Sign in Register

CMMC 2.13

CMMC Practices

Each practice, grouped by domain and cross-referenced to the NIST controls that support it.

All levels Level 1 · Foundational Level 2 · Advanced Level 3 · Expert

149 practices

AC

Access Control28

AC.L1-b.1.iAuthorized Access Control [FCI Data]1 refL1 AC.L1-b.1.iiTransaction & Function Control [FCI Data]1 refL1 AC.L1-b.1.iiiExternal Connections [FCI Data]1 refL1 AC.L1-b.1.ivControl Public Information [FCI Data]1 refL1 AC.L2-3.1.1Authorized Access Control [CUI Data]1 refL2 AC.L2-3.1.2Transaction & Function Control [CUI Data]1 refL2 AC.L2-3.1.3Control CUI Flow1 refL2 AC.L2-3.1.4Separation of Duties1 refL2 AC.L2-3.1.5Least Privilege1 refL2 AC.L2-3.1.6Non-Privileged Account Use1 refL2 AC.L2-3.1.7Privileged Functions1 refL2 AC.L2-3.1.8Unsuccessful Logon Attempts1 refL2 AC.L2-3.1.9Privacy & Security Notices1 refL2 AC.L2-3.1.10Session Lock1 refL2 AC.L2-3.1.11Session Termination1 refL2 AC.L2-3.1.12Control Remote Access1 refL2 AC.L2-3.1.13Remote Access Confidentiality1 refL2 AC.L2-3.1.14Remote Access Routing1 refL2 AC.L2-3.1.15Privileged Remote Access1 refL2 AC.L2-3.1.16Wireless Access Authorization1 refL2 AC.L2-3.1.17Wireless Access Protection1 refL2 AC.L2-3.1.18Mobile Device Connection1 refL2 AC.L2-3.1.19Encrypt CUI on Mobile1 refL2 AC.L2-3.1.20External Connections [CUI Data]1 refL2 AC.L2-3.1.21Portable Storage Use1 refL2 AC.L2-3.1.22Control Public Information [CUI Data]1 refL2 AC.L3-3.1.2eOrganizationally Controlled AssetsL3 AC.L3-3.1.3eSecured Information TransferL3

AT

Awareness & Training5

AT.L2-3.2.1Role-Based Risk Awareness1 refL2 AT.L2-3.2.2Role-Based Training1 refL2 AT.L2-3.2.3Insider Threat Awareness1 refL2 AT.L3-3.2.1eAdvanced Threat AwarenessL3 AT.L3-3.2.2ePractical Training ExercisesL3

AU

Audit & Accountability9

AU.L2-3.3.1System Auditing1 refL2 AU.L2-3.3.2User Accountability1 refL2 AU.L2-3.3.3Event Review1 refL2 AU.L2-3.3.4Audit Failure Alerting1 refL2 AU.L2-3.3.5Audit Correlation1 refL2 AU.L2-3.3.6Reduction & Reporting1 refL2 AU.L2-3.3.7Authoritative Time Source1 refL2 AU.L2-3.3.8Audit Protection1 refL2 AU.L2-3.3.9Audit Management1 refL2

CM

Configuration Management12

CM.L2-3.4.1System Baselining1 refL2 CM.L2-3.4.2Security Configuration Enforcement1 refL2 CM.L2-3.4.3System Change Management1 refL2 CM.L2-3.4.4Security Impact Analysis1 refL2 CM.L2-3.4.5Access Restrictions for Change1 refL2 CM.L2-3.4.6Least Functionality1 refL2 CM.L2-3.4.7Nonessential Functionality1 refL2 CM.L2-3.4.8Application Execution Policy1 refL2 CM.L2-3.4.9User-Installed Software1 refL2 CM.L3-3.4.1eAuthoritative RepositoryL3 CM.L3-3.4.2eAutomated Detection & RemediationL3 CM.L3-3.4.3eAutomated InventoryL3

IA

Identification & Authentication15

IA.L1-b.1.vIdentification [FCI Data]1 refL1 IA.L1-b.1.viAuthentication [FCI Data]1 refL1 IA.L2-3.5.1Identification [CUI Data]1 refL2 IA.L2-3.5.2Authentication [CUI Data]1 refL2 IA.L2-3.5.3Multifactor Authentication1 refL2 IA.L2-3.5.4Replay-Resistant Authentication1 refL2 IA.L2-3.5.5Identifier Reuse1 refL2 IA.L2-3.5.6Identifier Handling1 refL2 IA.L2-3.5.7Password Complexity1 refL2 IA.L2-3.5.8Password Reuse1 refL2 IA.L2-3.5.9Temporary Passwords1 refL2 IA.L2-3.5.10Cryptographically-Protected Passwords1 refL2 IA.L2-3.5.11Obscure Feedback1 refL2 IA.L3-3.5.1eBidirectional AuthenticationL3 IA.L3-3.5.3eBlock Untrusted AssetsL3

IR

Incident Response5

IR.L2-3.6.1Incident Handling1 refL2 IR.L2-3.6.2Incident Reporting1 refL2 IR.L2-3.6.3Incident Response Testing1 refL2 IR.L3-3.6.1eSecurity Operations CenterL3 IR.L3-3.6.2eCyber Incident Response TeamL3

