CMMC v2.0
Cybersecurity Maturity Model Certification for DoD contractors
This is a reference tool, not an authoritative source. For official documentation, visit dodcio.defense.gov.
110 All
AC — Access Control (22 practices)
AC.L1-3.1.1Authorized Access Control
AC.L1-3.1.2Transaction & Function Control
AC.L1-3.1.20External Connections
AC.L1-3.1.22Control Public Information
AC.L2-3.1.10Session Lock
AC.L2-3.1.11Session Termination
AC.L2-3.1.12Control Remote Access
AC.L2-3.1.13Remote Access Confidentiality
AC.L2-3.1.14Remote Access Routing
AC.L2-3.1.15Privileged Remote Access
AC.L2-3.1.16Wireless Access Authorization
AC.L2-3.1.17Wireless Access Protection
AC.L2-3.1.18Mobile Device Connection
AC.L2-3.1.19Encrypt CUI on Mobile
AC.L2-3.1.21Portable Storage Use
AC.L2-3.1.3Control CUI Flow
AC.L2-3.1.4Separation of Duties
AC.L2-3.1.5Least Privilege
AC.L2-3.1.6Non-Privileged Account Use
AC.L2-3.1.7Privileged Functions
AC.L2-3.1.8Unsuccessful Logon Attempts
AC.L2-3.1.9Privacy & Security Notices
AT — Awareness and Training (3 practices)
AU — Audit and Accountability (9 practices)
CA — Security Assessment (4 practices)
CM — Configuration Management (9 practices)
CM.L2-3.4.1System Baselining
CM.L2-3.4.2Security Configuration Enforcement
CM.L2-3.4.3System Change Management
CM.L2-3.4.4Security Impact Analysis
CM.L2-3.4.5Access Restrictions for Change
CM.L2-3.4.6Least Functionality
CM.L2-3.4.7Nonessential Functionality
CM.L2-3.4.8Application Execution Policy
CM.L2-3.4.9User-Installed Software
IA — Identification and Authentication (11 practices)
IA.L1-3.5.1Identification
IA.L1-3.5.2Authentication
IA.L2-3.5.10Cryptographically-Protected Passwords
IA.L2-3.5.11Obscure Feedback
IA.L2-3.5.3Multifactor Authentication
IA.L2-3.5.4Replay-Resistant Authentication
IA.L2-3.5.5Identifier Reuse
IA.L2-3.5.6Identifier Handling
IA.L2-3.5.7Password Complexity
IA.L2-3.5.8Password Reuse
IA.L2-3.5.9Temporary Passwords
IR — Incident Response (3 practices)
MA — Maintenance (6 practices)
MP — Media Protection (9 practices)
PE — Physical Protection (6 practices)
PS — Personnel Security (2 practices)
RA — Risk Assessment (3 practices)
SC — System and Communications Protection (16 practices)
SC.L1-3.13.1Boundary Protection
SC.L1-3.13.5Public-Access System Separation
SC.L2-3.13.10Key Management
SC.L2-3.13.11CUI Encryption
SC.L2-3.13.12Collaborative Device Control
SC.L2-3.13.13Mobile Code
SC.L2-3.13.14Voice over Internet Protocol
SC.L2-3.13.15Communications Authenticity
SC.L2-3.13.16Data at Rest
SC.L2-3.13.2Security Engineering
SC.L2-3.13.3Role Separation
SC.L2-3.13.4Shared Resource Control
SC.L2-3.13.6Network Communication by Exception
SC.L2-3.13.7Split Tunneling
SC.L2-3.13.8Data in Transit
SC.L2-3.13.9Connections Termination