Crosswalk
CMMC to NIST Crosswalk
Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.
15 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.
| Practice | 800-171 Rev 2 | 800-171 Rev 3 | 800-53 | 800-172 |
|---|---|---|---|---|
| AC.L1-b.1.iAuthorized Access Control [FCI Data] | 3.1.1 | 03.01.01 | AC-2AC-3AC-17 | — |
| AC.L1-b.1.iiTransaction & Function Control [FCI Data] | 3.1.2 | 03.01.02 | AC-2AC-3AC-17 | — |
| AC.L1-b.1.iiiExternal Connections [FCI Data] | 3.1.20 | 03.01.20 | AC-20AC-20 (1) | — |
| AC.L1-b.1.ivControl Public Information [FCI Data] | 3.1.22 | 03.01.22 | AC-22 | — |
| IA.L1-b.1.vIdentification [FCI Data] | 3.5.1 | 03.05.01 | IA-2IA-3IA-5 | — |
| IA.L1-b.1.viAuthentication [FCI Data] | 3.5.2 | 03.05.02 | IA-2IA-3IA-5 | — |
| MP.L1-b.1.viiMedia Disposal [FCI Data] | 3.8.3 | 03.08.03 | MP-2MP-4MP-6 | — |
| PE.L1-b.1.ixManage Visitors & Physical Access [FCI Data] | 3.10.33.10.43.10.5 | — | PE-3 | — |
| PE.L1-b.1.viiiLimit Physical Access [FCI Data] | 3.10.1 | 03.10.01 | PE-2PE-4PE-5PE-6 | — |
| SC.L1-b.1.xBoundary Protection [FCI Data] | 3.13.1 | 03.13.01 | SA-8SC-7 | — |
| SC.L1-b.1.xiPublic-Access System Separation [FCI Data] | 3.13.5 | — | SC-7 | — |
| SI.L1-b.1.xiiFlaw Remediation [FCI Data] | 3.14.1 | 03.14.01 | SI-2SI-3SI-5 | — |
| SI.L1-b.1.xiiiMalicious Code Protection [FCI Data] | 3.14.2 | 03.14.02 | SI-2SI-3SI-5 | — |
| SI.L1-b.1.xivUpdate Malicious Code Protection [FCI Data] | 3.14.4 | — | SI-3 | — |
| SI.L1-b.1.xvSystem & File Scanning [FCI Data] | 3.14.5 | — | SI-3 | — |