The 16 CMMC Level 2 system and communications protection requirements: boundary protection, secure architecture, network segmentation and deny-by-default, encryption in transit and at rest, key management, FIPS-validated cryptography and session controls.
Monitoring, controlling and protecting communications at the external boundary and key internal boundaries of the system, typically with firewalls and web proxies. A 5-point requirement with 8 assessment objectives and a Level 1 counterpart.
Identifying and applying architectural designs, software development techniques and systems engineering principles that promote effective security, for example drawing on NIST SP 800-160. A 5-point requirement with 6 assessment objectives.
Separating user functionality from system management functionality so administrative interfaces are not available to general users and administrators use them only for administration.
Preventing unauthorized and unintended information transfer through shared system resources such as memory, caches and disks, so no residual information passes from one user to another.
Placing publicly accessible system components in subnetworks physically or logically separated from internal networks, such as a DMZ or separate cloud environment. A 5-point requirement and a Level 1 safeguard.
Denying network traffic by default and allowing it only by exception, a deny-all, permit-by-exception rule set at managed interfaces. A 5-point requirement that adds specifics to SC.L2-3.13.1.
Preventing remote devices connected to organizational systems, for example over a VPN, from simultaneously communicating with external networks through another connection, by disabling split tunneling.
Encrypting CUI in transmission, commonly with current TLS, unless alternative physical safeguards protect it, using FIPS-validated cryptography. A 3-point requirement in the scoring methodology.
Terminating network connections at the end of communications sessions or after a defined period of inactivity, so open sessions cannot be hijacked. Covers timeout settings and evidence.
Establishing and managing cryptographic keys wherever cryptography is used, protecting their confidentiality, authenticity and authorized use across the key life cycle.
Using FIPS-validated cryptography whenever cryptography protects the confidentiality of CUI: a validated module, not just an approved algorithm. The only requirement above 1 point that may go on a POA&M, and only in one case.
Prohibiting remote activation of collaborative computing devices such as cameras and microphones and giving users present a visible indication when a device is in use. Screen-sharing technology is outside its intent.
Controlling and monitoring mobile code, with documented authorizations for acceptable mobile code technologies and monitoring through boundary devices, logs or endpoint tools.
Controlling and monitoring VoIP technologies through usage policies and monitoring for unauthorized or insecure use, with attention to eavesdropping and caller ID spoofing.
Protecting the authenticity of communications sessions so each end can trust the identity of the other, often through mutually authenticated session protocols. A 5-point requirement with a single objective.
Protecting the confidentiality of CUI at rest on drives, media and mobile devices through encryption or other technical and physical safeguards; where cryptography is used, it must be FIPS-validated.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.