---
name: cmmc-assessment-objectives
description: "Verbatim reference for all 320 NIST 800-171A Rev 2 assessment objectives, plus the Rev 2 → Rev 3 control crosswalk. Use for AO-level lookups (e.g., 3.1.1[c]), evidence planning, and forward-mapping to Rev 3. Pairs with cmmc-expert."
allowed-tools: Read, Glob, Grep, Write
---

# CMMC Assessment Objectives — 800-171A Rev 2 (with Rev 3 Crosswalk)

The scoreable layer underneath every CMMC Level 2 assessment. Where `cmmc-expert` describes the CMMC program, this skill captures the **320 specific objectives** an assessor is actually scoring against, plus the structural Rev 2 → Rev 3 mapping.

## How to use this skill (paired with cmmc-expert)

| Question | Skill |
|---|---|
| What does CMMC require, who needs L1 vs L2, how does SPRS scoring work, what's POA&M-eligible? | `cmmc-expert` |
| What does an assessor look for at the objective level for 3.1.1? What does 3.13.11[a] actually say? | **this skill** |
| Where does Rev 2 3.5.7 land in Rev 3? Which Rev 2 controls were withdrawn? | **this skill** |
| What FedRAMP level does a CSP need for CUI? | `cmmc-expert` |
| What does FIPS-validated cryptography mean in Rev 3 vs. Rev 2? | **this skill** (note in 3.13.11 crosswalk row) |

**Lookup patterns:**

- **By control:** Jump to the family heading (`## 3.X`) → find the practice number.
- **By objective:** Each practice lists `[a], [b], [c]...` — these are the scoreable units.
- **By Rev 3 equivalent:** Jump to "Rev 2 → Rev 3 Crosswalk" → find the family → row by Rev 2 ID.
- **For withdrawn controls:** See the "Quick Reference: Withdrawn Rev 2 Controls" table.

## Source & Verification Status

**Layer 1 — Assessment objectives (Rev 2):**

- Source: **NIST SP 800-171A** (June 2018; published assessment guide for 800-171 Rev 2).
- Status: Withdrawn May 14, 2024; **still operative for CMMC Level 2** under current DoD rulemaking.
- DOI for parent 800-171 Rev 2: https://doi.org/10.6028/NIST.SP.800-171r2
- Text below is verbatim from the PDF.

**Layer 2 — Rev 2 → Rev 3 crosswalk:**

- Source: **NIST SP 800-171 Rev 3** (Final, May 2024).
- AC, AT, AU families: PDF-verified.
- CM through SI families: high-confidence training-knowledge mapping; verify against the Rev 3 PDF before relying on it for a Rev 3 assessment deliverable.

**Critical constants for Rev 2:**

- 14 control families · 110 controls · **320 assessment objectives**.
- Numbering scheme: `Chapter.Family.Requirement[Objective]` — e.g., `3.1.1[a]` = AC, requirement 1, objective a.

---

## Quick Reference: Counts by Family

| Family | Rev 2 Controls | Rev 2 Assessment Objectives |
|---|---|---|
| 3.1 Access Control (AC) | 22 | **70** |
| 3.2 Awareness & Training (AT) | 3 | 9 |
| 3.3 Audit & Accountability (AU) | 9 | 29 |
| 3.4 Configuration Management (CM) | 9 | **44** |
| 3.5 Identification & Authentication (IA) | 11 | 25 |
| 3.6 Incident Response (IR) | 3 | 14 |
| 3.7 Maintenance (MA) | 6 | 10 |
| 3.8 Media Protection (MP) | 9 | 15 |
| 3.9 Personnel Security (PS) | 2 | 4 |
| 3.10 Physical Protection (PE) | 6 | 16 |
| 3.11 Risk Assessment (RA) | 3 | 9 |
| 3.12 Security Assessment (CA) | 4 | 14 |
| 3.13 System & Comms Protection (SC) | 16 | **41** |
| 3.14 System & Info Integrity (SI) | 7 | 20 |
| **TOTAL** | **110** | **320** |

---

## Assessment Methods Reference (per NIST SP 800-171A)

Three methods — **not four.** "Determine" is the verb each objective opens with, not a separate method.

| Method | What it means | Depth attributes |
|---|---|---|
| **EXAMINE** | Reviewing, inspecting, observing, studying, or analyzing assessment objects (specifications, mechanisms, activities). | Basic / Focused / Comprehensive |
| **INTERVIEW** | Discussions with individuals or groups to facilitate understanding, achieve clarification, or obtain evidence. | Basic / Focused / Comprehensive |
| **TEST** | Exercising assessment objects under specified conditions to compare actual with expected behavior. | Basic (black box) / Focused (gray box) / Comprehensive (white box) |

### Assessment Objects

- **Specifications** — policies, procedures, plans, SSP, designs, requirements.
- **Mechanisms** — hardware, software, firmware controls.
- **Activities** — system operations, exercises, backup operations.
- **Individuals** — system owners, admins, security personnel, users.

### How to read an assessment objective

Each lettered sub-item (`[a]`, `[b]`, ...) is **one scoreable assessment objective**. For each, the assessor will (per NIST 800-171A):

1. **Determine** if the objective is satisfied.
2. Support that determination with **E/I/T** evidence — typically all three for any non-trivial control.
3. Mark it **Satisfied** or **Other Than Satisfied** for SPRS / CMMC purposes.

**Practice-level rollup:** all AOs within a practice must be Satisfied for the practice to be **MET** in a C3PAO assessment.

---

# 320 Assessment Objectives (NIST SP 800-171A Rev 2)

> Text below is verbatim from NIST SP 800-171A. Each lettered sub-item is one scoreable assessment objective.

## 3.1 ACCESS CONTROL (22 controls, 70 objectives)

**3.1.1** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices.
- [a] authorized users are identified
- [b] processes acting on behalf of authorized users are identified
- [c] devices (and other systems) authorized to connect to the system are identified
- [d] system access is limited to authorized users
- [e] system access is limited to processes acting on behalf of authorized users
- [f] system access is limited to authorized devices (including other systems)

**3.1.2** — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- [a] the types of transactions and functions that authorized users are permitted to execute are defined
- [b] system access is limited to the defined types of transactions and functions for authorized users

**3.1.3** — Control the flow of CUI in accordance with approved authorizations.
- [a] information flow control policies are defined
- [b] methods and enforcement mechanisms for controlling the flow of CUI are defined
- [c] designated sources and destinations for CUI within the system and between interconnected systems are identified
- [d] authorizations for controlling the flow of CUI are defined
- [e] approved authorizations for controlling the flow of CUI are enforced

**3.1.4** — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- [a] the duties of individuals requiring separation are defined
- [b] responsibilities for duties that require separation are assigned to separate individuals
- [c] access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals

**3.1.5** — Employ the principle of least privilege, including for specific security functions and privileged accounts.
- [a] privileged accounts are identified
- [b] access to privileged accounts is authorized in accordance with the principle of least privilege
- [c] security functions are identified
- [d] access to security functions is authorized in accordance with the principle of least privilege

**3.1.6** — Use non-privileged accounts or roles when accessing nonsecurity functions.
- [a] nonsecurity functions are identified
- [b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions

**3.1.7** — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- [a] privileged functions are defined
- [b] non-privileged users are defined
- [c] non-privileged users are prevented from executing privileged functions
- [d] the execution of privileged functions is captured in audit logs

**3.1.8** — Limit unsuccessful logon attempts.
- [a] the means of limiting unsuccessful logon attempts is defined
- [b] the defined means of limiting unsuccessful logon attempts is implemented

