Crosswalk

CMMC to NIST Crosswalk

Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.

Download CSV

3 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.

Practice	800-171 Rev 2	800-171 Rev 3	800-53	800-172
IR.L2-3.6.1Incident Handling	3.6.1	03.06.01	IR-2 IR-4 IR-5 IR-6 IR-7	—
IR.L2-3.6.2Incident Reporting	3.6.2	03.06.02	IR-2 IR-4 IR-5 IR-6 IR-7	—
IR.L2-3.6.3Incident Response Testing	3.6.3	03.06.03	IR-3	—