Evidence Collection Approach

CMMC assessments and certification require substantial evidence and documentation. The following tables outline general guidelines for collecting evidence to assess control requirements and objectives. While these guidelines provide a structured approach, they are not the only means of conducting an accurate assessment. Assessors should exercise professional judgment and may employ alternative methods appropriate to the specific organizational context and circumstances.

Evidence collection approaches are defined as:

• Documentation: Tangible materials containing information over which an organization has authority, including all types of written records and their copies.
• Artifacts: Tangible, reviewable records directly resulting from a practice or process being performed by a system or by personnel executing their role within that practice, control, or process.
• Physical Review: Direct on-site observation and examination of evidence.
• Screen Share: Real-time remote observation of a user demonstrating a task or process via shared computer screen, sometimes called "over-the-shoulder" review.

For inquiries and reporting errors on this wiki, please contact us. Thank you.

Access Control (AC)

AC.L2-3.1.1 – Authorized Access Control [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.1 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
[a] authorized users are identified.	Document	Example
[b] processes acting on behalf of authorized users are identified.	Document	Example
[c] devices (and other systems) authorized to connect to the system are identified.	Document	Example
[d] system access is limited to authorized users.	Screen Share	Example
[e] system access is limited to processes acting on behalf of authorized users.	Screen Share	Example
[f] system access is limited to authorized devices (including other systems).	Screen Share	Example

AC.L2-3.1.2 – Transaction & Function Control [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.2 Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
[a] the types of transactions and functions that authorized users are permitted to execute are defined.	Document	Example
[b] system access is limited to the defined types of transactions and functions for authorized users.	Screen Share	Example

AC.L2-3.1.3 – Control CUI Flow

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations.
[a] information flow control policies are defined.	Document	Example
[b] methods and enforcement mechanisms for controlling the flow of CUI are defined.	Document	Example
[c] designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified.	Document	Example
[d] authorizations for controlling the flow of CUI are defined.	Document	Example
[e] approved authorizations for controlling the flow of CUI are enforced

AC.L2-3.1.4 – Separation of Duties

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
[a] the duties of individuals requiring separation are defined.	Document	Example
[b] responsibilities for duties that require separation are assigned to separate individuals.	Document	Example
[c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals

AC.L2-3.1.5 – Least Privilege

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
[a] privileged accounts are identified.	Document	Example
[b] access to privileged accounts is authorized in accordance with the principle of least privilege.	Document	Example
[c] security functions are identified.	Document	Example
[d] access to security functions is authorized in accordance with the principle of least privilege.	Document	Example

AC.L2-3.1.6 – Non-Privileged Account Use

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
[a] nonsecurity functions are identified.	Document	Example
[b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions.	Document	Example

AC.L2-3.1.7 – Privileged Functions

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
[a] privileged functions are defined.	Document	Example
[b] non-privileged users are defined.	Document	Example
[c] non-privileged users are prevented from executing privileged functions.	Document	Example
[d] the execution of privileged functions is captured in audit logs.	Document	Example

AC.L2-3.1.8 – Unsuccessful Logon Attempts

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.8 Limit unsuccessful logon attempts.
[a] the means of limiting unsuccessful logon attempts is defined.	Document	Example
[b] the defined means of limiting unsuccessful logon attempts is implemented.	Document	Example

AC.L2-3.1.9 – Privacy & Security Notices

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.9 Provide privacy and security notices consistent with applicable CUI rules.
[a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category.	Document	Example
[b] privacy and security notices are displayed.	Document	Example

AC.L2-3.1.10 – Session Lock

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.10 Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
[a] the period of inactivity after which the system initiates a session lock is defined.	Document	Example
[b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity.	Document	Example
[c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.	Document	Example

AC.L2-3.1.11 – Session Termination

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.11 Terminate (automatically) a user session after a defined condition.
[a] conditions requiring a user session to terminate are defined.	Document	Example
[b] a user session is automatically terminated after any of the defined conditions.	Document	Example

AC.L2-3.1.12 – Control Remote Access

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.12 Monitor and control remote access sessions.
[a] remote access sessions are permitted.	Document	Example
[b] the types of permitted remote access are identified.	Document	Example
[c] remote access sessions are controlled.	Document	Example
[d] remote access sessions are monitored.	Document	Example

