Cybersecurity Maturity Model Certification (CMMC) 2.0

cmmc_2.0

CMMCv2.0

OfficialVerified

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).

51requirements90checks

Prowler prowler-compliance-cmmc

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance cmmc_2.0

Requirements (51)

AC.L1-b.1.iLimit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).29

Attributes

Level: Level 1
Domain: Access Control
Source Requirement: 48 CFR 52.204-21(b)(1)(i)

AC.L1-b.1.iiLimit information system access to the types of transactions and functions that authorized users are permitted to execute.6

Attributes

Level: Level 1
Domain: Access Control
Source Requirement: 48 CFR 52.204-21(b)(1)(ii)

AC.L1-b.1.iiiVerify and control/limit connections to and use of external information systems.4

Attributes

Level: Level 1
Domain: Access Control
Source Requirement: 48 CFR 52.204-21(b)(1)(iii)

AC.L1-b.1.ivControl information posted or processed on publicly accessible information systems.13

Attributes

Level: Level 1
Domain: Access Control
Source Requirement: 48 CFR 52.204-21(b)(1)(iv)

IA.L1-b.1.viAuthenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.2

Attributes

Level: Level 1
Domain: Identification and Authentication
Source Requirement: 48 CFR 52.204-21(b)(1)(vi)

SC.L1-b.1.xMonitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.21

Attributes

Level: Level 1
Domain: System and Communications Protection
Source Requirement: 48 CFR 52.204-21(b)(1)(x)

SC.L1-b.1.xiImplement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.20

Attributes

Level: Level 1
Domain: System and Communications Protection
Source Requirement: 48 CFR 52.204-21(b)(1)(xi)

SI.L1-b.1.xiiIdentify, report, and correct information and information system flaws in a timely manner.2

Attributes

Level: Level 1
Domain: System and Information Integrity
Source Requirement: 48 CFR 52.204-21(b)(1)(xii)

SI.L1-b.1.xiiiProvide protection from malicious code at appropriate locations within organizational information systems.2

Attributes

Level: Level 1
Domain: System and Information Integrity
Source Requirement: 48 CFR 52.204-21(b)(1)(xiii)

SI.L1-b.1.xvPerform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.1

Attributes

Level: Level 1
Domain: System and Information Integrity
Source Requirement: 48 CFR 52.204-21(b)(1)(xv)

AC.L2-3.1.1Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).29

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.1

AC.L2-3.1.2Limit system access to the types of transactions and functions that authorized users are permitted to execute.6

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.2

AC.L2-3.1.3Control the flow of CUI in accordance with approved authorizations.16

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.3

AC.L2-3.1.5Employ the principle of least privilege, including for specific security functions and privileged accounts.11

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.5

AC.L2-3.1.7Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.4

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.7

AC.L2-3.1.12Monitor and control remote access sessions.8

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.12

AC.L2-3.1.13Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.1

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.13

AC.L2-3.1.14Route remote access via managed access control points.13

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.14

AC.L2-3.1.20Verify and control/limit connections to and use of external systems.4

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.20

AC.L2-3.1.22Control CUI posted or processed on publicly accessible systems.13

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.22

AU.L2-3.3.1Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity13

Attributes

Level: Level 2
Domain: Audit and Accountability
Source Requirement: NIST SP 800-171 Rev 2 3.3.1

AU.L2-3.3.2Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.8

Attributes

Level: Level 2
Domain: Audit and Accountability
Source Requirement: NIST SP 800-171 Rev 2 3.3.2

AU.L2-3.3.8Protect audit information and audit logging tools from unauthorized access, modification, and deletion.8

Attributes

Level: Level 2
Domain: Audit and Accountability
Source Requirement: NIST SP 800-171 Rev 2 3.3.8

AU.L2-3.3.9Limit management of audit logging functionality to a subset of privileged users.2

Attributes

Level: Level 2
Domain: Audit and Accountability
Source Requirement: NIST SP 800-171 Rev 2 3.3.9

CM.L2-3.4.1Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.2

Attributes

Level: Level 2
Domain: Configuration Management
Source Requirement: NIST SP 800-171 Rev 2 3.4.1

CM.L2-3.4.2Establish and enforce security configuration settings for information technology products employed in organizational systems.3

Attributes

Level: Level 2
Domain: Configuration Management
Source Requirement: NIST SP 800-171 Rev 2 3.4.2

CM.L2-3.4.3Track, review, approve or disapprove, and log changes to organizational systems.2

Attributes

Level: Level 2
Domain: Configuration Management
Source Requirement: NIST SP 800-171 Rev 2 3.4.3

CM.L2-3.4.6Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.11

Attributes

Level: Level 2
Domain: Configuration Management
Source Requirement: NIST SP 800-171 Rev 2 3.4.6

CM.L2-3.4.7Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.4

Attributes

Level: Level 2
Domain: Configuration Management
Source Requirement: NIST SP 800-171 Rev 2 3.4.7

IA.L2-3.5.2Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.2

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.2

IA.L2-3.5.3Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.[24] [25].3

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.3

IA.L2-3.5.6Disable identifiers after a defined period of inactivity.7

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.6

IA.L2-3.5.7Enforce a minimum password complexity and change of characters when new passwords are created.7

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.7

IA.L2-3.5.8Prohibit password reuse for a specified number of generations.1

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.8

IA.L2-3.5.9Allow temporary password use for system logons with an immediate change to a permanent password.1

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.9

IR.L2-3.6.1Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.7

Attributes

Level: Level 2
Domain: Incident Response
Source Requirement: NIST SP 800-171 Rev 2 3.6.1

RA.L2-3.11.2Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.1

Attributes

Level: Level 2
Domain: Risk Assessment
Source Requirement: NIST SP 800-171 Rev 2 3.11.2

RA.L2-3.11.3Remediate vulnerabilities in accordance with risk assessments.1

Attributes

Level: Level 2
Domain: Risk Assessment
Source Requirement: NIST SP 800-171 Rev 2 3.11.3

SC.L2-3.13.1Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.21

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.1

SC.L2-3.13.5Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.20

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.5

SC.L2-3.13.6Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).3

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.6

SC.L2-3.13.8Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.4

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.8

SC.L2-3.13.10Establish and manage cryptographic keys for cryptography employed in organizational systems.3

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.10

SC.L2-3.13.15Protect the authenticity of communications sessions.1

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.15

SC.L2-3.13.16Protect the confidentiality of CUI at rest.10

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.16

SI.L2-3.14.1Identify, report, and correct system flaws in a timely manner.2

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.1

SI.L2-3.14.2Provide protection from malicious code at designated locations within organizational systems.2

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.2

SI.L2-3.14.3Monitor system security alerts and advisories and take action in response.3

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.3

SI.L2-3.14.5Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.1

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.5

SI.L2-3.14.6Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.11

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.6

SI.L2-3.14.7Identify unauthorized use of organizational systems.11

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.7