CMMC 2.0 Self-Assessment Tool

Limit access to authorized users

AC.L1-3.1.1 — Limit information system access to authorized users, processes, and devices.

Limit access to authorized transactions

AC.L1-3.1.2 — Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Least privilege enforced

AC.L2-3.1.5 — Employ the principle of least privilege, including for specific security functions and privileged accounts.

Non-privileged accounts used for non-security functions

AC.L2-3.1.7 — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Security awareness training program

AT.L2-3.2.1 — Ensure that managers, system administrators, and users are made aware of the security risks associated with their activities.

Audit logs created and retained

AU.L2-3.3.1 — Create and retain system audit logs and records to enable monitoring, analysis, investigation, and reporting.

Least functionality (PAM/allowlisting)

CM.L2-3.4.6 — Employ the principle of least functionality. Application allowlisting (PAM) directly satisfies this control.

Application execution policy enforced

CM.L2-3.4.8 — Apply deny-all/permit-by-exception (allowlisting) policy. Allowlisting via PAM is the modern approach.

Users uniquely identified

IA.L1-3.5.1 — Identify information system users, processes acting on behalf of users, or devices.

MFA for privileged and remote access

IA.L2-3.5.3 — Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

Incident response capability established

IR.L2-3.6.1 — Establish an operational incident-handling capability for organizational systems.

Media containing CUI sanitized before disposal

MP.L1-3.8.3 — Sanitize or destroy information system media containing FCI before disposal or release for reuse.

Physical access to systems controlled

PE.L1-3.10.1 — Limit physical access to organizational information systems and equipment to authorized individuals.

Risk assessments performed periodically

RA.L2-3.11.1 — Periodically assess the risk to organizational operations resulting from the operation of organizational systems.

Security controls assessed periodically

CA.L2-3.12.1 — Periodically assess the security controls in organizational systems to determine if the controls are effective.

Communications monitored at boundaries

SC.L1-3.13.1 — Monitor, control, and protect communications at the external boundaries and key internal boundaries of organizational systems.

Information flow control between domains

SC.L2-3.13.4 — Prevent unauthorized information transfer via shared system resources. Application ringfencing (PAM) directly satisfies this control.

System flaws identified and remediated

SI.L1-3.14.1 — Identify, report, and correct information and information system flaws in a timely manner.

Security alerts and advisories monitored

SI.L2-3.14.3 — Monitor system security alerts and advisories and take action in response.