Level 2 Assessment Guide

Source of Reference: The official CMMC Level 2 Assessment Guide from the Office of the Under Secretary of Defense Acquisition & Sustainment.

For inquiries and reporting errors on this wiki, please contact us. Thank you.

Access Control (AC)

Level 1 AC Practices

AC.L1-3.1.1 - Authorized Access Control

SECURITY REQUIREMENT Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

ASSESSMENT OBJECTIVES [a] authorized users are identified; [b] processes acting on behalf of authorized users are identified; [c] devices (and other systems) authorized to connect to the system are identified; [d] system access is limited to authorized users; [e] system access is limited to processes acting on behalf of authorized users; and [f] system access is limited to authorized devices (including other systems).

More Practice Details...

AC.L1-3.1.2 - Transaction & Function Control

SECURITY REQUIREMENT Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

ASSESSMENT OBJECTIVES [a] the types of transactions and functions that authorized users are permitted to execute are defined; and [b] system access is limited to the defined types of transactions and functions for authorized users.

More Practice Details...

AC.L1-3.1.20 - External Connections

SECURITY REQUIREMENT Verify and control/limit connections to and use of external information systems.

ASSESSMENT OBJECTIVES [a] connections to external systems are identified; [b] the use of external systems is identified; [c] connections to external systems are verified; [d] the use of external systems is verified; [e] connections to external systems are controlled/limited; and [f] the use of external systems is controlled/limited.

More Practice Details...

AC.L1-3.1.22 - Control Public Information

SECURITY REQUIREMENT Control information posted or processed on publicly accessible information systems.

ASSESSMENT OBJECTIVES [a] individuals authorized to post or process information on publicly accessible systems are identified; [b] procedures to ensure FCI is not posted or processed on publicly accessible systems are identified; [c] a review process is in place prior to posting of any content to publicly accessible systems; [d] content on publicly accessible systems is reviewed to ensure that it does not include FCI; and [e] mechanisms are in place to remove and address improper posting of FCI.

More Practice Details...

Level 2 AC Practices

AC.L2-3.1.3 – Control CUI Flow

SECURITY REQUIREMENT Control the flow of CUI in accordance with approved authorizations.

ASSESSMENT OBJECTIVES [a] information flow control policies are defined; [b] methods and enforcement mechanisms for controlling the flow of CUI are defined; [c] designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified; [d] authorizations for controlling the flow of CUI are defined; and [e] approved authorizations for controlling the flow of CUI are enforced.

More Practice Details...

AC.L2-3.1.4 – Separation of Duties

SECURITY REQUIREMENT Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

ASSESSMENT OBJECTIVES [a] the duties of individuals requiring separation are defined; [b] responsibilities for duties that require separation are assigned to separate individuals; and [c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.

More Practice Details...

AC.L2-3.1.5 – Least Privilege

SECURITY REQUIREMENT Employ the principle of least privilege, including for specific security functions and privileged accounts.

ASSESSMENT OBJECTIVES [a] privileged accounts are identified; [b] access to privileged accounts is authorized in accordance with the principle of least privilege; [c] security functions are identified; and [d] access to security functions is authorized in accordance with the principle of least privilege.

More Practice Details...

AC.L2-3.1.6 – Non-Privileged Account Use

SECURITY REQUIREMENT Use non-privileged accounts or roles when accessing nonsecurity functions.

ASSESSMENT OBJECTIVES [a] nonsecurity functions are identified; and [b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions.

More Practice Details...

AC.L2-3.1.7 – Privileged Functions

SECURITY REQUIREMENT Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

ASSESSMENT OBJECTIVES [a] privileged functions are defined; [b] non-privileged users are defined; [c] non-privileged users are prevented from executing privileged functions; and [d] the execution of privileged functions is captured in audit logs.

More Practice Details...

AC.L2-3.1.8 – Unsuccessful Logon Attempts

SECURITY REQUIREMENT Limit unsuccessful logon attempts.

