Skip to content
ExpertCMMC

CMMC 2.13

CMMC Practices

Each practice, grouped by domain and cross-referenced to the NIST controls that support it.

All levelsLevel 1 · FoundationalLevel 2 · AdvancedLevel 3 · Expert

24 practices

AC

Access Control2
AC.L3-3.1.2eOrganizationally Controlled AssetsL3AC.L3-3.1.3eSecured Information TransferL3

AT

Awareness & Training2
AT.L3-3.2.1eAdvanced Threat AwarenessL3AT.L3-3.2.2ePractical Training ExercisesL3

CM

Configuration Management3
CM.L3-3.4.1eAuthoritative RepositoryL3CM.L3-3.4.2eAutomated Detection & RemediationL3CM.L3-3.4.3eAutomated InventoryL3

IA

Identification & Authentication2
IA.L3-3.5.1eBidirectional AuthenticationL3IA.L3-3.5.3eBlock Untrusted AssetsL3

IR

Incident Response2
IR.L3-3.6.1eSecurity Operations CenterL3IR.L3-3.6.2eCyber Incident Response TeamL3

PS

Personnel Security1
PS.L3-3.9.2eAdverse InformationL3

RA

Risk Assessment7
RA.L3-3.11.1eThreat-Informed Risk AssessmentL3RA.L3-3.11.2eThreat HuntingL3RA.L3-3.11.3eAdvanced Risk IdentificationL3RA.L3-3.11.4eSecurity Solution RationaleL3RA.L3-3.11.5eSecurity Solution EffectivenessL3RA.L3-3.11.6eSupply Chain Risk ResponseL3RA.L3-3.11.7eSupply Chain Risk PlanL3

CA

Security Assessment1
CA.L3-3.12.1ePenetration TestingL3

SC

System & Communications Protection1
SC.L3-3.13.4eIsolationL3

SI

System & Information Integrity3
SI.L3-3.14.1eIntegrity VerificationL3SI.L3-3.14.3eSpecialized Asset SecurityL3SI.L3-3.14.6eThreat-Guided Intrusion DetectionL3

Looking for the underlying standards? Browse NIST SP 800-171, 800-172 & 800-53 →