**3.1.9** — Provide privacy and security notices consistent with applicable CUI rules.
- [a] privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category
- [b] privacy and security notices are displayed

**3.1.10** — Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
- [a] the period of inactivity after which the system initiates a session lock is defined
- [b] access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity
- [c] previously visible information is concealed via a pattern-hiding display after the defined period of inactivity

**3.1.11** — Terminate (automatically) a user session after a defined condition.
- [a] conditions requiring a user session to terminate are defined
- [b] a user session is automatically terminated after any of the defined conditions occur

**3.1.12** — Monitor and control remote access sessions.
- [a] remote access sessions are permitted
- [b] the types of permitted remote access are identified
- [c] remote access sessions are controlled
- [d] remote access sessions are monitored

**3.1.13** — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
- [a] cryptographic mechanisms to protect the confidentiality of remote access sessions are identified
- [b] cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented

**3.1.14** — Route remote access via managed access control points.
- [a] managed access control points are identified and implemented
- [b] remote access is routed through managed network access control points

**3.1.15** — Authorize remote execution of privileged commands and remote access to security-relevant information.
- [a] privileged commands authorized for remote execution are identified
- [b] security-relevant information authorized to be accessed remotely is identified
- [c] the execution of the identified privileged commands via remote access is authorized
- [d] access to the identified security-relevant information via remote access is authorized

**3.1.16** — Authorize wireless access prior to allowing such connections.
- [a] wireless access points are identified
- [b] wireless access is authorized prior to allowing such connections

**3.1.17** — Protect wireless access using authentication and encryption.
- [a] wireless access to the system is protected using authentication
- [b] wireless access to the system is protected using encryption

**3.1.18** — Control connection of mobile devices.
- [a] mobile devices that process, store, or transmit CUI are identified
- [b] mobile device connections are authorized
- [c] mobile device connections are monitored and logged

**3.1.19** — Encrypt CUI on mobile devices and mobile computing platforms.
- [a] mobile devices and mobile computing platforms that process, store, or transmit CUI are identified
- [b] encryption is employed to protect CUI on identified mobile devices and mobile computing platforms

**3.1.20** — Verify and control/limit connections to and use of external systems.
- [a] connections to external systems are identified
- [b] the use of external systems is identified
- [c] connections to external systems are verified
- [d] the use of external systems is verified
- [e] connections to external systems are controlled/limited
- [f] the use of external systems is controlled/limited

**3.1.21** — Limit use of portable storage devices on external systems.
- [a] the use of portable storage devices containing CUI on external systems is identified and documented
- [b] limits on the use of portable storage devices containing CUI on external systems are defined
- [c] the use of portable storage devices containing CUI on external systems is limited as defined

**3.1.22** — Control CUI posted or processed on publicly accessible systems.
- [a] individuals authorized to post or process information on publicly accessible systems are identified
- [b] procedures to ensure CUI is not posted or processed on publicly accessible systems are identified
- [c] a review process is in place prior to posting of any content to publicly accessible systems
- [d] content on publicly accessible systems is reviewed to ensure that it does not include CUI
- [e] mechanisms are in place to remove and address improper posting of CUI

---

## 3.2 AWARENESS AND TRAINING (3 controls, 9 objectives)

**3.2.1** — Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities.
- [a] security risks associated with organizational activities involving CUI are identified
- [b] policies, standards, and procedures related to the security of the system are identified
- [c] managers, systems administrators, and users of the system are made aware of the security risks associated with their activities
- [d] managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system

**3.2.2** — Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
- [a] information security-related duties, roles, and responsibilities are defined
- [b] information security-related duties, roles, and responsibilities are assigned to designated personnel
- [c] personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities

**3.2.3** — Provide security awareness training on recognizing and reporting potential indicators of insider threat.
- [a] potential indicators associated with insider threats are identified
- [b] security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees

---

## 3.3 AUDIT AND ACCOUNTABILITY (9 controls, 29 objectives)

**3.3.1** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
- [a] audit logs needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified
- [b] the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined
- [c] audit records are created (generated)
- [d] audit records, once created, contain the defined content
- [e] retention requirements for audit records are defined
- [f] audit records are retained as defined

**3.3.2** — Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
- [a] the content of the audit records needed to support the ability to uniquely trace users to their actions is defined
- [b] audit records, once created, contain the defined content

**3.3.3** — Review and update logged events.
- [a] a process for determining when to review logged events is defined
- [b] event types being logged are reviewed in accordance with the defined review process
- [c] event types being logged are updated based on the review

**3.3.4** — Alert in the event of an audit logging process failure.
- [a] personnel or roles to be alerted in the event of an audit logging process failure are identified
- [b] types of audit logging process failures for which alert will be generated are defined
- [c] identified personnel or roles are alerted in the event of an audit logging process failure

**3.3.5** — Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
- [a] audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined
- [b] defined audit record review, analysis, and reporting processes are correlated

**3.3.6** — Provide audit record reduction and report generation to support on-demand analysis and reporting.
- [a] an audit record reduction capability that supports on-demand analysis is provided
- [b] a report generation capability that supports on-demand reporting is provided

**3.3.7** — Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
- [a] internal system clocks are used to generate time stamps for audit records
- [b] an authoritative source with which to compare and synchronize internal system clocks is specified
- [c] internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source

**3.3.8** — Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
- [a] audit information is protected from unauthorized access
- [b] audit information is protected from unauthorized modification
- [c] audit information is protected from unauthorized deletion
- [d] audit logging tools are protected from unauthorized access
- [e] audit logging tools are protected from unauthorized modification
- [f] audit logging tools are protected from unauthorized deletion

**3.3.9** — Limit management of audit logging functionality to a subset of privileged users.
- [a] a subset of privileged users granted access to manage audit logging functionality is defined
- [b] management of audit logging functionality is limited to the defined subset of privileged users

---

## 3.4 CONFIGURATION MANAGEMENT (9 controls, 44 objectives)

**3.4.1** — Establish and maintain baseline configurations and inventories of organizational systems throughout the respective system development life cycles.
- [a] a baseline configuration is established
- [b] the baseline configuration includes hardware, software, firmware, and documentation
- [c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle
- [d] a system inventory is established
- [e] the system inventory includes hardware, software, firmware, and documentation
- [f] the inventory is maintained (reviewed and updated) throughout the system development life cycle

**3.4.2** — Establish and enforce security configuration settings for information technology products employed in organizational systems.
- [a] security configuration settings for information technology products employed in the system are established and included in the baseline configuration
- [b] security configuration settings for information technology products employed in the system are enforced

**3.4.3** — Track, review, approve or disapprove, and log changes to organizational systems.
- [a] changes to the system are tracked
- [b] changes to the system are reviewed
- [c] changes to the system are approved or disapproved
- [d] changes to the system are logged

**3.4.4** — Analyze the security impact of changes prior to implementation.
- [a] the security impact of changes to the system is analyzed prior to implementation

**3.4.5** — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
- [a] physical access restrictions associated with changes to the system are defined
- [b] physical access restrictions associated with changes to the system are documented
- [c] physical access restrictions associated with changes to the system are approved
- [d] physical access restrictions associated with changes to the system are enforced
- [e] logical access restrictions associated with changes to the system are defined
- [f] logical access restrictions associated with changes to the system are documented
- [g] logical access restrictions associated with changes to the system are approved
- [h] logical access restrictions associated with changes to the system are enforced

**3.4.6** — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
- [a] essential system capabilities are defined based on the principle of least functionality
- [b] the system is configured to provide only the defined essential capabilities

