Crosswalk

CMMC to NIST Crosswalk

Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.

Download CSV

28 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.

Practice	800-171 Rev 2	800-171 Rev 3	800-53	800-172
AC.L1-b.1.iAuthorized Access Control [FCI Data]	3.1.1	03.01.01	AC-2 AC-3 AC-17	—
AC.L1-b.1.iiTransaction & Function Control [FCI Data]	3.1.2	03.01.02	AC-2 AC-3 AC-17	—
AC.L1-b.1.iiiExternal Connections [FCI Data]	3.1.20	03.01.20	AC-20 AC-20 (1)	—
AC.L1-b.1.ivControl Public Information [FCI Data]	3.1.22	03.01.22	AC-22	—
AC.L2-3.1.1Authorized Access Control [CUI Data]	3.1.1	03.01.01	AC-2 AC-3 AC-17	—
AC.L2-3.1.2Transaction & Function Control [CUI Data]	3.1.2	03.01.02	AC-2 AC-3 AC-17	—
AC.L2-3.1.3Control CUI Flow	3.1.3	03.01.03	AC-4	—
AC.L2-3.1.4Separation of Duties	3.1.4	03.01.04	AC-5	—
AC.L2-3.1.5Least Privilege	3.1.5	03.01.05	AC-6 AC-6 (1)AC-6 (5)	—
AC.L2-3.1.6Non-Privileged Account Use	3.1.6	03.01.06	AC-6 (2)	—
AC.L2-3.1.7Privileged Functions	3.1.7	03.01.07	AC-6 (9)AC-6 (10)	—
AC.L2-3.1.8Unsuccessful Logon Attempts	3.1.8	03.01.08	AC-7	—
AC.L2-3.1.9Privacy & Security Notices	3.1.9	03.01.09	AC-8	—
AC.L2-3.1.10Session Lock	3.1.10	03.01.10	AC-11 AC-11 (1)	—
AC.L2-3.1.11Session Termination	3.1.11	03.01.11	AC-12	—
AC.L2-3.1.12Control Remote Access	3.1.12	03.01.12	AC-17 (1)	—
AC.L2-3.1.13Remote Access Confidentiality	3.1.13	—	AC-17 (2)	—
AC.L2-3.1.14Remote Access Routing	3.1.14	—	AC-17 (3)	—
AC.L2-3.1.15Privileged Remote Access	3.1.15	—	AC-17 (4)	—
AC.L2-3.1.16Wireless Access Authorization	3.1.16	03.01.16	AC-18	—
AC.L2-3.1.17Wireless Access Protection	3.1.17	—	AC-18 (1)	—
AC.L2-3.1.18Mobile Device Connection	3.1.18	03.01.18	AC-19	—
AC.L2-3.1.19Encrypt CUI on Mobile	3.1.19	—	AC-19 (5)	—
AC.L2-3.1.20External Connections [CUI Data]	3.1.20	03.01.20	AC-20 AC-20 (1)	—
AC.L2-3.1.21Portable Storage Use	3.1.21	—	AC-20 (2)	—
AC.L2-3.1.22Control Public Information [CUI Data]	3.1.22	03.01.22	AC-22	—
AC.L3-3.1.2eOrganizationally Controlled Assets	—	—	—	—
AC.L3-3.1.3eSecured Information Transfer	—	—	—	—