Crosswalk
CMMC to NIST Crosswalk
Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.
5 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.
| Practice | 800-171 Rev 2 | 800-171 Rev 3 | 800-53 | 800-172 |
|---|---|---|---|---|
| CA.L2-3.12.1Security Control Assessment | 3.12.1 | 03.12.01 | CA-2CA-5CA-7PL-2 | — |
| CA.L2-3.12.2Operational Plan of Action | 3.12.2 | 03.12.02 | CA-2CA-5CA-7PL-2 | — |
| CA.L2-3.12.3Security Control Monitoring | 3.12.3 | 03.12.03 | CA-2CA-5CA-7PL-2 | — |
| CA.L2-3.12.4System Security Plan | 3.12.4 | — | CA-2CA-5CA-7PL-2 | — |
| CA.L3-3.12.1ePenetration Testing | — | — | — | — |