CMMC 2.0

United States

v2.0

14 domains

110 controls

Cybersecurity Maturity Model Certification for defense industrial base

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (14)

Access Control

22 controls

Controls in the Access Control domain of CMMC 2.0 — 22 controls
Code	Title	Description
AC.L2-3.1.1	Authorized Access Control	CMMC 2.0 Level 2 practice AC.L2-3.1.1: Authorized Access Control (= NIST SP 800-171 Rev 2 requirement 3.1.1).
AC.L2-3.1.10	Session Lock	CMMC 2.0 Level 2 practice AC.L2-3.1.10: Session Lock (= NIST SP 800-171 Rev 2 requirement 3.1.10).
AC.L2-3.1.11	Session Termination	CMMC 2.0 Level 2 practice AC.L2-3.1.11: Session Termination (= NIST SP 800-171 Rev 2 requirement 3.1.11).
AC.L2-3.1.12	Control Remote Access	CMMC 2.0 Level 2 practice AC.L2-3.1.12: Control Remote Access (= NIST SP 800-171 Rev 2 requirement 3.1.12).
AC.L2-3.1.13	Remote Access Confidentiality	CMMC 2.0 Level 2 practice AC.L2-3.1.13: Remote Access Confidentiality (= NIST SP 800-171 Rev 2 requirement 3.1.13).
AC.L2-3.1.14	Remote Access Routing	CMMC 2.0 Level 2 practice AC.L2-3.1.14: Remote Access Routing (= NIST SP 800-171 Rev 2 requirement 3.1.14).
AC.L2-3.1.15	Privileged Remote Access	CMMC 2.0 Level 2 practice AC.L2-3.1.15: Privileged Remote Access (= NIST SP 800-171 Rev 2 requirement 3.1.15).
AC.L2-3.1.16	Wireless Access Authorization	CMMC 2.0 Level 2 practice AC.L2-3.1.16: Wireless Access Authorization (= NIST SP 800-171 Rev 2 requirement 3.1.16).
AC.L2-3.1.17	Wireless Access Protection	CMMC 2.0 Level 2 practice AC.L2-3.1.17: Wireless Access Protection (= NIST SP 800-171 Rev 2 requirement 3.1.17).
AC.L2-3.1.18	Mobile Device Connection	CMMC 2.0 Level 2 practice AC.L2-3.1.18: Mobile Device Connection (= NIST SP 800-171 Rev 2 requirement 3.1.18).
AC.L2-3.1.19	Encrypt CUI on Mobile	CMMC 2.0 Level 2 practice AC.L2-3.1.19: Encrypt CUI on Mobile (= NIST SP 800-171 Rev 2 requirement 3.1.19).
AC.L2-3.1.2	Transaction & Function Control	CMMC 2.0 Level 2 practice AC.L2-3.1.2: Transaction & Function Control (= NIST SP 800-171 Rev 2 requirement 3.1.2).
AC.L2-3.1.20	External Connections	CMMC 2.0 Level 2 practice AC.L2-3.1.20: External Connections (= NIST SP 800-171 Rev 2 requirement 3.1.20).
AC.L2-3.1.21	Portable Storage Use	CMMC 2.0 Level 2 practice AC.L2-3.1.21: Portable Storage Use (= NIST SP 800-171 Rev 2 requirement 3.1.21).
AC.L2-3.1.22	Control Public Information	CMMC 2.0 Level 2 practice AC.L2-3.1.22: Control Public Information (= NIST SP 800-171 Rev 2 requirement 3.1.22).
AC.L2-3.1.3	Control CUI Flow	CMMC 2.0 Level 2 practice AC.L2-3.1.3: Control CUI Flow (= NIST SP 800-171 Rev 2 requirement 3.1.3).
AC.L2-3.1.4	Separation of Duties	CMMC 2.0 Level 2 practice AC.L2-3.1.4: Separation of Duties (= NIST SP 800-171 Rev 2 requirement 3.1.4).
AC.L2-3.1.5	Least Privilege	CMMC 2.0 Level 2 practice AC.L2-3.1.5: Least Privilege (= NIST SP 800-171 Rev 2 requirement 3.1.5).
AC.L2-3.1.6	Non-Privileged Account Use	CMMC 2.0 Level 2 practice AC.L2-3.1.6: Non-Privileged Account Use (= NIST SP 800-171 Rev 2 requirement 3.1.6).
AC.L2-3.1.7	Privileged Functions	CMMC 2.0 Level 2 practice AC.L2-3.1.7: Privileged Functions (= NIST SP 800-171 Rev 2 requirement 3.1.7).
AC.L2-3.1.8	Unsuccessful Logon Attempts	CMMC 2.0 Level 2 practice AC.L2-3.1.8: Unsuccessful Logon Attempts (= NIST SP 800-171 Rev 2 requirement 3.1.8).
AC.L2-3.1.9	Privacy & Security Notices	CMMC 2.0 Level 2 practice AC.L2-3.1.9: Privacy & Security Notices (= NIST SP 800-171 Rev 2 requirement 3.1.9).

