Cybersecurity Maturity Model Certification (CMMC) 2.0
The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, codified in 32 CFR Part 170, is the U.S. Department of Defense mechanism to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It defines three levels: Level 1 (15 basic safeguarding requirements from 48 CFR 52.204-21), Level 2 (the 110 security requirements of NIST SP 800-171 Rev 2) and Level 3 (24 enhanced requirements selected from NIST SP 800-172).
ProwlerRun this compliance with Prowler
Run in Prowler Cloudprowler oraclecloud --compliance cmmc_2.0Requirements (32)
AC.L1-b.1.iLimit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).11
Attributes
- Level
Level 1
- Domain
Access Control
- Source Requirement
48 CFR 52.204-21(b)(1)(i)
AC.L1-b.1.iiLimit information system access to the types of transactions and functions that authorized users are permitted to execute.3
Attributes
- Level
Level 1
- Domain
Access Control
- Source Requirement
48 CFR 52.204-21(b)(1)(ii)
AC.L1-b.1.iiiVerify and control/limit connections to and use of external information systems.8
Attributes
- Level
Level 1
- Domain
Access Control
- Source Requirement
48 CFR 52.204-21(b)(1)(iii)
AC.L1-b.1.ivControl information posted or processed on publicly accessible information systems.4
Attributes
- Level
Level 1
- Domain
Access Control
- Source Requirement
48 CFR 52.204-21(b)(1)(iv)
IA.L1-b.1.viAuthenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.2
Attributes
- Level
Level 1
- Domain
Identification and Authentication
- Source Requirement
48 CFR 52.204-21(b)(1)(vi)
SC.L1-b.1.xMonitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.6
Attributes
- Level
Level 1
- Domain
System and Communications Protection
- Source Requirement
48 CFR 52.204-21(b)(1)(x)
AC.L2-3.1.1Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).11
Attributes
- Level
Level 2
- Domain
Access Control
- Source Requirement
NIST SP 800-171 Rev 2 3.1.1
AC.L2-3.1.2Limit system access to the types of transactions and functions that authorized users are permitted to execute.3
Attributes
- Level
Level 2
- Domain
Access Control
- Source Requirement
NIST SP 800-171 Rev 2 3.1.2
AC.L2-3.1.4Separate the duties of individuals to reduce the risk of malevolent activity without collusion.1
Attributes
- Level
Level 2
- Domain
Access Control
- Source Requirement
NIST SP 800-171 Rev 2 3.1.4
AC.L2-3.1.5Employ the principle of least privilege, including for specific security functions and privileged accounts.2
Attributes
- Level
Level 2
- Domain
Access Control
- Source Requirement
NIST SP 800-171 Rev 2 3.1.5
AC.L2-3.1.7Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.2
Attributes
- Level
Level 2
- Domain
Access Control
- Source Requirement
NIST SP 800-171 Rev 2 3.1.7
AC.L2-3.1.14Route remote access via managed access control points.5
Attributes
- Level
Level 2
- Domain
Access Control
- Source Requirement
NIST SP 800-171 Rev 2 3.1.14
AC.L2-3.1.20Verify and control/limit connections to and use of external systems.8
Attributes
- Level
Level 2
- Domain
Access Control
- Source Requirement
NIST SP 800-171 Rev 2 3.1.20
AC.L2-3.1.22Control CUI posted or processed on publicly accessible systems.4
Attributes
- Level
Level 2
- Domain
Access Control
- Source Requirement
NIST SP 800-171 Rev 2 3.1.22
AU.L2-3.3.1Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity3
Attributes
- Level
Level 2
- Domain
Audit and Accountability
- Source Requirement
NIST SP 800-171 Rev 2 3.3.1
CM.L2-3.4.2Establish and enforce security configuration settings for information technology products employed in organizational systems.3
Attributes
- Level
Level 2
- Domain
Configuration Management
- Source Requirement
NIST SP 800-171 Rev 2 3.4.2
CM.L2-3.4.3Track, review, approve or disapprove, and log changes to organizational systems.5
Attributes
- Level
Level 2
- Domain
Configuration Management
- Source Requirement
NIST SP 800-171 Rev 2 3.4.3
CM.L2-3.4.6Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.1
Attributes
- Level
Level 2
- Domain
Configuration Management
- Source Requirement
NIST SP 800-171 Rev 2 3.4.6
CM.L2-3.4.7Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.5
Attributes
- Level
Level 2
- Domain
Configuration Management
- Source Requirement
NIST SP 800-171 Rev 2 3.4.7
IA.L2-3.5.2Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.2
Attributes
- Level
Level 2
- Domain
Identification and Authentication
- Source Requirement
NIST SP 800-171 Rev 2 3.5.2
IA.L2-3.5.3Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.[24] [25].1
Attributes
- Level
Level 2
- Domain
Identification and Authentication
- Source Requirement
NIST SP 800-171 Rev 2 3.5.3
IA.L2-3.5.7Enforce a minimum password complexity and change of characters when new passwords are created.1
Attributes
- Level
Level 2
- Domain
Identification and Authentication
- Source Requirement
NIST SP 800-171 Rev 2 3.5.7
IA.L2-3.5.8Prohibit password reuse for a specified number of generations.1
Attributes
- Level
Level 2
- Domain
Identification and Authentication
- Source Requirement
NIST SP 800-171 Rev 2 3.5.8
IR.L2-3.6.1Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.15
Attributes
- Level
Level 2
- Domain
Incident Response
- Source Requirement
NIST SP 800-171 Rev 2 3.6.1
SC.L2-3.13.1Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.6
Attributes
- Level
Level 2
- Domain
System and Communications Protection
- Source Requirement
NIST SP 800-171 Rev 2 3.13.1
SC.L2-3.13.6Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).5
Attributes
- Level
Level 2
- Domain
System and Communications Protection
- Source Requirement
NIST SP 800-171 Rev 2 3.13.6
SC.L2-3.13.10Establish and manage cryptographic keys for cryptography employed in organizational systems.1
Attributes
- Level
Level 2
- Domain
System and Communications Protection
- Source Requirement
NIST SP 800-171 Rev 2 3.13.10
SC.L2-3.13.16Protect the confidentiality of CUI at rest.4
Attributes
- Level
Level 2
- Domain
System and Communications Protection
- Source Requirement
NIST SP 800-171 Rev 2 3.13.16
SI.L2-3.14.3Monitor system security alerts and advisories and take action in response.1
Attributes
- Level
Level 2
- Domain
System and Information Integrity
- Source Requirement
NIST SP 800-171 Rev 2 3.14.3
SI.L2-3.14.6Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.1
Attributes
- Level
Level 2
- Domain
System and Information Integrity
- Source Requirement
NIST SP 800-171 Rev 2 3.14.6
SI.L2-3.14.7Identify unauthorized use of organizational systems.2
Attributes
- Level
Level 2
- Domain
System and Information Integrity
- Source Requirement
NIST SP 800-171 Rev 2 3.14.7
SI.L3-3.14.1eVerify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures.1
Attributes
- Level
Level 3
- Domain
System and Information Integrity
- Source Requirement
NIST SP 800-172 Feb2021 3.14.1e