How is Athena different from Secureframe, Strike Graph, Paramify, Risk Cognizance, SMPL-C, or Kiteworks?

Those platforms optimize the contractor's readiness workflow — live SPRS tracking, AI controls dashboards, fast SSP/POA&M drafting, continuous control monitoring, LLM document analysis, or CUI data movement. Athena focuses on the assessor-facing submission layer: SAR narrative drafting, eMASS-ready JSON packaging, OSCAL output, and SHA-256 integrity provenance (SHA-256 + chain-of-custody) for every artifact a C3PAO or DIBCAC assessor opens on engagement day.

Does Athena replace Secureframe, Strike Graph, or Paramify?

No — Athena is the assessor-side submission layer that sits on top of whatever readiness GRC you already use. Bring evidence from any tool; Athena drafts the SAR, generates the POA&M with prioritized remediation, scores SPRS, and exports eMASS / OSCAL packages with provenance.

What does Athena export for a CMMC Level 2 assessment?

SAR draft with citations, POA&M with milestone estimates, SPRS scoring package, eMASS-ready JSON, OSCAL package, evidence binder with SHA-256 hashes, and a chain-of-custody manifest signed for the assessor.

Evidence Collection

CMMC Evidence Collection: What Assessors Actually Want to See

CMMC evidence collection is the work most teams underestimate. The standard is not "we have a policy" — it is a defensible chain from each of the 320 NIST 800-171A objectives back to the policy, procedure, configuration, log, screenshot, or interview that proves the control is operating. This page covers what evidence C3PAOs actually accept, the freshness windows that matter, and how to map evidence to objectives without losing the trail.

See the Assessment Pack Free CMMC Quick Score

Current CMMC status — as of 8 September 2026

The Phase II procurement transition was suspended on 13 July 2026. Phase I self-assessment requirements remain in effect, and DFARS 252.204-7019/7020 reporting of a NIST SP 800-171 self-assessment score in SPRS still applies. CMMC and the C3PAO certification path have not been eliminated — confirm current applicability on the official DoD CMMC status page before making contractual decisions.

This tool runs entirely in your browser

Your answers stay on this device in local browser storage. Nothing you type is uploaded, stored on our servers, or shared. Do not enter CUI, credentials, vulnerability details, export-controlled technical data, or personal data. Use general descriptions only. Clearing your browser storage erases your work.

Evidence coverage: 0 of 320 objectives

A practice is only Met when every applicable objective under it is satisfied with evidence an assessor can examine, corroborate in interview, and where applicable test. 110 requirements decompose into 320 objectives — objectives, not practices, are what get assessed.

Source: CMMC Assessment Guide - Level 2, Version 2.13 (CMMC-L2-v2.13); objective language per NIST SP 800-171A Rev. 2.

Search and filter objectives

Search by objective ID, practice, or wording

Family

Only outstanding

Showing 320 objectives.

