CMMC 2.0

United States

v2.0

14 domains

110 controls

Cybersecurity Maturity Model Certification for defense industrial base

Verified

CMMC 2.0 is a compliance framework from United States with 14 domains and 110 controls that map to 48 other frameworks. The largest domains are Access Control (22 controls), System and Communications Protection (16 controls), Identification and Authentication (11 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (14)

Access Control

22 controls

Controls in the Access Control domain of CMMC 2.0 — 22 controls
Code	Title	Description
AC.L2-3.1.1	Authorized Access Control	Restrict system access so only identified, authorized users, the processes running on their behalf, and approved devices...
AC.L2-3.1.10	Session Lock	Lock the user session after a defined period of inactivity and conceal previously displayed content behind a pattern hid...
AC.L2-3.1.11	Session Termination	Automatically end a user session once a defined condition, such as an inactivity period or maximum session duration, is...
AC.L2-3.1.12	Control Remote Access	Monitor and control remote access sessions so each remote connection is authorized, visible to the organization and subj...
AC.L2-3.1.13	Remote Access Confidentiality	Apply cryptographic protection to remote access sessions so session confidentiality is preserved in transit.
AC.L2-3.1.14	Remote Access Routing	Force remote access traffic through a limited set of managed access control points rather than allowing arbitrary entry...
AC.L2-3.1.15	Privileged Remote Access	Require explicit authorization before privileged commands may be executed remotely or security relevant information acce...
AC.L2-3.1.16	Wireless Access Authorization	Authorize each wireless connection before it is permitted to attach to the system.
AC.L2-3.1.17	Wireless Access Protection	Protect wireless connections using authentication and encryption so wireless traffic and access are not open to nearby p...
AC.L2-3.1.18	Mobile Device Connection	Control which mobile devices may connect to organizational systems, and manage those connections.
AC.L2-3.1.19	Encrypt CUI on Mobile	Encrypt CUI held on mobile devices and mobile computing platforms so the data stays protected if a device is lost or sto...
AC.L2-3.1.2	Transaction & Function Control	Confine each authorized user to the specific transactions and functions their role permits, so privileges bound what can...
AC.L2-3.1.20	External Connections	Verify, then control or limit, connections to and use of external systems that are outside organizational control.
AC.L2-3.1.21	Portable Storage Use	Restrict how organizational portable storage devices may be used when connected to systems outside organizational contro...
AC.L2-3.1.22	Control Public Information	Control CUI that is posted to or processed on publicly accessible systems so CUI is not released to the public.
AC.L2-3.1.3	Control CUI Flow	Enforce approved authorization rules on the movement of CUI between systems, components and destinations, so CUI flows o...
AC.L2-3.1.4	Separation of Duties	Divide security relevant duties among different individuals so no single person can both carry out and conceal a harmful...
AC.L2-3.1.5	Least Privilege	Grant users and processes only the privileges their assigned tasks require, applying this specifically to security funct...
AC.L2-3.1.6	Non-Privileged Account Use	Require staff holding privileged accounts to use a non privileged account or role when performing work that does not nee...
AC.L2-3.1.7	Privileged Functions	Block non privileged users from executing privileged functions, and capture every execution of such functions in the aud...
AC.L2-3.1.8	Unsuccessful Logon Attempts	Cap the number of consecutive failed logon attempts allowed and take a defined action, such as account lockout, once tha...
AC.L2-3.1.9	Privacy & Security Notices	Display privacy and security notices to users at logon that reflect the CUI rules applicable to the system.

Audit and Accountability

9 controls

Controls in the Audit and Accountability domain of CMMC 2.0 — 9 controls
Code	Title	Description
AU.L2-3.3.1	System Auditing	Generate and retain system audit logs in sufficient scope and detail to support monitoring, analysis, investigation and...
AU.L2-3.3.2	User Accountability	Ensure actions taken on the system can be traced uniquely to the individual user responsible so users can be held accoun...
AU.L2-3.3.3	Event Review	Review the set of events selected for logging and update it as the environment and threat picture change.
AU.L2-3.3.4	Audit Failure Alerting	Raise an alert when the audit logging process itself fails, so a loss of logging is noticed rather than silent.
AU.L2-3.3.5	Audit Correlation	Bring audit review, analysis and reporting together across sources so signs of unlawful, unauthorized, suspicious or unu...
AU.L2-3.3.6	Reduction & Reporting	Provide audit record reduction and report generation capability that supports analysis and reporting on demand.
AU.L2-3.3.7	Time Stamps & Synchronization	Synchronize internal system clocks against an authoritative time source so audit record time stamps are comparable acros...
AU.L2-3.3.8	Audit Protection	Prevent unauthorized access to, modification of, and deletion of both audit records and the tools that produce them.
AU.L2-3.3.9	Audit Management	Restrict the ability to manage audit logging functionality to a limited subset of privileged users, separate from genera...

