Cybersecurity Maturity Model Certification (CMMC) Model Overview¶
Version 2.13 | September 2024 DoD-CIO-00001 (ZRIN 0790-ZA17) | 24-T-2765
Notice: The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing CMMC security requirements under the law or departmental policies.
Distribution Statement A. Approved for public release. Distribution is unlimited.
1. Introduction¶
The theft of intellectual property and sensitive information from all industrial sectors because of malicious cyber activity threatens economic security and national security. The Council of Economic Advisors estimates that malicious cyber activity cost the U.S. economy between $57 billion and $109 billion in 2016 [1]. The Center for Strategic and International Studies estimates that the total global cost of cybercrime was as high as $600 billion in 2017 [2]. Over a ten-year period, that burden would equate to an estimated $570 billion to $1.09 trillion dollars in costs.
Malicious cyber actors have targeted and continue to target the Defense Industrial Base (DIB) sector and the Department of Defense (DoD) supply chain. These attacks not only focus on the large prime contractors, but also target subcontractors that make up the lower tiers of the DoD supply chain. Many of these subcontractors are small entities that provide critical support and innovation. Overall, the DIB sector consists of over 220,000 companies¹ that process, store, or transmit Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) in support of the warfighter and contribute towards the research, engineering, development, acquisition, production, delivery, sustainment, and operations of DoD systems, networks, installations, capabilities, and services. The aggregate loss of intellectual property and controlled unclassified information from the DoD supply chain can undercut U.S. technical advantages and innovation, as well as significantly increase the risk to national security.
As part of multiple lines of effort focused on the security and resiliency of the DIB sector, the DoD is working with industry to enforce the safeguarding requirements of the following types of unclassified information within the supply chain:
- Federal Contract Information (FCI): is defined in 32 CFR § 170.4 and 48 CFR 4.1901 [3].
- Controlled Unclassified Information (CUI): is defined in 32 CFR § 2002.4 (h) [4].
To this end, the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) and DoD Chief Information Officer (CIO) have developed the Cybersecurity Maturity Model Certification (CMMC) in concert with DoD stakeholders, University Affiliated Research Centers (UARCs), Federally Funded Research and Development Centers (FFRDCs), and the DIB sector.
This document focuses on the Cybersecurity Maturity Model Certification (CMMC) Model as set forth in section 170.14 of title 32, Code of Federal Regulations (CFR). The model incorporates the security requirements from:
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
- NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- A subset of the requirements from NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171
The CMMC Program is designed to provide increased assurance to the DoD that defense contractors and subcontractors are compliant with information protection requirements for FCI and CUI, and are protecting such information at a level commensurate with risk from cybersecurity threats, including Advanced Persistent Threats (APTs).
When implementing the CMMC model, an organization can achieve a specific CMMC level for its entire enterprise network or for a particular enclave(s), depending on where the information to be protected is handled and stored.
¹ Based on information from the Federal Procurement Data System, the average number of unique prime contractors is approximately 212,657 and the number of known unique subcontractors is approximately 8,309. (FPDS from FY18–FY21).
1.1 Document Organization¶
Section 2 presents the CMMC Model and each of its elements in detail. Appendix A provides the model as a matrix and maps the CMMC model to other secondary sources. Appendix B lists the abbreviations and acronyms. Finally, Appendix C provides the references contained in this document.
1.2 Supporting Documents¶
This document is supported by multiple companion documents that provide additional information:
- The CMMC Assessment Guides present assessment objectives, discussion, examples, potential assessment considerations, and key references for each CMMC security requirement.
- The CMMC Scoping Guides provide additional guidance on how to correctly scope an assessment.
- The CMMC Hashing Guide provides information on how to create the hash to validate the integrity of archived assessment artifacts.
These supplemental documents are intended to provide explanatory information to assist organizations with implementing and assessing the security requirements covered by CMMC in 32 CFR § 170. The documents are not prescriptive and their use is optional. Implementation of security requirements by following any examples is not a guarantee of compliance with any CMMC security requirement or objective.
2. CMMC Model¶
2.1 Overview¶
The CMMC Model incorporates the security requirements from:
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
- NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- A subset of the requirements from NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171
These source documents may be revised in the future, however the CMMC security requirements will remain unchanged until the CMMC final rule is published. Any further modifications to the CMMC rule will follow appropriate rulemaking procedures.
The CMMC Model consists of domains that map to the Security Requirement Families defined in NIST SP 800-171 Rev 2.
