Cybersecurity Maturity Model Certification (CMMC) 2.0

cmmc_2.0

CMMCv2.0

OfficialVerified

The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).

36requirements67checks

Prowler prowler-compliance-cmmc

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler m365 --compliance cmmc_2.0

Requirements (36)

AC.L1-b.1.iLimit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).3

Attributes

Level: Level 1
Domain: Access Control
Source Requirement: 48 CFR 52.204-21(b)(1)(i)

AC.L1-b.1.iiLimit information system access to the types of transactions and functions that authorized users are permitted to execute.3

Attributes

Level: Level 1
Domain: Access Control
Source Requirement: 48 CFR 52.204-21(b)(1)(ii)

AC.L1-b.1.iiiVerify and control/limit connections to and use of external information systems.9

Attributes

Level: Level 1
Domain: Access Control
Source Requirement: 48 CFR 52.204-21(b)(1)(iii)

AC.L1-b.1.ivControl information posted or processed on publicly accessible information systems.6

Attributes

Level: Level 1
Domain: Access Control
Source Requirement: 48 CFR 52.204-21(b)(1)(iv)

IA.L1-b.1.viAuthenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.2

Attributes

Level: Level 1
Domain: Identification and Authentication
Source Requirement: 48 CFR 52.204-21(b)(1)(vi)

SC.L1-b.1.xMonitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.8

Attributes

Level: Level 1
Domain: System and Communications Protection
Source Requirement: 48 CFR 52.204-21(b)(1)(x)

SI.L1-b.1.xiiiProvide protection from malicious code at appropriate locations within organizational information systems.6

Attributes

Level: Level 1
Domain: System and Information Integrity
Source Requirement: 48 CFR 52.204-21(b)(1)(xiii)

SI.L1-b.1.xvPerform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.3

Attributes

Level: Level 1
Domain: System and Information Integrity
Source Requirement: 48 CFR 52.204-21(b)(1)(xv)

AC.L2-3.1.1Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).3

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.1

AC.L2-3.1.2Limit system access to the types of transactions and functions that authorized users are permitted to execute.3

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.2

AC.L2-3.1.3Control the flow of CUI in accordance with approved authorizations.4

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.3

AC.L2-3.1.5Employ the principle of least privilege, including for specific security functions and privileged accounts.2

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.5

AC.L2-3.1.7Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.2

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.7

AC.L2-3.1.11Terminate (automatically) a user session after a defined condition.1

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.11

AC.L2-3.1.12Monitor and control remote access sessions.1

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.12

AC.L2-3.1.18Control connection of mobile devices.3

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.18

AC.L2-3.1.20Verify and control/limit connections to and use of external systems.9

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.20

AC.L2-3.1.22Control CUI posted or processed on publicly accessible systems.6

Attributes

Level: Level 2
Domain: Access Control
Source Requirement: NIST SP 800-171 Rev 2 3.1.22

AU.L2-3.3.1Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity4

Attributes

Level: Level 2
Domain: Audit and Accountability
Source Requirement: NIST SP 800-171 Rev 2 3.3.1

AU.L2-3.3.2Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.2

Attributes

Level: Level 2
Domain: Audit and Accountability
Source Requirement: NIST SP 800-171 Rev 2 3.3.2

CM.L2-3.4.6Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.2

Attributes

Level: Level 2
Domain: Configuration Management
Source Requirement: NIST SP 800-171 Rev 2 3.4.6

CM.L2-3.4.7Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.4

Attributes

Level: Level 2
Domain: Configuration Management
Source Requirement: NIST SP 800-171 Rev 2 3.4.7

CM.L2-3.4.9Control and monitor user-installed software.3

Attributes

Level: Level 2
Domain: Configuration Management
Source Requirement: NIST SP 800-171 Rev 2 3.4.9

IA.L2-3.5.2Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.2

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.2

IA.L2-3.5.3Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.[24] [25].4

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.3

IA.L2-3.5.4Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.2

Attributes

Level: Level 2
Domain: Identification and Authentication
Source Requirement: NIST SP 800-171 Rev 2 3.5.4

IR.L2-3.6.1Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.2

Attributes

Level: Level 2
Domain: Incident Response
Source Requirement: NIST SP 800-171 Rev 2 3.6.1

IR.L2-3.6.2Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.1

Attributes

Level: Level 2
Domain: Incident Response
Source Requirement: NIST SP 800-171 Rev 2 3.6.2

SC.L2-3.13.1Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.8

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.1

SC.L2-3.13.9Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.2

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.9

SC.L2-3.13.12Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.[29].1

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.12

SC.L2-3.13.15Protect the authenticity of communications sessions.3

Attributes

Level: Level 2
Domain: System and Communications Protection
Source Requirement: NIST SP 800-171 Rev 2 3.13.15

SI.L2-3.14.2Provide protection from malicious code at designated locations within organizational systems.6

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.2

SI.L2-3.14.3Monitor system security alerts and advisories and take action in response.1

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.3

SI.L2-3.14.5Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.3

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.5

SI.L2-3.14.7Identify unauthorized use of organizational systems.4

Attributes

Level: Level 2
Domain: System and Information Integrity
Source Requirement: NIST SP 800-171 Rev 2 3.14.7