Awareness and Training

3 controls

Controls in the Awareness and Training domain of CMMC 2.0 — 3 controls
Code	Title	Description
AT.L2-3.2.1	Role-Based Risk Awareness	Make managers, system administrators and users aware of the security risks their activities create and of the policies,...
AT.L2-3.2.2	Role-Based Training	Train personnel to perform the specific information security duties and responsibilities assigned to their roles.
AT.L2-3.2.3	Insider Threat Awareness	Provide awareness training that teaches staff to recognize potential insider threat indicators and to report them.

Configuration Management

9 controls

Controls in the Configuration Management domain of CMMC 2.0 — 9 controls
Code	Title	Description
CM.L2-3.4.1	System Baselining	Establish and maintain baseline configurations and inventories of systems, covering hardware, software, firmware and doc...
CM.L2-3.4.2	Security Configuration Enforcement	Define security configuration settings for the IT products used in the system and enforce those settings in operation.
CM.L2-3.4.3	System Change Management	Track changes to systems, review them, approve or reject them, and log the decision together with the change.
CM.L2-3.4.4	Security Impact Analysis	Analyze the security impact of a proposed change before it is implemented.
CM.L2-3.4.5	Access Restrictions for Change	Define, document, approve and enforce the physical and logical access restrictions that apply to making changes to syste...
CM.L2-3.4.6	Least Functionality	Configure systems to provide only the capabilities that are essential, applying the principle of least functionality.
CM.L2-3.4.7	Nonessential Functionality	Prevent nonessential programs, functions, ports, protocols and services from being used, by restricting or disabling eac...
CM.L2-3.4.8	Application Execution Policy	Operate a software execution policy, either deny by exception blocking of unauthorized software or permit by exception a...
CM.L2-3.4.9	User-Installed Software	Control which software users are able to install, and monitor what has in fact been installed on organizational systems.

Identification and Authentication

11 controls

Controls in the Identification and Authentication domain of CMMC 2.0 — 11 controls
Code	Title	Description
IA.L2-3.5.1	Identification	Identify system users, the processes acting on their behalf, and devices, so each is distinguishable before any access d...
IA.L2-3.5.10	Cryptographically-Protected Passwords	Store and transmit passwords only in cryptographically protected form.
IA.L2-3.5.11	Obscure Feedback	Obscure authentication feedback during entry so credentials cannot be read from the screen.
IA.L2-3.5.2	Authentication	Authenticate or verify the identity of users, processes and devices as a precondition of granting access to organization...
IA.L2-3.5.3	Multifactor Authentication	Require more than one authentication factor for privileged account access both locally and across the network, and for n...
IA.L2-3.5.4	Replay-Resistant Authentication	Use authentication mechanisms that resist replay for network access to both privileged and non privileged accounts.
IA.L2-3.5.5	Identifier Reuse	Prevent an identifier from being reissued to a different entity until a defined period has elapsed.
IA.L2-3.5.6	Identifier Handling	Disable identifiers once they have been inactive for a defined period.
IA.L2-3.5.7	Password Complexity	Set a minimum complexity for passwords, and require that a newly created password differ in its characters from the one...
IA.L2-3.5.8	Password Reuse	Prohibit reuse of a password for a specified number of generations.
IA.L2-3.5.9	Temporary Passwords	Permit a temporary password for logon only where it must be changed to a permanent password immediately on use.

Incident Response

3 controls

Controls in the Incident Response domain of CMMC 2.0 — 3 controls
Code	Title	Description
IR.L2-3.6.1	Incident Handling	Operate an incident handling capability covering preparation, detection, analysis, containment, recovery and user respon...
IR.L2-3.6.2	Incident Reporting	Track, document and report incidents to the designated internal officials and to external authorities where required.
IR.L2-3.6.3	Incident Response Testing	Test the organizational incident response capability to confirm it works.