AC.L2-3.1.13 – Remote Access Confidentiality

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
[a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified.	Document	Example
[b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.	Document	Example

AC.L2-3.1.14 – Remote Access Routing

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.14 Route remote access via managed access control points.
[a] managed access control points are identified and implemented.	Document	Example
[b] remote access is routed through managed network access control points.	Document	Example

AC.L2-3.1.15 – Privileged Remote Access

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.15 Authorize remote execution of privileged commands and remote access to security-relevant information.
[a] privileged commands authorized for remote execution are identified.	Document	Example
[b] security-relevant information authorized to be accessed remotely is identified.	Document	Example
[c] the execution of the identified privileged commands via remote access is authorized.	Document	Example
[d] access to the identified security-relevant information via remote access is authorized.	Document	Example

AC.L2-3.1.16 – Wireless Access Authorization

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.16 Authorize wireless access prior to allowing such connections.
[a] wireless access points are identified.	Document	Example
[b] wireless access is authorized prior to allowing such connections.	Document	Example

AC.L2-3.1.17 – Wireless Access Protection

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.17 Protect wireless access using authentication and encryption.
[a] wireless access to the system is protected using authentication.	Document	Example
[b] wireless access to the system is protected using encryption.	Document	Example

AC.L2-3.1.18 – Mobile Device Connection

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.18 Control connection of mobile devices.
[a] mobile devices that process, store, or transmit CUI are identified.	Document	Example
[b] mobile device connections are authorized.	Document	Example
[c] mobile device connections are monitored and logged.	Document	Example

AC.L2-3.1.19 – Encrypt CUI on Mobile

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.19 Encrypt CUI on mobile devices and mobile computing platforms.
[a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified.	Document	Example
[b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.	Document	Example

AC.L2-3.1.20 – External Connections [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.20 Verify and control/limit connections to and use of external information systems.
[a] connections to external systems are identified.	Document	Example
[b] the use of external systems is identified.	Document	Example
[c] connections to external systems are verified.	Document	Example
[d] the use of external systems is verified.	Document	Example
[e] connections to external systems are controlled/limited.	Document	Example
[f] the use of external systems is controlled/limited.	Document	Example

AC.L2-3.1.21 – Portable Storage Use

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.21 Limit use of portable storage devices on external systems.
[a] the use of portable storage devices containing CUI on external systems is identified and documented.	Document	Example
[b] limits on the use of portable storage devices containing CUI on external systems are defined.	Document	Example
[c] the use of portable storage devices containing CUI on external systems is limited as defined.	Document	Example

AC.L2-3.1.22 – Control Public Information [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.1.22 Control information posted or processed on publicly accessible information systems.
[a] individuals authorized to post or process information on publicly accessible systems are identified.	Document	Example
[b] procedures to ensure CUI is not posted or processed on publicly accessible systems are identified.	Document	Example
[c] a review process is in place prior to posting of any content to publicly accessible systems.	Document	Example
[d] content on publicly accessible systems is reviewed to ensure that it does not include CUI.	Document	Example
[e] mechanisms are in place to remove and address improper posting of CUI.	Document	Example

Awareness and Training (AT)

AT.L2-3.2.1 – Role-Based Risk Awareness

Assessment Objectives	Collection Approach	Evidence Examples
AT.L2-3.2.1 Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
[a] security risks associated with organizational activities involving CUI are identified.	Document	Example
[b] policies, standards, and procedures related to the security of the system are identified.	Document	Example
[c] managers, systems administrators, and users of the system are made aware of the security risks associated with their activities.	Document	Example
[d] managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.	Document	Example

AT.L2-3.2.2 – Role-Based Training

Assessment Objectives	Collection Approach	Evidence Examples
AT.L2-3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.|-
[a] information security-related duties, roles, and responsibilities are defined.	Document	Example
[b] information security-related duties, roles, and responsibilities are assigned to designated personnel.	Document	Example
[c] personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities.	Document	Example

AT.L2-3.2.3 – Insider Threat Awareness

Assessment Objectives	Collection Approach	Evidence Examples
AT.L2-3.2.3 Provide security awareness training on recognizing and reporting potential indicators of insider threat.
[a] potential indicators associated with insider threats are identified.	Document	Example
[b] security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.	Document	Example

Audit and Accountability (AU)