**3.4.7** — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
- [a] essential programs are defined
- [b] the use of nonessential programs is defined
- [c] the use of nonessential programs is restricted, disabled, or prevented as defined
- [d] essential functions are defined
- [e] the use of nonessential functions is defined
- [f] the use of nonessential functions is restricted, disabled, or prevented as defined
- [g] essential ports are defined
- [h] the use of nonessential ports is defined
- [i] the use of nonessential ports is restricted, disabled, or prevented as defined
- [j] essential protocols are defined
- [k] the use of nonessential protocols is defined
- [l] the use of nonessential protocols is restricted, disabled, or prevented as defined
- [m] essential services are defined
- [n] the use of nonessential services is defined
- [o] the use of nonessential services is restricted, disabled, or prevented as defined

**3.4.8** — Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
- [a] a policy specifying whether whitelisting or blacklisting is to be implemented is specified
- [b] the software allowed to execute under whitelisting or denied use under blacklisting is specified
- [c] whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified

**3.4.9** — Control and monitor user-installed software.
- [a] a policy for controlling the installation of software by users is established
- [b] installation of software by users is controlled based on the established policy
- [c] installation of software by users is monitored

---

## 3.5 IDENTIFICATION AND AUTHENTICATION (11 controls, 25 objectives)

**3.5.1** — Identify system users, processes acting on behalf of users, and devices.
- [a] system users are identified
- [b] processes acting on behalf of users are identified
- [c] devices accessing the system are identified

**3.5.2** — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
- [a] the identity of each user is authenticated or verified as a prerequisite to system access
- [b] the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access
- [c] the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access

**3.5.3** — Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
- [a] privileged accounts are identified
- [b] multifactor authentication is implemented for local access to privileged accounts
- [c] multifactor authentication is implemented for network access to privileged accounts
- [d] multifactor authentication is implemented for network access to non-privileged accounts

**3.5.4** — Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
- [a] replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts

**3.5.5** — Prevent reuse of identifiers for a defined period.
- [a] a period within which identifiers cannot be reused is defined
- [b] reuse of identifiers is prevented within the defined period

**3.5.6** — Disable identifiers after a defined period of inactivity.
- [a] a period of inactivity after which an identifier is disabled is defined
- [b] identifiers are disabled after the defined period of inactivity

**3.5.7** — Enforce a minimum password complexity and change of characters when new passwords are created.
- [a] password complexity requirements are defined
- [b] password change of character requirements are defined
- [c] minimum password complexity requirements as defined are enforced when new passwords are created
- [d] minimum password change of character requirements as defined are enforced when new passwords are created

**3.5.8** — Prohibit password reuse for a specified number of generations.
- [a] the number of generations during which a password cannot be reused is specified
- [b] reuse of passwords is prohibited during the specified number of generations

**3.5.9** — Allow temporary password use for system logons with an immediate change to a permanent password.
- [a] an immediate change to a permanent password is required when a temporary password is used for system logon

**3.5.10** — Store and transmit only cryptographically-protected passwords.
- [a] passwords are cryptographically protected in storage
- [b] passwords are cryptographically protected in transit

**3.5.11** — Obscure feedback of authentication information.
- [a] authentication information is obscured during the authentication process

---

## 3.6 INCIDENT RESPONSE (3 controls, 14 objectives)

**3.6.1** — Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
- [a] an operational incident-handling capability is established
- [b] the operational incident-handling capability includes preparation
- [c] the operational incident-handling capability includes detection
- [d] the operational incident-handling capability includes analysis
- [e] the operational incident-handling capability includes containment
- [f] the operational incident-handling capability includes recovery
- [g] the operational incident-handling capability includes user response activities

**3.6.2** — Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
- [a] incidents are tracked
- [b] incidents are documented
- [c] authorities to whom incidents are to be reported are identified
- [d] organizational officials to whom incidents are to be reported are identified
- [e] identified authorities are notified of incidents
- [f] identified organizational officials are notified of incidents

**3.6.3** — Test the organizational incident response capability.
- [a] the incident response capability is tested

---

## 3.7 MAINTENANCE (6 controls, 10 objectives)

**3.7.1** — Perform maintenance on organizational systems.
- [a] system maintenance is performed

**3.7.2** — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
- [a] tools used to conduct system maintenance are controlled
- [b] techniques used to conduct system maintenance are controlled
- [c] mechanisms used to conduct system maintenance are controlled
- [d] personnel used to conduct system maintenance are controlled

**3.7.3** — Ensure equipment removed for off-site maintenance is sanitized of any CUI.
- [a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI

**3.7.4** — Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
- [a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI

**3.7.5** — Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
- [a] multifactor authentication is used to establish nonlocal maintenance sessions via external network connections
- [b] nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete

**3.7.6** — Supervise the maintenance activities of maintenance personnel without required access authorization.
- [a] maintenance personnel without required access authorization are supervised during maintenance activities

---

## 3.8 MEDIA PROTECTION (9 controls, 15 objectives)

**3.8.1** — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
- [a] paper media containing CUI is physically controlled
- [b] digital media containing CUI is physically controlled
- [c] paper media containing CUI is securely stored
- [d] digital media containing CUI is securely stored

**3.8.2** — Limit access to CUI on system media to authorized users.
- [a] access to CUI on system media is limited to authorized users

**3.8.3** — Sanitize or destroy system media containing CUI before disposal or release for reuse.
- [a] system media containing CUI is sanitized or destroyed before disposal
- [b] system media containing CUI is sanitized before it is released for reuse

**3.8.4** — Mark media with necessary CUI markings and distribution limitations.
- [a] media containing CUI is marked with applicable CUI markings
- [b] media containing CUI is marked with distribution limitations

**3.8.5** — Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
- [a] access to media containing CUI is controlled
- [b] accountability for media containing CUI is maintained during transport outside of controlled areas

**3.8.6** — Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
- [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards

**3.8.7** — Control the use of removable media on system components.
- [a] the use of removable media on system components is controlled

**3.8.8** — Prohibit the use of portable storage devices when such devices have no identifiable owner.
- [a] the use of portable storage devices is prohibited when such devices have no identifiable owner

**3.8.9** — Protect the confidentiality of backup CUI at storage locations.
- [a] the confidentiality of backup CUI is protected at storage locations

---

## 3.9 PERSONNEL SECURITY (2 controls, 4 objectives)

**3.9.1** — Screen individuals prior to authorizing access to organizational systems containing CUI.
- [a] individuals are screened prior to authorizing access to organizational systems containing CUI

**3.9.2** — Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
- [a] a policy and/or process for terminating system access and any credentials coincident with personnel actions is established
- [b] system access and credentials are terminated consistent with personnel actions such as termination or transfer
- [c] the system is protected during and after personnel transfer actions

---

## 3.10 PHYSICAL PROTECTION (6 controls, 16 objectives)

**3.10.1** — Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
- [a] authorized individuals allowed physical access are identified
- [b] physical access to organizational systems is limited to authorized individuals
- [c] physical access to equipment is limited to authorized individuals
- [d] physical access to operating environments is limited to authorized individuals

**3.10.2** — Protect and monitor the physical facility and support infrastructure for organizational systems.
- [a] the physical facility where organizational systems reside is protected
- [b] the support infrastructure for organizational systems is protected
- [c] the physical facility where organizational systems reside is monitored
- [d] the support infrastructure for organizational systems is monitored

**3.10.3** — Escort visitors and monitor visitor activity.
- [a] visitors are escorted
- [b] visitor activity is monitored