Maintenance

6 controls

Controls in the Maintenance domain of CMMC 2.0 — 6 controls
Code	Title	Description
MA.L2-3.7.1	Perform Maintenance	Carry out maintenance on organizational systems, so the scheduled and corrective upkeep those systems require is actuall...
MA.L2-3.7.2	System Maintenance Control	Place controls over the tools, techniques and mechanisms used for system maintenance, and over the personnel who carry i...
MA.L2-3.7.3	Equipment Sanitization	Remove CUI from equipment by sanitization before that equipment leaves the organization for off site maintenance.
MA.L2-3.7.4	Media Inspection	Scan media holding diagnostic and test programs for malicious code before that media is connected to organizational syst...
MA.L2-3.7.5	Nonlocal Maintenance	Authenticate nonlocal maintenance sessions opened across external networks using multiple factors, and close those sessi...
MA.L2-3.7.6	Maintenance Personnel	Supervise maintenance personnel who do not hold the access authorization normally required, for the duration of their wo...

Media Protection

9 controls

Controls in the Media Protection domain of CMMC 2.0 — 9 controls
Code	Title	Description
MP.L2-3.8.1	Media Protection	Physically control and securely store system media holding CUI, in both paper and digital form.
MP.L2-3.8.2	Media Access	Limit access to CUI held on system media to users authorized to see it.
MP.L2-3.8.3	Media Disposal	Sanitize or destroy system media containing CUI before the media is disposed of or released for reuse.
MP.L2-3.8.4	Media Markings	Mark media with the CUI markings and distribution limitations that apply to its contents.
MP.L2-3.8.5	Media Accountability	Restrict who may access media holding CUI, and keep that media accounted for whenever it moves beyond controlled areas.
MP.L2-3.8.6	Portable Storage Encryption	Apply cryptographic protection to CUI held on digital media during transport, unless equivalent alternative physical saf...
MP.L2-3.8.7	Removable Media	Govern which removable media may be used on system components, and enforce that restriction at the components themselves...
MP.L2-3.8.8	Shared Media	Prohibit the use of portable storage devices that have no identifiable owner.
MP.L2-3.8.9	Protect Backups	Protect the confidentiality of backup copies of CUI at the locations where those backups are stored.

Personnel Security

2 controls

Controls in the Personnel Security domain of CMMC 2.0 — 2 controls
Code	Title	Description
PS.L2-3.9.1	Screen Individuals	Screen individuals before authorizing their access to systems containing CUI.
PS.L2-3.9.2	Personnel Actions	Protect systems containing CUI during and after personnel actions such as termination or transfer, including timely revo...

Physical Protection

6 controls

Controls in the Physical Protection domain of CMMC 2.0 — 6 controls
Code	Title	Description
PE.L2-3.10.1	Limit Physical Access	Limit physical access to systems, equipment and their operating environments to authorized individuals.
PE.L2-3.10.2	Monitor Facility	Protect and monitor the physical facility and the support infrastructure that organizational systems depend on.
PE.L2-3.10.3	Escort Visitors	Escort visitors and monitor visitor activity while they are on site.
PE.L2-3.10.4	Physical Access Logs	Maintain audit logs recording physical access to facilities holding organizational systems.
PE.L2-3.10.5	Manage Physical Access	Control and manage physical access devices such as keys, locks, combinations and badge readers.
PE.L2-3.10.6	Alternative Work Sites	Enforce safeguarding measures for CUI at alternate work sites such as home or remote offices.

Risk Assessment

3 controls

Controls in the Risk Assessment domain of CMMC 2.0 — 3 controls
Code	Title	Description
RA.L2-3.11.1	Risk Assessments	Periodically assess the risk that operating organizational systems, and processing, storing or transmitting CUI, creates...
RA.L2-3.11.2	Vulnerability Scan	Scan systems and applications for vulnerabilities periodically and again when new vulnerabilities affecting them are ide...
RA.L2-3.11.3	Vulnerability Remediation	Remediate identified vulnerabilities in line with the priorities set by risk assessment.

Security Assessment

4 controls

Controls in the Security Assessment domain of CMMC 2.0 — 4 controls
Code	Title	Description
CA.L2-3.12.1	Security Control Assessment	Assess the security controls in place periodically to determine whether they are effective as implemented.
CA.L2-3.12.2	Plan of Action	Develop and carry out plans of action that correct identified deficiencies and reduce or eliminate vulnerabilities.
CA.L2-3.12.3	Security Control Monitoring	Monitor security controls continuously so their effectiveness is known on an ongoing basis rather than only at assessmen...
CA.L2-3.12.4	System Security Plan	Develop, document and periodically update a system security plan describing system boundaries, the operating environment...

