CMMC Level 3 control library
Every control CMDash tracks for CMMC Level 3, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
24 controls10 families24 mapped to other frameworksNo published text extract yet
Families
Access Control · 2
| AC.L3-3.1.2e | Restrict access to organization-issued resources Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| AC.L3-3.1.3e | Secure transfer between security domains Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
Awareness & Training · 2
| AT.L3-3.2.1e | Threat-focused awareness training Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| AT.L3-3.2.2e | Role-tailored practical exercises Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
Configuration Management · 3
| CM.L3-3.4.1e | Authoritative source of approved components Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| CM.L3-3.4.2e | Automated detection of unauthorized components Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| CM.L3-3.4.3e | Automated component discovery and inventory Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
Identification & Authentication · 2
| IA.L3-3.5.1e | Cryptographic bidirectional authentication Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| IA.L3-3.5.3e | Block unknown or unhealthy components Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
Incident Response · 2
| IR.L3-3.6.1e | 24/7 security operations capability Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| IR.L3-3.6.2e | Incident response team deployable within 24 hours Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
Personnel Security · 1
| PS.L3-3.9.2e | Protect systems on adverse personnel information Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
Risk Assessment · 7
| RA.L3-3.11.1e | Threat intelligence in risk assessment Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| RA.L3-3.11.2e | Ongoing cyber threat hunting Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| RA.L3-3.11.3e | Advanced automation and analytics for risk Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| RA.L3-3.11.4e | Document security solution rationale in the SSP Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| RA.L3-3.11.5e | Annual assessment of security solution effectiveness Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| RA.L3-3.11.6e | Assess and monitor supply chain risk Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| RA.L3-3.11.7e | Supply chain risk management plan Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
Security Assessment · 1
| CA.L3-3.12.1e | Annual penetration testing Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
System & Communications Protection · 1
| SC.L3-3.13.4e | Physical or logical isolation Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
System & Information Integrity · 3
| SI.L3-3.14.1e | Root-of-trust software integrity verification Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| SI.L3-3.14.3e | Specialized assets in scope or segregated Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
| SI.L3-3.14.6e | Threat indicators guide detection and hunting Maps to CMMC Level 2, NIST Cybersecurity Framework (1.1, legacy) |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for CMMC Level 3 2.0, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.