Features Frameworks Guide Pricing

Frameworks · US

CMMC Level 2

The Cybersecurity Maturity Model Certification (CMMC) program is how the US Department of Defense verifies that its contractors protect the information it shares with them. Level 2 covers Controlled Unclassified Information (CUI) and requires all 110 security requirements of NIST SP 800-171 Revision 2, grouped into 14 domains, together with a system security plan. Depending on the contract, compliance is shown through a self-assessment or a certification assessment by an authorized third-party assessor (C3PAO) every three years, with results and an annual affirmation of continuing compliance entered in SPRS. It applies to defense contractors and subcontractors at every tier whose contracts involve CUI.

Version
32 CFR Part 170 (CMMC Program, effective December 16, 2024); Level 2 requirements are NIST SP 800-171 Rev. 2 (February 2020, updated January 28, 2021)
Requirements
124, each mapped to ProofTrail’s controls
Try it in the demo $20 a year per installation

Requirements and controls

  • AC Access Control

    • AC.L2-3.1.1 Only authorized users, processes and devices

      Only authorized users, processes acting for them and authorized devices, including other systems, can access systems that handle CUI.

      • Access Control Policy & Procedure
      • Identity Validation
      • User Access Reviews
      • Termination of Employment
      • Inventory of Endpoint Assets

    • AC.L2-3.1.2 Access limited to permitted functions

      Users can run only the types of transactions and functions their role allows.

      • Identity Validation
      • User Privilege Reviews
      • Access Control Policy & Procedure

    • AC.L2-3.1.3 CUI flow follows approved authorizations

      The movement of CUI within and between systems is controlled so that it only flows where it has been approved to go.

      • External System Connections
      • Limit Network Connections
      • Network & Data Flow Diagrams

    • AC.L2-3.1.4 Duties separated

      Duties are divided between people so that misuse would need more than one person to collude.

      • Segregation of Duties
      • Approval of Changes

    • AC.L2-3.1.5 Least privilege applied

      Users and accounts, including privileged accounts and those with security functions, get only the access their work requires.

      • Identity Validation
      • User Privilege Reviews
      • Production Database Access Restriction

    • AC.L2-3.1.6 Non-privileged accounts for everyday work

      People who hold privileged access use a separate non-privileged account or role for work that is not security administration.

      • Production Database Access Restriction
      • Access Control Policy & Procedure

    • AC.L2-3.1.7 Privileged functions restricted and logged

      Non-privileged users cannot run privileged functions, and every use of a privileged function is recorded in audit logs.

      • Identity Validation
      • Centralized Security Logging
      • Production Database Access Restriction

    • AC.L2-3.1.8 Failed logon attempts limited

      Systems lock or slow down accounts after a set number of failed logon attempts.

      • Access Control Policy & Procedure

    • AC.L2-3.1.9 System use notice displayed

      Users see privacy and security notices consistent with CUI rules before they log on.

      • System Use Notification

    • AC.L2-3.1.10 Session lock after inactivity

      Sessions lock after a period of inactivity and hide what was on screen until the user signs back in.

      • Session Lock
      • Clear Desk & Clear Screen

    • AC.L2-3.1.11 Sessions end automatically

      User sessions end automatically when a defined condition is met, such as a period of inactivity.

      • Cloud Console Session Timeout
      • Access Control Policy & Procedure

    • AC.L2-3.1.12 Remote access monitored and controlled

      Remote access sessions are monitored and controlled.

      • Remote & Wireless Access
      • Centralized Security Logging

    • AC.L2-3.1.13 Remote access sessions encrypted

      Cryptography protects the confidentiality of remote access sessions.

      • Remote & Wireless Access
      • Transmission Confidentiality
      • FIPS-Validated Cryptography

    • AC.L2-3.1.14 Remote access through managed entry points

      Remote access is routed only through managed access control points.

