NIST SP 800-172CMMC 2.0

NIST SP 800-172 covers 18.2% of CMMC 2.0

20 of the 110 controls in CMMC 2.0 are already satisfied by evidence you collected for NIST SP 800-172. 90 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

18.2%

of the target already covered

controls evidenced

genuine gaps

claims rejected in review

This number is directional. It says how much of CMMC 2.0 your NIST SP 800-172 evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

57 candidate mappings were examined and 9 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

Awareness and Training3 of 3 evidenced

Security Assessment3 of 4 evidenced, 1 to do

Personnel Security1 of 2 evidenced, 1 to do

System and Information Integrity3 of 7 evidenced, 4 to do

Configuration Management3 of 9 evidenced, 6 to do

Incident Response1 of 3 evidenced, 2 to do

Risk Assessment1 of 3 evidenced, 2 to do

Access Control3 of 22 evidenced, 19 to do

Audit and Accountability1 of 9 evidenced, 8 to do

Identification and Authentication1 of 11 evidenced, 10 to do

Maintenance0 of 6 evidenced, 6 to do

Media Protection0 of 9 evidenced, 9 to do

Physical Protection0 of 6 evidenced, 6 to do

System and Communications Protection0 of 16 evidenced, 16 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

3.1.2eAC.L2-3.1.20argued against and upheld

External Connections

Restricting access to only organization owned, provisioned or issued resources controls external system connections.

3.1.3eAC.L2-3.1.3argued against and upheld

Control CUI Flow

Secure transfer solutions enforcing approved flows between security domains is CUI flow control.

3.1.1eAC.L2-3.1.4argued against and upheld

Separation of Duties

Dual authorization for critical operations divides security relevant duties between individuals.

3.2.1eAT.L2-3.2.1argued against and upheld

Role-Based Risk Awareness

Awareness training at hire, annually and on change makes staff aware of the risks their activities carry.

3.2.2eAT.L2-3.2.2argued against and upheld

Role-Based Training

Practical exercises for managers, executives and selected personnel reinforce role specific duties.

3.9.2eAT.L2-3.2.3argued against and upheld

Insider Threat Awareness

An insider threat program addressing adverse information about people with CUI access covers insider threat.

3.2.1eAT.L2-3.2.3argued against and upheld

Insider Threat Awareness

Awareness training covering social engineering and advanced threats teaches recognition of insider indicators.

3.11.3eAU.L2-3.3.5argued against and upheld

Audit Correlation

Advanced automation and analytics supporting analysts brings audit review and analysis together across sources.

Claims that did not hold

9 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

3.13.2eAC.L2-3.1.5

Least Privilege

control identity corrected 2026-08-19: issued 3.13.2e is introducing unpredictability into operations; these mappings are least privilege and secure engineering, a subject that appears nowhere in the issued 800-172