ASSESSMENT OBJECTIVES [a] the means of limiting unsuccessful logon attempts is defined; and [b] the defined means of limiting unsuccessful logon attempts is implemented.

More Practice Details...

AC.L2-3.1.9 – Privacy & Security Notices

SECURITY REQUIREMENT Provide privacy and security notices consistent with applicable CUI rules.

ASSESSMENT OBJECTIVES [a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category; and [b] privacy and security notices are displayed.

More Practice Details...

AC.L2-3.1.10 – Session Lock

SECURITY REQUIREMENT Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

ASSESSMENT OBJECTIVES [a] the period of inactivity after which the system initiates a session lock is defined; [b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and [c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.

More Practice Details...

AC.L2-3.1.11 – Session Termination

SECURITY REQUIREMENT Terminate (automatically) a user session after a defined condition.

ASSESSMENT OBJECTIVES [a] conditions requiring a user session to terminate are defined; and [b] a user session is automatically terminated after any of the defined conditions

More Practice Details...

AC.L2-3.1.12 – Control Remote Access

SECURITY REQUIREMENT Monitor and control remote access sessions.

ASSESSMENT OBJECTIVES [a] remote access sessions are permitted; [b] the types of permitted remote access are identified; [c] remote access sessions are controlled; and [d] remote access sessions are monitored.

More Practice Details...

AC.L2-3.1.13 – Remote Access Confidentiality

SECURITY REQUIREMENT Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

ASSESSMENT OBJECTIVES [a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified; and [b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.

More Practice Details...

AC.L2-3.1.14 – Remote Access Routing

SECURITY REQUIREMENT Route remote access via managed access control points.

ASSESSMENT OBJECTIVES Determine if: [a] managed access control points are identified and implemented; and [b] remote access is routed through managed network access control points.

More Practice Details...

AC.L2-3.1.15 – Privileged Remote Access

SECURITY REQUIREMENT Authorize remote execution of privileged commands and remote access to security-relevant information.

ASSESSMENT OBJECTIVES [a] privileged commands authorized for remote execution are identified; [b] security-relevant information authorized to be accessed remotely is identified; [c] the execution of the identified privileged commands via remote access is authorized; and [d] access to the identified security-relevant information via remote access is authorized.

More Practice Details...

AC.L2-3.1.16 – Wireless Access Authorization

SECURITY REQUIREMENT Authorize wireless access prior to allowing such connections.

ASSESSMENT OBJECTIVES [a] wireless access points are identified; and [b] wireless access is authorized prior to allowing such connections.

More Practice Details...

AC.L2-3.1.17 – Wireless Access Protection

SECURITY REQUIREMENT Protect wireless access using authentication and encryption.

ASSESSMENT OBJECTIVES [a] wireless access to the system is protected using authentication; and [b] wireless access to the system is protected using encryption.

More Practice Details...

AC.L2-3.1.18 – Mobile Device Connection

SECURITY REQUIREMENT Control connection of mobile devices.

ASSESSMENT OBJECTIVES [a] mobile devices that process, store, or transmit CUI are identified; [b] mobile device connections are authorized; and [c] mobile device connections are monitored and logged.

More Practice Details...

AC.L2-3.1.19 – Encrypt CUI on Mobile

SECURITY REQUIREMENT Encrypt CUI on mobile devices and mobile computing platforms.

ASSESSMENT OBJECTIVES [a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified; and [b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.

More Practice Details...

AC.L2-3.1.21 – Portable Storage Use

SECURITY REQUIREMENT Limit use of portable storage devices on external systems.

ASSESSMENT OBJECTIVES [a] the use of portable storage devices containing CUI on external systems is identified and documented; [b] limits on the use of portable storage devices containing CUI on external systems are defined; and [c] the use of portable storage devices containing CUI on external systems is limited as defined.

More Practice Details...