      • Remote & Wireless Access
      • Limit Network Connections

    • AC.L2-3.1.15 Remote privileged access authorized

      Running privileged commands remotely and accessing security-relevant information remotely require explicit authorization.

      • Remote & Wireless Access
      • Production Database Access Restriction

    • AC.L2-3.1.16 Wireless access authorized

      Wireless access is authorized before any wireless connection is allowed.

      • Remote & Wireless Access
      • Network Security Policy & Procedure

    • AC.L2-3.1.17 Wireless access protected

      Wireless access is protected with authentication and encryption.

      • Remote & Wireless Access
      • Transmission Confidentiality

    • AC.L2-3.1.18 Mobile device connections controlled

      Only approved and managed mobile devices can connect to systems that handle CUI.

      • Endpoint Security Policy
      • Inventory of Endpoint Assets
      • Endpoint Encryption

    • AC.L2-3.1.19 CUI encrypted on mobile devices

      CUI stored on mobile devices and mobile computing platforms is encrypted.

      • Full Device Encryption
      • Endpoint Encryption
      • FIPS-Validated Cryptography

    • AC.L2-3.1.20 External system connections controlled

      Connections to and use of systems outside the organization's control are verified and limited.

      • External System Connections
      • Rules of Behavior
      • Third-Party Criticality Assessments

    • AC.L2-3.1.21 Portable storage on external systems limited

      The use of the organization's portable storage devices on external systems is limited.

      • Removable Media & Portable Storage

    • AC.L2-3.1.22 CUI kept off public systems

      Content is reviewed before it is posted to publicly accessible systems so that CUI is not published, and any CUI found there is removed.

      • FCI & CUI Identification and Handling
      • Rules of Behavior

  • AT Awareness and Training

    • AT.L2-3.2.1 Security risks and policies made known

      Managers, administrators and users know the security risks of their activities and the policies, standards and procedures that apply to the systems they use.

      • Security & Privacy Awareness
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training
      • Periodic Policy Acknowledgement

    • AT.L2-3.2.2 Staff trained for their security duties

      Staff are trained to carry out the security duties and responsibilities assigned to them.

      • Periodic Security & Privacy Training
      • New Hire Security & Privacy Training
      • Cybersecurity Responsibilities

    • AT.L2-3.2.3 Insider threat awareness

      Security awareness training teaches staff to recognize and report possible signs of insider threat.

      • Periodic Security & Privacy Training
      • Security & Privacy Awareness

  • AU Audit and Accountability

    • AU.L2-3.3.1 Audit logs created and retained

      Systems create and keep audit logs detailed enough to monitor, analyze, investigate and report unlawful or unauthorized activity.

      • Centralized Security Logging
      • Anomalous Behavior Detection

    • AU.L2-3.3.2 User actions traceable

      The actions of each user can be traced back to that individual, so people can be held accountable.

      • Centralized Security Logging
      • Identity Validation
      • User Access Reviews

    • AU.L2-3.3.3 Logged events reviewed

      The list of events that systems log is reviewed and updated.

      • Centralized Security Logging

    • AU.L2-3.3.4 Alert on logging failure

      Staff are alerted when an audit logging process fails.

      • Centralized Security Logging

    • AU.L2-3.3.5 Audit review correlated

      Audit record review, analysis and reporting are correlated to investigate and respond to signs of unlawful, unauthorized, suspicious or unusual activity.

      • Centralized Security Logging
      • Anomalous Behavior Detection
      • Unauthorized Activity Monitoring

    • AU.L2-3.3.6 Audit reduction and reporting

      Tools can filter audit records and produce reports for on-demand analysis.

      • Centralized Security Logging

    • AU.L2-3.3.7 Clocks synchronized to an authoritative source

      System clocks are compared and synchronized with an authoritative time source so audit timestamps are reliable.

      • Clock Synchronization

    • AU.L2-3.3.8 Audit information protected

      Audit logs and logging tools are protected from unauthorized access, change and deletion.

