze the security impact of changes prior to implementation.

  • NIST SP 800-171 Rev 2 3.4.4
CM.L2-3.4.5

Access Restrictions for Change

Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.

  • NIST SP 800-171 Rev 2 3.4.5
CM.L2-3.4.6

Least Functionality

Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

  • NIST SP 800-171 Rev 2 3.4.6
CM.L2-3.4.7

Nonessential Functionality

Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

  • NIST SP 800-171 Rev 2 3.4.7
CM.L2-3.4.8

Application Execution Policy

Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

  • NIST SP 800-171 Rev 2 3.4.8
CM.L2-3.4.9

User-Installed Software

Control and monitor user-installed software.

  • NIST SP 800-171 Rev 2 3.4.9

Identification and Authentication (IA)

Level 1 Level 2 Level 3 (TBD)
IA.L1-3.5.1

Identification

Identify information system users, processes acting on behalf of users, or devices.

  • FAR Clause 52.204-21 b.1.v
  • NIST SP 800-171 Rev 2 3.5.1
 IA.L2-3.5.3

Multifactor Authentication

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

  • NIST SP 800-171 Rev 2 3.5.3
IA.L1-3.5.2

Authentication

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

  • FAR Clause 52.204-21 b.1.vi
  • NIST SP 800-171 Rev 2 3.5.2
 IA.L2-3.5.4

Replay-Resistant Authentication

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

  • NIST SP 800-171 Rev 2 3.5.4
IA.L2-3.5.5

Identifier Reuse

Prevent reuse of identifiers for a defined period.

  • NIST SP 800-171 Rev 2 3.5.5
IA.L2-3.5.6

Identifier Handling

Disable identifiers after a defined period of inactivity.

  • NIST SP 800-171 Rev 2 3.5.6
IA.L2-3.5.7

Password Complexity

Enforce a minimum password complexity and change of characters when new passwords are created.

  • NIST SP 800-171 Rev 2 3.5.7
IA.L2-3.5.8

Password Reuse

Prohibit password reuse for a specified number of generations.

  • NIST SP 800-171 Rev 2 3.5.8
IA.L2-3.5.9

Temporary Passwords

Allow temporary password use for system logons with an immediate change to a permanent password.

  • NIST SP 800-171 Rev 2 3.5.9
IA.L2-3.5.10

Cryptographically-Protected Passwords

Store and transmit only cryptographically protected passwords.

  • NIST SP 800-171 Rev 2 3.5.10
IA.L2-3.5.11

Obscure Feedback

Obscure feedback of authentication information.

  • NIST SP 800-171 Rev 2 3.5.11

Incident Response (IR)

Level 1 Level 2 Level 3 (TBD)
IR.L2-3.6.1

Incident Handling

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

  • NIST SP 800-171 Rev 2 3.6.1
IR.L2-3.6.2

Incident Reporting

Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

  • NIST SP 800-171 Rev 2 3.6.2
IR.L2-3.6.3

Incident Response Testing

Test the organizational incident response capability.

  • NIST SP 800-171 Rev 2 3.6.3

Maintenance (MA)

Level 1 Level 2 Level 3 (TBD)
MA.L2-3.7.1

Perform Maintenance

Perform maintenance on organizational systems.

  • NIST SP 800-171 Rev 2 3.7.1
MA.L2-3.7.2

System Maintenance Control

Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

  • NIST SP 800-171 Rev 2 3.7.2
MA.L2-3.7.3

Equipment Sanitization

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

  • NIST SP 800-171 Rev 2 3.7.3
MA.L2-3.7.4

Media Inspection

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

  • NIST SP 800-171 Rev 2 3.7.4
MA.L2-3.7.5

Nonlocal Maintenance

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

  • NIST SP 800-171 Rev 2 3.7.5
MA.L2-3.7.6

Maintenance Personnel

Supervise the maintenance activities of maintenance personnel without required access authorization.

