CMMC 2.0: the evidence behind every control

110 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Access Control

AC.L2-3.1.1Authorized Access Control easy AC.L2-3.1.2Transaction & Function Control hard AC.L2-3.1.3Control CUI Flow hard AC.L2-3.1.4Separation of Duties hard AC.L2-3.1.5Least Privilege moderate AC.L2-3.1.6Non-Privileged Account Use moderate AC.L2-3.1.7Privileged Functions moderate AC.L2-3.1.8Unsuccessful Logon Attempts hard AC.L2-3.1.9Privacy & Security Notices hard AC.L2-3.1.10Session Lock hard AC.L2-3.1.11Session Termination easy AC.L2-3.1.12Control Remote Access moderate AC.L2-3.1.13Remote Access Confidentiality moderate AC.L2-3.1.14Remote Access Routing moderate AC.L2-3.1.15Privileged Remote Access easy AC.L2-3.1.16Wireless Access Authorization moderate AC.L2-3.1.17Wireless Access Protection moderate AC.L2-3.1.18Mobile Device Connection moderate AC.L2-3.1.19Encrypt CUI on Mobile moderate AC.L2-3.1.20External Connections hard AC.L2-3.1.21Portable Storage Use hard AC.L2-3.1.22Control Public Information hard

Awareness and Training

AT.L2-3.2.1Role-Based Risk Awareness hard AT.L2-3.2.2Role-Based Training hard AT.L2-3.2.3Insider Threat Awareness hard

Audit and Accountability

AU.L2-3.3.1System Auditing easy AU.L2-3.3.2User Accountability moderate AU.L2-3.3.3Event Review hard AU.L2-3.3.4Audit Failure Alerting easy AU.L2-3.3.5Audit Correlation easy AU.L2-3.3.6Reduction & Reporting moderate AU.L2-3.3.7Time Stamps & Synchronization easy AU.L2-3.3.8Audit Protection easy AU.L2-3.3.9Audit Management easy

Security Assessment

CA.L2-3.12.1Security Control Assessment hard CA.L2-3.12.2Plan of Action hard CA.L2-3.12.3Security Control Monitoring easy CA.L2-3.12.4System Security Plan hard

Configuration Management

CM.L2-3.4.1System Baselining hard CM.L2-3.4.2Security Configuration Enforcement moderate CM.L2-3.4.3System Change Management hard CM.L2-3.4.4Security Impact Analysis hard CM.L2-3.4.5Access Restrictions for Change easy CM.L2-3.4.6Least Functionality moderate CM.L2-3.4.7Nonessential Functionality moderate CM.L2-3.4.8Application Execution Policy hard CM.L2-3.4.9User-Installed Software moderate

Identification and Authentication

IA.L2-3.5.1Identification hard IA.L2-3.5.2Authentication easy IA.L2-3.5.3Multifactor Authentication moderate IA.L2-3.5.4Replay-Resistant Authentication moderate IA.L2-3.5.5Identifier Reuse hard IA.L2-3.5.6Identifier Handling moderate IA.L2-3.5.7Password Complexity hard IA.L2-3.5.8Password Reuse hard IA.L2-3.5.9Temporary Passwords moderate IA.L2-3.5.10Cryptographically-Protected Passwords moderate IA.L2-3.5.11Obscure Feedback hard

Incident Response

IR.L2-3.6.1Incident Handling hard IR.L2-3.6.2Incident Reporting hard IR.L2-3.6.3Incident Response Testing hard

Maintenance

MA.L2-3.7.1Perform Maintenance moderate MA.L2-3.7.2System Maintenance Control hard MA.L2-3.7.3Equipment Sanitization hard MA.L2-3.7.4Media Inspection moderate MA.L2-3.7.5Nonlocal Maintenance moderate MA.L2-3.7.6Maintenance Personnel hard

Media Protection

MP.L2-3.8.1Media Protection hard MP.L2-3.8.2Media Access hard MP.L2-3.8.3Media Disposal hard MP.L2-3.8.4Media Markings hard MP.L2-3.8.5Media Accountability moderate MP.L2-3.8.6Portable Storage Encryption moderate MP.L2-3.8.7Removable Media hard MP.L2-3.8.8Shared Media hard MP.L2-3.8.9Protect Backups hard

Physical Protection

PE.L2-3.10.1Limit Physical Access moderate PE.L2-3.10.2Monitor Facility easy PE.L2-3.10.3Escort Visitors easy PE.L2-3.10.4Physical Access Logs easy PE.L2-3.10.5Manage Physical Access hard PE.L2-3.10.6Alternative Work Sites hard

Personnel Security

PS.L2-3.9.1Screen Individuals hard PS.L2-3.9.2Personnel Actions moderate

Risk Assessment

RA.L2-3.11.1Risk Assessments hard RA.L2-3.11.2Vulnerability Scan easy RA.L2-3.11.3Vulnerability Remediation hard

System and Communications Protection

SC.L2-3.13.1Boundary Protection easy SC.L2-3.13.2Security Engineering hard SC.L2-3.13.3Role Separation moderate SC.L2-3.13.4Shared Resource Control moderate SC.L2-3.13.5Public-Access System Separation moderate SC.L2-3.13.6Network Communication by Exception hard SC.L2-3.13.7Split Tunneling moderate SC.L2-3.13.8Data in Transit moderate SC.L2-3.13.9Connections Termination easy SC.L2-3.13.10Key Management hard SC.L2-3.13.11CUI Encryption moderate SC.L2-3.13.12Collaborative Device Control moderate SC.L2-3.13.13Mobile Code moderate SC.L2-3.13.14Voice over Internet Protocol easy SC.L2-3.13.15Communications Authenticity easy SC.L2-3.13.16Data at Rest moderate

System and Information Integrity

SI.L2-3.14.1Flaw Remediation hard SI.L2-3.14.2Malicious Code Protection moderate SI.L2-3.14.3Security Alerts & Advisories easy SI.L2-3.14.4Update Malicious Code Protection moderate SI.L2-3.14.5System & File Scanning easy SI.L2-3.14.6Monitor Communications for Attacks moderate SI.L2-3.14.7Identify Unauthorized Use moderate