**3.10.4** — Maintain audit logs of physical access.
- [a] audit logs of physical access are maintained

**3.10.5** — Control and manage physical access devices.
- [a] physical access devices are identified
- [b] physical access devices are controlled
- [c] physical access devices are managed

**3.10.6** — Enforce safeguarding measures for CUI at alternate work sites.
- [a] safeguarding measures for CUI are defined for alternate work sites
- [b] safeguarding measures for CUI are enforced for alternate work sites

---

## 3.11 RISK ASSESSMENT (3 controls, 9 objectives)

**3.11.1** — Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
- [a] the frequency to assess risk to organizational operations, organizational assets, and individuals is defined
- [b] risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency

**3.11.2** — Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
- [a] the frequency to scan for vulnerabilities in organizational systems and applications is defined
- [b] vulnerability scans are performed on organizational systems with the defined frequency
- [c] vulnerability scans are performed on applications with the defined frequency
- [d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified
- [e] vulnerability scans are performed on applications when new vulnerabilities are identified

**3.11.3** — Remediate vulnerabilities in accordance with risk assessments.
- [a] vulnerabilities are identified
- [b] vulnerabilities are remediated in accordance with risk assessments

---

## 3.12 SECURITY ASSESSMENT (4 controls, 14 objectives)

**3.12.1** — Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
- [a] the frequency of security control assessments is defined
- [b] security controls are assessed with the defined frequency to determine if the controls are effective in their application

**3.12.2** — Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
- [a] deficiencies and vulnerabilities to be addressed by the plan of action are identified
- [b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities
- [c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities

**3.12.3** — Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
- [a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls

**3.12.4** — Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
- [a] a system security plan is developed
- [b] the system boundary is described and documented in the system security plan
- [c] the system environment of operation is described and documented in the system security plan
- [d] the security requirements identified and approved by the designated authority as non-applicable are identified
- [e] the method of security requirement implementation is described and documented in the system security plan
- [f] the relationship with or connection to other systems is described and documented in the system security plan
- [g] the frequency to update the system security plan is defined
- [h] system security plan is updated with the defined frequency

---

## 3.13 SYSTEM AND COMMUNICATIONS PROTECTION (16 controls, 41 objectives)

**3.13.1** — Monitor, control, and protect communications at the external boundaries and key internal boundaries of organizational systems.
- [a] the external system boundary is defined
- [b] key internal system boundaries are defined
- [c] communications are monitored at the external system boundary
- [d] communications are monitored at key internal boundaries
- [e] communications are controlled at the external system boundary
- [f] communications are controlled at key internal boundaries
- [g] communications are protected at the external system boundary
- [h] communications are protected at key internal boundaries

**3.13.2** — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
- [a] architectural designs that promote effective information security are identified
- [b] software development techniques that promote effective information security are identified
- [c] systems engineering principles that promote effective information security are identified
- [d] identified architectural designs that promote effective information security are employed
- [e] identified software development techniques that promote effective information security are employed
- [f] identified systems engineering principles that promote effective information security are employed

**3.13.3** — Separate user functionality from system management functionality.
- [a] user functionality is identified
- [b] system management functionality is identified
- [c] user functionality is separated from system management functionality

**3.13.4** — Prevent unauthorized and unintended information transfer via shared system resources.
- [a] unauthorized and unintended information transfer via shared system resources is prevented

**3.13.5** — Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
- [a] publicly accessible system components are identified
- [b] subnetworks for publicly accessible system components are physically or logically separated from internal networks

**3.13.6** — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- [a] network communications traffic is denied by default
- [b] network communications traffic is allowed by exception

**3.13.7** — Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
- [a] remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (split tunneling)

**3.13.8** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- [a] cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified
- [b] alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified
- [c] either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission

**3.13.9** — Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
- [a] a period of inactivity to terminate network connections associated with communications sessions is defined
- [b] network connections associated with communications sessions are terminated at the end of the sessions
- [c] network connections associated with communications sessions are terminated after the defined period of inactivity

**3.13.10** — Establish and manage cryptographic keys for cryptography employed in organizational systems.
- [a] cryptographic keys are established whenever cryptography is employed
- [b] cryptographic keys are managed whenever cryptography is employed

**3.13.11** — Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
- [a] FIPS-validated cryptography is employed to protect the confidentiality of CUI

**3.13.12** — Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
- [a] collaborative computing devices are identified
- [b] collaborative computing devices provide indication to users of devices in use
- [c] remote activation of collaborative computing devices is prohibited

**3.13.13** — Control and monitor the use of mobile code.
- [a] use of mobile code is controlled
- [b] use of mobile code is monitored

**3.13.14** — Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
- [a] use of Voice over Internet Protocol (VoIP) technologies is controlled
- [b] use of Voice over Internet Protocol (VoIP) technologies is monitored

**3.13.15** — Protect the authenticity of communications sessions.
- [a] the authenticity of communications sessions is protected

**3.13.16** — Protect the confidentiality of CUI at rest.
- [a] the confidentiality of CUI at rest is protected

---

## 3.14 SYSTEM AND INFORMATION INTEGRITY (7 controls, 20 objectives)

**3.14.1** — Identify, report, and correct system flaws in a timely manner.
- [a] the time within which to identify system flaws is specified
- [b] system flaws are identified within the specified time frame
- [c] the time within which to report system flaws is specified
- [d] system flaws are reported within the specified time frame
- [e] the time within which to correct system flaws is specified
- [f] system flaws are corrected within the specified time frame

**3.14.2** — Provide protection from malicious code at designated locations within organizational systems.
- [a] designated locations for malicious code protection are identified
- [b] protection from malicious code at designated locations is provided

**3.14.3** — Monitor system security alerts and advisories and take action in response.
- [a] response actions to system security alerts and advisories are identified
- [b] system security alerts and advisories are monitored
- [c] actions in response to system security alerts and advisories are taken

**3.14.4** — Update malicious code protection mechanisms when new releases are available.
- [a] malicious code protection mechanisms are updated when new releases are available

**3.14.5** — Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
- [a] the frequency for malicious code scans is defined
- [b] malicious code scans are performed with the defined frequency
- [c] real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed

**3.14.6** — Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
- [a] the system is monitored to detect attacks and indicators of potential attacks
- [b] inbound communications traffic is monitored to detect attacks and indicators of potential attacks
- [c] outbound communications traffic is monitored to detect attacks and indicators of potential attacks

**3.14.7** — Identify unauthorized use of organizational systems.
- [a] authorized use of the system is defined
- [b] unauthorized use of the system is identified

---

# Rev 2 → Rev 3 Control Crosswalk

> **CMMC 2.0 is Rev 2 only.** Rev 3 (Final, May 2024) is the forward horizon. DoD has not adopted Rev 3 for CMMC. Use this section for transition planning and to understand Rev 3 finding language — not as a substitute for Rev 2 assessment evidence.
>
> Verification status: ✅ PDF-verified | 🔵 Training-knowledge (high confidence; verify against the Rev 3 PDF for deliverables)

### Summary

| Metric | Rev 2 | Rev 3 |
|---|---|---|
| Control families | 14 | **17** (adds PL, SA, SR) |
| Total requirements | 110 | ~97 (net — many consolidations) |
| Numbering | `3.X.Y` | `03.X.Y` (leading zeros) |
| Basic / Derived distinction | Yes | Eliminated |
| ODPs (Organization-Defined Parameters) | None | **Introduced** |
| Family rename | Security Assessment (CA) | "Security Assessment and Monitoring" |

