CMMC Level 2 control library
Every control CMDash tracks for CMMC Level 2, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
110 controls14 families66 mapped to other frameworks110 with authoritative text
Families
Access Control · 22Awareness & Training · 3Audit & Accountability · 9Configuration Management · 9Identification & Authentication · 11Incident Response · 3Maintenance · 6Media Protection · 9Personnel Security · 2Physical Protection · 6Risk Assessment · 3Security Assessment · 4System & Communications Protection · 16System & Information Integrity · 7
Access Control · 22
| AC.L2-3.1.1 | Authorized access Maps to CMMC Level 1, NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.2 | Transaction & function control Maps to CMMC Level 1, NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.3 | Control CUI flow Maps to CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.4 | Separation of duties Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.5 | Least privilege Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.6 | Non-privileged account use Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.7 | Privileged functions Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.8 | Unsuccessful logon attempts Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.9 | Privacy & security notices |
| AC.L2-3.1.10 | Session lock |
| AC.L2-3.1.11 | Session termination |
| AC.L2-3.1.12 | Control remote access Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.13 | Remote access confidentiality Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.14 | Remote access routing Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.15 | Privileged remote access |
| AC.L2-3.1.16 | Wireless access authorization |
| AC.L2-3.1.17 | Wireless access protection Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.18 | Mobile device connection |
| AC.L2-3.1.19 | Encrypt CUI on mobile Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.20 | External connections Maps to CMMC Level 1, CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| AC.L2-3.1.21 | Portable storage |
| AC.L2-3.1.22 | Control public information Maps to CMMC Level 1, NIST Cybersecurity Framework (1.1, legacy) |
Awareness & Training · 3
| AT.L2-3.2.1 | Role-based risk awareness Maps to CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| AT.L2-3.2.2 | Role-based training Maps to CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| AT.L2-3.2.3 | Insider threat awareness Maps to NIST Cybersecurity Framework (1.1, legacy) |
Audit & Accountability · 9
| AU.L2-3.3.1 | System auditing Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AU.L2-3.3.2 | User accountability Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AU.L2-3.3.3 | Event review Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AU.L2-3.3.4 | Audit failure alerting Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AU.L2-3.3.5 | Audit correlation Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AU.L2-3.3.6 | Reduction & reporting |
| AU.L2-3.3.7 | Authoritative time source |
| AU.L2-3.3.8 | Audit protection Maps to NIST Cybersecurity Framework (1.1, legacy) |
| AU.L2-3.3.9 | Audit management |
Configuration Management · 9
| CM.L2-3.4.1 | System baselining Maps to CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| CM.L2-3.4.2 | Security configuration enforcement Maps to NIST Cybersecurity Framework (1.1, legacy) |
| CM.L2-3.4.3 | System change management Maps to NIST Cybersecurity Framework (1.1, legacy) |
| CM.L2-3.4.4 | Security impact analysis |
| CM.L2-3.4.5 | Access restrictions for change |
| CM.L2-3.4.6 | Least functionality Maps to NIST Cybersecurity Framework (1.1, legacy) |
| CM.L2-3.4.7 | Nonessential functionality Maps to NIST Cybersecurity Framework (1.1, legacy) |
| CM.L2-3.4.8 | Application execution policy Maps to NIST Cybersecurity Framework (1.1, legacy) |
| CM.L2-3.4.9 | User-installed software |
Identification & Authentication · 11
| IA.L2-3.5.1 | Identification Maps to CMMC Level 1, NIST Cybersecurity Framework (1.1, legacy) |
| IA.L2-3.5.2 | Authentication Maps to CMMC Level 1, CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| IA.L2-3.5.3 | Multi-factor authentication Maps to NIST Cybersecurity Framework (1.1, legacy) |
| IA.L2-3.5.4 | Replay-resistant authentication |
| IA.L2-3.5.5 | Identifier reuse prevention |
| IA.L2-3.5.6 | Identifier disabling |
| IA.L2-3.5.7 | Password complexity Maps to NIST Cybersecurity Framework (1.1, legacy) |