MA

Maintenance6

MA.L2-3.7.1Perform Maintenance1 refL2 MA.L2-3.7.2System Maintenance Control1 refL2 MA.L2-3.7.3Equipment Sanitization1 refL2 MA.L2-3.7.4Media Inspection1 refL2 MA.L2-3.7.5Nonlocal Maintenance1 refL2 MA.L2-3.7.6Maintenance Personnel1 refL2

MP

Media Protection10

MP.L1-b.1.viiMedia Disposal [FCI Data]1 refL1 MP.L2-3.8.1Media Protection1 refL2 MP.L2-3.8.2Media Access1 refL2 MP.L2-3.8.3Media Disposal [CUI Data]1 refL2 MP.L2-3.8.4Media Markings1 refL2 MP.L2-3.8.5Media Accountability1 refL2 MP.L2-3.8.6Portable Storage Encryption1 refL2 MP.L2-3.8.7Removable Media1 refL2 MP.L2-3.8.8Shared Media1 refL2 MP.L2-3.8.9Protect Backups1 refL2

PS

Personnel Security3

PS.L2-3.9.1Screen Individuals1 refL2 PS.L2-3.9.2Personnel Actions1 refL2 PS.L3-3.9.2eAdverse InformationL3

PE

Physical Protection8

PE.L1-b.1.viiiLimit Physical Access [FCI Data]1 refL1 PE.L1-b.1.ixManage Visitors & Physical Access [FCI Data]3 refsL1 PE.L2-3.10.1Limit Physical Access [CUI Data]1 refL2 PE.L2-3.10.2Monitor Facility1 refL2 PE.L2-3.10.3Escort Visitors [CUI Data]1 refL2 PE.L2-3.10.4Physical Access Logs [CUI Data]1 refL2 PE.L2-3.10.5Manage Physical Access [CUI Data]1 refL2 PE.L2-3.10.6Alternative Work Sites1 refL2

RA

Risk Assessment10

RA.L2-3.11.1Risk Assessments1 refL2 RA.L2-3.11.2Vulnerability Scan1 refL2 RA.L2-3.11.3Vulnerability Remediation1 refL2 RA.L3-3.11.1eThreat-Informed Risk AssessmentL3 RA.L3-3.11.2eThreat HuntingL3 RA.L3-3.11.3eAdvanced Risk IdentificationL3 RA.L3-3.11.4eSecurity Solution RationaleL3 RA.L3-3.11.5eSecurity Solution EffectivenessL3 RA.L3-3.11.6eSupply Chain Risk ResponseL3 RA.L3-3.11.7eSupply Chain Risk PlanL3

CA

Security Assessment5

CA.L2-3.12.1Security Control Assessment1 refL2 CA.L2-3.12.2Operational Plan of Action1 refL2 CA.L2-3.12.3Security Control Monitoring1 refL2 CA.L2-3.12.4System Security Plan1 refL2 CA.L3-3.12.1ePenetration TestingL3

SC

System & Communications Protection19

SC.L1-b.1.xBoundary Protection [FCI Data]1 refL1 SC.L1-b.1.xiPublic-Access System Separation [FCI Data]1 refL1 SC.L2-3.13.1Boundary Protection [CUI Data]1 refL2 SC.L2-3.13.2Security Engineering1 refL2 SC.L2-3.13.3Role Separation1 refL2 SC.L2-3.13.4Shared Resource Control1 refL2 SC.L2-3.13.5Public-Access System Separation [CUI Data]1 refL2 SC.L2-3.13.6Network Communication by Exception1 refL2 SC.L2-3.13.7Split Tunneling1 refL2 SC.L2-3.13.8Data in Transit1 refL2 SC.L2-3.13.9Connections Termination1 refL2 SC.L2-3.13.10Key Management1 refL2 SC.L2-3.13.11CUI Encryption1 refL2 SC.L2-3.13.12Collaborative Device Control1 refL2 SC.L2-3.13.13Mobile Code1 refL2 SC.L2-3.13.14Voice over Internet Protocol1 refL2 SC.L2-3.13.15Communications Authenticity1 refL2 SC.L2-3.13.16Data at Rest1 refL2 SC.L3-3.13.4eIsolationL3

SI

System & Information Integrity14

SI.L1-b.1.xiiFlaw Remediation [FCI Data]1 refL1 SI.L1-b.1.xiiiMalicious Code Protection [FCI Data]1 refL1 SI.L1-b.1.xivUpdate Malicious Code Protection [FCI Data]1 refL1 SI.L1-b.1.xvSystem & File Scanning [FCI Data]1 refL1 SI.L2-3.14.1Flaw Remediation [CUI Data]1 refL2 SI.L2-3.14.2Malicious Code Protection [CUI Data]1 refL2 SI.L2-3.14.3Security Alerts & Advisories1 refL2 SI.L2-3.14.4Update Malicious Code Protection [CUI Data]1 refL2 SI.L2-3.14.5System & File Scanning [CUI Data]1 refL2 SI.L2-3.14.6Monitor Communications for Attacks1 refL2 SI.L2-3.14.7Identify Unauthorized Use1 refL2 SI.L3-3.14.1eIntegrity VerificationL3 SI.L3-3.14.3eSpecialized Asset SecurityL3 SI.L3-3.14.6eThreat-Guided Intrusion DetectionL3

Looking for the underlying standards? Browse NIST SP 800-171, 800-172 & 800-53 →