---

### 3.1 → 03.01 ACCESS CONTROL ✅

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.1.1 | Limit system access to authorized users/processes/devices | 03.01.01 | Account Management | Massively expanded — 8 parts (a–h) covering full account lifecycle |
| 3.1.2 | Limit access to permitted transactions/functions | 03.01.02 | Access Enforcement | Similar scope, refined |
| 3.1.3 | Control flow of CUI | 03.01.03 | Information Flow Enforcement | Similar scope |
| 3.1.4 | Separate duties | 03.01.04 | Separation of Duties | Slightly narrowed |
| 3.1.5 | Least privilege | 03.01.05 | Least Privilege | Split — privilege rules moved to 03.01.06/07 |
| 3.1.6 | Non-privileged accounts for non-security functions | 03.01.06 | Least Privilege – Privileged Accounts | Carved out from Rev 2 3.1.5 |
| 3.1.7 | Prevent non-privileged execution of privileged functions | 03.01.07 | Least Privilege – Privileged Functions | Carved out |
| 3.1.8 | Limit unsuccessful logon attempts | 03.01.08 | Unsuccessful Logon Attempts | Added ODPs for count and time; selection for response |
| 3.1.9 | Privacy/security notices | 03.01.09 | System Use Notification | Similar |
| 3.1.10 | Session lock | 03.01.10 | Device Lock | Added ODP for inactivity period |
| 3.1.11 | Terminate user session after defined condition | 03.01.11 | Session Termination | Added ODP for triggers |
| 3.1.12 | Monitor and control remote access | 03.01.12 | Remote Access | Consolidated with 3.1.14 and 3.1.15 |
| 3.1.13 | Crypto for remote access confidentiality | **03.01.13** | **WITHDRAWN** | Addressed by **03.13.08** |
| 3.1.14 | Route remote access via managed access points | **03.01.14** | **WITHDRAWN** | Into **03.01.12** |
| 3.1.15 | Authorize remote execution of privileged commands | **03.01.15** | **WITHDRAWN** | Into **03.01.12** |
| 3.1.16 | Authorize wireless access | 03.01.16 | Wireless Access | Consolidated with 3.1.17 |
| 3.1.17 | Protect wireless via authn/encryption | **03.01.17** | **WITHDRAWN** | Into **03.01.16** |
| 3.1.18 | Control connection of mobile devices | 03.01.18 | Access Control for Mobile Devices | Consolidated with 3.1.19 |
| 3.1.19 | Encrypt CUI on mobile devices | **03.01.19** | **WITHDRAWN** | Into **03.01.18** |
| 3.1.20 | Verify/control external system connections | 03.01.20 | Use of External Systems | Consolidated with 3.1.21; ODP added |
| 3.1.21 | Limit portable storage on external systems | **03.01.21** | **WITHDRAWN** | Into **03.01.20** |
| 3.1.22 | Control CUI on publicly accessible systems | 03.01.22 | Publicly Accessible Content | Streamlined |

**AC summary:** 22 Rev 2 → 13 active Rev 3 (+ 9 withdrawn slots).

---

### 3.2 → 03.02 AWARENESS AND TRAINING ✅

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.2.1 | Make users aware of security risks | 03.02.01 | Literacy Training and Awareness | Incorporates 3.2.3; ODPs for frequency/triggers; adds social-engineering topics |
| 3.2.2 | Train personnel for assigned security duties | 03.02.02 | Role-Based Training | Similar; ODPs for frequency/triggers |
| 3.2.3 | Insider threat awareness training | **03.02.03** | **WITHDRAWN** | Into **03.02.01** |

**AT summary:** 3 Rev 2 → 2 active Rev 3 (+ 1 withdrawn).

---

### 3.3 → 03.03 AUDIT AND ACCOUNTABILITY ✅

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.3.1 | Create and retain audit logs | 03.03.01 + 03.03.03 | Split | Event types/review → 03.03.01; record generation/retention → 03.03.03 |
| 3.3.2 | Trace actions to individual users | 03.03.02 | Audit Record Content | Expanded — 6 required content elements |
| 3.3.3 | Review and update logged events | 03.03.01 | Merged | Into 03.03.01 |
| 3.3.4 | Alert on audit logging process failure | 03.03.04 | Response to Audit Logging Process Failures | ODPs for time period and additional response actions |
| 3.3.5 | Correlate audit record review/analysis | 03.03.05 | Audit Record Review, Analysis, and Reporting | ODP for review frequency |
| 3.3.6 | Record reduction and report generation | 03.03.06 | Audit Record Reduction and Report Generation | Adds requirement to preserve original content and time ordering |
| 3.3.7 | Synchronize internal clocks with authoritative source | 03.03.07 | Time Stamps | **Scope changed** — focus on UTC-based format and granularity; explicit NTP-sync requirement softened |
| 3.3.8 | Protect audit information and tools | 03.03.08 | Protection of Audit Information | Consolidated with 3.3.9 |
| 3.3.9 | Limit management of audit logging to privileged users | **03.03.09** | **WITHDRAWN** | Into **03.03.08** |

**AU summary:** 9 Rev 2 → 8 active Rev 3 (+ 1 withdrawn). Practitioner note on **3.3.7**: Rev 3 no longer requires explicit NTP sync with an authoritative source — but for CMMC purposes (Rev 2), NTP sync is still required.

---

### 3.4 → 03.04 CONFIGURATION MANAGEMENT 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.4.1 | Baseline configurations and inventories | 03.04.01 | Baseline Configuration | Simplified — inventory handled separately |
| 3.4.2 | Establish/enforce security configuration settings | 03.04.02 | Configuration Settings | ODP added for settings |
| 3.4.3 | Track/review/approve/log changes | 03.04.03 | Configuration Change Control | Incorporates 3.4.4 (security impact analysis) |
| 3.4.4 | Analyze security impact of changes | 03.04.03 | Merged | Into 03.04.03 |
| 3.4.5 | Physical/logical access restrictions for changes | 03.04.04 | Access Restrictions for Change | Streamlined |
| 3.4.6 | Least functionality | 03.04.05 | Least Functionality | ODP for essential capabilities |
| 3.4.7 | Restrict nonessential programs/functions/ports/protocols/services | 03.04.06 | Nonessential Programs, Functions, Ports, Protocols, and Services | **15 Rev 2 sub-objectives collapsed into a single ODP-driven control** |
| 3.4.8 | Deny-by-exception or allow-by-exception software policy | 03.04.07 | Authorized Software | Reframed; ODP for allowed/denied software |
| 3.4.9 | Control and monitor user-installed software | 03.04.08 | User-Installed Software | Retained |

**CM summary:** 9 Rev 2 → 8 active Rev 3.

---

### 3.5 → 03.05 IDENTIFICATION AND AUTHENTICATION 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.5.1 | Identify users/processes/devices | 03.05.01 | Identification | Similar |
| 3.5.2 | Authenticate identities | 03.05.02 | Authenticator Management | Expanded — full authenticator lifecycle |
| 3.5.3 | MFA for privileged/non-privileged accounts | 03.05.03 | Multi-Factor Authentication | Incorporates 3.5.4; ODP for when MFA is required |
| 3.5.4 | Replay-resistant authentication mechanisms | **03.05.04** | **WITHDRAWN** | Into **03.05.03** |
| 3.5.5 | Prevent reuse of identifiers | 03.05.05 | Identifier Management | Incorporates 3.5.6 |
| 3.5.6 | Disable identifiers after inactivity | **03.05.06** | **WITHDRAWN** | Into **03.05.05** |
| 3.5.7 | Password complexity / change of characters | 03.05.07 | Password Management | Consolidates 3.5.7 through 3.5.11 |
| 3.5.8 | Prohibit password reuse | **03.05.08** | **WITHDRAWN** | Into **03.05.07** |
| 3.5.9 | Temporary password with immediate change | **03.05.09** | **WITHDRAWN** | Into **03.05.07** |
| 3.5.10 | Cryptographically-protected passwords | **03.05.10** | **WITHDRAWN** | Into **03.05.07** |
| 3.5.11 | Obscure feedback of authentication info | **03.05.11** | **WITHDRAWN** | Into **03.05.07** |

