Crosswalk
CMMC to NIST Crosswalk
Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.
9 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.
| Practice | 800-171 Rev 2 | 800-171 Rev 3 | 800-53 | 800-172 |
|---|---|---|---|---|
| CM.L2-3.4.1System Baselining | 3.4.1 | 03.04.01 | CM-2CM-6CM-8CM-8 (1) | — |
| CM.L2-3.4.2Security Configuration Enforcement | 3.4.2 | 03.04.02 | CM-2CM-6CM-8CM-8 (1) | — |
| CM.L2-3.4.3System Change Management | 3.4.3 | 03.04.03 | CM-3 | — |
| CM.L2-3.4.4Security Impact Analysis | 3.4.4 | 03.04.04 | CM-4 | — |
| CM.L2-3.4.5Access Restrictions for Change | 3.4.5 | 03.04.05 | CM-5 | — |
| CM.L2-3.4.6Least Functionality | 3.4.6 | 03.04.06 | CM-7 | — |
| CM.L2-3.4.7Nonessential Functionality | 3.4.7 | — | CM-7 (1)CM-7 (2) | — |
| CM.L2-3.4.8Application Execution Policy | 3.4.8 | 03.04.08 | CM-7 (4)CM-7 (5) | — |
| CM.L2-3.4.9User-Installed Software | 3.4.9 | — | CM-11 | — |