3.1.1[a]
AC.L2-3.1.1
Determine if authorized users are identified.
AC · Authorized Access Control [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.1[b]
AC.L2-3.1.1
Determine if processes acting on behalf of authorized users are identified.
AC · Authorized Access Control [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.1[c]
AC.L2-3.1.1
Determine if devices (and other systems) authorized to connect to the system are identified.
AC · Authorized Access Control [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.1[d]
AC.L2-3.1.1
Determine if system access is limited to authorized users.
AC · Authorized Access Control [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.1[e]
AC.L2-3.1.1
Determine if system access is limited to processes acting on behalf of authorized users.
AC · Authorized Access Control [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.1[f]
AC.L2-3.1.1
Determine if system access is limited to authorized devices (including other systems).
AC · Authorized Access Control [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.2[a]
AC.L2-3.1.2
Determine if the types of transactions and functions that authorized users are permitted to execute are defined.
AC · Transaction & Function Control
Evidence plan note (no CUI, no system names)
3.1.2[b]
AC.L2-3.1.2
Determine if system access is limited to the defined types of transactions and functions for authorized users.
AC · Transaction & Function Control
Evidence plan note (no CUI, no system names)
3.1.3[a]
AC.L2-3.1.3
Determine if information flow control policies are defined.
AC · Control Cui Flow
Evidence plan note (no CUI, no system names)
3.1.3[b]
AC.L2-3.1.3
Determine if methods and enforcement mechanisms for controlling the flow of CUI are defined.
AC · Control Cui Flow
Evidence plan note (no CUI, no system names)
3.1.3[c]
AC.L2-3.1.3
Determine if designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified.
AC · Control Cui Flow
Evidence plan note (no CUI, no system names)
3.1.3[d]
AC.L2-3.1.3
Determine if authorizations for controlling the flow of CUI are defined.
AC · Control Cui Flow
Evidence plan note (no CUI, no system names)
3.1.3[e]
AC.L2-3.1.3
Determine if approved authorizations for controlling the flow of CUI are enforced.
AC · Control Cui Flow
Evidence plan note (no CUI, no system names)
3.1.4[a]
AC.L2-3.1.4
Determine if the duties of individuals requiring separation are defined.
AC · Separation Of Duties
Evidence plan note (no CUI, no system names)
3.1.4[b]
AC.L2-3.1.4
Determine if responsibilities for duties that require separation are assigned to separate individuals.
AC · Separation Of Duties
Evidence plan note (no CUI, no system names)
3.1.4[c]
AC.L2-3.1.4
Determine if access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.
AC · Separation Of Duties
Evidence plan note (no CUI, no system names)
3.1.5[a]
AC.L2-3.1.5
Determine if privileged accounts are identified.
AC · Least Privilege
Evidence plan note (no CUI, no system names)
3.1.5[b]
AC.L2-3.1.5
Determine if access to privileged accounts is authorized in accordance with the principle of least privilege.
AC · Least Privilege
Evidence plan note (no CUI, no system names)
3.1.5[c]
AC.L2-3.1.5
Determine if security functions are identified.
AC · Least Privilege
Evidence plan note (no CUI, no system names)
3.1.5[d]
AC.L2-3.1.5
Determine if access to security functions is authorized in accordance with the principle of least privilege.
AC · Least Privilege
Evidence plan note (no CUI, no system names)
3.1.6[a]
AC.L2-3.1.6
Determine if nonsecurity functions are identified.
AC · Non-Privileged Account Use
Evidence plan note (no CUI, no system names)
3.1.6[b]
AC.L2-3.1.6
Determine if users are required to use non-privileged accounts or roles when accessing nonsecurity functions.
AC · Non-Privileged Account Use
Evidence plan note (no CUI, no system names)
3.1.7[a]
AC.L2-3.1.7
Determine if privileged functions are defined.
AC · Privileged Functions
Evidence plan note (no CUI, no system names)
3.1.7[b]
AC.L2-3.1.7
Determine if non-privileged users are defined.
AC · Privileged Functions
Evidence plan note (no CUI, no system names)
3.1.7[c]
AC.L2-3.1.7
Determine if non-privileged users are prevented from executing privileged functions.
AC · Privileged Functions
Evidence plan note (no CUI, no system names)
3.1.7[d]
AC.L2-3.1.7
Determine if the execution of privileged functions is captured in audit logs.
AC · Privileged Functions
Evidence plan note (no CUI, no system names)
3.1.8[a]
AC.L2-3.1.8
Determine if the means of limiting unsuccessful logon attempts is defined.
AC · Unsuccessful Logon Attempts
Evidence plan note (no CUI, no system names)
3.1.8[b]
AC.L2-3.1.8
Determine if the defined means of limiting unsuccessful logon attempts is implemented.
AC · Unsuccessful Logon Attempts
Evidence plan note (no CUI, no system names)
3.1.9[a]
AC.L2-3.1.9
Determine if privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category.
AC · Privacy & Security Notices
Evidence plan note (no CUI, no system names)
3.1.9[b]
AC.L2-3.1.9
Determine if privacy and security notices are displayed.
AC · Privacy & Security Notices
Evidence plan note (no CUI, no system names)
3.1.10[a]
AC.L2-3.1.10