Audit and Accountability

9 controls

Controls in the Audit and Accountability domain of CMMC 2.0 — 9 controls
Code	Title	Description
AU.L2-3.3.1	System Auditing	CMMC 2.0 Level 2 practice AU.L2-3.3.1: System Auditing (= NIST SP 800-171 Rev 2 requirement 3.3.1).
AU.L2-3.3.2	User Accountability	CMMC 2.0 Level 2 practice AU.L2-3.3.2: User Accountability (= NIST SP 800-171 Rev 2 requirement 3.3.2).
AU.L2-3.3.3	Event Review	CMMC 2.0 Level 2 practice AU.L2-3.3.3: Event Review (= NIST SP 800-171 Rev 2 requirement 3.3.3).
AU.L2-3.3.4	Audit Failure Alerting	CMMC 2.0 Level 2 practice AU.L2-3.3.4: Audit Failure Alerting (= NIST SP 800-171 Rev 2 requirement 3.3.4).
AU.L2-3.3.5	Audit Correlation	CMMC 2.0 Level 2 practice AU.L2-3.3.5: Audit Correlation (= NIST SP 800-171 Rev 2 requirement 3.3.5).
AU.L2-3.3.6	Reduction & Reporting	CMMC 2.0 Level 2 practice AU.L2-3.3.6: Reduction & Reporting (= NIST SP 800-171 Rev 2 requirement 3.3.6).
AU.L2-3.3.7	Time Stamps & Synchronization	CMMC 2.0 Level 2 practice AU.L2-3.3.7: Time Stamps & Synchronization (= NIST SP 800-171 Rev 2 requirement 3.3.7).
AU.L2-3.3.8	Audit Protection	CMMC 2.0 Level 2 practice AU.L2-3.3.8: Audit Protection (= NIST SP 800-171 Rev 2 requirement 3.3.8).
AU.L2-3.3.9	Audit Management	CMMC 2.0 Level 2 practice AU.L2-3.3.9: Audit Management (= NIST SP 800-171 Rev 2 requirement 3.3.9).

Awareness and Training

3 controls

Controls in the Awareness and Training domain of CMMC 2.0 — 3 controls
Code	Title	Description
AT.L2-3.2.1	Role-Based Risk Awareness	CMMC 2.0 Level 2 practice AT.L2-3.2.1: Role-Based Risk Awareness (= NIST SP 800-171 Rev 2 requirement 3.2.1).
AT.L2-3.2.2	Role-Based Training	CMMC 2.0 Level 2 practice AT.L2-3.2.2: Role-Based Training (= NIST SP 800-171 Rev 2 requirement 3.2.2).
AT.L2-3.2.3	Insider Threat Awareness	CMMC 2.0 Level 2 practice AT.L2-3.2.3: Insider Threat Awareness (= NIST SP 800-171 Rev 2 requirement 3.2.3).

