Crosswalk
CMMC to NIST Crosswalk
Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.
16 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.
| Practice | 800-171 Rev 2 | 800-171 Rev 3 | 800-53 | 800-172 |
|---|---|---|---|---|
| SC.L2-3.13.1Boundary Protection [CUI Data] | 3.13.1 | 03.13.01 | SA-8SC-7 | — |
| SC.L2-3.13.2Security Engineering | 3.13.2 | — | SA-8SC-7 | — |
| SC.L2-3.13.3Role Separation | 3.13.3 | — | SC-2 | — |
| SC.L2-3.13.4Shared Resource Control | 3.13.4 | 03.13.04 | SC-4 | — |
| SC.L2-3.13.5Public-Access System Separation [CUI Data] | 3.13.5 | — | SC-7 | — |
| SC.L2-3.13.6Network Communication by Exception | 3.13.6 | 03.13.06 | SC-7 (5) | — |
| SC.L2-3.13.7Split Tunneling | 3.13.7 | — | SC-7 (7) | — |
| SC.L2-3.13.8Data in Transit | 3.13.8 | 03.13.08 | SC-8SC-8 (1) | — |
| SC.L2-3.13.9Connections Termination | 3.13.9 | 03.13.09 | SC-10 | — |
| SC.L2-3.13.10Key Management | 3.13.10 | 03.13.10 | SC-12 | — |
| SC.L2-3.13.11CUI Encryption | 3.13.11 | 03.13.11 | SC-13 | — |
| SC.L2-3.13.12Collaborative Device Control | 3.13.12 | 03.13.12 | SC-15 | — |
| SC.L2-3.13.13Mobile Code | 3.13.13 | 03.13.13 | SC-18 | — |
| SC.L2-3.13.14Voice over Internet Protocol | 3.13.14 | — | SC-19 | — |
| SC.L2-3.13.15Communications Authenticity | 3.13.15 | 03.13.15 | SC-23 | — |
| SC.L2-3.13.16Data at Rest | 3.13.16 | — | SC-28 | — |