2.2 CMMC Levels¶
There are three levels within CMMC – Level 1, Level 2, and Level 3.
2.2.1 Descriptions¶
The CMMC model measures the implementation of cybersecurity requirements at three levels. Each level is independent and consists of a set of CMMC security requirements as set forth in 32 CFR § 170.14 ©:
- Level 1 Requirements. The security requirements in Level 1 are those set forth in FAR clause 52.204-21(b)(1)(i) – (b)(1)(xv).
- Level 2 Requirements. The security requirements in Level 2 are identical to the requirements in NIST SP 800-171 Rev 2.
- Level 3 Requirements. The security requirements in Level 3 are derived from NIST SP 800-172 with DoD-approved parameters where applicable, as identified in 32 CFR § 170.14©(4). DoD defined selections and parameters for the NIST SP 800-172 requirements are italicized, where applicable.
2.2.2 CMMC Overview¶
| Level | Requirement Count | Assessment |
|---|---|---|
| Level 1 | 15 requirements aligned with FAR 52.204-21 | Annual self-assessment; Annual Affirmation |
| Level 2 | 110 requirements aligned with NIST SP 800-171 r2 | C3PAO assessment every 3 years, or self-assessment every 3 years for select programs; Annual Affirmation |
| Level 3 | 134 requirements (110 from NIST SP 800-171 r2 plus 24 from 800-172) | DIBCAC assessment every 3 years; Annual Affirmation |
2.2.3 Level 1¶
Level 1 focuses on the protection of FCI and consists of the security requirements that correspond to the 15 basic safeguarding requirements specified in 48 CFR 52.204-21, commonly referred to as the FAR Clause.
2.2.4 Level 2¶
Level 2 focuses on the protection of CUI and incorporates the 110 security requirements specified in NIST SP 800-171 Rev 2.
2.2.5 Level 3¶
Level 3 focuses on the protection of CUI and encompasses a subset of the NIST SP 800-172 security requirements [5] with DoD-approved parameters. DoD-approved parameters are denoted with underlining below.
2.3 CMMC Domains¶
The CMMC model consists of 14 domains that align with the families specified in NIST SP 800-171 Rev 2:
- Access Control (AC)
- Awareness & Training (AT)
- Audit & Accountability (AU)
- Configuration Management (CM)
- Identification & Authentication (IA)
- Incident Response (IR)
- Maintenance (MA)
- Media Protection (MP)
- Personnel Security (PS)
- Physical Protection (PE)
- Risk Assessment (RA)
- Security Assessment (CA)
- System and Communications Protection (SC)
- System and Information Integrity (SI)
2.4 CMMC Security Requirements¶
Each requirement below has a requirement identification number in the format DD.L#-REQ, where:
- DD is the two-letter domain abbreviation
- L# is the level number
- REQ is the FAR Clause 52.204-21 paragraph number, NIST SP 800-171 Rev 2, or NIST SP 800-172 security requirement number
Each requirement's short name (for quick reference only) is shown in italics beneath its ID. Level 3 requirements with a DoD-approved parameter have that parameter underlined.
Note on layout: The source document repeats this same requirement data twice — once grouped by domain/level (Section 2.4) and once as a Level ½/3 matrix (Appendix A). To avoid duplicating identical content in this wiki, the tables below merge both views into a single reference table per domain (sorted by Level, then ID), including the source-standard cross-references originally listed in Appendix A.
