Crosswalk
CMMC to NIST Crosswalk
Each CMMC practice with the NIST SP 800-171 Rev 2 requirement it is built on, the Rev 3 counterpart, the SP 800-53 controls behind it and, for Level 3, the SP 800-172 requirement. Open any number to read it.
24 practices. Mappings are the guides' key references and NIST's published relationships; a practice with no mapping yet shows a dash.
| Practice | 800-171 Rev 2 | 800-171 Rev 3 | 800-53 | 800-172 |
|---|---|---|---|---|
| AC.L3-3.1.2eOrganizationally Controlled Assets | — | — | — | — |
| AC.L3-3.1.3eSecured Information Transfer | — | — | — | — |
| AT.L3-3.2.1eAdvanced Threat Awareness | — | — | — | — |
| AT.L3-3.2.2ePractical Training Exercises | — | — | — | — |
| CA.L3-3.12.1ePenetration Testing | — | — | — | — |
| CM.L3-3.4.1eAuthoritative Repository | — | — | — | — |
| CM.L3-3.4.2eAutomated Detection & Remediation | — | — | — | — |
| CM.L3-3.4.3eAutomated Inventory | — | — | — | — |
| IA.L3-3.5.1eBidirectional Authentication | — | — | — | — |
| IA.L3-3.5.3eBlock Untrusted Assets | — | — | — | — |
| IR.L3-3.6.1eSecurity Operations Center | — | — | — | — |
| IR.L3-3.6.2eCyber Incident Response Team | — | — | — | — |
| PS.L3-3.9.2eAdverse Information | — | — | — | — |
| RA.L3-3.11.1eThreat-Informed Risk Assessment | — | — | — | — |
| RA.L3-3.11.2eThreat Hunting | — | — | — | — |
| RA.L3-3.11.3eAdvanced Risk Identification | — | — | — | — |
| RA.L3-3.11.4eSecurity Solution Rationale | — | — | — | — |
| RA.L3-3.11.5eSecurity Solution Effectiveness | — | — | — | — |
| RA.L3-3.11.6eSupply Chain Risk Response | — | — | — | — |
| RA.L3-3.11.7eSupply Chain Risk Plan | — | — | — | — |
| SC.L3-3.13.4eIsolation | — | — | — | — |
| SI.L3-3.14.1eIntegrity Verification | — | — | — | — |
| SI.L3-3.14.3eSpecialized Asset Security | — | — | — | — |
| SI.L3-3.14.6eThreat-Guided Intrusion Detection | — | — | — | — |