System and Communications Protection

16 controls

Controls in the System and Communications Protection domain of CMMC 2.0 — 16 controls
Code	Title	Description
SC.L2-3.13.1	Boundary Protection	Monitor, control and protect communications at the external boundary of the system and at key internal boundaries.
SC.L2-3.13.10	Key Management	Establish and manage the cryptographic keys used by cryptography employed in organizational systems, across their life c...
SC.L2-3.13.11	CUI Encryption	Use FIPS validated cryptography wherever cryptography is relied on to protect the confidentiality of CUI.
SC.L2-3.13.12	Collaborative Device Control	Prohibit remote activation of collaborative computing devices such as cameras and microphones, and indicate to people pr...
SC.L2-3.13.13	Mobile Code	Define which mobile code technologies are permitted, enforce that decision, and keep mobile code use under observation.
SC.L2-3.13.14	Voice over Internet Protocol	Govern how Voice over Internet Protocol technology may be used, and keep its use under observation once deployed.
SC.L2-3.13.15	Communications Authenticity	Protect the authenticity of communications sessions so a session cannot be hijacked or spoofed.
SC.L2-3.13.16	Data at Rest	Protect the confidentiality of CUI while it is at rest in storage.
SC.L2-3.13.2	Security Engineering	Apply architectural design, software development techniques and systems engineering principles that promote effective in...
SC.L2-3.13.3	Role Separation	Separate user functionality from system management functionality so ordinary users are not presented with administrative...
SC.L2-3.13.4	Shared Resource Control	Prevent information from being transferred, intentionally or unintentionally, between users through shared system resour...
SC.L2-3.13.5	Public-Access System Separation	Place publicly accessible system components on subnetworks that are physically or logically separated from internal netw...
SC.L2-3.13.6	Network Communication by Exception	Deny network communications traffic by default and permit only traffic explicitly allowed by exception.
SC.L2-3.13.7	Split Tunneling	Prevent a remote device from holding a connection to organizational systems while simultaneously connecting through anot...
SC.L2-3.13.8	Data in Transit	Apply cryptographic protection to prevent unauthorized disclosure of CUI during transmission, unless alternative physica...
SC.L2-3.13.9	Connections Termination	Terminate network connections when the associated session ends or after a defined period of inactivity.

System and Information Integrity

7 controls

Controls in the System and Information Integrity domain of CMMC 2.0 — 7 controls
Code	Title	Description
SI.L2-3.14.1	Flaw Remediation	Identify system flaws, report them, and correct them within a timely period.
SI.L2-3.14.2	Malicious Code Protection	Provide malicious code protection at the points in the system where such code is likely to enter or execute.
SI.L2-3.14.3	Security Alerts & Advisories	Monitor security alerts and advisories and take action in response to them.
SI.L2-3.14.4	Update Malicious Code Protection	Keep malicious code protection mechanisms current by applying new releases as they are issued.
SI.L2-3.14.5	System & File Scanning	Run periodic scans of systems and real time scans of files arriving from external sources as those files are downloaded,...
SI.L2-3.14.6	Monitor Communications for Attacks	Watch organizational systems, and both inbound and outbound traffic, for attacks and for indicators that an attack may b...
SI.L2-3.14.7	Identify Unauthorized Use	Define what constitutes authorized use of organizational systems, and identify use that falls outside that definition.

Your Compliance Coverage

If you comply with CMMC 2.0, you already cover:

SOC 2

100%

110 controls mapped

Compare →

NIST SP 800-53 Rev 5

100%

110 controls mapped

Compare →

FedRAMP Moderate

99%

109 controls mapped

Compare →

+ 45 more: FedRAMP High (99%), ISO 27001:2022 (98%)