Determine if the period of inactivity after which the system initiates a session lock is defined.
AC · Session Lock
Evidence plan note (no CUI, no system names)
3.1.10[b]
AC.L2-3.1.10
Determine if access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity.
AC · Session Lock
Evidence plan note (no CUI, no system names)
3.1.10[c]
AC.L2-3.1.10
Determine if previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.
AC · Session Lock
Evidence plan note (no CUI, no system names)
3.1.11[a]
AC.L2-3.1.11
Determine if conditions requiring a user session to terminate are defined.
AC · Session Termination
Evidence plan note (no CUI, no system names)
3.1.11[b]
AC.L2-3.1.11
Determine if a user session is automatically terminated after any of the defined conditions occur.
AC · Session Termination
Evidence plan note (no CUI, no system names)
3.1.12[a]
AC.L2-3.1.12
Determine if remote access sessions are permitted.
AC · Control Remote Access
Evidence plan note (no CUI, no system names)
3.1.12[b]
AC.L2-3.1.12
Determine if the types of permitted remote access are identified.
AC · Control Remote Access
Evidence plan note (no CUI, no system names)
3.1.12[c]
AC.L2-3.1.12
Determine if remote access sessions are controlled.
AC · Control Remote Access
Evidence plan note (no CUI, no system names)
3.1.12[d]
AC.L2-3.1.12
Determine if remote access sessions are monitored.
AC · Control Remote Access
Evidence plan note (no CUI, no system names)
3.1.13[a]
AC.L2-3.1.13
Determine if cryptographic mechanisms to protect the confidentiality of remote access sessions are identified.
AC · Remote Access Confidentiality
Evidence plan note (no CUI, no system names)
3.1.13[b]
AC.L2-3.1.13
Determine if cryptographic mechanisms to protect the confidentiality of remote access sessions are implemented.
AC · Remote Access Confidentiality
Evidence plan note (no CUI, no system names)
3.1.14[a]
AC.L2-3.1.14
Determine if managed access control points are identified and implemented.
AC · Remote Access Routing
Evidence plan note (no CUI, no system names)
3.1.14[b]
AC.L2-3.1.14
Determine if remote access is routed through managed network access control points.
AC · Remote Access Routing
Evidence plan note (no CUI, no system names)
3.1.15[a]
AC.L2-3.1.15
Determine if privileged commands authorized for remote execution are identified.
AC · Privileged Remote Access
Evidence plan note (no CUI, no system names)
3.1.15[b]
AC.L2-3.1.15
Determine if security-relevant information authorized to be accessed remotely is identified.
AC · Privileged Remote Access
Evidence plan note (no CUI, no system names)
3.1.15[c]
AC.L2-3.1.15
Determine if the execution of the identified privileged commands via remote access is authorized.
AC · Privileged Remote Access
Evidence plan note (no CUI, no system names)
3.1.15[d]
AC.L2-3.1.15
Determine if access to the identified security-relevant information via remote access is authorized.
AC · Privileged Remote Access
Evidence plan note (no CUI, no system names)
3.1.16[a]
AC.L2-3.1.16
Determine if wireless access points are identified.
AC · Wireless Access Authorization
Evidence plan note (no CUI, no system names)
3.1.16[b]
AC.L2-3.1.16
Determine if wireless access is authorized prior to allowing such connections.
AC · Wireless Access Authorization
Evidence plan note (no CUI, no system names)
3.1.17[a]
AC.L2-3.1.17
Determine if wireless access to the system is protected using authentication.
AC · Wireless Access Protection
Evidence plan note (no CUI, no system names)
3.1.17[b]
AC.L2-3.1.17
Determine if wireless access to the system is protected using encryption.
AC · Wireless Access Protection
Evidence plan note (no CUI, no system names)
3.1.18[a]
AC.L2-3.1.18
Determine if mobile devices that process, store, or transmit CUI are identified.
AC · Mobile Device Connection
Evidence plan note (no CUI, no system names)
3.1.18[b]
AC.L2-3.1.18
Determine if mobile device connections are authorized.
AC · Mobile Device Connection
Evidence plan note (no CUI, no system names)
3.1.18[c]
AC.L2-3.1.18
Determine if mobile device connections are monitored and logged.
AC · Mobile Device Connection
Evidence plan note (no CUI, no system names)
3.1.19[a]
AC.L2-3.1.19
Determine if mobile devices and mobile computing platforms that process, store, or transmit CUI are identified.
AC · Encrypt Cui On Mobile
Evidence plan note (no CUI, no system names)
3.1.19[b]
AC.L2-3.1.19
Determine if encryption is employed to protect CUI on identified mobile devices and mobile computing platforms.
AC · Encrypt Cui On Mobile
Evidence plan note (no CUI, no system names)
3.1.20[a]
AC.L2-3.1.20
Determine if connections to external systems are identified.
AC · External Connections [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.20[b]
AC.L2-3.1.20
Determine if the use of external systems is identified.
AC · External Connections [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.20[c]
AC.L2-3.1.20
Determine if connections to external systems are verified.
AC · External Connections [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.20[d]
AC.L2-3.1.20
Determine if the use of external systems is verified.
AC · External Connections [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.20[e]
AC.L2-3.1.20
Determine if connections to external systems are controlled/limited.