      • Centralized Security Logging

    • AU.L2-3.3.9 Logging managed by few administrators

      Only a small, defined group of privileged users can manage audit logging.

      • Centralized Security Logging
      • Production Database Access Restriction

  • CM Configuration Management

    • CM.L2-3.4.1 Baselines and inventories maintained

      Baseline configurations and inventories of hardware, software, firmware and documentation are set up and kept current throughout each system's life cycle.

      • Secure Configuration Baselines
      • Inventory of Infrastructure Assets
      • Inventory of Endpoint Assets
      • Asset Inventory Updates

    • CM.L2-3.4.2 Security settings enforced

      Security configuration settings are defined and enforced for the technology products used in systems.

      • Secure Configuration Baselines
      • Endpoint Security Validation
      • Endpoint Security Policy

    • CM.L2-3.4.3 Changes tracked and approved

      Changes to systems are tracked, reviewed, approved or rejected, and logged.

      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes
      • Deployment Notifications

    • CM.L2-3.4.4 Security impact of changes analyzed

      The security impact of a change is analyzed before it is implemented.

      • Change Management Policy & Procedure
      • Approval of Changes

    • CM.L2-3.4.5 Access to make changes restricted

      Physical and logical restrictions on who can make changes to systems are defined, documented, approved and enforced.

      • Approval of Changes
      • Production Database Access Restriction
      • Change Management Policy & Procedure

    • CM.L2-3.4.6 Least functionality

      Systems are configured to provide only the capabilities they need.

      • Least Functionality & Software Restrictions
      • Secure Configuration Baselines

    • CM.L2-3.4.7 Nonessential functions disabled

      Programs, functions, ports, protocols and services that are not needed are restricted, disabled or blocked.

      • Least Functionality & Software Restrictions
      • External System Connections

    • CM.L2-3.4.8 Software execution policy

      Unauthorized software is blocked by a deny-by-exception list, or only authorized software can run under a permit-by-exception list.

      • Least Functionality & Software Restrictions

    • CM.L2-3.4.9 User-installed software controlled

      Software that users install themselves is controlled and monitored.

      • Least Functionality & Software Restrictions
      • Rules of Behavior

  • IA Identification and Authentication

    • IA.L2-3.5.1 Users, processes and devices identified

      System users, processes acting for them and devices are uniquely identified.

      • Identity Validation
      • User Access Reviews
      • Inventory of Endpoint Assets

    • IA.L2-3.5.2 Identities authenticated before access

      The identity of each user, process or device is authenticated before it can access systems.

      • Multi-Factor Authentication
      • Password Management Guidelines
      • Access Control Policy & Procedure

    • IA.L2-3.5.3 Multi-factor authentication

      Multi-factor authentication is required for local and network access to privileged accounts and for network access to non-privileged accounts.

      • Multi-Factor Authentication
      • Production Database Access Restriction

    • IA.L2-3.5.4 Replay-resistant authentication

      Network access to privileged and non-privileged accounts uses authentication methods that resist replay attacks.

      • Multi-Factor Authentication
      • Transmission Confidentiality

    • IA.L2-3.5.5 Identifiers not reused

      User and device identifiers are not reassigned to someone else for a defined period.

      • Identity Validation
      • Access Control Policy & Procedure

    • IA.L2-3.5.6 Inactive identifiers disabled

      Identifiers are disabled after a defined period of inactivity.

      • Production Database Access Restriction
      • User Access Reviews

    • IA.L2-3.5.7 Password complexity enforced

      New passwords must meet minimum complexity rules and change a minimum number of characters.

      • Password Management Guidelines
      • Production Database Access Restriction

    • IA.L2-3.5.8 Password reuse prohibited

      Users cannot reuse a password for a set number of password generations.

      • Password Management Guidelines

    • IA.L2-3.5.9 Temporary passwords changed at first use

      Temporary passwords work only for the first logon and must be changed immediately to a permanent password.

