AC Access control
The 22 CMMC Level 2 access control requirements: who and what may use the system, least privilege, sessions, remote and wireless access, mobile devices, external systems and public content.
CMMC
CMMC Level 2 practices by domain for defense contractors.
AT Awareness and training
The three CMMC Level 2 awareness and training requirements: security risk awareness for managers, administrators and users, role-based training, and insider threat awareness.
AU Audit and accountability
The nine CMMC Level 2 audit and accountability requirements: creating and retaining audit logs, tracing actions to users, reviewing and correlating events, alerting on logging failures, time stamps, and protecting audit data.
CM Configuration management
The nine CMMC Level 2 configuration management requirements: baselines and inventories, secure settings, change control and impact analysis, least functionality, application allow or deny lists, and user-installed software.
IA Identification and authentication
The 11 CMMC Level 2 identification and authentication requirements: identifying and authenticating users, processes and devices, multifactor and replay-resistant authentication, identifier management and password rules.
IR Incident response
The three CMMC Level 2 incident response requirements: an operational incident handling capability, tracking and reporting incidents, and testing the response capability.
MA Maintenance
The six CMMC Level 2 maintenance requirements: performing and controlling maintenance, sanitizing equipment removed for off-site maintenance, inspecting media and tools, nonlocal maintenance and supervising maintenance personnel.
MP Media protection
The nine CMMC Level 2 media protection requirements: protecting, limiting access to, sanitizing, marking and tracking media with CUI, encrypting portable storage, removable and shared media, and backup confidentiality.
PS Personnel security
The two CMMC Level 2 personnel security requirements: screening individuals before they get access to systems with CUI, and protecting those systems during terminations and transfers.
PE Physical protection
The six CMMC Level 2 physical protection requirements: limiting and monitoring physical access, escorting visitors, keeping physical access logs, managing keys and badges, and safeguarding CUI at alternate work sites.
RA Risk assessment
The three CMMC Level 2 risk assessment requirements: periodic risk assessments, vulnerability scanning, and remediating vulnerabilities according to risk.
CA Security assessment
The four CMMC Level 2 security assessment requirements: periodically assessing controls, operational plans of action, ongoing control monitoring, and the system security plan.
SC System and communications protection
The 16 CMMC Level 2 system and communications protection requirements: boundary protection, secure architecture, network segmentation and deny-by-default, encryption in transit and at rest, key management, FIPS-validated cryptography and session controls.
SI System and information integrity
The seven CMMC Level 2 system and information integrity requirements: flaw remediation, malicious code protection and updates, security alerts, system and file scanning, and monitoring for attacks and unauthorized use.
CMMC Level 3
The top CMMC level for the most critical programs: the 24 NIST SP 800-172 requirements, the DCMA DIBCAC assessment, DoD's cost estimates, and how a program decides to require it.
CMMC assessment preparation
Getting through a CMMC assessment and staying compliant afterwards: running a Level 2 self-assessment, evidence assessors accept, specialized assets such as OT and test equipment, and maintaining status between assessments.
CMMC contract clauses and affirmations
How CMMC shows up in DoD contracts and proposals: DFARS 252.204-7021 and 252.204-7025, CMMC UIDs and SPRS entries, the Affirming Official, and winning work with a Conditional status.
CMMC consultants and services
Who helps with CMMC and what to buy: Registered Practitioner Organizations, CCPs versus CCAs, what consultants do and cost, and what to outsource while keeping assessors independent.
CMMC cloud and IT environments
Where to run a CMMC environment: Microsoft 365 GCC High, Azure Government, AWS GovCloud, Google Cloud and Workspace, cloud versus on-premises, and open-source tools for the Level 2 controls.
CMMC by company type
How CMMC lands on different kinds of companies: small businesses, manufacturers and machine shops, managed service providers, cloud and SaaS providers, and COTS suppliers.
CMMC guides
Questions defense contractors ask when they plan for CMMC: cost, levels, the assessment process, POA&M rules, timeline, scoping, readiness, subcontractor flowdown, cloud and service providers, Level 1, and choosing a C3PAO.