Configuration Management

9 controls

Controls in the Configuration Management domain of CMMC 2.0 — 9 controls
Code	Title	Description
CM.L2-3.4.1	System Baselining	CMMC 2.0 Level 2 practice CM.L2-3.4.1: System Baselining (= NIST SP 800-171 Rev 2 requirement 3.4.1).
CM.L2-3.4.2	Security Configuration Enforcement	CMMC 2.0 Level 2 practice CM.L2-3.4.2: Security Configuration Enforcement (= NIST SP 800-171 Rev 2 requirement 3.4.2).
CM.L2-3.4.3	System Change Management	CMMC 2.0 Level 2 practice CM.L2-3.4.3: System Change Management (= NIST SP 800-171 Rev 2 requirement 3.4.3).
CM.L2-3.4.4	Security Impact Analysis	CMMC 2.0 Level 2 practice CM.L2-3.4.4: Security Impact Analysis (= NIST SP 800-171 Rev 2 requirement 3.4.4).
CM.L2-3.4.5	Access Restrictions for Change	CMMC 2.0 Level 2 practice CM.L2-3.4.5: Access Restrictions for Change (= NIST SP 800-171 Rev 2 requirement 3.4.5).
CM.L2-3.4.6	Least Functionality	CMMC 2.0 Level 2 practice CM.L2-3.4.6: Least Functionality (= NIST SP 800-171 Rev 2 requirement 3.4.6).
CM.L2-3.4.7	Nonessential Functionality	CMMC 2.0 Level 2 practice CM.L2-3.4.7: Nonessential Functionality (= NIST SP 800-171 Rev 2 requirement 3.4.7).
CM.L2-3.4.8	Application Execution Policy	CMMC 2.0 Level 2 practice CM.L2-3.4.8: Application Execution Policy (= NIST SP 800-171 Rev 2 requirement 3.4.8).
CM.L2-3.4.9	User-Installed Software	CMMC 2.0 Level 2 practice CM.L2-3.4.9: User-Installed Software (= NIST SP 800-171 Rev 2 requirement 3.4.9).

Identification and Authentication

11 controls

Controls in the Identification and Authentication domain of CMMC 2.0 — 11 controls
Code	Title	Description
IA.L2-3.5.1	Identification	CMMC 2.0 Level 2 practice IA.L2-3.5.1: Identification (= NIST SP 800-171 Rev 2 requirement 3.5.1).
IA.L2-3.5.10	Cryptographically-Protected Passwords	CMMC 2.0 Level 2 practice IA.L2-3.5.10: Cryptographically-Protected Passwords (= NIST SP 800-171 Rev 2 requirement 3.5.1...
IA.L2-3.5.11	Obscure Feedback	CMMC 2.0 Level 2 practice IA.L2-3.5.11: Obscure Feedback (= NIST SP 800-171 Rev 2 requirement 3.5.11).
IA.L2-3.5.2	Authentication	CMMC 2.0 Level 2 practice IA.L2-3.5.2: Authentication (= NIST SP 800-171 Rev 2 requirement 3.5.2).
IA.L2-3.5.3	Multifactor Authentication	CMMC 2.0 Level 2 practice IA.L2-3.5.3: Multifactor Authentication (= NIST SP 800-171 Rev 2 requirement 3.5.3).
IA.L2-3.5.4	Replay-Resistant Authentication	CMMC 2.0 Level 2 practice IA.L2-3.5.4: Replay-Resistant Authentication (= NIST SP 800-171 Rev 2 requirement 3.5.4).
IA.L2-3.5.5	Identifier Reuse	CMMC 2.0 Level 2 practice IA.L2-3.5.5: Identifier Reuse (= NIST SP 800-171 Rev 2 requirement 3.5.5).
IA.L2-3.5.6	Identifier Handling	CMMC 2.0 Level 2 practice IA.L2-3.5.6: Identifier Handling (= NIST SP 800-171 Rev 2 requirement 3.5.6).
IA.L2-3.5.7	Password Complexity	CMMC 2.0 Level 2 practice IA.L2-3.5.7: Password Complexity (= NIST SP 800-171 Rev 2 requirement 3.5.7).
IA.L2-3.5.8	Password Reuse	CMMC 2.0 Level 2 practice IA.L2-3.5.8: Password Reuse (= NIST SP 800-171 Rev 2 requirement 3.5.8).
IA.L2-3.5.9	Temporary Passwords	CMMC 2.0 Level 2 practice IA.L2-3.5.9: Temporary Passwords (= NIST SP 800-171 Rev 2 requirement 3.5.9).