      • Password Management Guidelines
      • Access Control Policy & Procedure

    • IA.L2-3.5.10 Passwords stored and sent encrypted

      Passwords are only stored and transmitted in cryptographically protected form.

      • Password Management Guidelines
      • Encryption Policy & Procedure
      • Transmission Confidentiality

    • IA.L2-3.5.11 Authentication feedback obscured

      Systems hide authentication information, such as typed passwords, while it is being entered.

      • Access Control Policy & Procedure

  • IR Incident Response

    • IR.L2-3.6.1 Incident handling capability

      An operational incident handling capability covers preparation, detection, analysis, containment, recovery and user response.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Automated Incident Reporting

    • IR.L2-3.6.2 Incidents tracked and reported

      Incidents are tracked, documented and reported to designated officials and authorities inside and outside the organization, including the DoD where required.

      • Incident Tracking
      • DoD Cyber Incident Reporting
      • Incident Management Policy & Procedure

    • IR.L2-3.6.3 Incident response tested

      The organization's incident response capability is tested.

      • Incident Response Exercises

  • MA Maintenance

    • MA.L2-3.7.1 System maintenance performed

      Maintenance is performed on systems that handle CUI.

      • System Maintenance

    • MA.L2-3.7.2 Maintenance tools and people controlled

      The tools, techniques, mechanisms and people used for system maintenance are controlled.

      • System Maintenance

    • MA.L2-3.7.3 Equipment sanitized before off-site maintenance

      Equipment sent off site for maintenance is cleared of CUI first.

      • System Maintenance
      • Media Disposal Policy

    • MA.L2-3.7.4 Diagnostic media checked for malware

      Media holding diagnostic and test programs is scanned for malicious code before it is used on systems.

      • Malware Protection
      • System Maintenance

    • MA.L2-3.7.5 Remote maintenance secured

      Remote maintenance sessions over external networks require multi-factor authentication and are ended when the work is done.

      • System Maintenance
      • Multi-Factor Authentication

    • MA.L2-3.7.6 Maintenance personnel supervised

      Maintenance staff who do not have the required access authorization are supervised while they work.

      • System Maintenance
      • Physical Access Management

  • MP Media Protection

    • MP.L2-3.8.1 Media containing CUI protected

      Paper and digital media containing CUI are physically controlled and stored securely.

      • FCI & CUI Identification and Handling
      • Removable Media & Portable Storage
      • Clear Desk & Clear Screen

    • MP.L2-3.8.2 Access to CUI on media limited

      Only authorized users can access CUI held on system media.

      • Removable Media & Portable Storage
      • FCI & CUI Identification and Handling
      • Full Device Encryption

    • MP.L2-3.8.3 Media sanitized before disposal or reuse

      Media containing CUI is sanitized or destroyed before it is disposed of or reused.

      • Media Disposal Policy

    • MP.L2-3.8.4 Media marked

      Media is marked with the required CUI markings and distribution limits.

      • FCI & CUI Identification and Handling
      • Data Classification Labels

    • MP.L2-3.8.5 Media accountable during transport

      Access to media containing CUI is controlled, and the media is tracked while it is transported outside controlled areas.

      • Removable Media & Portable Storage
      • FCI & CUI Identification and Handling

    • MP.L2-3.8.6 Portable media encrypted in transit

      CUI on digital media is encrypted while it is transported, unless other physical safeguards protect it.

      • Removable Media & Portable Storage
      • FIPS-Validated Cryptography

    • MP.L2-3.8.7 Removable media controlled

      The use of removable media on system components is controlled.

      • Removable Media & Portable Storage
      • Endpoint Security Policy

    • MP.L2-3.8.8 Unowned portable storage prohibited

      Portable storage devices that have no identifiable owner cannot be used.

