The 22 CMMC Level 2 access control requirements: who and what may use the system, least privilege, sessions, remote and wireless access, mobile devices, external systems and public content.
The foundational CMMC access requirement: knowing which users, processes and devices are authorized and limiting system access to them. Covers account management evidence, how assessors test it, and its Level 1 counterpart for FCI.
Limiting each authorized user to the transactions and functions their role permits, such as create, read, update and delete rights. Covers role and permission design, the evidence assessors examine, and the Level 1 counterpart.
Controlling where CUI may flow inside the system and between connected systems under approved authorizations: flow control policies, firewalls, proxies and network zones, and the enforcement evidence assessors expect.
Dividing critical duties so that no one person can carry out malicious activity without collusion: defining which duties need separation, assigning them to different people, and granting access privileges to match.
Applying least privilege to all users and processes, with particular attention to privileged accounts and security functions: identifying them, authorizing access narrowly, and showing assessors how privileges are granted and reviewed.
Requiring administrators and other privileged users to use non-privileged accounts or roles for everyday, nonsecurity tasks such as email and web browsing, and the evidence that shows this is enforced.
Preventing non-privileged users from executing privileged functions and logging every execution of a privileged function so misuse can be detected. Covers defining privileged functions, enforcement and audit log evidence.
Limiting consecutive failed logon attempts, usually by locking the account at a threshold the organization sets for its risk. Covers lockout and unlock settings and the evidence assessors check.
Displaying system use, privacy and security notices, typically logon banners, consistent with the rules for the CUI categories the system handles, and keeping evidence of approval, display and acknowledgement.
Locking sessions after a defined period of inactivity with a pattern-hiding display that conceals what was on screen. Covers choosing the inactivity period, configuration evidence and how assessors test it.
Automatically ending user sessions when defined conditions occur, such as inactivity, end of the workday, policy violations or maintenance. Unlike session lock, which hides the screen, termination ends the session.
Permitting only defined types of remote access and monitoring and controlling every remote session, including access to cloud email or hosted infrastructure that holds CUI. Covers remote access gateways, session logging and assessor tests.
Encrypting remote access sessions to protect CUI confidentiality, using cryptography that meets the FIPS-validated standard of SC.L2-3.13.11. Covers identifying and implementing the cryptographic mechanisms and the evidence assessors review.
Routing all remote access through a small number of managed access control points to reduce the attack surface and make remote connections easier to monitor and control.
Authorizing which privileged commands may be run remotely and which security-relevant information may be accessed remotely, then enforcing that authorization. Covers documentation, role permissions and enforcement evidence.
Identifying wireless access points and authorizing wireless access before any connection is allowed, based on management guidelines for device types and configuration. Covers evidence and what happens when Wi-Fi is added later.
Protecting wireless access with both authentication and encryption: shared-key versus enterprise authentication, FIPS-validated cryptography, and the configuration evidence assessors test.
Identifying mobile devices that process, store or transmit CUI, authorizing their connections, and monitoring and logging those connections. Covers smartphones, tablets and e-readers, device identifiers and connection evidence.
Encrypting CUI on mobile devices and mobile computing platforms such as laptops, smartphones, tablets and e-readers, with FIPS-validated cryptography. Covers device identification, full-disk or device encryption and evidence.
Identifying, verifying and controlling connections to and use of external systems, including personally owned devices and company networks outside the assessment scope. One of six requirements that can never be left on a POA&M.
Limiting the use of portable storage devices containing CUI, such as USB drives and external hard disks, on external systems. Covers usage restrictions, technical enforcement and the evidence assessors review.
Keeping CUI off publicly accessible systems such as company websites and public forums: authorized posters, pre-posting review, content review and removal procedures. One of six requirements that can never be left on a POA&M.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.