ACCESS CONTROL (AC)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| AC.L1-b.1.i | Authorized Access Control [FCI Data] | Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). | FAR 52.204-21 b.1.i; NIST SP 800-171 Rev 2 3.1.1 |
| AC.L1-b.1.ii | Transaction & Function Control [FCI Data] | Limit information system access to the types of transactions and functions that authorized users are permitted to execute. | FAR 52.204-21 b.1.ii; NIST SP 800-171 Rev 2 3.1.2 |
| AC.L1-b.1.iii | External Connections [FCI Data] | Verify and control/limit connections to and use of external information systems. | FAR 52.204-21 b.1.iii; NIST SP 800-171 Rev 2 3.1.20 |
| AC.L1-b.1.iv | Control Public Information [FCI Data] | Control information posted or processed on publicly accessible information systems. | FAR 52.204-21 b.1.iv; NIST SP 800-171 Rev 2 3.1.22 |
| AC.L2-3.1.1 | Authorized Access Control [CUI Data] | Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). | NIST SP 800-171 Rev 2 3.1.1; FAR 52.204-21 b.1.i |
| AC.L2-3.1.2 | Transaction & Function Control [CUI Data] | Limit system access to the types of transactions and functions that authorized users are permitted to execute. | NIST SP 800-171 Rev 2 3.1.2; FAR 52.204-21 b.1.ii |
| AC.L2-3.1.3 | Control CUI Flow | Control the flow of CUI in accordance with approved authorizations. | NIST SP 800-171 Rev 2 3.1.3 |
| AC.L2-3.1.4 | Separation of Duties | Separate the duties of individuals to reduce the risk of malevolent activity without collusion. | NIST SP 800-171 Rev 2 3.1.4 |
| AC.L2-3.1.5 | Least Privilege | Employ the principle of least privilege, including for specific security functions and privileged accounts. | NIST SP 800-171 Rev 2 3.1.5 |
| AC.L2-3.1.6 | Non-Privileged Account Use | Use non-privileged accounts or roles when accessing nonsecurity functions. | NIST SP 800-171 Rev 2 3.1.6 |
| AC.L2-3.1.7 | Privileged Functions | Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. | NIST SP 800-171 Rev 2 3.1.7 |
| AC.L2-3.1.8 | Unsuccessful Logon Attempts | Limit unsuccessful logon attempts. | NIST SP 800-171 Rev 2 3.1.8 |
| AC.L2-3.1.9 | Privacy & Security Notices | Provide privacy and security notices consistent with applicable CUI rules. | NIST SP 800-171 Rev 2 3.1.9 |
| AC.L2-3.1.10 | Session Lock | Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. | NIST SP 800-171 Rev 2 3.1.10 |
| AC.L2-3.1.11 | Session Termination | Terminate (automatically) a user session after a defined condition. | NIST SP 800-171 Rev 2 3.1.11 |
| AC.L2-3.1.12 | Control Remote Access | Monitor and control remote access sessions. | NIST SP 800-171 Rev 2 3.1.12 |
| AC.L2-3.1.13 | Remote Access Confidentiality | Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. | NIST SP 800-171 Rev 2 3.1.13 |
| AC.L2-3.1.14 | Remote Access Routing | Route remote access via managed access control points. | NIST SP 800-171 Rev 2 3.1.14 |
| AC.L2-3.1.15 | Privileged Remote Access | Authorize remote execution of privileged commands and remote access to security-relevant information. | NIST SP 800-171 Rev 2 3.1.15 |
| AC.L2-3.1.16 | Wireless Access Authorization | Authorize wireless access prior to allowing such connections. | NIST SP 800-171 Rev 2 3.1.16 |
| AC.L2-3.1.17 | Wireless Access Protection | Protect wireless access using authentication and encryption. | NIST SP 800-171 Rev 2 3.1.17 |
| AC.L2-3.1.18 | Mobile Device Connection | Control connection of mobile devices. | NIST SP 800-171 Rev 2 3.1.18 |
| AC.L2-3.1.19 | Encrypt CUI on Mobile | Encrypt CUI on mobile devices and mobile computing platforms. | NIST SP 800-171 Rev 2 3.1.19 |
| AC.L2-3.1.20 | External Connections [CUI Data] | Verify and control/limit connections to and use of external systems. | NIST SP 800-171 Rev 2 3.1.20; FAR 52.204-21 b.1.iii |
| AC.L2-3.1.21 | Portable Storage Use | Limit use of portable storage devices on external systems. | NIST SP 800-171 Rev 2 3.1.21 |
| AC.L2-3.1.22 | Control Public Information [CUI Data] | Control CUI posted or processed on publicly accessible systems. | NIST SP 800-171 Rev 2 3.1.22; FAR 52.204-21 b.1.iv |
| AC.L3-3.1.2e | Organizationally Controlled Assets | Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization. | NIST SP 800-172 3.1.2e |
| AC.L3-3.1.3e | Secured Information Transfer | Employ secure information transfer solutions to control information flows between security domains on connected systems. | NIST SP 800-172 3.1.3e |
AWARENESS AND TRAINING (AT)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| AT.L2-3.2.1 | Role-Based Risk Awareness | Inform managers, systems administrators, and users of organizational systems of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. | NIST SP 800-171 Rev 2 3.2.1 |