AU.L2-3.3.1 – System Auditing

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
[a] audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified.	Document	Example
[b] the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined.	Document	Example
[c] audit records are created (generated).	Document	Example
[d] audit records, once created, contain the defined content.	Document	Example
[e] retention requirements for audit records are defined.	Document	Example
[f] audit records are retained as defined.	Document	Example

AU.L2-3.3.2 – User Accountability

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
[a] the content of the audit records needed to support the ability to uniquely trace users to their actions is defined.	Document	Example
[b] audit records, once created, contain the defined content.	Document	Example

AU.L2-3.3.3 – Event Review

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.3 Review and update logged events.
[a] a process for determining when to review logged events is defined.	Document	Example
[b] event types being logged are reviewed in accordance with the defined review process.	Document	Example
[c] event types being logged are updated based on the review.	Document	Example

AU.L2-3.3.4 – Audit Failure Alerting

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.4 Alert in the event of an audit logging process failure.
[a] personnel or roles to be alerted in the event of an audit logging process failure are identified.	Document	Example
[b] types of audit logging process failures for which alert will be generated are defined.	Document	Example
[c] identified personnel or roles are alerted in the event of an audit logging process failure.	Document	Example

AU.L2-3.3.5 – Audit Correlation

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
[a] audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined.	Document	Example
[b] defined audit record review, analysis, and reporting processes are correlated.	Document	Example

AU.L2-3.3.6 – Reduction & Reporting

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.6 Provide audit record reduction and report generation to support on-demand analysis and reporting.
[a] an audit record reduction capability that supports on-demand analysis is provided.	Document	Example
[b] a report generation capability that supports on-demand reporting is provided.	Document	Example

AU.L2-3.3.7 – Authoritative Time Source

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.7 Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
[a] internal system clocks are used to generate time stamps for audit records.	Document	Example
[b] an authoritative source with which to compare and synchronize internal system clocks is specified.	Document	Example
[c] internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source.	Document	Example

AU.L2-3.3.8 – Audit Protection

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.8 Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
[a] audit information is protected from unauthorized access.	Document	Example
[b] audit information is protected from unauthorized modification.	Document	Example
[c] audit information is protected from unauthorized deletion.	Document	Example
[d] audit logging tools are protected from unauthorized access.	Document	Example
[e] audit logging tools are protected from unauthorized modification.	Document	Example
[f] audit logging tools are protected from unauthorized deletion.	Document	Example

AU.L2-3.3.9 – Audit Management

Assessment Objectives	Collection Approach	Evidence Examples
AU.L2-3.3.9 Limit management of audit logging functionality to a subset of privileged users.
[a] a subset of privileged users granted access to manage audit logging functionality is defined.	Document	Example
[b] management of audit logging functionality is limited to the defined subset of privileged users.	Document	Example

Configuration Management (CM)

CM.L2-3.4.1 – System Baselining

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
[a] a baseline configuration is established.	Document	Example
[b] the baseline configuration includes hardware, software, firmware, and documentation.	Document	Example
[c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle.	Document	Example
[d] a system inventory is established.	Document	Example
[e] the system inventory includes hardware, software, firmware, and documentation.	Document	Example
[f] the inventory is maintained (reviewed and updated) throughout the system development life cycle.	Document	Example

CM.L2-3.4.2 – Security Configuration Enforcement

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems.
[a] security configuration settings for information technology products employed in the system are established and included in the baseline configuration.	Document	Example
[b] security configuration settings for information technology products employed in the system are enforced.	Document	Example

CM.L2-3.4.3 – System Change Management

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.3 Track, review, approve or disapprove, and log changes to organizational systems.
[a] changes to the system are tracked.	Document	Example
[b] changes to the system are reviewed.	Document	Example
[c] changes to the system are approved or disapproved.	Document	Example
[d] changes to the system are logged.	Document	Example

CM.L2-3.4.4 – Security Impact Analysis

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.4 Analyze the security impact of changes prior to implementation.
[a] the security impact of changes to the system is analyzed prior to implementation.	Document	Example

