← Reviewed editions
Level 2 · 2.13 — Level 2
CMMC Assessment Guide — Level 2 · 2.13 · 2024-09
Official sourceAC.L2-3.1.1Authorized Access Control [CUI Data]AC.L2-3.1.2Transaction & Function ControlAC.L2-3.1.3Control CUI FlowAC.L2-3.1.4Separation of DutiesAC.L2-3.1.5Least PrivilegeAC.L2-3.1.6Non-Privileged Account UseAC.L2-3.1.7Privileged FunctionsAC.L2-3.1.8Unsuccessful Logon AttemptsAC.L2-3.1.9Privacy & Security NoticesAC.L2-3.1.10Session LockAC.L2-3.1.11Session TerminationAC.L2-3.1.12Control Remote AccessAC.L2-3.1.13Remote Access ConfidentialityAC.L2-3.1.14Remote Access RoutingAC.L2-3.1.15Privileged Remote AccessAC.L2-3.1.16Wireless Access AuthorizationAC.L2-3.1.17Wireless Access ProtectionAC.L2-3.1.18Mobile Device ConnectionAC.L2-3.1.19Encrypt CUI on MobileAC.L2-3.1.20External Connections [CUI Data]AC.L2-3.1.21Portable Storage UseAC.L2-3.1.22Control Public Information [CUI Data]AT.L2-3.2.1Role-Based Risk AwarenessAT.L2-3.2.2Role-Based TrainingAT.L2-3.2.3Insider Threat AwarenessAU.L2-3.3.1System AuditingAU.L2-3.3.2User AccountabilityAU.L2-3.3.3Event ReviewAU.L2-3.3.4Audit Failure AlertingAU.L2-3.3.5Audit CorrelationAU.L2-3.3.6Reduction & ReportingAU.L2-3.3.7Authoritative Time SourceAU.L2-3.3.8Audit ProtectionAU.L2-3.3.9Audit ManagementCM.L2-3.4.1System BaseliningCM.L2-3.4.2Security Configuration EnforcementCM.L2-3.4.3System Change ManagementCM.L2-3.4.4Security Impact AnalysisCM.L2-3.4.5Access Restrictions for ChangeCM.L2-3.4.6Least FunctionalityCM.L2-3.4.7Nonessential FunctionalityCM.L2-3.4.8Application Execution PolicyCM.L2-3.4.9User-Installed SoftwareIA.L2-3.5.1Identification [CUI Data]IA.L2-3.5.2Authentication [CUI Data]IA.L2-3.5.3Multifactor AuthenticationIA.L2-3.5.4Replay-Resistant AuthenticationIA.L2-3.5.5Identifier ReuseIA.L2-3.5.6Identifier HandlingIA.L2-3.5.7Password ComplexityIA.L2-3.5.8Password ReuseIA.L2-3.5.9Temporary PasswordsIA.L2-3.5.10Cryptographically-Protected PasswordsIA.L2-3.5.11Obscure FeedbackIR.L2-3.6.1Incident HandlingIR.L2-3.6.2Incident ReportingIR.L2-3.6.3Incident Response TestingMA.L2-3.7.1Perform MaintenanceMA.L2-3.7.2System Maintenance ControlMA.L2-3.7.3Equipment SanitizationMA.L2-3.7.4Media InspectionMA.L2-3.7.5Nonlocal MaintenanceMA.L2-3.7.6Maintenance PersonnelMP.L2-3.8.1Media ProtectionMP.L2-3.8.2Media AccessMP.L2-3.8.3Media Disposal [CUI Data]MP.L2-3.8.4Media MarkingsMP.L2-3.8.5Media AccountabilityMP.L2-3.8.6Portable Storage EncryptionMP.L2-3.8.7Removeable MediaMP.L2-3.8.8Shared MediaMP.L2-3.8.9Protect BackupsPS.L2-3.9.1Screen IndividualsPS.L2-3.9.2Personnel ActionsPE.L2-3.10.1Limit Physical Access [CUI Data]PE.L2-3.10.2Monitor FacilityPE.L2-3.10.3Escort Visitors [CUI Data]PE.L2-3.10.4Physical Access Logs [CUI Data]PE.L2-3.10.5Manage Physical Access [CUI Data]PE.L2-3.10.6Alternative Work SitesRA.L2-3.11.1RIsk AssessmentsRA.L2-3.11.2Vulnerability ScanRA.L2-3.11.3Vulnerability RemediationCA.L2-3.12.1Security Control AssessmentCA.L2-3.12.2operational Plan of ActionCA.L2-3.12.3Security Control MonitoringCA.L2-3.12.4System Security PlanSC.L2-3.13.1Boundary Protection [CUI Data]SC.L2-3.13.2Security EngineeringSC.L2-3.13.3Role SeparationSC.L2-3.13.4Shared Resource ControlSC.L2-3.13.5Public-Access System Separation [CUI Data]SC.L2-3.13.6Network Communication by ExceptionSC.L2-3.13.7Split TunnelingSC.L2-3.13.8Data in TransitSC.L2-3.13.9Connections TerminationSC.L2-3.13.10Key ManagementSC.L2-3.13.11CUI EncryptionSC.L2-3.13.12Collaborative Device ControlSC.L2-3.13.13Mobile CodeSC.L2-3.13.14Voice over Internet ProtocolSC.L2-3.13.15Communications AuthenticitySC.L2-3.13.16Data at RestSI.L2-3.14.1Flaw Remediation [CUI Data]SI.L2-3.14.2Malicious Code Protection [CUI Data]SI.L2-3.14.3Security Alerts & AdvisoriesSI.L2-3.14.4Update Malicious Code Protection [CUI Data]SI.L2-3.14.5System & File Scanning [CUI Data]SI.L2-3.14.6Monitor Communications for AttacksSI.L2-3.14.7Identify Unauthorized Use