| AT.L2-3.2.2 | Role-Based Training | Train personnel to carry out their assigned information security-related duties and responsibilities. | NIST SP 800-171 Rev 2 3.2.2 |
| AT.L2-3.2.3 | Insider Threat Awareness | Provide security awareness training on recognizing and reporting potential indicators of insider threat. | NIST SP 800-171 Rev 2 3.2.3 |
| AT.L3-3.2.1e | Advanced Threat Awareness | Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat. | NIST SP 800-172 3.2.1e |
| AT.L3-3.2.2e | Practical Training Exercises | Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors. | NIST SP 800-172 3.2.2e |
AUDIT AND ACCOUNTABILITY (AU)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| AU.L2-3.3.1 | System Auditing | Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. | NIST SP 800-171 Rev 2 3.3.1 |
| AU.L2-3.3.2 | User Accountability | Uniquely trace the actions of individual system users, so they can be held accountable for their actions. | NIST SP 800-171 Rev 2 3.3.2 |
| AU.L2-3.3.3 | Event Review | Review and update logged events. | NIST SP 800-171 Rev 2 3.3.3 |
| AU.L2-3.3.4 | Audit Failure Alerting | Alert in the event of an audit logging process failure. | NIST SP 800-171 Rev 2 3.3.4 |
| AU.L2-3.3.5 | Audit Correlation | Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. | NIST SP 800-171 Rev 2 3.3.5 |
| AU.L2-3.3.6 | Reduction & Reporting | Provide audit record reduction and report generation to support on-demand analysis and reporting. | NIST SP 800-171 Rev 2 3.3.6 |
| AU.L2-3.3.7 | Authoritative Time Source | Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. | NIST SP 800-171 Rev 2 3.3.7 |
| AU.L2-3.3.8 | Audit Protection | Protect audit information and audit logging tools from unauthorized access, modification, and deletion. | NIST SP 800-171 Rev 2 3.3.8 |
| AU.L2-3.3.9 | Audit Management | Limit management of audit logging functionality to a subset of privileged users. | NIST SP 800-171 Rev 2 3.3.9 |
No Level 1 or Level 3 requirements in this domain.
CONFIGURATION MANAGEMENT (CM)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| CM.L2-3.4.1 | System Baselining | Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. | NIST SP 800-171 Rev 2 3.4.1 |
| CM.L2-3.4.2 | Security Configuration Enforcement | Establish and enforce security configuration settings for information technology products employed in organizational systems. | NIST SP 800-171 Rev 2 3.4.2 |
| CM.L2-3.4.3 | System Change Management | Track, review, approve or disapprove, and log changes to organizational systems. | NIST SP 800-171 Rev 2 3.4.3 |
| CM.L2-3.4.4 | Security Impact Analysis | Analyze the security impact of changes prior to implementation. | NIST SP 800-171 Rev 2 3.4.4 |
| CM.L2-3.4.5 | Access Restrictions for Change | Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. | NIST SP 800-171 Rev 2 3.4.5 |
| CM.L2-3.4.6 | Least Functionality | Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. | NIST SP 800-171 Rev 2 3.4.6 |
| CM.L2-3.4.7 | Nonessential Functionality | Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. | NIST SP 800-171 Rev 2 3.4.7 |
| CM.L2-3.4.8 | Application Execution Policy | Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. | NIST SP 800-171 Rev 2 3.4.8 |
| CM.L2-3.4.9 | User-Installed Software | Control and monitor user-installed software. | NIST SP 800-171 Rev 2 3.4.9 |
| CM.L3-3.4.1e | Authoritative Repository | Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components. | NIST SP 800-172 3.4.1e |
| CM.L3-3.4.2e | Automated Detection & Remediation | Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a quarantine or remediation network to facilitate patching, re-configuration, or other mitigations. | NIST SP 800-172 3.4.2e |
| CM.L3-3.4.3e | Automated Inventory | Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components. | NIST SP 800-172 3.4.3e |
IDENTIFICATION AND AUTHENTICATION (IA)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| IA.L1-b.1.v | Identification [FCI Data] | Identify information system users, processes acting on behalf of users, or devices. | FAR 52.204-21 b.1.v; NIST SP 800-171 Rev 2 3.5.1 |
| IA.L1-b.1.vi | Authentication [FCI Data] | Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. | FAR 52.204-21 b.1.vi; NIST SP 800-171 Rev 2 3.5.2 |
| IA.L2-3.5.1 | Identification [CUI Data] | Identify system users, processes acting on behalf of users, and devices. | NIST SP 800-171 Rev 2 3.5.1; FAR 52.204-21 b.1.v |
| IA.L2-3.5.2 | Authentication [CUI Data] | Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. | NIST SP 800-171 Rev 2 3.5.2; FAR 52.204-21 b.1.vi |