CM.L2-3.4.5 – Access Restrictions for Change

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
[a] physical access restrictions associated with changes to the system are defined.	Document	Example
[b] physical access restrictions associated with changes to the system are documented.	Document	Example
[c] physical access restrictions associated with changes to the system are approved.	Document	Example
[d] physical access restrictions associated with changes to the system are enforced.	Document	Example
[e] logical access restrictions associated with changes to the system are defined.	Document	Example
[f] logical access restrictions associated with changes to the system are documented.	Document	Example
[g] logical access restrictions associated with changes to the system are approved.	Document	Example
[h] logical access restrictions associated with changes to the system are enforced.	Document	Example

CM.L2-3.4.6 – Least Functionality

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
[a] essential system capabilities are defined based on the principle of least functionality.	Document	Example
[b] the system is configured to provide only the defined essential capabilities.	Document	Example

CM.L2-3.4.7 – Nonessential Functionality

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
[a] essential programs are defined.	Document	Example
[b] the use of nonessential programs is defined.	Document	Example
[c] the use of nonessential programs is restricted, disabled, or prevented as defined.	Document	Example
[d] essential functions are defined.	Document	Example
[e] the use of nonessential functions is defined.	Document	Example
[f] the use of nonessential functions is restricted, disabled, or prevented as defined.	Document	Example
[g] essential ports are defined.	Document	Example
[h] the use of nonessential ports is defined.	Document	Example
[i] the use of nonessential ports is restricted, disabled, or prevented as defined.	Document	Example
[j] essential protocols are defined.	Document	Example
[k] the use of nonessential protocols is defined.	Document	Example
[l] the use of nonessential protocols is restricted, disabled, or prevented as defined.	Document	Example
[m] essential services are defined.	Document	Example
[n] the use of nonessential services is defined.	Document	Example
[o] the use of nonessential services is restricted, disabled, or prevented as defined.	Document	Example

CM.L2-3.4.8 – Application Execution Policy

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.8 Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
[a] a policy specifying whether whitelisting or blacklisting is to be implemented is specified.	Document	Example
[b] the software allowed to execute under whitelisting or denied use under blacklisting is specified.	Document	Example
[c] whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.	Document	Example

CM.L2-3.4.9 – User-Installed Software

Assessment Objectives	Collection Approach	Evidence Examples
CM.L2-3.4.9 Control and monitor user-installed software.
[a] a policy for controlling the installation of software by users is established.	Document	Example
[b] installation of software by users is controlled based on the established policy.	Document	Example
[c] installation of software by users is monitored.	Document	Example

Identification and Authentication (IA)

IA.L2-3.5.1 – Identification [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.1 Identify information system users, processes acting on behalf of users, or devices.
[a] system users are identified.	Document	Example
[b] processes acting on behalf of users are identified.	Document	Example
[c] devices accessing the system are identified.	Document	Example

IA.L2-3.5.2 – Authentication [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.2 Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
[a] the identity of each user is authenticated or verified as a prerequisite to system access.	Document	Example
[b] the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access.	Document	Example
[c] the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.	Document	Example

IA.L2-3.5.3 – Multifactor Authentication

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.3 Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
[a] privileged accounts are identified.	Document	Example
[b] multifactor authentication is implemented for local access to privileged accounts.	Document	Example
[c] multifactor authentication is implemented for network access to privileged accounts.	Document	Example
[d] multifactor authentication is implemented for network access to non-privileged accounts.	Document	Example

IA.L2-3.5.4 – Replay-Resistant Authentication

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.4 Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
[a] replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts.	Document	Example

IA.L2-3.5.5 – Identifier Reuse

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.5 Prevent reuse of identifiers for a defined period.
[a] a period within which identifiers cannot be reused is defined.	Document	Example
[b] reuse of identifiers is prevented within the defined period.	Document	Example

IA.L2-3.5.6 – Identifier Handling

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.6 Disable identifiers after a defined period of inactivity.
[a] a period of inactivity after which an identifier is disabled is defined.	Document	Example
[b] identifiers are disabled after the defined period of inactivity.	Document	Example

IA.L2-3.5.7 – Password Complexity

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created.
[a] password complexity requirements are defined.	Document	Example
[b] password change of character requirements are defined.	Document	Example
[c] minimum password complexity requirements as defined are enforced when new passwords are created.	Document	Example
[d] minimum password change of character requirements as defined are enforced when new passwords are created.	Document	Example

IA.L2-3.5.8 – Password Reuse

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.8 Prohibit password reuse for a specified number of generations.
[a] the number of generations during which a password cannot be reused is specified and [b] reuse of passwords is prohibited during the specified number of generations.	Document	Example

