Main public logs

Combined display of all available logs of CMMC Toolkit Wiki. You can narrow down the view by selecting a log type, the username (case-sensitive), or the affected page (also case-sensitive).

04:29, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.4.a (Created page with "For the assessment objective "[a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?"")
04:29, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.4 (Created page with "I am a cybersecurity manager working for an organization that is a DoD contractor. I need to implement various security practices that conform to DoD's CMMC program at level 2. The CMMC program stipulates security practices that are based on NIST Special Publication 800-171 R2. For each security practice of CMMC Level 2, I need to show evidence that my organization is in compliance with CMMC. Each security practice has a security requirement and several assessment object...")
04:22, 2 April 2025 David talk contribs created page LLMResponse MA.L2-3.7.3.a (Created page with "I'll help you rank the evidence types and prioritize assessment approaches for assessing compliance with MA.L2-3.7.3 (Equipment Sanitization), specifically the objective of ensuring equipment removed for off-site maintenance is sanitized of any CUI. == Ranking of Evidence Types == 1. **Artifacts** - Highest priority evidence type - Media sanitization records showing what equipment was sanitized - Equipment sanitization logs - Chain of custody documentation...")
04:22, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.3.a (Created page with "For the assessment objective "[a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?"")
04:21, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.3 (Created page with "I am a cybersecurity manager working for an organization that is a DoD contractor. I need to implement various security practices that conform to DoD's CMMC program at level 2. The CMMC program stipulates security practices that are based on NIST Special Publication 800-171 R2. For each security practice of CMMC Level 2, I need to show evidence that my organization is in compliance with CMMC. Each security practice has a security requirement and several assessment object...")
03:57, 2 April 2025 David talk contribs created page LLMResponse MA.L2-3.7.2.d (Created page with "I'll help you determine the most effective approach for collecting evidence and evaluating assessment objective "[d] personnel used to conduct system maintenance are controlled" in practice MA.L2-3.7.2. == Ranking Evidence Types for Assessment Objective [d] == Based on the CMMC Assessment Guide and the assessment objects you provided, I would rank the evidence types for this objective as follows: 1. **Documents** - Most valuable because they establish the personnel co...")
03:56, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.2.d (Created page with "For the assessment objective "[d] personnel used to conduct system maintenance are controlled," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?"")
03:56, 2 April 2025 David talk contribs created page LLMResponse MA.L2-3.7.2.c (Created page with "I'll help you determine the most effective approach for collecting evidence and evaluating assessment objective "[c] mechanisms used to conduct system maintenance are controlled" in practice MA.L2-3.7.2. == Ranking Evidence Types for Assessment Objective [c] == Based on the CMMC Assessment Guide and the assessment objects you provided, I would rank the evidence types for this objective as follows: 1. **Artifacts** - Most valuable because they demonstrate actual implem...")
03:55, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.2.c (Created page with "For the assessment objective "[c] mechanisms used to conduct system maintenance are controlled," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?"")
03:52, 2 April 2025 David talk contribs created page LLMResponse MA.L2-3.7.2.b (Created page with "I'll help you determine the most effective approach for collecting evidence and evaluating assessment objective "[b] techniques used to conduct system maintenance are controlled" in practice MA.L2-3.7.2. == Ranking Evidence Types for Assessment Objective [b] == Based on the CMMC Assessment Guide and the assessment objects you provided, I would rank the evidence types for this objective as follows: 1. **Documents** - Most valuable because they establish the framework f...")
03:51, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.2.b (Created page with "For the assessment objective "[b] techniques used to conduct system maintenance are controlled," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?"")
03:25, 2 April 2025 David talk contribs created page LLMResponse MA.L2-3.7.2.a (Created page with "I'll help you determine the most effective approach for collecting evidence and evaluating assessment objective "[a] tools used to conduct system maintenance are controlled" in practice MA.L2-3.7.2. == Ranking Evidence Types for Assessment Objective [a] == Based on the CMMC Assessment Guide and the assessment objects you provided, I would rank the evidence types for this objective as follows: 1. **Artifacts** - Most valuable because they demonstrate actual implementat...")