| IA.L2-3.5.3 | Multifactor Authentication | Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. | NIST SP 800-171 Rev 2 3.5.3 |
| IA.L2-3.5.4 | Replay-Resistant Authentication | Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. | NIST SP 800-171 Rev 2 3.5.4 |
| IA.L2-3.5.5 | Identifier Reuse | Prevent reuse of identifiers for a defined period. | NIST SP 800-171 Rev 2 3.5.5 |
| IA.L2-3.5.6 | Identifier Handling | Disable identifiers after a defined period of inactivity. | NIST SP 800-171 Rev 2 3.5.6 |
| IA.L2-3.5.7 | Password Complexity | Enforce a minimum password complexity and change of characters when new passwords are created. | NIST SP 800-171 Rev 2 3.5.7 |
| IA.L2-3.5.8 | Password Reuse | Prohibit password reuse for a specified number of generations. | NIST SP 800-171 Rev 2 3.5.8 |
| IA.L2-3.5.9 | Temporary Passwords | Allow temporary password use for system logons with an immediate change to a permanent password. | NIST SP 800-171 Rev 2 3.5.9 |
| IA.L2-3.5.10 | Cryptographically-Protected Passwords | Store and transmit only cryptographically protected passwords. | NIST SP 800-171 Rev 2 3.5.10 |
| IA.L2-3.5.11 | Obscure Feedback | Obscure feedback of authentication information. | NIST SP 800-171 Rev 2 3.5.11 |
| IA.L3-3.5.1e | Bidirectional Authentication | Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant. | NIST SP 800-172 3.5.1e |
| IA.L3-3.5.3e | Block Untrusted Assets | Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile. | NIST SP 800-172 3.5.3e |
INCIDENT RESPONSE (IR)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| IR.L2-3.6.1 | Incident Handling | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. | NIST SP 800-171 Rev 2 3.6.1 |
| IR.L2-3.6.2 | Incident Reporting | Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. | NIST SP 800-171 Rev 2 3.6.2 |
| IR.L2-3.6.3 | Incident Response Testing | Test the organizational incident response capability. | NIST SP 800-171 Rev 2 3.6.3 |
| IR.L3-3.6.1e | Security Operations Center | Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff. | NIST SP 800-172 3.6.1e |
| IR.L3-3.6.2e | Cyber Incident Response Team | Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours. | NIST SP 800-172 3.6.2e |
MAINTENANCE (MA)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| MA.L2-3.7.1 | Perform Maintenance | Perform maintenance on organizational systems. | NIST SP 800-171 Rev 2 3.7.1 |
| MA.L2-3.7.2 | System Maintenance Control | Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. | NIST SP 800-171 Rev 2 3.7.2 |
| MA.L2-3.7.3 | Equipment Sanitization | Sanitize equipment removed for off-site maintenance of any CUI. | NIST SP 800-171 Rev 2 3.7.3 |
| MA.L2-3.7.4 | Media Inspection | Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. | NIST SP 800-171 Rev 2 3.7.4 |
| MA.L2-3.7.5 | Nonlocal Maintenance | Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. | NIST SP 800-171 Rev 2 3.7.5 |
| MA.L2-3.7.6 | Maintenance Personnel | Supervise the maintenance activities of maintenance personnel without required access authorization. | NIST SP 800-171 Rev 2 3.7.6 |
No Level 1 or Level 3 requirements in this domain.
MEDIA PROTECTION (MP)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| MP.L1-b.1.vii | Media Disposal [FCI Data] | Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. | FAR 52.204-21 b.1.vii; NIST SP 800-171 Rev 2 3.8.3 |
| MP.L2-3.8.1 | Media Protection | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. | NIST SP 800-171 Rev 2 3.8.1 |
| MP.L2-3.8.2 | Media Access | Limit access to CUI on system media to authorized users. | NIST SP 800-171 Rev 2 3.8.2 |
| MP.L2-3.8.3 | Media Disposal [CUI Data] | Sanitize or destroy system media containing CUI before disposal or release for reuse. | NIST SP 800-171 Rev 2 3.8.3; FAR 52.204-21 b.1.vii |
| MP.L2-3.8.4 | Media Markings | Mark media with necessary CUI markings and distribution limitations. | NIST SP 800-171 Rev 2 3.8.4 |
| MP.L2-3.8.5 | Media Accountability | Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. | NIST SP 800-171 Rev 2 3.8.5 |
| MP.L2-3.8.6 | Portable Storage Encryption | Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. | NIST SP 800-171 Rev 2 3.8.6 |
| MP.L2-3.8.7 | Removable Media | Control the use of removable media on system components. | NIST SP 800-171 Rev 2 3.8.7 |
| MP.L2-3.8.8 | Shared Media | Prohibit the use of portable storage devices when such devices have no identifiable owner. | NIST SP 800-171 Rev 2 3.8.8 |
| MP.L2-3.8.9 | Protect Backups | Protect the confidentiality of backup CUI at storage locations. | NIST SP 800-171 Rev 2 3.8.9 |
No Level 3 requirements in this domain.