IA.L2-3.5.9 – Temporary Passwords

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.9 Allow temporary password use for system logons with an immediate change to a permanent password.
[a] an immediate change to a permanent password is required when a temporary password is used for system logon.	Document	Example

IA.L2-3.5.10 – Cryptographically-Protected Passwords

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.1 Store and transmit only cryptographically-protected passwords.
[a] passwords are cryptographically protected in storage.	Document	Example
[b] passwords are cryptographically protected in transit.	Document	Example

IA.L2-3.5.11 – Obscure Feedback

Assessment Objectives	Collection Approach	Evidence Examples
IA.L2-3.5.10 Obscure feedback of authentication information.
[a] authentication information is obscured during the authentication process.	Document	Example

Incident Response (IR)

IR.L2-3.6.1 – Incident Handling

Assessment Objectives	Collection Approach	Evidence Examples
IR.L2-3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
[a] an operational incident-handling capability is established.	Document	Example
[b] the operational incident-handling capability includes preparation.	Document	Example
[c] the operational incident-handling capability includes detection.	Document	Example
[d] the operational incident-handling capability includes analysis.	Document	Example
[e] the operational incident-handling capability includes containment.	Document	Example
[f] the operational incident-handling capability includes recovery.	Document	Example
[g] the operational incident-handling capability includes user response.	Document	Example

IR.L2-3.6.2 – Incident Reporting

Assessment Objectives	Collection Approach	Evidence Examples
IR.L2-3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
[a] incidents are tracked.	Document	Example
[b] incidents are documented.	Document	Example
[c] authorities to whom incidents are to be reported are identified.	Document	Example
[d] organizational officials to whom incidents are to be reported are identified.	Document	Example
[e] identified authorities are notified of incidents.	Document	Example
[f] identified organizational officials are notified of incidents.	Document	Example

IR.L2-3.6.3 – Incident Response Testing

Assessment Objectives	Collection Approach	Evidence Examples
IR.L2-3.6.3 Test the organizational incident response capability.
[a] the incident response capability is tested.	Document	Example

Maintenance (MA)

MA.L2-3.7.1 – Perform Maintenance

Assessment Objectives	Collection Approach	Evidence Examples
MA.L2-3.7.1 Perform maintenance on organizational systems.
[a] system maintenance is performed.	Document	Example

MA.L2-3.7.2 – System Maintenance Control

Assessment Objectives	Collection Approach	Evidence Examples
MA.L2-3.7.2 Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
[a] tools used to conduct system maintenance are controlled.	Document	Example
[b] techniques used to conduct system maintenance are controlled.	Document	Example
[c] mechanisms used to conduct system maintenance are controlled.	Document	Example
[d] personnel used to conduct system maintenance are controlled.	Document	Example

MA.L2-3.7.3 – Equipment Sanitization

Assessment Objectives	Collection Approach	Evidence Examples
MA.L2-3.7.3 Ensure equipment removed for off-site maintenance is sanitized of any CUI.
[a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.	Document	Example

MA.L2-3.7.4 – Media Inspection

Assessment Objectives	Collection Approach	Evidence Examples
MA.L2-3.7.4 Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
[a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI.	Document	Example

MA.L2-3.7.5 – Nonlocal Maintenance

Assessment Objectives	Collection Approach	Evidence Examples
MA.L2-3.7.5 Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
[a] multifactor authentication is used to establish nonlocal maintenance sessions via external network connections.	Document	Example
[b] nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.	Document	Example

MA.L2-3.7.6 – Maintenance Personnel

Assessment Objectives	Collection Approach	Evidence Examples
MA.L2-3.7.6 Supervise the maintenance activities of maintenance personnel without required access authorization.
[a] maintenance personnel without required access authorization are supervised during maintenance activities.	Document	Example

Media Protection (MP)

MP.L2-3.8.1 – Media Protection

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.1 Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
[a] paper media containing CUI is physically controlled.	Document	Example
[b] digital media containing CUI is physically controlled.	Document	Example
[c] paper media containing CUI is securely stored.	Document	Example
[d] digital media containing CUI is securely stored.	Document	Example

MP.L2-3.8.2 – Media Access

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.2 Limit access to CUI on system media to authorized users.
[a] access to CUI on system media is limited to authorized users.	Document	Example