**IA summary:** 11 Rev 2 → 5 active Rev 3 (+ 6 withdrawn). Biggest family consolidation in Rev 3.

---

### 3.6 → 03.06 INCIDENT RESPONSE 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.6.1 | Operational incident-handling capability | 03.06.01 | Incident Handling | IR phases retained |
| 3.6.2 | Track, document, report incidents | 03.06.02 | Incident Monitoring, Reporting, Response Planning | Adds formal IR plan requirement |
| 3.6.3 | Test incident response capability | 03.06.03 | Incident Response Testing | ODP for testing frequency |

**IR summary:** 3 → 3, no withdrawals.

---

### 3.7 → 03.07 MAINTENANCE 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.7.1 | Perform maintenance | 03.07.01 | Controlled Maintenance | Incorporates 3.7.2 |
| 3.7.2 | Controls on maintenance tools/techniques/personnel | **03.07.02** | **WITHDRAWN** | Into **03.07.01** |
| 3.7.3 | Sanitize off-site maintenance equipment | 03.07.02 | Maintenance Tools | Renumbered; sanitization retained |
| 3.7.4 | Check diagnostic/test media for malicious code | 03.07.03 | (Nonlocal Maintenance / Media Check) | ODP added |
| 3.7.5 | MFA for nonlocal maintenance via external connections | 03.07.04 | Nonlocal Maintenance | MFA retained; ODP for authentication mechanisms |
| 3.7.6 | Supervise unauthorized maintenance personnel | 03.07.05 | Maintenance Personnel | Similar |

**MA summary:** 6 → 5 active (+ 1 withdrawn).

---

### 3.8 → 03.08 MEDIA PROTECTION 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.8.1 | Protect media containing CUI | 03.08.01 | Media Protection | Incorporates 3.8.2 |
| 3.8.2 | Limit access to CUI on media | **03.08.02** | **WITHDRAWN** | Into **03.08.01** |
| 3.8.3 | Sanitize/destroy media before disposal/reuse | 03.08.02 | Media Sanitization | Renumbered; ODP for sanitization methods |
| 3.8.4 | Mark media with CUI markings and distribution limits | 03.08.03 | Media Marking | Similar |
| 3.8.5 | Control access to media and accountability during transport | 03.08.04 | Media Transport | ODP for protection during transport |
| 3.8.6 | Crypto for CUI on digital media during transport | **03.08.05** | **WITHDRAWN** | Addressed by **03.13.08** |
| 3.8.7 | Control use of removable media | 03.08.05 | Media Use | Renumbered; ODP for restrictions |
| 3.8.8 | Prohibit portable storage without identifiable owner | **03.08.06** | **WITHDRAWN** | Into **03.08.05** |
| 3.8.9 | Protect confidentiality of backup CUI | 03.08.06 | Media Downgrading | Reframed |

**MP summary:** 9 → 6 active (+ 3 withdrawn). **Key change:** transport-encryption requirement moves to SC family (03.13.08).

---

### 3.9 → 03.09 PERSONNEL SECURITY 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.9.1 | Screen individuals before authorizing access | 03.09.01 | Personnel Screening | ODP for screening criteria |
| 3.9.2 | Protect systems during/after personnel actions | 03.09.02 | Personnel Termination and Transfer | Explicit about both termination and transfer |

**PS summary:** 2 → 2, no withdrawals.

---

### 3.10 → 03.10 PHYSICAL PROTECTION 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.10.1 | Limit physical access to authorized individuals | 03.10.01 | Physical Access Authorizations | Authorization process now explicit |
| 3.10.2 | Protect and monitor physical facility/infrastructure | 03.10.02 | Physical Access Control | Monitoring split into separate concern |
| 3.10.3 | Escort visitors / monitor activity | 03.10.03 | Visitor Control | ODP for visitor log retention |
| 3.10.4 | Maintain audit logs of physical access | 03.10.04 | (Within broader physical access controls — verify) | Reorganized |
| 3.10.5 | Control and manage physical access devices | 03.10.05 | Physical Access Devices | ODP for inventory frequency |
| 3.10.6 | Safeguarding measures for CUI at alternate work sites | 03.10.06 | Alternate Work Sites | Adds compromise detection requirement |

**PE summary:** 6 → 6, no withdrawals (reorganized within family).

---

### 3.11 → 03.11 RISK ASSESSMENT 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.11.1 | Periodically assess risk | 03.11.01 | Risk Assessment | ODP for frequency; documents results |
| 3.11.2 | Scan for vulnerabilities | 03.11.02 | Vulnerability Monitoring and Scanning | Expanded; ODPs for scan frequency, tools, techniques; remediation tracking added |
| 3.11.3 | Remediate vulnerabilities | 03.11.03 | Vulnerability Remediation | ODP for remediation timeframes by severity |

**RA summary:** 3 → 3, no withdrawals.

---

### 3.12 → 03.12 SECURITY ASSESSMENT AND MONITORING 🔵
*(Renamed from "Security Assessment" in Rev 2.)*

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.12.1 | Assess effectiveness of security controls | 03.12.01 | Security Assessments | ODP for frequency; more explicit scope |
| 3.12.2 | POA&M development and implementation | 03.12.02 | Plan of Action and Milestones | ODP for POA&M update frequency |
| 3.12.3 | Monitor security controls on ongoing basis | 03.12.03 | Continuous Monitoring | Expanded — monitoring strategy/program/frequency now explicit |
| 3.12.4 | SSP development, documentation, periodic update | **Moved** | **→ 03.15.02** (Planning family) | **SSP requirement relocated** to new PL family |

**CA summary:** 4 → 3 active in the CA family; SSP requirement migrated to the new PL family.

---

### 3.13 → 03.13 SYSTEM AND COMMUNICATIONS PROTECTION 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.13.1 | Monitor/control/protect communications at boundaries | 03.13.01 | Boundary Protection | ODP for external/key internal boundaries |
| 3.13.2 | Architectural designs, software dev techniques, systems eng | 03.13.02 | Security Engineering Principles | Similar |
| 3.13.3 | Separate user and system management functionality | 03.13.03 | Security Function Isolation | Similar |
| 3.13.4 | Prevent unauthorized info transfer via shared resources | 03.13.04 | (Reframed) | May be combined/reframed in Rev 3 |
| 3.13.5 | Subnetworks for publicly accessible components | 03.13.05 | Boundary Protection – Publicly Accessible Systems | Similar |
| 3.13.6 | Deny network communications by default | 03.13.06 | Deny by Default | Similar |
| 3.13.7 | Prevent split tunneling | 03.13.07 | Boundary Protection – Split Tunneling | Similar |
| 3.13.8 | Crypto to prevent unauthorized disclosure during transmission | 03.13.08 | Cryptographic Protection | **Consolidation target** — 3.1.13 and 3.8.6 point here |
| 3.13.9 | Terminate network connections after inactivity | 03.13.09 | Network Disconnect | ODP for inactivity period |
| 3.13.10 | Establish/manage cryptographic keys | 03.13.10 | Cryptographic Key Management | Similar |
| 3.13.11 | Employ FIPS-validated cryptography for CUI | 03.13.11 | Cryptographic Protection – FIPS | **Changed** — Rev 3 uses ODP "organization-defined types of cryptography." **For CMMC purposes, FIPS 140-2/140-3 validation is still the operational expectation.** Do not advise clients that Rev 3 weakens this. |
| 3.13.12 | Prohibit remote activation of collaborative computing devices | 03.13.12 | Collaborative Computing Devices and Applications | ODP for authorized exceptions |
| 3.13.13 | Control and monitor mobile code | 03.13.13 | Mobile Code | ODP for mobile code technologies |
| 3.13.14 | Control and monitor VoIP | 03.13.14 | Voice Over IP Technologies | ODP for VoIP technologies |
| 3.13.15 | Protect authenticity of communications sessions | 03.13.15 | Communications Authenticity | Similar |
| 3.13.16 | Protect confidentiality of CUI at rest | 03.13.16 | CUI at Rest | ODP for types of cryptography |