PERSONNEL SECURITY (PS)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| PS.L2-3.9.1 | Screen Individuals | Screen individuals prior to authorizing access to organizational systems containing CUI. | NIST SP 800-171 Rev 2 3.9.1 |
| PS.L2-3.9.2 | Personnel Actions | Protect organizational systems containing CUI during and after personnel actions such as terminations and transfers. | NIST SP 800-171 Rev 2 3.9.2 |
| PS.L3-3.9.2e | Adverse Information | Protect organizational systems when adverse information develops or is obtained about individuals with access to CUI. | NIST SP 800-172 3.9.2e |
No Level 1 requirements in this domain.
PHYSICAL PROTECTION (PE)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| PE.L1-b.1.viii | Limit Physical Access [FCI Data] | Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. | FAR 52.204-21 b.1.viii; NIST SP 800-171 Rev 2 3.10.1 |
| PE.L1-b.1.ix | Manage Visitors & Physical Access [FCI Data] | Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. | FAR 52.204-21 (partial) b.1.ix; NIST SP 800-171 Rev 2 3.10.3, 3.10.4, 3.10.5 |
| PE.L2-3.10.1 | Limit Physical Access [CUI Data] | Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. | NIST SP 800-171 Rev 2 3.10.1; FAR 52.204-21 b.1.viii |
| PE.L2-3.10.2 | Monitor Facility | Protect and monitor the physical facility and support infrastructure for organizational systems. | NIST SP 800-171 Rev 2 3.10.2 |
| PE.L2-3.10.3 | Escort Visitors [CUI Data] | Escort visitors and monitor visitor activity. | NIST SP 800-171 Rev 2 3.10.3; FAR 52.204-21 (partial) b.1.ix |
| PE.L2-3.10.4 | Physical Access Logs [CUI Data] | Maintain audit logs of physical access. | NIST SP 800-171 Rev 2 3.10.4; FAR 52.204-21 (partial) b.1.ix |
| PE.L2-3.10.5 | Manage Physical Access [CUI Data] | Control and manage physical access devices. | NIST SP 800-171 Rev 2 3.10.5; FAR 52.204-21 (partial) b.1.ix |
| PE.L2-3.10.6 | Alternative Work Sites | Enforce safeguarding measures for CUI at alternate work sites. | NIST SP 800-171 Rev 2 3.10.6 |
No Level 3 requirements in this domain.
RISK ASSESSMENT (RA)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| RA.L2-3.11.1 | Risk Assessments | Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. | NIST SP 800-171 Rev 2 3.11.1 |
| RA.L2-3.11.2 | Vulnerability Scan | Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. | NIST SP 800-171 Rev 2 3.11.2 |
| RA.L2-3.11.3 | Vulnerability Remediation | Remediate vulnerabilities in accordance with risk assessments. | NIST SP 800-171 Rev 2 3.11.3 |
| RA.L3-3.11.1e | Threat-Informed Risk Assessment | Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities. | NIST SP 800-172 3.11.1e |
| RA.L3-3.11.2e | Threat Hunting | Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls. | NIST SP 800-172 3.11.2e |
| RA.L3-3.11.3e | Advanced Risk Identification | Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components. | NIST SP 800-172 3.11.3e |
| RA.L3-3.11.4e | Security Solution Rationale | Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination. | NIST SP 800-172 3.11.4e |
| RA.L3-3.11.5e | Security Solution Effectiveness | Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence. | NIST SP 800-172 3.11.5e |
| RA.L3-3.11.6e | Supply Chain Risk Response | Assess, respond to, and monitor supply chain risks associated with organizational systems and system components. | NIST SP 800-172 3.11.6e |
| RA.L3-3.11.7e | Supply Chain Risk Plan | Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident. | NIST SP 800-172 3.11.7e |
No Level 1 requirements in this domain.