      • Removable Media & Portable Storage

    • MP.L2-3.8.9 Backups of CUI protected

      The confidentiality of CUI in backups is protected where the backups are stored.

      • Data Backup Policy
      • Data Backups
      • Encryption of Data at Rest

  • PS Personnel Security

    • PS.L2-3.9.1 Individuals screened before access

      People are screened before they are given access to systems containing CUI.

      • Personnel Screening

    • PS.L2-3.9.2 CUI protected during personnel changes

      Systems containing CUI stay protected when people leave or change roles, for example by removing access and recovering equipment.

      • Termination of Employment
      • User Access Reviews
      • Human Resources Policy & Procedure

  • PE Physical Protection

    • PE.L2-3.10.1 Physical access limited

      Physical access to systems, equipment and their operating environments is limited to authorized people.

      • Physical Access Management
      • Physical Protection Policy & Procedure

    • PE.L2-3.10.2 Facility monitored and protected

      The physical facility and its supporting infrastructure are protected and monitored.

      • Physical Access Management
      • Physical Protection Policy & Procedure

    • PE.L2-3.10.3 Visitors escorted and monitored

      Visitors are escorted and their activity is monitored.

      • Physical Access Management

    • PE.L2-3.10.4 Physical access logged

      Logs of physical access are kept.

      • Physical Access Management

    • PE.L2-3.10.5 Physical access devices managed

      Keys, badges, codes and other physical access devices are controlled and managed.

      • Physical Access Management

    • PE.L2-3.10.6 CUI safeguarded at alternate work sites

      Safeguards for CUI are enforced wherever staff work away from the main site, such as at home.

      • Endpoint Security Policy
      • Full Device Encryption
      • Session Lock
      • Clear Desk & Clear Screen

  • RA Risk Assessment

    • RA.L2-3.11.1 Risk assessed periodically

      Risks to operations, assets and individuals from operating systems that handle CUI are assessed periodically.

      • Risk Assessment
      • Risk Framing
      • Risk Assessment Policy & Procedure

    • RA.L2-3.11.2 Vulnerability scanning

      Systems and applications are scanned for vulnerabilities periodically and when new vulnerabilities that affect them are identified.

      • Vulnerability Remediation Process
      • Penetration Testing

    • RA.L2-3.11.3 Vulnerabilities remediated

      Vulnerabilities are fixed in line with the results of risk assessments.

      • Vulnerability Remediation Process
      • Centralized Flaw Remediation

  • CA Security Assessment

    • CA.L2-3.12.1 Security controls assessed

      Security controls are assessed periodically to confirm they work as intended.

      • CMMC Self-Assessment & Affirmation
      • Internal Audit

    • CA.L2-3.12.2 Plans of action maintained

      Plans of action are written and carried out to correct deficiencies and reduce or remove vulnerabilities.

      • Plan of Action & Milestones

    • CA.L2-3.12.3 Security controls monitored

      Security controls are monitored on an ongoing basis so they stay effective.

      • Internal Audit
      • Security & Privacy Program Review
      • CMMC Self-Assessment & Affirmation

    • CA.L2-3.12.4 System security plan

      A system security plan describes the system boundary, its environment, how each security requirement is met and its connections to other systems, and it is updated periodically.

      • System Security Plan

  • SC System and Communications Protection

    • SC.L2-3.13.1 Boundaries protected

      Communications at the external boundary and key internal boundaries of systems are monitored, controlled and protected.

      • External System Connections
      • Limit Network Connections
      • Anomalous Behavior Detection

    • SC.L2-3.13.2 Security built into architecture and engineering

      System architecture, software development techniques and engineering principles that support security are used.

      • Change Management Policy & Procedure
      • Network & Data Flow Diagrams
      • Approval of Changes

    • SC.L2-3.13.3 User and management functions separated

      Functions for ordinary users are kept separate from system management functions.