  • NIST SP 800-171 Rev 2 3.7.6

Media Protection (MP)

Level 1 Level 2 Level 3 (TBD)
MP.L1-3.8.3

Media Disposal

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

  • FAR Clause 52.204-21 b.1.vii
  • NIST SP 800-171 Rev 2 3.8.3
 MP.L2-3.8.1

Media Protection

Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

  • NIST SP 800-171 Rev 2 3.8.1
MP.L2-3.8.2

Media Access

Limit access to CUI on system media to authorized users.

  • NIST SP 800-171 Rev 2 3.8.2
MP.L2-3.8.4

Media Markings

Mark media with necessary CUI markings and distribution limitations.

  • NIST SP 800-171 Rev 2 3.8.4
MP.L2-3.8.5

Media Accountability

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

  • NIST SP 800-171 Rev 2 3.8.5
MP.L2-3.8.6

Portable Storage Encryption

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

  • NIST SP 800-171 Rev 2 3.8.6
MP.L2-3.8.7

Removable Media

Control the use of removable media on system components.

  • NIST SP 800-171 Rev 2 3.8.7
MP.L2-3.8.8

Shared Media

Prohibit the use of portable storage devices when such devices have no identifiable owner.

  • NIST SP 800-171 Rev 2 3.8.8
MP.L2-3.8.9

Protect Backups

Protect the confidentiality of backup CUI at storage locations.

  • NIST SP 800-171 Rev 2 3.8.9

Personnel Security (PS)

Level 1 Level 2 Level 3 (TBD)
PS.L2-3.9.1

Screen Individuals

Screen individuals prior to authorizing access to organizational systems containing CUI.

  • NIST SP 800-171 Rev 2 3.9.1
PS.L2-3.9.2

Personnel Actions

Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

  • NIST SP 800-171 Rev 2 3.9.2

Physical Protection (PE)

Level 1 Level 2 Level 3 (TBD)
PE.L1-3.10.1

Limit Physical Access

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

  • FAR Clause 52.204-21 b.1.viii
  • NIST SP 800-171 Rev 2 3.10.1
 PE.L2-3.10.2

Monitor Facility

Protect and monitor the physical facility and support infrastructure for organizational systems.

  • NIST SP 800-171 Rev 2 3.10.2
PE.L1-3.10.3

Escort Visitors

Escort visitors and monitor visitor activity.

  • FAR Clause 52.204-21 Partial b.1.ix
  • NIST SP 800-171 Rev 2 3.10.3
 PE.L2-3.10.6

Alternative Work Sites

Enforce safeguarding measures for CUI at alternate work sites.

  • NIST SP 800-171 Rev 2 3.10.6
PE.L1-3.10.4

Physical Access Logs

Maintain audit logs of physical access.

  • FAR Clause 52.204-21 Partial b.1.ix
  • NIST SP 800-171 Rev 2 3.10.4
PE.L1-3.10.5

Manage Physical Access

Control and manage physical access devices.

  • FAR Clause 52.204-21 Partial b.1.ix
  • NIST SP 800-171 Rev 2 3.10.5

Risk Assessment (RA)

Level 1 Level 2 Level 3 (TBD)
RA.L2-3.11.1

Risk Assessments

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

  • NIST SP 800-171 Rev 2 3.11.1
RA.L2-3.11.2

Vulnerability Scan

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

  • NIST SP 800-171 Rev 2 3.11.2
RA.L2-3.11.3

Vulnerability Remediation

Remediate vulnerabilities in accordance with risk assessments.

  • NIST SP 800-171 Rev 2 3.11.3

Security Assessment (CA)

Level 1 Level 2 Level 3 (TBD)
CA.L2-3.12.1

Security Control Assessment

Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

  • NIST SP 800-171 Rev 2 3.12.1
CA.L2-3.12.2

Plan of Action

Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.