**SC summary:** 16 → 16, no withdrawals.

---

### 3.14 → 03.14 SYSTEM AND INFORMATION INTEGRITY 🔵

| Rev 2 | Rev 2 title | Rev 3 | Status | Notes |
|---|---|---|---|---|
| 3.14.1 | Identify, report, correct system flaws | 03.14.01 | Flaw Remediation | ODP for remediation timeframes by severity |
| 3.14.2 | Malicious code protection at designated locations | 03.14.02 | Malicious Code Protection | ODP for mechanisms and locations |
| 3.14.3 | Monitor security alerts/advisories and take action | 03.14.03 | Security Alerts, Advisories, and Directives | Requires internal dissemination |
| 3.14.4 | Update malicious code protection on new releases | **03.14.04** | **WITHDRAWN** | Into **03.14.02** |
| 3.14.5 | Periodic and real-time scans | 03.14.04 | Malicious Code Protection – Scans | Renumbered |
| 3.14.6 | Monitor inbound/outbound traffic for attacks | 03.14.05 | System Monitoring | Expanded; ODP for monitoring activities |
| 3.14.7 | Identify unauthorized use of systems | 03.14.06 | System Monitoring – Unauthorized Use | Possibly incorporated into 03.14.05 |

**SI summary:** 7 → 6 active (+ 1 withdrawn).

---

## New Families in Rev 3 (No Rev 2 Equivalent)

### 03.15 PLANNING (PL) — NEW 🔵

Picks up planning requirements that were implicit or in other Rev 2 families.

| Rev 3 | Title | Origin |
|---|---|---|
| 03.15.01 | Policy and Procedures | New — formerly NFO (`XX-1` type) controls that were excluded from Rev 2 |
| 03.15.02 | System Security Plan | **From Rev 2 3.12.4** — relocated from CA family |
| 03.15.03 | Rules of Behavior | New — system use rules for users |
| 03.15.04 | (Additional planning requirements) | New additions from 800-53B moderate baseline |

**Practitioner note:** SSP migration from 3.12.4 → 03.15.02 means Rev 3 assessors will look at the SSP as a planning artifact, not a security assessment artifact. SSP content requirements are retained and expanded.

---

### 03.16 SYSTEM AND SERVICES ACQUISITION (SA) — NEW 🔵

Requirements for secure acquisition of systems, components, and services.

| Rev 3 | Title | Notes |
|---|---|---|
| 03.16.01 | Security Engineering Principles for Development | Software/system development security |
| 03.16.02 | Unsupported System Components | EOL/unsupported software management |
| 03.16.03 | External System Services | Contracts/agreements with cloud/MSP providers — related to Rev 2 3.1.20 |
| 03.16.04 | (Additional SA requirements) | Acquisition documentation, security requirements in contracts |

**Practitioner note:** **03.16.03** is particularly relevant for clients using cloud providers — it requires verifying that service providers implement required controls. Formalizes what was implied in Rev 2 3.1.20.

---

### 03.17 SUPPLY CHAIN RISK MANAGEMENT (SR) — NEW 🔵

| Rev 3 | Title | Notes |
|---|---|---|
| 03.17.01 | Supply Chain Risk Management Plan | Develop and maintain SCRM plan |
| 03.17.02 | Acquisition Strategies, Tools, and Methods | Address supply chain risks during acquisition |
| 03.17.03 | Supplier Reviews | Assess suppliers/vendors providing system components |

**Practitioner note:** Entirely new for nonfederal contractors. CMMC 2.0 (Rev 2-based) has no SR family. When/if CMMC adopts Rev 3, SCRM becomes a new assessment domain — notable for clients with complex vendor ecosystems.

---

## Quick Reference: Withdrawn Rev 2 Controls

| Rev 2 Control | Disposition in Rev 3 |
|---|---|
| 3.1.13 | 03.01.13 WITHDRAWN — addressed by 03.13.08 |
| 3.1.14 | 03.01.14 WITHDRAWN — into 03.01.12 |
| 3.1.15 | 03.01.15 WITHDRAWN — into 03.01.12 |
| 3.1.17 | 03.01.17 WITHDRAWN — into 03.01.16 |
| 3.1.19 | 03.01.19 WITHDRAWN — into 03.01.18 |
| 3.1.21 | 03.01.21 WITHDRAWN — into 03.01.20 |
| 3.2.3 | 03.02.03 WITHDRAWN — into 03.02.01 |
| 3.3.3 | Merged into 03.03.01 (no "withdrawn" slot) |
| 3.3.9 | 03.03.09 WITHDRAWN — into 03.03.08 |
| 3.4.4 | Merged into 03.04.03 (no "withdrawn" slot) |
| 3.5.4 | 03.05.04 WITHDRAWN — into 03.05.03 |
| 3.5.6 | 03.05.06 WITHDRAWN — into 03.05.05 |
| 3.5.8 | 03.05.08 WITHDRAWN — into 03.05.07 |
| 3.5.9 | 03.05.09 WITHDRAWN — into 03.05.07 |
| 3.5.10 | 03.05.10 WITHDRAWN — into 03.05.07 |
| 3.5.11 | 03.05.11 WITHDRAWN — into 03.05.07 |
| 3.7.2 | 03.07.02 WITHDRAWN — into 03.07.01 |
| 3.8.2 | 03.08.02 WITHDRAWN — into 03.08.01 |
| 3.8.6 | 03.08.06 WITHDRAWN — addressed by 03.13.08 |
| 3.8.8 | 03.08.08 WITHDRAWN — into 03.08.07 |
| 3.12.4 | Relocated to 03.15.02 (PL family) |
| 3.14.4 | 03.14.04 WITHDRAWN — into 03.14.02 |

---

## ODPs — Organization-Defined Parameters (Rev 3 concept)

Rev 3 introduces ODPs — values that the organization (or contracting federal agency) must define. Once defined, they become **assessable scope**. Common categories:

- **Time periods** — inactivity timeouts, audit-failure response windows, scan frequency.
- **Roles/personnel** — who is authorized for privileged accounts, who responds to logon-attempt thresholds.
- **Technical parameters** — number of invalid logon attempts allowed, configuration settings, types of cryptography.
- **Security requirements** — those imposed on external systems, prohibited services/ports/protocols.

**Pre-adoption planning for clients:**

1. Stand up an ODP register (separate document or SSP appendix).
2. Get management approval for each value.
3. Implement controls using those defined values.
4. Be ready to be assessed against the values you stated — they become binding.