SECURITY ASSESSMENT (CA)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| CA.L2-3.12.1 | Security Control Assessment | Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. | NIST SP 800-171 Rev 2 3.12.1 |
| CA.L2-3.12.2 | Operational Plan of Action | Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. | NIST SP 800-171 Rev 2 3.12.2 |
| CA.L2-3.12.3 | Security Control Monitoring | Monitor security controls on an ongoing basis to determine the continued effectiveness of the controls. | NIST SP 800-171 Rev 2 3.12.3 |
| CA.L2-3.12.4 | System Security Plan | Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. | NIST SP 800-171 Rev 2 3.12.4 |
| CA.L3-3.12.1e | Penetration Testing | Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts. | NIST SP 800-172 3.12.1e |
No Level 1 requirements in this domain.
SYSTEM AND COMMUNICATIONS PROTECTION (SC)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| SC.L1-b.1.x | Boundary Protection [FCI Data] | Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. | FAR 52.204-21 b.1.x; NIST SP 800-171 Rev 2 3.13.1 |
| SC.L1-b.1.xi | Public-Access System Separation [FCI Data] | Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. | FAR 52.204-21 b.1.xi; NIST SP 800-171 Rev 2 3.13.5 |
| SC.L2-3.13.1 | Boundary Protection [CUI Data] | Monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of the information systems. | NIST SP 800-171 Rev 2 3.13.1; FAR 52.204-21 b.1.x |
| SC.L2-3.13.2 | Security Engineering | Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. | NIST SP 800-171 Rev 2 3.13.2 |
| SC.L2-3.13.3 | Role Separation | Separate user functionality from system management functionality. | NIST SP 800-171 Rev 2 3.13.3 |
| SC.L2-3.13.4 | Shared Resource Control | Prevent unauthorized and unintended information transfer via shared system resources. | NIST SP 800-171 Rev 2 3.13.4 |
| SC.L2-3.13.5 | Public-Access System Separation [CUI Data] | Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. | NIST SP 800-171 Rev 2 3.13.5; FAR 52.204-21 b.1.xi |
| SC.L2-3.13.6 | Network Communication by Exception | Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). | NIST SP 800-171 Rev 2 3.13.6 |
| SC.L2-3.13.7 | Split Tunneling | Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). | NIST SP 800-171 Rev 2 3.13.7 |
| SC.L2-3.13.8 | Data in Transit | Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. | NIST SP 800-171 Rev 2 3.13.8 |
| SC.L2-3.13.9 | Connections Termination | Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. | NIST SP 800-171 Rev 2 3.13.9 |
| SC.L2-3.13.10 | Key Management | Establish and manage cryptographic keys for cryptography employed in organizational systems. | NIST SP 800-171 Rev 2 3.13.10 |
| SC.L2-3.13.11 | CUI Encryption | Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. | NIST SP 800-171 Rev 2 3.13.11 |
| SC.L2-3.13.12 | Collaborative Device Control | Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. | NIST SP 800-171 Rev 2 3.13.12 |
| SC.L2-3.13.13 | Mobile Code | Control and monitor the use of mobile code. | NIST SP 800-171 Rev 2 3.13.13 |
| SC.L2-3.13.14 | Voice over Internet Protocol | Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. | NIST SP 800-171 Rev 2 3.13.14 |
| SC.L2-3.13.15 | Communications Authenticity | Protect the authenticity of communications sessions. | NIST SP 800-171 Rev 2 3.13.15 |
| SC.L2-3.13.16 | Data at Rest | Protect the confidentiality of CUI at rest. | NIST SP 800-171 Rev 2 3.13.16 |
| SC.L3-3.13.4e | Isolation | Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components. | NIST SP 800-172 3.13.4e |
SYSTEM AND INFORMATION INTEGRITY (SI)¶
| ID | Short Name | Description | Source Reference |
|---|---|---|---|
| SI.L1-b.1.xii | Flaw Remediation [FCI Data] | Identify, report, and correct information and information system flaws in a timely manner. | FAR 52.204-21 b.1.xii; NIST SP 800-171 Rev 2 3.14.1 |
| SI.L1-b.1.xiii | Malicious Code Protection [FCI Data] | Provide protection from malicious code at appropriate locations within organizational information systems. | FAR 52.204-21 b.1.xiii; NIST SP 800-171 Rev 2 3.14.2 |
| SI.L1-b.1.xiv | Update Malicious Code Protection [FCI Data] | Update malicious code protection mechanisms when new releases are available. | FAR 52.204-21 b.1.xiv; NIST SP 800-171 Rev 2 3.14.4 |
| SI.L1-b.1.xv | System & File Scanning [FCI Data] | Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. | FAR 52.204-21 b.1.xv; NIST SP 800-171 Rev 2 3.14.5 |