      • Production Database Access Restriction
      • External System Connections

    • SC.L2-3.13.4 No leakage through shared resources

      Information cannot be transferred without authorization through shared system resources such as memory or storage.

      • Secure Configuration Baselines

    • SC.L2-3.13.5 Public-facing components separated

      Publicly accessible system components sit in subnetworks that are physically or logically separated from internal networks.

      • Limit Network Connections
      • External System Connections

    • SC.L2-3.13.6 Network traffic denied by default

      Network traffic is denied by default and allowed only by exception.

      • External System Connections

    • SC.L2-3.13.7 Split tunneling prevented

      Remote devices cannot connect to organizational systems and to external networks at the same time through a split tunnel.

      • Remote & Wireless Access

    • SC.L2-3.13.8 CUI encrypted in transit

      Cryptography prevents unauthorized disclosure of CUI in transit, unless other physical safeguards protect it.

      • Transmission Confidentiality
      • FIPS-Validated Cryptography

    • SC.L2-3.13.9 Idle network connections terminated

      Network connections are ended when a session finishes or after a defined period of inactivity.

      • Cloud Console Session Timeout
      • Remote & Wireless Access

    • SC.L2-3.13.10 Cryptographic keys managed

      Cryptographic keys used in systems are established and managed.

      • Encryption Policy & Procedure
      • Encryption of Data at Rest

    • SC.L2-3.13.11 FIPS-validated encryption for CUI

      Cryptography that protects the confidentiality of CUI uses FIPS-validated modules.

      • FIPS-Validated Cryptography

    • SC.L2-3.13.12 Collaborative devices controlled

      Collaborative devices such as cameras and microphones cannot be switched on remotely, and people nearby can see when they are in use.

      • Endpoint Security Policy

    • SC.L2-3.13.13 Mobile code controlled

      The use of mobile code, such as scripts and macros that run in browsers or documents, is controlled and monitored.

      • Least Functionality & Software Restrictions
      • Malware Protection

    • SC.L2-3.13.14 Voice over IP controlled

      The use of Voice over Internet Protocol technologies is controlled and monitored.

      • Network Security Policy & Procedure

    • SC.L2-3.13.15 Communication sessions authenticated

      The authenticity of communication sessions is protected, for example against session hijacking.

      • Transmission Confidentiality

    • SC.L2-3.13.16 CUI encrypted at rest

      The confidentiality of CUI is protected while it is stored.

      • Encryption of Data at Rest
      • Full Device Encryption
      • FIPS-Validated Cryptography

  • SI System and Information Integrity

    • SI.L2-3.14.1 System flaws remediated promptly

      System flaws are identified, reported and corrected in a timely way.

      • Vulnerability Remediation Process
      • Centralized Flaw Remediation
      • Endpoint Security Validation

    • SI.L2-3.14.2 Malicious code protection

      Protection against malicious code is in place at appropriate points in systems.

      • Malware Protection

    • SI.L2-3.14.3 Security alerts and advisories acted on

      System security alerts and advisories are monitored and acted on.

      • Threat Intelligence & Security Advisories
      • Vulnerability Management Policy & Procedure

    • SI.L2-3.14.4 Malware protection kept up to date

      Malicious code protection is updated whenever new releases are available.

      • Malware Protection
      • Endpoint Security Validation

    • SI.L2-3.14.5 Periodic and real-time scanning

      Systems are scanned periodically, and files from external sources are scanned as they are downloaded, opened or run.

      • Malware Protection

    • SI.L2-3.14.6 Systems monitored for attacks

      Systems, including inbound and outbound traffic, are monitored to detect attacks and signs of potential attacks.

      • Anomalous Behavior Detection
      • External System Connections
      • Centralized Security Logging

    • SI.L2-3.14.7 Unauthorized use identified

      Unauthorized use of systems is identified.

      • Unauthorized Activity Monitoring
      • Anomalous Behavior Detection
      • Centralized Security Logging

Also in CMMC