03:24, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.2.a (Created page with "For the assessment objective "[a] tools used to conduct system maintenance are controlled," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?"")
03:24, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.2 (Created page with "I am a cybersecurity manager working for an organization that is a DoD contractor. I need to implement various security practices that conform to DoD's CMMC program at level 2. The CMMC program stipulates security practices that are based on NIST Special Publication 800-171 R2. For each security practice of CMMC Level 2, I need to show evidence that my organization is in compliance with CMMC. Each security practice has a security requirement and several assessment object...")
02:52, 2 April 2025 David talk contribs created page LLMResponse MA.L2-3.7.1.a (Created page with "I'll help you prioritize your assessment approaches and evidence types for the MA.L2-3.7.1 requirement. Based on the CMMC Level 2 Assessment Guide and the specifics of this security practice, here's my recommendation: == Assessment Approaches Priority == 1. **Examine** - This should be your first approach because system maintenance documentation provides foundational evidence of your maintenance program. Examining maintenance records, policies, and schedules will show...")
02:51, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.1.a (Created page with "For the assessment objective "[a] system maintenance is performed," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?"")
02:50, 2 April 2025 David talk contribs created page LLMPrompt MA.L2-3.7.1 (Created page with "I am a cybersecurity manager working for an organization that is a DoD contractor. I need to implement various security practices that conform to DoD's CMMC program at level 2. The CMMC program stipulates security practices that are based on NIST Special Publication 800-171 R2. For each security practice of CMMC Level 2, I need to show evidence that my organization is in compliance with CMMC. Each security practice has a security requirement and several assessment object...")
01:46, 29 March 2025 David talk contribs moved page Commonly Accepted and Practiced CMMC Operating Model to Commonly Accepted and Practiced CMMC Operation Matrix without leaving a redirect
04:48, 28 March 2025 David talk contribs created page LLMResponse AC.L2-3.1.1.f (Created page with "== Evidence Types and Assessment Approaches for AC.L2-3.1.1 Assessment Objective [f] == === Ranking of Evidence Types for Assessment Objective [f] === For the assessment objective "[f] system access is limited to authorized devices (including other systems)," I recommend prioritizing evidence types in this order: 1. **Artifacts**: These provide the strongest evidence for this device-focused objective, including: - Network access control system logs showing blocked...")
04:48, 28 March 2025 David talk contribs created page LLMPrompt AC.L2-3.1.1.f (Created page with "Using the previous conversations on the practice AC.L2-3.1.1 and for the assessment objective, "[f] system access is limited to authorized devices (including other systems)," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?")
04:47, 28 March 2025 David talk contribs created page LLMResponse AC.L2-3.1.1.e (Created page with "== Evidence Types and Assessment Approaches for AC.L2-3.1.1 Assessment Objective [e] == === Ranking of Evidence Types for Assessment Objective [e] === For the assessment objective "[e] system access is limited to processes acting on behalf of authorized users," I recommend prioritizing evidence types in this order: 1. **Artifacts**: These provide the strongest evidence for this process-focused objective, including: - System logs showing process execution with user...")
04:47, 28 March 2025 David talk contribs created page LLMPrompt AC.L2-3.1.1.e (Created page with "Using the previous conversations on the practice AC.L2-3.1.1 and for the assessment objective, "[e] system access is limited to processes acting on behalf of authorized users," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?")
04:47, 28 March 2025 David talk contribs created page LLMResponse AC.L2-3.1.1.d (Created page with "== Evidence Types and Assessment Approaches for AC.L2-3.1.1 Assessment Objective [d] == === Ranking of Evidence Types for Assessment Objective [d] === For the assessment objective "[d] system access is limited to authorized users," I recommend prioritizing evidence types in this order: 1. **Artifacts**: These provide the strongest evidence for this control-focused objective, including: - System login attempt logs showing rejected unauthorized access attempts - A...")
04:46, 28 March 2025 David talk contribs created page LLMPrompt AC.L2-3.1.1.d (Created page with "Using the previous conversations on the practice AC.L2-3.1.1 and for the assessment objective, "[d] system access is limited to authorized users," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?")
