Crosswalk
CMMC to NIST Crosswalk
Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.
15 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.
| Practice | 800-171 Rev 2 | 800-171 Rev 3 | 800-53 | 800-172 |
|---|---|---|---|---|
| IA.L1-b.1.vIdentification [FCI Data] | 3.5.1 | 03.05.01 | IA-2IA-3IA-5 | — |
| IA.L1-b.1.viAuthentication [FCI Data] | 3.5.2 | 03.05.02 | IA-2IA-3IA-5 | — |
| IA.L2-3.5.1Identification [CUI Data] | 3.5.1 | 03.05.01 | IA-2IA-3IA-5 | — |
| IA.L2-3.5.2Authentication [CUI Data] | 3.5.2 | 03.05.02 | IA-2IA-3IA-5 | — |
| IA.L2-3.5.3Multifactor Authentication | 3.5.3 | 03.05.03 | IA-2 (1)IA-2 (2)IA-2 (3) | — |
| IA.L2-3.5.4Replay-Resistant Authentication | 3.5.4 | 03.05.04 | IA-2 (8)IA-2 (9) | — |
| IA.L2-3.5.5Identifier Reuse | 3.5.5 | 03.05.05 | IA-4 | — |
| IA.L2-3.5.6Identifier Handling | 3.5.6 | — | IA-4 | — |
| IA.L2-3.5.7Password Complexity | 3.5.7 | 03.05.07 | IA-5 (1) | — |
| IA.L2-3.5.8Password Reuse | 3.5.8 | — | IA-5 (1) | — |
| IA.L2-3.5.9Temporary Passwords | 3.5.9 | — | IA-5 (1) | — |
| IA.L2-3.5.10Cryptographically-Protected Passwords | 3.5.10 | — | IA-5 (1) | — |
| IA.L2-3.5.11Obscure Feedback | 3.5.11 | 03.05.11 | IA-6 | — |
| IA.L3-3.5.1eBidirectional Authentication | — | — | — | — |
| IA.L3-3.5.3eBlock Untrusted Assets | — | — | — | — |