Incident Response

3 controls

Controls in the Incident Response domain of CMMC 2.0 — 3 controls
Code	Title	Description
IR.L2-3.6.1	Incident Handling	CMMC 2.0 Level 2 practice IR.L2-3.6.1: Incident Handling (= NIST SP 800-171 Rev 2 requirement 3.6.1).
IR.L2-3.6.2	Incident Reporting	CMMC 2.0 Level 2 practice IR.L2-3.6.2: Incident Reporting (= NIST SP 800-171 Rev 2 requirement 3.6.2).
IR.L2-3.6.3	Incident Response Testing	CMMC 2.0 Level 2 practice IR.L2-3.6.3: Incident Response Testing (= NIST SP 800-171 Rev 2 requirement 3.6.3).

Maintenance

6 controls

Controls in the Maintenance domain of CMMC 2.0 — 6 controls
Code	Title	Description
MA.L2-3.7.1	Perform Maintenance	CMMC 2.0 Level 2 practice MA.L2-3.7.1: Perform Maintenance (= NIST SP 800-171 Rev 2 requirement 3.7.1).
MA.L2-3.7.2	System Maintenance Control	CMMC 2.0 Level 2 practice MA.L2-3.7.2: System Maintenance Control (= NIST SP 800-171 Rev 2 requirement 3.7.2).
MA.L2-3.7.3	Equipment Sanitization	CMMC 2.0 Level 2 practice MA.L2-3.7.3: Equipment Sanitization (= NIST SP 800-171 Rev 2 requirement 3.7.3).
MA.L2-3.7.4	Media Inspection	CMMC 2.0 Level 2 practice MA.L2-3.7.4: Media Inspection (= NIST SP 800-171 Rev 2 requirement 3.7.4).
MA.L2-3.7.5	Nonlocal Maintenance	CMMC 2.0 Level 2 practice MA.L2-3.7.5: Nonlocal Maintenance (= NIST SP 800-171 Rev 2 requirement 3.7.5).
MA.L2-3.7.6	Maintenance Personnel	CMMC 2.0 Level 2 practice MA.L2-3.7.6: Maintenance Personnel (= NIST SP 800-171 Rev 2 requirement 3.7.6).

Media Protection

9 controls

Controls in the Media Protection domain of CMMC 2.0 — 9 controls
Code	Title	Description
MP.L2-3.8.1	Media Protection	CMMC 2.0 Level 2 practice MP.L2-3.8.1: Media Protection (= NIST SP 800-171 Rev 2 requirement 3.8.1).
MP.L2-3.8.2	Media Access	CMMC 2.0 Level 2 practice MP.L2-3.8.2: Media Access (= NIST SP 800-171 Rev 2 requirement 3.8.2).
MP.L2-3.8.3	Media Disposal	CMMC 2.0 Level 2 practice MP.L2-3.8.3: Media Disposal (= NIST SP 800-171 Rev 2 requirement 3.8.3).
MP.L2-3.8.4	Media Markings	CMMC 2.0 Level 2 practice MP.L2-3.8.4: Media Markings (= NIST SP 800-171 Rev 2 requirement 3.8.4).
MP.L2-3.8.5	Media Accountability	CMMC 2.0 Level 2 practice MP.L2-3.8.5: Media Accountability (= NIST SP 800-171 Rev 2 requirement 3.8.5).
MP.L2-3.8.6	Portable Storage Encryption	CMMC 2.0 Level 2 practice MP.L2-3.8.6: Portable Storage Encryption (= NIST SP 800-171 Rev 2 requirement 3.8.6).
MP.L2-3.8.7	Removable Media	CMMC 2.0 Level 2 practice MP.L2-3.8.7: Removable Media (= NIST SP 800-171 Rev 2 requirement 3.8.7).
MP.L2-3.8.8	Shared Media	CMMC 2.0 Level 2 practice MP.L2-3.8.8: Shared Media (= NIST SP 800-171 Rev 2 requirement 3.8.8).
MP.L2-3.8.9	Protect Backups	CMMC 2.0 Level 2 practice MP.L2-3.8.9: Protect Backups (= NIST SP 800-171 Rev 2 requirement 3.8.9).