MP.L2-3.8.3 – Media Disposal [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.3 Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
[a] system media containing CUI is sanitized or destroyed before disposal.	Document	Example
[b] system media containing CUI is sanitized before it is released for reuse.	Document	Example

MP.L2-3.8.4 – Media Markings

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.4 Mark media with necessary CUI markings and distribution limitations.
[a] media containing CUI is marked with applicable CUI markings.	Document	Example
[b] media containing CUI is marked with distribution limitations.	Document	Example

MP.L2-3.8.5 – Media Accountability

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.5 Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
[a] access to media containing CUI is controlled.	Document	Example
[b] accountability for media containing CUI is maintained during transport outside of controlled areas.	Document	Example

MP.L2-3.8.6 – Portable Storage Encryption

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.6 Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
[a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.	Document	Example

MP.L2-3.8.7 – Removable Media

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.7 Control the use of removable media on system components.
[a] the use of removable media on system components is controlled.	Document	Example

MP.L2-3.8.8 – Shared Media

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.8 Prohibit the use of portable storage devices when such devices have no identifiable owner.ASSESSMENT OBJECTIVES
[a] the use of portable storage devices is prohibited when such devices have no identifiable owner.	Document	Example

MP.L2-3.8.9 – Protect Backups

Assessment Objectives	Collection Approach	Evidence Examples
MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations.
[a] the confidentiality of backup CUI is protected at storage locations.	Document	Example

Personnel Security (PS)

PS.L2-3.9.1 – Screen Individuals

Assessment Objectives	Collection Approach	Evidence Examples
PS.L2-3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.
[a] individuals are screened prior to authorizing access to organizational systems containing CUI.	Document	Example

PS.L2-3.9.2 – Personnel Actions

Assessment Objectives	Collection Approach	Evidence Examples
PS.L2-3.9.2 Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
[a] a policy and/or process for terminating system access and any credentials coincident with personnel actions is established.	Document	Example
[b] system access and credentials are terminated consistent with personnel actions such as termination or transfer.	Document	Example
[c] the system is protected during and after personnel transfer actions.	Document	Example

Physical Protection (PE)

PE.L2-3.10.1 – Limit Physical Access [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
PE.L2-3.10.1 Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
[a] authorized individuals allowed physical access are identified.	Document	Example
[b] physical access to organizational systems is limited to authorized individuals.	Document	Example
[c] physical access to equipment is limited to authorized individuals.	Document	Example
[d] physical access to operating environments is limited to authorized.	Document	Example

PE.L2-3.10.2 – Monitor Facility

Assessment Objectives	Collection Approach	Evidence Examples
PE.L2-3.10.2 Protect and monitor the physical facility and support infrastructure for organizational systems.
[a] the physical facility where organizational systems reside is protected.	Document	Example
[b] the support infrastructure for organizational systems is protected.	Document	Example
[c] the physical facility where organizational systems reside is monitored.	Document	Example
[d] the support infrastructure for organizational systems is monitored.	Document	Example

PE.L2-3.10.3 – Escort Visitors [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
PE.L2-3.10.3 Escort visitors and monitor visitor activity.
[a] visitors are escorted.	Document	Example
[b] visitor activity is monitored.	Document	Example

PE.L2-3.10.4 – Physical Access Logs [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
PE.L2-3.10.4 Maintain audit logs of physical access.
[a] audit logs of physical access are maintained.	Document	Example

PE.L2-3.10.5 – Manage Physical Access [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
PE.L2-3.10.5 Control and manage physical access devices.
[a] physical access devices are identified.	Document	Example
[b] physical access devices are controlled.	Document	Example
[c] physical access devices are managed.	Document	Example

PE.L2-3.10.6 – Alternative Work Sites

Assessment Objectives	Collection Approach	Evidence Examples
PE.L2-3.10.6 Enforce safeguarding measures for CUI at alternate work sites.
[a] safeguarding measures for CUI are defined for alternate work sites.	Document	Example
[b] safeguarding measures for CUI are enforced for alternate work sites.	Document	Example

Risk Assessment (RA)

RA.L2-3.11.1 – Risk Assessments

Assessment Objectives	Collection Approach	Evidence Examples
RA.L2-3.11.1 Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
[a] the frequency to assess risk to organizational operations, organizational assets, and individuals is defined.	Document	Example
[b] risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency.	Document	Example