See all 48 mapped frameworks ↓

Maps to 48 other frameworks

110 total controls

SOC 2

110 source controls mapped|43 target controls covered

100%

NIST SP 800-53 Rev 5

110 source controls mapped|140 target controls covered

100%

FedRAMP Moderate

109 source controls mapped|176 target controls covered

99%

FedRAMP High

109 source controls mapped|176 target controls covered

99%

ISO 27001:2022

108 source controls mapped|76 target controls covered

98%

ISO 27002:2022

107 source controls mapped|71 target controls covered

97%

NIST SP 800-171 Rev 3

107 source controls mapped|88 target controls covered

97%

PCI DSS 4.0

102 source controls mapped|199 target controls covered

93%

NIST SP 800-53 Rev 5 MODERATE

100 source controls mapped|137 target controls covered

91%

NIST SP 800-53 Revision 5.1 HIGH

100 source controls mapped|139 target controls covered

91%

NIST Cybersecurity Framework 2.0

98 source controls mapped|71 target controls covered

89%

CIS Controls v8

97 source controls mapped|131 target controls covered

88%

C5 (Germany)

93 source controls mapped|86 target controls covered

85%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

92 source controls mapped|121 target controls covered

84%

HIPAA Security Rule

80 source controls mapped|49 target controls covered

73%

NIST SP 800-66 Rev 2

80 source controls mapped|45 target controls covered

73%

ISO 27701:2019

80 source controls mapped|64 target controls covered

73%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

79 source controls mapped|40 target controls covered

72%

AWS Well-Architected Security Pillar

77 source controls mapped|59 target controls covered

70%

NIST SP 800-161 Rev 1

73 source controls mapped|73 target controls covered

66%

NIST SP 800-53 Rev 5 LOW

71 source controls mapped|76 target controls covered

65%

Azure Security Benchmark

70 source controls mapped|70 target controls covered

64%

ASD Strategies to Mitigate Cyber Security Incidents

57 source controls mapped|37 target controls covered

52%

NIST SP 800-172

50 source controls mapped|30 target controls covered

45%

UK Cyber Essentials

40 source controls mapped|30 target controls covered

36%

ACSC Essential Eight

39 source controls mapped|22 target controls covered

35%

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

39 source controls mapped|14 target controls covered

35%

Australia Consumer Data Right - Banking (CDR)

36 source controls mapped|12 target controls covered

33%

NIS2 Directive

31 source controls mapped|17 target controls covered

28%

ISO 22301:2019

23 source controls mapped|31 target controls covered

21%

APRA CPS 234

17 source controls mapped|19 target controls covered

15%

CMMC 2.0 Level 1

17 source controls mapped|17 target controls covered

15%

NIST SP 800-218

16 source controls mapped|20 target controls covered

15%

APRA CPS 230 Operational Risk Management

12 source controls mapped|13 target controls covered

11%

APPI

10 source controls mapped|5 target controls covered

Authorised Economic Operator (AEO) Programmes - Global Standards

8 source controls mapped|5 target controls covered

ISO/IEC 42001:2023

6 source controls mapped|6 target controls covered

APRA SPS 220 Risk Management (Superannuation)

5 source controls mapped|7 target controls covered

APRA CPS 220 Risk Management

5 source controls mapped|9 target controls covered

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

4 source controls mapped|4 target controls covered

DFARS 252.204-7012 - Safeguarding Covered Defense Information

3 source controls mapped|2 target controls covered

DISA Security Technical Implementation Guides (STIGs)

3 source controls mapped|3 target controls covered

NIST SP 800-53A Rev. 5

3 source controls mapped|5 target controls covered

NIST SP 800-181

3 source controls mapped|4 target controls covered

ISO 27018:2019

1 source controls mapped|1 target controls covered

COSO Internal Control - Integrated Framework (2013)

1 source controls mapped|1 target controls covered

ISO 10005:2005

1 source controls mapped|1 target controls covered

ISO 9001:2015

1 source controls mapped|1 target controls covered

Compare CMMC 2.0 with SOC 2

What is CMMC 2.0 and who does it apply to?

CMMC 2.0 is a compliance framework from United States with 14 domains and 110 controls. Cybersecurity Maturity Model Certification for defense industrial base It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does CMMC 2.0 actually require?

CMMC 2.0 has 110 controls organised across 14 domains. The largest domains are Access Control (22 controls), System and Communications Protection (16 controls), Identification and Authentication (11 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of CMMC 2.0 do I already cover?

CMMC 2.0 maps to 48 other compliance frameworks. The top mapping partners are SOC 2 (100% coverage), NIST SP 800-53 Rev 5 (100% coverage), FedRAMP Moderate (99% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement CMMC 2.0?

Start your CMMC 2.0 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CMMC 2.0 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 110 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required