Personnel Security

2 controls

Controls in the Personnel Security domain of CMMC 2.0 — 2 controls
Code	Title	Description
PS.L2-3.9.1	Screen Individuals	CMMC 2.0 Level 2 practice PS.L2-3.9.1: Screen Individuals (= NIST SP 800-171 Rev 2 requirement 3.9.1).
PS.L2-3.9.2	Personnel Actions	CMMC 2.0 Level 2 practice PS.L2-3.9.2: Personnel Actions (= NIST SP 800-171 Rev 2 requirement 3.9.2).

Physical Protection

6 controls

Controls in the Physical Protection domain of CMMC 2.0 — 6 controls
Code	Title	Description
PE.L2-3.10.1	Limit Physical Access	CMMC 2.0 Level 2 practice PE.L2-3.10.1: Limit Physical Access (= NIST SP 800-171 Rev 2 requirement 3.10.1).
PE.L2-3.10.2	Monitor Facility	CMMC 2.0 Level 2 practice PE.L2-3.10.2: Monitor Facility (= NIST SP 800-171 Rev 2 requirement 3.10.2).
PE.L2-3.10.3	Escort Visitors	CMMC 2.0 Level 2 practice PE.L2-3.10.3: Escort Visitors (= NIST SP 800-171 Rev 2 requirement 3.10.3).
PE.L2-3.10.4	Physical Access Logs	CMMC 2.0 Level 2 practice PE.L2-3.10.4: Physical Access Logs (= NIST SP 800-171 Rev 2 requirement 3.10.4).
PE.L2-3.10.5	Manage Physical Access	CMMC 2.0 Level 2 practice PE.L2-3.10.5: Manage Physical Access (= NIST SP 800-171 Rev 2 requirement 3.10.5).
PE.L2-3.10.6	Alternative Work Sites	CMMC 2.0 Level 2 practice PE.L2-3.10.6: Alternative Work Sites (= NIST SP 800-171 Rev 2 requirement 3.10.6).

Risk Assessment

3 controls

Controls in the Risk Assessment domain of CMMC 2.0 — 3 controls
Code	Title	Description
RA.L2-3.11.1	Risk Assessments	CMMC 2.0 Level 2 practice RA.L2-3.11.1: Risk Assessments (= NIST SP 800-171 Rev 2 requirement 3.11.1).
RA.L2-3.11.2	Vulnerability Scan	CMMC 2.0 Level 2 practice RA.L2-3.11.2: Vulnerability Scan (= NIST SP 800-171 Rev 2 requirement 3.11.2).
RA.L2-3.11.3	Vulnerability Remediation	CMMC 2.0 Level 2 practice RA.L2-3.11.3: Vulnerability Remediation (= NIST SP 800-171 Rev 2 requirement 3.11.3).