If the contracting agency specifies ODP values via contract or policy, those govern. Otherwise the contractor defines its own.

---

## Rev 2 vs. Rev 3 — Which Applies Right Now

**As of 2026-05-17:**

- **CMMC 2.0 assessments → Rev 2 only.** All 110 Rev 2 controls and 320 assessment objectives apply.
- **DFARS 252.204-7012** requires Rev 2 compliance. No DoD contract language has adopted Rev 3.
- **SPRS scoring** uses the 110-point Rev 2 framework.
- **C3PAO assessments** assess against Rev 2 practices (CMMC Level 2 = 110 practices).

**Forward planning:**

- DoD has not announced a CMMC adoption timeline for Rev 3.
- When adopted, control count drops from 110 to ~97, but the addition of PL/SA/SR families likely increases total requirement counts.
- ODP values become assessable scope.
- Clients implementing MFA via platform tools (Entra ID, Okta) benefit from IA consolidation (one implementation, one control).

### Reverse-Mapping (Rev 3 finding → Rev 2 impact)

When a Rev 3 finding references a specific control, map back to Rev 2 to understand CMMC impact:

| If Rev 3 finds an issue with... | Check Rev 2 controls... |
|---|---|
| 03.01.01 Account Management | 3.1.1, 3.1.2 |
| 03.01.12 Remote Access | 3.1.12, 3.1.14, 3.1.15 |
| 03.01.16 Wireless Access | 3.1.16, 3.1.17 |
| 03.01.18 Mobile Device AC | 3.1.18, 3.1.19 |
| 03.01.20 External Systems | 3.1.20, 3.1.21 |
| 03.02.01 Literacy Training | 3.2.1, 3.2.3 |
| 03.03.01 Event Logging | 3.3.1 (partial), 3.3.3 |
| 03.03.08 Audit Protection | 3.3.8, 3.3.9 |
| 03.05.03 MFA | 3.5.3, 3.5.4 |
| 03.05.07 Password Management | 3.5.7, 3.5.8, 3.5.9, 3.5.10, 3.5.11 |
| 03.13.08 Cryptographic Protection | 3.1.13, 3.8.6, 3.13.8 |
| 03.15.02 System Security Plan | 3.12.4 |

### Key Risk: Clients Who Know Rev 3 But Aren't Rev 2 Ready

Some clients have implemented Rev 3-style controls and believe they're covered. **Rev 2 has specific requirements that Rev 3 softened with ODPs** — for current CMMC assessments, the **Rev 2** language governs:

- **3.3.7 (clock sync)** — Rev 2 requires NTP sync with an authoritative source; Rev 3 softened. NTP sync is required for CMMC.
- **3.4.8 (allow/deny software)** — Rev 2 requires an explicit policy choice and implementation. "We'll define an ODP later" does not satisfy Rev 2.
- **3.5.3 (MFA)** — Rev 2 requires MFA for network access to non-privileged accounts. No ODP wiggle room in Rev 2.
- **3.13.11 (FIPS crypto)** — Rev 2 says "FIPS-validated", flat. Rev 3 uses an ODP. For CMMC, FIPS 140-2/140-3 validation is mandatory.

---

## High-Complexity Controls (Assessment Effort Indicators)

Controls with 5+ assessment objectives drive the bulk of assessment effort and evidence burden:

| Control | Objectives | Key evidence focus |
|---|---|---|
| 3.4.7 | **15** | Port/protocol/service documentation (most objectives of any control) |
| 3.13.1 | 8 | Network boundary definition + monitoring/control/protection |
| 3.4.5 | 8 | Change control access restrictions (physical AND logical) |
| 3.12.4 | 8 | SSP completeness (boundary, environment, connections, update freq) |
| 3.6.1 | 7 | IRP covering all IR phases |
| 3.6.2 | 6 | Incident reporting chain (internal + external) |
| 3.1.1 | 6 | User/device/process inventory + access restrictions |
| 3.1.20 | 6 | External system agreements + connection controls |
| 3.3.1 | 6 | Audit log configuration + retention policy |
| 3.3.8 | 6 | Log protection controls |
| 3.4.1 | 6 | Baseline config + asset inventory |
| 3.13.2 | 6 | Secure architecture documentation |
| 3.14.1 | 6 | Flaw ID/report/correct with defined timeframes |
| 3.1.3 | 5 | Data flow diagrams + flow enforcement |
| 3.1.22 | 5 | Public web content review process |

---

## Common POA&M Objective-Split Patterns

When clients have partial implementations, these objectives are typically split across a POA&M (some Satisfied, some Other Than Satisfied — assuming the practice is POA&M-eligible per `cmmc-expert` §11):

- **3.4.7**: Often `[a]–[f]` Satisfied (programs/functions); `[g]–[o]` (ports/protocols/services) on POA&M.
- **3.3.1**: Often `[a]–[d]` Satisfied (log creation/content); `[e]–[f]` (retention) on POA&M.
- **3.5.3**: Often `[b]–[c]` Satisfied (MFA on privileged); `[d]` (network MFA for non-privileged) on POA&M.
- **3.12.4**: Often `[a]–[c]` Satisfied (SSP exists); `[d]–[h]` (specific elements) on POA&M.
- **3.1.12**: Often `[a]–[b]` Satisfied (types defined); `[c]–[d]` (active monitoring) on POA&M.

For POA&M eligibility rules, point weights, and the 180-day window, see `cmmc-expert` §10–§11.

---

## Authoritative Sources

- **NIST SP 800-171A** (June 2018) — assessment procedures for 800-171 Rev 2 (this skill's primary source).
- **NIST SP 800-171 Rev 2** — https://doi.org/10.6028/NIST.SP.800-171r2
- **NIST SP 800-171 Rev 3** (Final, May 2024) — forward horizon; source of the crosswalk.
- **NIST SP 800-171A Rev 3** — assessment procedures for Rev 3 (consult directly for Rev 3 AO-level language).
- **NIST SP 800-53B** — parent moderate baseline that informed Rev 3 expansions.
- **32 CFR Part 170** — CMMC program rule.
- **DFARS 252.204-7012 / -7019 / -7020 / -7021 / -7025** — contract clauses.
- **CMMC Assessment Guide — Level 2** (current version on dodcio.defense.gov).
- **CMMC Scoping Guide — Level 2**.
- **CMMC Scoring Methodology**.

Primary locations: `dodcio.defense.gov/CMMC/`, `cyber.mil`, `cyberab.org`, `sprs.csd.disa.mil`.

---

## Capabilities

This skill supports:

- Looking up the verbatim text of any Rev 2 assessment objective by ID (e.g., `3.1.1[c]`, `3.13.11[a]`)
- Counting and listing AOs per family for assessment planning
- Determining what evidence types support a given AO (via Examine/Interview/Test method mapping)
- Mapping any Rev 2 control to its Rev 3 equivalent (or noting that it was withdrawn / merged)
- Identifying which Rev 2 controls are gone in Rev 3 and where their content lives now
- Distinguishing Rev 3 ODP-driven language from Rev 2 hard requirements
- Reverse-mapping a Rev 3 finding to its Rev 2 impact on a current CMMC assessment
- Identifying high-complexity controls for assessment scoping
- Spotting common objective-split POA&M patterns

For program-level CMMC topics — SPRS scoring, POA&M rules, scoping, ESP/CSP, C3PAO lifecycle, annual affirmation, False Claims Act risk — use the `cmmc-expert` skill instead.