04:45, 28 March 2025 David talk contribs created page LLMResponse AC.L2-3.1.1.c (Created page with "== Evidence Types and Assessment Approaches for AC.L2-3.1.1 Assessment Objective [c] == === Ranking of Evidence Types for Assessment Objective [c] === For the assessment objective "[c] devices (and other systems) authorized to connect to the system are identified," I recommend prioritizing evidence types in this order: 1. **Artifacts**: These provide the strongest evidence for this objective, including: - Network device inventories and asset management databases...")
04:45, 28 March 2025 David talk contribs created page LLMPrompt AC.L2-3.1.1.c (Created page with "Using the previous conversations on the practice AC.L2-3.1.1 and for the assessment objective, "[c] devices (and other systems) authorized to connect to the system are identified," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?")
04:44, 28 March 2025 David talk contribs created page LLMResponse AC.L2-3.1.1.b (Created page with "== Evidence Types and Assessment Approaches for AC.L2-3.1.1 Assessment Objective [b] == === Ranking of Evidence Types for Assessment Objective [b] === For the assessment objective "[b] processes acting on behalf of authorized users are identified," I recommend prioritizing evidence types in this order: 1. **Artifacts**: System-generated lists of automated processes, service accounts, scheduled tasks, and process ownership records provide the strongest direct evidence...")
04:44, 28 March 2025 David talk contribs created page LLMPrompt AC.L2-3.1.1.b (Created page with "Using the previous conversations on the practice AC.L2-3.1.1 and for the assessment objective, "[b] processes acting on behalf of authorized users are identified," rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?")
04:41, 28 March 2025 David talk contribs created page LLMResponse AC.L2-3.1.1.a (Created page with "# Evidence Types and Assessment Approaches for AC.L2-3.1.1 Assessment Objective [a] ## Ranking of Evidence Types for Assessment Objective [a] For the assessment objective "[a] authorized users are identified," I recommend prioritizing evidence types in this order: 1. **Documents**: User authorization lists, access control policies, and account management procedures provide the most direct evidence that authorized users are formally identified. 2. **Artifacts**: Syste...")
04:40, 28 March 2025 David talk contribs created page LLMPrompt AC.L2-3.1.1.a (Created page with "For the assessment objective, ""[a] authorized users are identified,"" rank the evidence types supported by assessment objects. Also, how should I prioritize the three assessment approaches in obtaining the evidence?"")
04:40, 28 March 2025 David talk contribs created page LLMPrompt AC.L2-3.1.1 (Created page with ""I am a cybersecurity manager working for an organization that is a DoD contractor. I need to implement various security practices that conform to DoD's CMMC program at level 2. The CMMC program stipulates security practices that are based on NIST Special Publication 800-171 R2. For each security practice of CMMC Level 2, I need to show evidence that my organization is in compliance with CMMC. Each security practice has a security requirement and several assessment objec...")
03:07, 28 March 2025 David talk contribs created page Practice SI.L3-3.14.6e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == SI.L3-3.14.6E – THREAT-GUIDED INTRUSION DETECTION == === SECURITY REQUIREMENT === Use threat indicator information and effective mitigations obtained from, ...")
03:07, 28 March 2025 David talk contribs created page Practice SI.L3-3.14.3e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == SI.L3-3.14.3E – SPECIALIZED ASSET SECURITY === === SECURITY REQUIREMENT === Ensure that specialized assets including IoT, IIoT, OT, GFE, Restricted Informat...")
03:06, 28 March 2025 David talk contribs created page Practice SI.L3-3.14.1e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == SI.L3-3.14.1E – INTEGRITY VERIFICATION === === SECURITY REQUIREMENT === Verify the integrity of security critical and essential software using root of t...")
02:48, 28 March 2025 David talk contribs created page Practice SC.L3-3.13.4e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == SC.L3-3.13.4E – ISOLATION == === SECURITY REQUIREMENT === Employ physical isolation techniques or logical isolation techniques or both in organizational...")
