Frameworks / CMMC 2.0 / CM.L2-3.4.2 What else in your programme already covers this This control maps to 69 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-12.1 Ensure Network Infrastructure is Up-to-Date CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure CIS-4.1 Establish and Maintain a Secure Configuration Process CIS-4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS-4.6 Securely Manage Enterprise Assets and Software CIS-4.7 Manage Default Accounts on Enterprise Assets and Software CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS-5.6 Centralize Account Management 1.2.1 1.2.1 Ruleset configuration standards for NSCs 1.2.7 1.2.7 Six-monthly review of NSC configurations 1.2.8 1.2.8 NSC configuration files secured and consistent 2.2.1 2.2.1 System configuration standards maintained 2.2.2 2.2.2 Vendor default accounts managed 2.2.6 2.2.6 System security parameters configured against misuse ASD37-03 Configure Microsoft Office macro settings (Essential) ASD37-04 User application hardening (Essential) ASD37-09 OS generic exploit mitigation (Excellent) ASD37-10 Server application hardening (Very Good) ASD37-11 Operating system hardening (Very Good) ASBv3-NS-7 Simplify network security configuration ASBv3-PV-1 Define and establish secure configurations ASBv3-PV-3 Define and establish secure configurations for compute resources ASBv3-PV-4 Audit and enforce secure configurations for compute resources PV-2 Audit and enforce secure configurations ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate ANSSI-HYG-16 Use a Centralised Management Tool to Standardise Security Policies ANSSI-HYG-33 Adopt Security Policies Dedicated to Mobile Terminals SEC01-BP06 Automate deployment of standard security controls SEC04-BP04 Initiate remediation for non-compliant resources SEC05-BP04 Automate network protection SEC06-BP02 Provision compute from hardened images SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11) SOC2-CC6.1 CC6.1 Logical access security over protected information assets SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure C5-AM-03 Commissioning of Hardware C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening C5-PSS-11 Images for Virtual Machines and Containers CE-SC.1 Remove or Disable Unused Software CE-SC.2 Change Default Passwords on Devices and Software CE-SC.3 Disable Auto-Run Features E8-MACRO-ML1 Configure Microsoft Office Macro Settings (ML1) E8-UAH-ML2 User Application Hardening - Maturity Level 2 CM-6 Configuration Settings CM-6(1) Automated Management, Application, and Verification CM-6 Configuration Settings CM-6(1) Automated Management, Application, and Verification NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles NIST-CSF-PR.PS-01 Configuration management practices are established and applied AUCDR-IS-2 Secure the network and systems within the data environment STIG-SRG-OS Operating system STIG hardening 8.9 Configuration management 8.9 Configuration management Art.21.2.g Basic cyber hygiene practices and cybersecurity training Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Configuration Management You are reading one control. How much of CMMC 2.0 have you already done? CMMC 2.0 CM.L2-3.4.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CMMC 2.0 your existing evidence covers. Hold FedRAMP Moderate and 108 of 110 CMMC 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 1 were rejected on the FedRAMP Moderate pair alone.
Query this from an agent The graph holds this control, the 69 it maps to, and the evidence behind each claim, over MCP and REST.