Crosswalk
CMMC to NIST Crosswalk
Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.
9 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.
| Practice | 800-171 Rev 2 | 800-171 Rev 3 | 800-53 | 800-172 |
|---|---|---|---|---|
| AU.L2-3.3.1System Auditing | 3.3.1 | 03.03.01 | AU-2AU-3AU-3 (1)AU-6AU-11AU-12 | — |
| AU.L2-3.3.2User Accountability | 3.3.2 | 03.03.02 | AU-2AU-3AU-3 (1)AU-6AU-11AU-12 | — |
| AU.L2-3.3.3Event Review | 3.3.3 | 03.03.03 | AU-2 (3) | — |
| AU.L2-3.3.4Audit Failure Alerting | 3.3.4 | 03.03.04 | AU-5 | — |
| AU.L2-3.3.5Audit Correlation | 3.3.5 | 03.03.05 | AU-6 (3) | — |
| AU.L2-3.3.6Reduction & Reporting | 3.3.6 | 03.03.06 | AU-7 | — |
| AU.L2-3.3.7Authoritative Time Source | 3.3.7 | 03.03.07 | AU-8AU-8 (1) | — |
| AU.L2-3.3.8Audit Protection | 3.3.8 | 03.03.08 | AU-9 | — |
| AU.L2-3.3.9Audit Management | 3.3.9 | — | AU-9 (4) | — |