Security Assessment

4 controls

Controls in the Security Assessment domain of CMMC 2.0 — 4 controls
Code	Title	Description
CA.L2-3.12.1	Security Control Assessment	CMMC 2.0 Level 2 practice CA.L2-3.12.1: Security Control Assessment (= NIST SP 800-171 Rev 2 requirement 3.12.1).
CA.L2-3.12.2	Plan of Action	CMMC 2.0 Level 2 practice CA.L2-3.12.2: Plan of Action (= NIST SP 800-171 Rev 2 requirement 3.12.2).
CA.L2-3.12.3	Security Control Monitoring	CMMC 2.0 Level 2 practice CA.L2-3.12.3: Security Control Monitoring (= NIST SP 800-171 Rev 2 requirement 3.12.3).
CA.L2-3.12.4	System Security Plan	CMMC 2.0 Level 2 practice CA.L2-3.12.4: System Security Plan (= NIST SP 800-171 Rev 2 requirement 3.12.4).

System and Communications Protection

16 controls

Controls in the System and Communications Protection domain of CMMC 2.0 — 16 controls
Code	Title	Description
SC.L2-3.13.1	Boundary Protection	CMMC 2.0 Level 2 practice SC.L2-3.13.1: Boundary Protection (= NIST SP 800-171 Rev 2 requirement 3.13.1).
SC.L2-3.13.10	Key Management	CMMC 2.0 Level 2 practice SC.L2-3.13.10: Key Management (= NIST SP 800-171 Rev 2 requirement 3.13.10).
SC.L2-3.13.11	CUI Encryption	CMMC 2.0 Level 2 practice SC.L2-3.13.11: CUI Encryption (= NIST SP 800-171 Rev 2 requirement 3.13.11).
SC.L2-3.13.12	Collaborative Device Control	CMMC 2.0 Level 2 practice SC.L2-3.13.12: Collaborative Device Control (= NIST SP 800-171 Rev 2 requirement 3.13.12).
SC.L2-3.13.13	Mobile Code	CMMC 2.0 Level 2 practice SC.L2-3.13.13: Mobile Code (= NIST SP 800-171 Rev 2 requirement 3.13.13).
SC.L2-3.13.14	Voice over Internet Protocol	CMMC 2.0 Level 2 practice SC.L2-3.13.14: Voice over Internet Protocol (= NIST SP 800-171 Rev 2 requirement 3.13.14).
SC.L2-3.13.15	Communications Authenticity	CMMC 2.0 Level 2 practice SC.L2-3.13.15: Communications Authenticity (= NIST SP 800-171 Rev 2 requirement 3.13.15).
SC.L2-3.13.16	Data at Rest	CMMC 2.0 Level 2 practice SC.L2-3.13.16: Data at Rest (= NIST SP 800-171 Rev 2 requirement 3.13.16).
SC.L2-3.13.2	Security Engineering	CMMC 2.0 Level 2 practice SC.L2-3.13.2: Security Engineering (= NIST SP 800-171 Rev 2 requirement 3.13.2).
SC.L2-3.13.3	Role Separation	CMMC 2.0 Level 2 practice SC.L2-3.13.3: Role Separation (= NIST SP 800-171 Rev 2 requirement 3.13.3).
SC.L2-3.13.4	Shared Resource Control	CMMC 2.0 Level 2 practice SC.L2-3.13.4: Shared Resource Control (= NIST SP 800-171 Rev 2 requirement 3.13.4).
SC.L2-3.13.5	Public-Access System Separation	CMMC 2.0 Level 2 practice SC.L2-3.13.5: Public-Access System Separation (= NIST SP 800-171 Rev 2 requirement 3.13.5).
SC.L2-3.13.6	Network Communication by Exception	CMMC 2.0 Level 2 practice SC.L2-3.13.6: Network Communication by Exception (= NIST SP 800-171 Rev 2 requirement 3.13.6).
SC.L2-3.13.7	Split Tunneling	CMMC 2.0 Level 2 practice SC.L2-3.13.7: Split Tunneling (= NIST SP 800-171 Rev 2 requirement 3.13.7).
SC.L2-3.13.8	Data in Transit	CMMC 2.0 Level 2 practice SC.L2-3.13.8: Data in Transit (= NIST SP 800-171 Rev 2 requirement 3.13.8).
SC.L2-3.13.9	Connections Termination	CMMC 2.0 Level 2 practice SC.L2-3.13.9: Connections Termination (= NIST SP 800-171 Rev 2 requirement 3.13.9).