| IA.L2-3.5.8 | Password reuse prohibition |
| IA.L2-3.5.9 | Temporary passwords |
| IA.L2-3.5.10 | Cryptographic key-based auth |
| IA.L2-3.5.11 | Obscure feedback |
Incident Response · 3
| IR.L2-3.6.1 | Incident handling Maps to CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| IR.L2-3.6.2 | Incident reporting Maps to NIST Cybersecurity Framework (1.1, legacy) |
| IR.L2-3.6.3 | Incident response testing Maps to NIST Cybersecurity Framework (1.1, legacy) |
Maintenance · 6
| MA.L2-3.7.1 | Perform maintenance Maps to NIST Cybersecurity Framework (1.1, legacy) |
| MA.L2-3.7.2 | System maintenance control |
| MA.L2-3.7.3 | Equipment sanitization |
| MA.L2-3.7.4 | Media inspection |
| MA.L2-3.7.5 | Nonlocal maintenance Maps to NIST Cybersecurity Framework (1.1, legacy) |
| MA.L2-3.7.6 | Maintenance personnel |
Media Protection · 9
| MP.L2-3.8.1 | Media protection Maps to NIST Cybersecurity Framework (1.1, legacy) |
| MP.L2-3.8.2 | Media access |
| MP.L2-3.8.3 | Media disposal Maps to CMMC Level 1, NIST Cybersecurity Framework (1.1, legacy) |
| MP.L2-3.8.4 | Media markings |
| MP.L2-3.8.5 | Media accountability |
| MP.L2-3.8.6 | Portable storage encryption Maps to NIST Cybersecurity Framework (1.1, legacy) |
| MP.L2-3.8.7 | Removable media Maps to NIST Cybersecurity Framework (1.1, legacy) |
| MP.L2-3.8.8 | Shared media |
| MP.L2-3.8.9 | Protect backup CUI |
Personnel Security · 2
| PS.L2-3.9.1 | Screen individuals |
| PS.L2-3.9.2 | CUI during personnel actions Maps to CMMC Level 3 |
Physical Protection · 6
| PE.L2-3.10.1 | Limit physical access Maps to CMMC Level 1, NIST Cybersecurity Framework (1.1, legacy) |
| PE.L2-3.10.2 | Monitor facility Maps to NIST Cybersecurity Framework (1.1, legacy) |
| PE.L2-3.10.3 | Escort visitors Maps to CMMC Level 1 |
| PE.L2-3.10.4 | Physical access logs Maps to CMMC Level 1 |
| PE.L2-3.10.5 | Manage physical access Maps to CMMC Level 1 |
| PE.L2-3.10.6 | Alternative work sites |
Risk Assessment · 3
| RA.L2-3.11.1 | Risk assessments Maps to CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| RA.L2-3.11.2 | Vulnerability scan Maps to NIST Cybersecurity Framework (1.1, legacy) |
| RA.L2-3.11.3 | Vulnerability remediation Maps to NIST Cybersecurity Framework (1.1, legacy) |
Security Assessment · 4
| CA.L2-3.12.1 | Security control assessment Maps to CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| CA.L2-3.12.2 | Plan of action Maps to NIST Cybersecurity Framework (1.1, legacy) |
| CA.L2-3.12.3 | Continuous monitoring Maps to NIST Cybersecurity Framework (1.1, legacy) |
| CA.L2-3.12.4 | System security plans |
System & Communications Protection · 16
| SC.L2-3.13.1 | Boundary protection Maps to CMMC Level 1, CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| SC.L2-3.13.2 | Architectural designs |
| SC.L2-3.13.3 | Role separation |
| SC.L2-3.13.4 | Shared resource control |
| SC.L2-3.13.5 | Public-access system separation Maps to CMMC Level 1 |
| SC.L2-3.13.6 | Network communication by exception |
| SC.L2-3.13.7 | Split tunneling |
| SC.L2-3.13.8 | CUI encryption in transit Maps to NIST Cybersecurity Framework (1.1, legacy) |
| SC.L2-3.13.9 | Network disconnect |
| SC.L2-3.13.10 | Cryptographic key management |
| SC.L2-3.13.11 | CUI encryption at rest Maps to NIST Cybersecurity Framework (1.1, legacy) |
| SC.L2-3.13.12 | Collaborative device control |
| SC.L2-3.13.13 | Mobile code |
| SC.L2-3.13.14 | VoIP |
| SC.L2-3.13.15 | Session authenticity |
| SC.L2-3.13.16 | CUI at rest |
System & Information Integrity · 7
| SI.L2-3.14.1 | Flaw remediation Maps to CMMC Level 1, CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| SI.L2-3.14.2 | Malicious code protection Maps to CMMC Level 1, NIST Cybersecurity Framework (1.1, legacy) |
| SI.L2-3.14.3 | Security alerts Maps to NIST Cybersecurity Framework (1.1, legacy) |
| SI.L2-3.14.4 | Update malicious code protection Maps to CMMC Level 1 |
| SI.L2-3.14.5 | System & file scanning Maps to CMMC Level 1 |
| SI.L2-3.14.6 | Monitor communications Maps to CMMC Level 3, NIST Cybersecurity Framework (1.1, legacy) |
| SI.L2-3.14.7 | Identify unauthorized use Maps to NIST Cybersecurity Framework (1.1, legacy) |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for CMMC Level 2 2.0, published from a build-time export rather than read from any customer’s workspace. Control text is quoted verbatim from NIST SP 800-171 Rev 2 (NIST CPRT), which is in the public domain. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.