02:39, 28 March 2025 David talk contribs created page Practice CA.L3-3.12.1e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == CA.L3-3.12.1E – PENETRATION TESTING === Conduct penetration testing at least annually or when significant security changes are made to the system, lever...")
02:32, 28 March 2025 David talk contribs created page Practice RA.L3-3.11.7e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == RA.L3-3.11.7E – SUPPLY CHAIN RISK PLAN == === SECURITY REQUIREMENT === Develop a plan for managing supply chain risks associated with organizational systems an...")
02:30, 28 March 2025 David talk contribs created page Practice RA.L3-3.11.6e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == RA.L3-3.11.6E – SUPPLY CHAIN RISK RESPONSE == === SECURITY REQUIREMENT === Assess, respond to, and monitor supply chain risks associated with organizational sy...")
02:27, 28 March 2025 David talk contribs created page Practice RA.L3-3.11.5e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == RA.L3-3.11.5E – SECURITY SOLUTION EFFECTIVENESS == === SECURITY REQUIREMENT === Assess the effectiveness of security solutions at least annually or upon rec...")
02:23, 28 March 2025 David talk contribs created page Practice RA.L3-3.11.4e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == RA.L3-3.11.4E – SECURITY SOLUTION RATIONALE === === SECURITY REQUIREMENT === Document or reference in the system security plan the security solution selected,...")
02:17, 28 March 2025 David talk contribs created page Practice RA.L3-3.11.3e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == RA.L3-3.11.3E – ADVANCED RISK IDENTIFICATION == === SECURITY REQUIREMENT === Employ advanced automation and analytics capabilities in support of analysts to pr...")
02:16, 28 March 2025 David talk contribs created page Practice RA.L3-3.11.2e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == RA.L3-3.11.2E – THREAT HUNTING == === SECURITY REQUIREMENT === Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications wa...")
01:49, 28 March 2025 David talk contribs created page Practice RA.L3-3.11.1e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == RA.L3-3.11.1E – THREAT-INFORMED RISK ASSESSMENT == === SECURITY REQUIREMENT === Employ threat intelligence, at a minimum from open or commercial sources, an...")
03:47, 27 March 2025 David talk contribs created page Commonly Accepted and Practiced CMMC Operating Model (Created page with "== Commonly Accepted and Practiced CMMC Operating Model == Under Construction!!!")
01:52, 27 March 2025 David talk contribs created page Evidence Collection Approach (Created page with "For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == Evidence Collection Approach for CMMC Practices Levels 1 and 2 == The following table contains the DIBCAC Evidence collection approach for the CMMC Lvels 1 and 2 practices and their Assessment Objectives. The following tables provide a general approach between Assessment Objectives (AOs) and Assessment Methods that may be used. These are not to be construe...")
01:28, 27 March 2025 David talk contribs created page Practice PS.L3-3.9.2e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == PS.L3-3.9.2E – ADVERSE INFORMATION == === SECURITY REQUIREMENT === Ensure that organizational systems are protected if adverse information develops or is obtai...")
01:28, 27 March 2025 David talk contribs created page Practice IR.L3-3.6.2e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == IR.L3-3.6.2E – CYBER INCIDENT RESPONSE TEAM == === SECURITY REQUIREMENT === Establish and maintain a cyber incident response team that can be deployed by the o...")
01:28, 27 March 2025 David talk contribs created page Practice IR.L3-3.6.1e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == IR.L3-3.6.1E – SECURITY OPERATIONS CENTER == === SECURITY REQUIREMENT === Establish and maintain a security operations center capability that operates 24/7,...")
01:27, 27 March 2025 David talk contribs created page Practice IA.L3-3.5.3e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == IA.L3-3.5.3E – BLOCK UNTRUSTED ASSETS == === SECURITY REQUIREMENT === Employ automated or manual/procedural mechanisms to prohibit system components from conne...")
01:27, 27 March 2025 David talk contribs created page Practice IA.L3-3.5.1e Details (Created page with "'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == IA.L3-3.5.1E – BIDIRECTIONAL AUTHENTICATION == === SECURITY REQUIREMENT === Identify and authenticate systems and system components, where possible, bef...")

Main public logs

Navigation menu

Search