| SI.L2-3.14.1 | Flaw Remediation [CUI Data] | Identify, report, and correct system flaws in a timely manner. | NIST SP 800-171 Rev 2 3.14.1; FAR 52.204-21 b.1.xii |
| SI.L2-3.14.2 | Malicious Code Protection [CUI Data] | Provide protection from malicious code at designated locations within organizational systems. | NIST SP 800-171 Rev 2 3.14.2; FAR 52.204-21 b.1.xiii |
| SI.L2-3.14.3 | Security Alerts & Advisories | Monitor system security alerts and advisories and take action in response. | NIST SP 800-171 Rev 2 3.14.3 |
| SI.L2-3.14.4 | Update Malicious Code Protection [CUI Data] | Update malicious code protection mechanisms when new releases are available. | NIST SP 800-171 Rev 2 3.14.4; FAR 52.204-21 b.1.xiv |
| SI.L2-3.14.5 | System & File Scanning [CUI Data] | Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. | NIST SP 800-171 Rev 2 3.14.5; FAR 52.204-21 b.1.xv |
| SI.L2-3.14.6 | Monitor Communications for Attacks | Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. | NIST SP 800-171 Rev 2 3.14.6 |
| SI.L2-3.14.7 | Identify Unauthorized Use | Identify unauthorized use of organizational systems. | NIST SP 800-171 Rev 2 3.14.7 |
| SI.L3-3.14.1e | Integrity Verification | Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures. | NIST SP 800-172 3.14.1e |
| SI.L3-3.14.3e | Specialized Asset Security | Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks. | NIST SP 800-172 3.14.3e |
| SI.L3-3.14.6e | Threat-Guided Intrusion Detection | Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoD-provided sources, to guide and inform intrusion detection and threat hunting. | NIST SP 800-172 3.14.6e |
Appendix A. About the CMMC Model Matrix¶
The source PDF's Appendix A presents this same set of requirements again in a Level 1 / Level 2 / Level 3 side-by-side matrix format, organized by domain. Because the requirement text, IDs, and source citations are identical to those already captured in the tables under Section 2.4 above, that content has not been duplicated here. If a literal side-by-side matrix layout is needed for a specific domain, it can be generated on request.
Appendix B. Abbreviations and Acronyms¶
| Acronym | Meaning |
|---|---|
| AC | Access Control |
| APT | Advanced Persistent Threat |
| AT | Awareness and Training |
| AU | Audit and Accountability |
| CA | Security Assessment |
| CFR | Code of Federal Regulations |
| CM | Configuration Management |
| CMMC | Cybersecurity Maturity Model Certification |
| CUI | Controlled Unclassified Information |
| DFARS | Defense Federal Acquisition Regulation Supplement |
| DIB | Defense Industrial Base |
| DoD | Department of Defense |
| FAR | Federal Acquisition Regulation |
| FCI | Federal Contract Information |
| FFRDC | Federally Funded Research and Development Center |
| FIPS | Federal Information Processing Standard |
| IA | Identification and Authentication |
| IR | Incident Response |
| L# | Level Number |
| MA | Maintenance |
| MP | Media Protection |
| N/A | Not Applicable (NA) |
| NIST | National Institute of Standards and Technology |
| OUSD A&S | Office of the Under Secretary of Defense for Acquisition and Sustainment |
| PE | Physical Protection |
| PS | Personnel Security |
| PUB | Publication |
| Rev | Revision |
| RA | Risk Assessment |
| SC | System and Communications Protection |
| SI | System and Information Integrity |
| SP | Special Publication |
| UARC | University Affiliated Research Center |
| U.S. | United States |
| VoIP | Voice over Internet Protocol |
| Vol. | Volume |
Appendix C. References¶
- U.S. Executive Office of the President, Council of Economic Advisers (CEA), The Cost of Malicious Cyber Activity to the U.S. Economy, available online at https://www.whitehouse.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf, February 2018
- Center for Strategic and International Studies (CSIS) and McAfee, Economic Impact of Cybercrime - No Slowing Down, February 2018
- 48 Code of Federal Regulations (CFR) 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, Federal Acquisition Regulation (FAR), 1 Oct 2016
- NIST Special Publication (SP) 800-171 Revision (Rev) 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, U.S. Department of Commerce National Institute of Standards and Technology (NIST), December 2016 (updated June 2018)
- NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171, U.S. Department of Commerce National Institute of Standards and Technology (NIST), February 2021