RA.L2-3.11.2 – Vulnerability Scan

Assessment Objectives	Collection Approach	Evidence Examples
RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
[a] the frequency to scan for vulnerabilities in organizational systems and applications is defined.	Document	Example
[b] vulnerability scans are performed on organizational systems with the defined frequency.	Document	Example
[c] vulnerability scans are performed on applications with the defined frequency.	Document	Example
[d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified.	Document	Example
[e] vulnerability scans are performed on applications when new vulnerabilities are identified. || Document || Example

RA.L2-3.11.3 – Vulnerability Remediation

Assessment Objectives	Collection Approach	Evidence Examples
RA.L2-3.11.3 Remediate vulnerabilities in accordance with risk assessments.
[a] vulnerabilities are identified.	Document	Example
[b] vulnerabilities are remediated in accordance with risk assessments.	Document	Example

Security Assessment (CA)

CA.L2-3.12.1 – Security Control Assessment

Assessment Objectives	Collection Approach	Evidence Examples
CA.L2-3.12.1 Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
[a] the frequency of security control assessments is defined.	Document	Example
[b] security controls are assessed with the defined frequency to determine if the controls are effective in their application.	Document	Example

CA.L2-3.12.2 – Operational Plan of Action

Assessment Objectives	Collection Approach	Evidence Examples
CA.L2-3.12.2 Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
[a] deficiencies and vulnerabilities to be addressed by the plan of action are identified.	Document	Example
[b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities.	Document	Example
[c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.	Document	Example

CA.L2-3.12.3 – Security Control Monitoring

Assessment Objectives	Collection Approach	Evidence Examples
CA.L2-3.12.3 Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
[a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.	Document	Example

CA.L2-3.12.4 – System Security Plan =

Assessment Objectives	Collection Approach	Evidence Examples
CA.L2-3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
[a] a system security plan is developed.	Document	Example
[b] the system boundary is described and documented in the system security plan.	Document	Example
[c] the system environment of operation is described and documented in the system security plan.	Document	Example
[d] the security requirements identified and approved by the designated authority as non-applicable are identified.	Document	Example
[e] the method of security requirement implementation is described and documented in the system security plan.	Document	Example
[f] the relationship with or connection to other systems is described and documented in the system security plan.	Document	Example
[g] the frequency to update the system security plan is defined.	Document	Example
[h] system security plan is updated with the defined frequency.	Document	Example

System and Communications Protection (SC)

SC.L2-3.13.1 – Boundary Protection [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
[a] the external system boundary is defined.	Document	Example
[b] key internal system boundaries are defined.	Document	Example
[c] communications are monitored at the external system boundary.	Document	Example
[d] communications are monitored at key internal boundaries.	Document	Example
[e] communications are controlled at the external system boundary.	Document	Example
[f] communications are controlled at key internal boundaries.	Document	Example
[g] communications are protected at the external system boundary.	Document	Example
[h] communications are protected at key internal boundaries.	Document	Example

SC.L2-3.13.2 – Security Engineering

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
[a] architectural designs that promote effective information security are identified.	Document	Example
[b] software development techniques that promote effective information security are identified.	Document	Example
[c] systems engineering principles that promote effective information security are identified.	Document	Example
[d] identified architectural designs that promote effective information security are employed.	Document	Example
[e] identified software development techniques that promote effective information security are employed.	Document	Example
[f] identified systems engineering principles that promote effective information security are employed.	Document	Example

SC.L2-3.13.3 – Role Separation

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Separate user functionality from system management functionality.
[a] user functionality is identified.	Document	Example
[b] system management functionality is identified.	Document	Example
[c] user functionality is separated from system management functionality.	Document	Example

SC.L2-3.13.4 – Shared Resource Control

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Prevent unauthorized and unintended information transfer via shared system resources.
[a] unauthorized and unintended information transfer via shared system resources is prevented.	Document	Example

SC.L2-3.13.5 – Public-Access System Separation [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
[a] publicly accessible system components are identified.	Document	Example
[b] subnetworks for publicly accessible system components are physically or logically separated from internal networks.	Document	Example

SC.L2-3.13.6 – Network Communication by Exception

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
[a] network communications traffic is denied by default.	Document	Example
[b] network communications traffic is allowed by exception.	Document	Example

