Crosswalk
CMMC to NIST Crosswalk
Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.
14 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.
| Practice | 800-171 Rev 2 | 800-171 Rev 3 | 800-53 | 800-172 |
|---|---|---|---|---|
| SI.L1-b.1.xiiFlaw Remediation [FCI Data] | 3.14.1 | 03.14.01 | SI-2SI-3SI-5 | — |
| SI.L1-b.1.xiiiMalicious Code Protection [FCI Data] | 3.14.2 | 03.14.02 | SI-2SI-3SI-5 | — |
| SI.L1-b.1.xivUpdate Malicious Code Protection [FCI Data] | 3.14.4 | — | SI-3 | — |
| SI.L1-b.1.xvSystem & File Scanning [FCI Data] | 3.14.5 | — | SI-3 | — |
| SI.L2-3.14.1Flaw Remediation [CUI Data] | 3.14.1 | 03.14.01 | SI-2SI-3SI-5 | — |
| SI.L2-3.14.2Malicious Code Protection [CUI Data] | 3.14.2 | 03.14.02 | SI-2SI-3SI-5 | — |
| SI.L2-3.14.3Security Alerts & Advisories | 3.14.3 | 03.14.03 | SI-2SI-3SI-5 | — |
| SI.L2-3.14.4Update Malicious Code Protection [CUI Data] | 3.14.4 | — | SI-3 | — |
| SI.L2-3.14.5System & File Scanning [CUI Data] | 3.14.5 | — | SI-3 | — |
| SI.L2-3.14.6Monitor Communications for Attacks | 3.14.6 | 03.14.06 | SI-4SI-4 (4) | — |
| SI.L2-3.14.7Identify Unauthorized Use | 3.14.7 | — | SI-4 | — |
| SI.L3-3.14.1eIntegrity Verification | — | — | — | — |
| SI.L3-3.14.3eSpecialized Asset Security | — | — | — | — |
| SI.L3-3.14.6eThreat-Guided Intrusion Detection | — | — | — | — |