System and Information Integrity

7 controls

Controls in the System and Information Integrity domain of CMMC 2.0 — 7 controls
Code	Title	Description
SI.L2-3.14.1	Flaw Remediation	CMMC 2.0 Level 2 practice SI.L2-3.14.1: Flaw Remediation (= NIST SP 800-171 Rev 2 requirement 3.14.1).
SI.L2-3.14.2	Malicious Code Protection	CMMC 2.0 Level 2 practice SI.L2-3.14.2: Malicious Code Protection (= NIST SP 800-171 Rev 2 requirement 3.14.2).
SI.L2-3.14.3	Security Alerts & Advisories	CMMC 2.0 Level 2 practice SI.L2-3.14.3: Security Alerts & Advisories (= NIST SP 800-171 Rev 2 requirement 3.14.3).
SI.L2-3.14.4	Update Malicious Code Protection	CMMC 2.0 Level 2 practice SI.L2-3.14.4: Update Malicious Code Protection (= NIST SP 800-171 Rev 2 requirement 3.14.4).
SI.L2-3.14.5	System & File Scanning	CMMC 2.0 Level 2 practice SI.L2-3.14.5: System & File Scanning (= NIST SP 800-171 Rev 2 requirement 3.14.5).
SI.L2-3.14.6	Monitor Communications for Attacks	CMMC 2.0 Level 2 practice SI.L2-3.14.6: Monitor Communications for Attacks (= NIST SP 800-171 Rev 2 requirement 3.14.6).
SI.L2-3.14.7	Identify Unauthorized Use	CMMC 2.0 Level 2 practice SI.L2-3.14.7: Identify Unauthorized Use (= NIST SP 800-171 Rev 2 requirement 3.14.7).

Your Compliance Coverage

If you comply with CMMC 2.0, you already cover:

NIST SP 800-53 Rev 5

29%

32 controls mapped

Compare →

CMMC 2.0 Level 1

15%

17 controls mapped

Compare →

NIST Cybersecurity Framework 2.0

7 controls mapped

Compare →

+ 2 more: DFARS 252.204-7012 - Safeguarding Covered Defense Information (3%), DISA Security Technical Implementation Guides (STIGs) (3%)

See all 5 mapped frameworks ↓

Maps to 5 other frameworks

110 total controls

NIST SP 800-53 Rev 5

32 source controls mapped|32 target controls covered

29%

CMMC 2.0 Level 1

17 source controls mapped|17 target controls covered

15%

NIST Cybersecurity Framework 2.0

7 source controls mapped|6 target controls covered

DFARS 252.204-7012 - Safeguarding Covered Defense Information

3 source controls mapped|2 target controls covered

DISA Security Technical Implementation Guides (STIGs)

3 source controls mapped|3 target controls covered

Compare CMMC 2.0 with NIST SP 800-53 Rev 5

Frequently Asked Questions

What is CMMC 2.0?

CMMC 2.0 is a compliance framework from United States with 14 domains and 110 controls. Cybersecurity Maturity Model Certification for defense industrial base It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does CMMC 2.0 have?

CMMC 2.0 has 110 controls organised across 14 domains. The largest domains are Access Control (22 controls), System and Communications Protection (16 controls), Identification and Authentication (11 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does CMMC 2.0 map to?

CMMC 2.0 maps to 5 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (29% coverage), CMMC 2.0 Level 1 (15% coverage), NIST Cybersecurity Framework 2.0 (6% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with CMMC 2.0 compliance?

Start your CMMC 2.0 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CMMC 2.0 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 110 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required