SC.L2-3.13.7 – Split Tunneling

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
[a] remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).	Document	Example

SC.L2-3.13.8 – Data in Transit

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
[a] cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified.	Document	Example
[b] alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified.	Document	Example
[c] either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission.	Document	Example

SC.L2-3.13.9 – Connections Termination

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
[a] a period of inactivity to terminate network connections associated with communications sessions is defined.	Document	Example
[b] network connections associated with communications sessions are terminated at the end of the sessions.	Document	Example
[c] network connections associated with communications sessions are terminated after the defined period of inactivity.	Document	Example

SC.L2-3.13.10 – Key Management

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Establish and manage cryptographic keys for cryptography employed in organizational systems.
[a] cryptographic keys are established whenever cryptography is employed.	Document	Example
[b] cryptographic keys are managed whenever cryptography is employed.	Document	Example

SC.L2-3.13.11 – CUI Encryption

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
[a] FIPS-validated cryptography is employed to protect the confidentiality of CUI.	Document	Example

SC.L2-3.13.12 – Collaborative Device Control

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
[a] collaborative computing devices are identified.	Document	Example
[b] collaborative computing devices provide indication to users of devices in use.	Document	Example
[c] remote activation of collaborative computing devices is prohibited.	Document	Example

SC.L2-3.13.13 – Mobile Code

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Control and monitor the use of mobile code.
[a] use of mobile code is controlled.	Document	Example
[b] use of mobile code is monitored.	Document	Example

SC.L2-3.13.14 – Voice over Internet Protocol

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
[a] use of Voice over Internet Protocol (VoIP) technologies is controlled.	Document	Example
[b] use of Voice over Internet Protocol (VoIP) technologies is monitored.	Document	Example

SC.L2-3.13.15 – Communications Authenticity

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Protect the authenticity of communications sessions.
[a] the authenticity of communications sessions is protected.	Document	Example

SC.L2-3.13.16 – Data at Rest

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Protect the confidentiality of CUI at rest.
[a] the confidentiality of CUI at rest is protected.	Document	Example

System and Information Integrity (SI)

SI.L2-3.14.1 – Flaw Remediation [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Identify, report, and correct information and information system flaws in a timely manner.
[a] the time within which to identify system flaws is specified.	Document	Example
[b] system flaws are identified within the specified time frame.	Document	Example
[c] the time within which to report system flaws is specified.	Document	Example
[d] system flaws are reported within the specified time frame.	Document	Example
[e] the time within which to correct system flaws is specified.	Document	Example
[f] system flaws are corrected within the specified time frame.	Document	Example

SI.L2-3.14.2 – Malicious Code ProTection [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Provide protection from malicious code at appropriate locations within organizational information systems.
[a] designated locations for malicious code protection are identified.	Document	Example
[b] protection from malicious code at designated locations is provided.	Document	Example

SI.L2-3.14.3 – Security Alerts & Advisories

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Monitor system security alerts and advisories and take action in response.
[a] response actions to system security alerts and advisories are identified.	Document	Example
[b] system security alerts and advisories are monitored.	Document	Example
[c] actions in response to system security alerts and advisories are taken.	Document	Example

SI.L2-3.14.4 – Update Malicious Code Protection [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Update malicious code protection mechanisms when new releases are available.
[a] malicious code protection mechanisms are updated when new releases are available.	Document	Example

SI.L2-3.14.5 – System & File Scanning [CUI Data]

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
[a] the frequency for malicious code scans is defined.	Document	Example
[b] malicious code scans are performed with the defined frequency.	Document	Example
[c] real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.	Document	Example

SI.L2-3.14.6 – Monitor Communications for Attacks

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
[a] the system is monitored to detect attacks and indicators of potential attacks.	Document	Example
[b] inbound communications traffic is monitored to detect attacks and indicators of potential attacks.	Document	Example
[c] outbound communications traffic is monitored to detect attacks and indicators of potential attacks.	Document	Example

SI.L2-3.14.7 – Identify Unauthorized Use

Assessment Objectives	Collection Approach	Evidence Examples
AC.L2-3.x.1 Identify unauthorized use of organizational systems.
[a] authorized use of the system is defined.	Document	Example
[b] unauthorized use of the system is identified.	Document	Example