  • NIST SP 800-171 Rev 2 3.12.2
CA.L2-3.12.3

Security Control Monitoring

Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

  • NIST SP 800-171 Rev 2 3.12.3
CA.L2-3.12.4

System Security Plan

Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

  • NIST SP 800-171 Rev 2 3.12.4

System and Communications Protection (SC)

Level 1 Level 2 Level 3 (TBD)
SC.L1-3.13.1

Boundary Protection

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

  • FAR Clause 52.204-21 b.1.x
  • NIST SP 800-171 Rev 2 3.13.1
 SC.L2-3.13.2

Security Engineering

Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

  • NIST SP 800-171 Rev 2 3.13.2
SC.L1-3.13.5

Public-Access System Separation

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

  • FAR Clause 52.204-21 b.1.xi
  • NIST SP 800-171 Rev 2 3.13.5
 SC.L2-3.13.3

Role Separation

Separate user functionality from system management functionality.

  • NIST SP 800-171 Rev 2 3.13.3
SC.L2-3.13.4

Shared Resource Control

Prevent unauthorized and unintended information transfer via shared system resources.

  • NIST SP 800-171 Rev 2 3.13.4
SC.L2-3.13.6

Network Communication by Exception

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

  • NIST SP 800-171 Rev 2 3.13.6
SC.L2-3.13.7

Split Tunneling

Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

  • NIST SP 800-171 Rev 2 3.13.7
SC.L2-3.13.8

Data in Transit

Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

  • NIST SP 800-171 Rev 2 3.13.8
SC.L2-3.13.9

Connections Termination

Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

  • NIST SP 800-171 Rev 2 3.13.9
SC.L2-3.13.10

Key Management

Establish and manage cryptographic keys for cryptography employed in organizational systems.

  • NIST SP 800-171 Rev 2 3.13.10
SC.L2-3.13.11

CUI Encryption

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

  • NIST SP 800-171 Rev 2 3.13.11
SC.L2-3.13.12

Collaborative Device Control

Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.

  • NIST SP 800-171 Rev 2 3.13.12
SC.L2-3.13.13

Mobile Code

Control and monitor the use of mobile code.

  • NIST SP 800-171 Rev 2 3.13.13
SC.L2-3.13.14

Voice over Internet Protocol

Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.

  • NIST SP 800-171 Rev 2 3.13.14
SC.L2-3.13.15

Communications Authenticity

Protect the authenticity of communications sessions.

  • NIST SP 800-171 Rev 2 3.13.15
SC.L2-3.13.16

Data at Rest

Protect the confidentiality of CUI at rest.

  • NIST SP 800-171 Rev 2 3.13.16

System and Information Integrity (SI)

Level 1 Level 2 Level 3 (TBD)
SI.L1-3.14.1

Flaw Remediation

Identify, report, and correct information and information system flaws in a timely manner.

  • FAR Clause 52.204-21 b.1.xii
  • NIST SP 800-171 Rev 2 3.14.1
 SI.L2-3.14.3

Security Alerts & Advisories

Monitor system security alerts and advisories and take action in response.

  • NIST SP 800-171 Rev 2 3.14.3
SI.L1-3.14.2

Malicious Code Protection

Provide protection from malicious code at appropriate locations within organizational information systems.

  • FAR Clause 52.204-21 b.1.xiii
  • NIST SP 800-171 Rev 2 3.14.2
 SI.L2-3.14.6

Monitor Communications for Attacks

Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

  • NIST SP 800-171 Rev 2 3.14.6
SI.L1-3.14.4

Update Malicious Code Protection

Update malicious code protection mechanisms when new releases are available.

  • FAR Clause 52.204-21 b.1.xiv
  • NIST SP 800-171 Rev 2 3.14.4
 SI.L2-3.14.7

Identify Unauthorized Use

Identify unauthorized use of organizational systems.

  • NIST SP 800-171 Rev 2 3.14.7
SI.L1-3.14.5

System & File Scanning

Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

  • FAR Clause 52.204-21 b.1.xv
  • NIST SP 800-171 Rev 2 3.14.5

Notes

  1. ↑ Based on information from the Federal Procurement Data System, the average number of unique prime contractors is approximately 212,657 and the number of known unique subcontractors is approximately 8,309. (FPDS from FY18-FY21).
Retrieved from "https://cmmcwiki.org/index.php?title=Model_Overview&oldid=693"