AC · External Connections [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.20[f]
AC.L2-3.1.20
Determine if the use of external systems is controlled/limited.
AC · External Connections [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.21[a]
AC.L2-3.1.21
Determine if the use of portable storage devices containing CUI on external systems is identified and documented.
AC · Portable Storage Use
Evidence plan note (no CUI, no system names)
3.1.21[b]
AC.L2-3.1.21
Determine if limits on the use of portable storage devices containing CUI on external systems are defined.
AC · Portable Storage Use
Evidence plan note (no CUI, no system names)
3.1.21[c]
AC.L2-3.1.21
Determine if the use of portable storage devices containing CUI on external systems is limited as defined.
AC · Portable Storage Use
Evidence plan note (no CUI, no system names)
3.1.22[a]
AC.L2-3.1.22
Determine if individuals authorized to post or process information on publicly accessible systems are identified.
AC · Control Public Information [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.22[b]
AC.L2-3.1.22
Determine if procedures to ensure CUI is not posted or processed on publicly accessible systems are identified.
AC · Control Public Information [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.22[c]
AC.L2-3.1.22
Determine if a review process is in place prior to posting of any content to publicly accessible systems.
AC · Control Public Information [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.22[d]
AC.L2-3.1.22
Determine if content on publicly accessible systems is reviewed to ensure that it does not include CUI.
AC · Control Public Information [Cui Data]
Evidence plan note (no CUI, no system names)
3.1.22[e]
AC.L2-3.1.22
Determine if mechanisms are in place to remove and address improper posting of CUI.
AC · Control Public Information [Cui Data]
Evidence plan note (no CUI, no system names)
3.2.1[a]
AT.L2-3.2.1
Determine if security risks associated with organizational activities involving CUI are identified.
AT · Role-Based Risk Awareness
Evidence plan note (no CUI, no system names)
3.2.1[b]
AT.L2-3.2.1
Determine if policies, standards, and procedures related to the security of the system are identified.
AT · Role-Based Risk Awareness
Evidence plan note (no CUI, no system names)
3.2.1[c]
AT.L2-3.2.1
Determine if managers, systems administrators, and users of the system are made aware of the security risks associated with their activities.
AT · Role-Based Risk Awareness
Evidence plan note (no CUI, no system names)
3.2.1[d]
AT.L2-3.2.1
Determine if managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.
AT · Role-Based Risk Awareness
Evidence plan note (no CUI, no system names)
3.2.2[a]
AT.L2-3.2.2
Determine if information security-related duties, roles, and responsibilities are defined.
AT · Role-Based Training
Evidence plan note (no CUI, no system names)
3.2.2[b]
AT.L2-3.2.2
Determine if information security-related duties, roles, and responsibilities are assigned to designated personnel.
AT · Role-Based Training
Evidence plan note (no CUI, no system names)
3.2.2[c]
AT.L2-3.2.2
Determine if personnel are adequately trained to carry out their assigned information security- related duties, roles, and responsibilities.
AT · Role-Based Training
Evidence plan note (no CUI, no system names)
3.2.3[a]
AT.L2-3.2.3
Determine if potential indicators associated with insider threats are identified.
AT · Insider Threat Awareness
Evidence plan note (no CUI, no system names)
3.2.3[b]
AT.L2-3.2.3
Determine if security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.
AT · Insider Threat Awareness
Evidence plan note (no CUI, no system names)
3.3.1[a]
AU.L2-3.3.1
Determine if audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified.
AU · System Auditing
Evidence plan note (no CUI, no system names)
3.3.1[b]
AU.L2-3.3.1
Determine if the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined.
AU · System Auditing
Evidence plan note (no CUI, no system names)
3.3.1[c]
AU.L2-3.3.1
Determine if audit records are created (generated).
AU · System Auditing
Evidence plan note (no CUI, no system names)
3.3.1[d]
AU.L2-3.3.1
Determine if audit records, once created, contain the defined content.
AU · System Auditing
Evidence plan note (no CUI, no system names)
3.3.1[e]
AU.L2-3.3.1
Determine if retention requirements for audit records are defined.
AU · System Auditing
Evidence plan note (no CUI, no system names)
3.3.1[f]
AU.L2-3.3.1
Determine if audit records are retained as defined.
AU · System Auditing
Evidence plan note (no CUI, no system names)
3.3.2[a]
AU.L2-3.3.2
Determine if the content of the audit records needed to support the ability to uniquely trace users to their actions is defined.
AU · User Accountability
Evidence plan note (no CUI, no system names)
3.3.2[b]
AU.L2-3.3.2
Determine if audit records, once created, contain the defined content.
AU · User Accountability
Evidence plan note (no CUI, no system names)
3.3.3[a]
AU.L2-3.3.3
Determine if a process for determining when to review logged events is defined.
AU · Event Review
Evidence plan note (no CUI, no system names)
3.3.3[b]
AU.L2-3.3.3
Determine if event types being logged are reviewed in accordance with the defined review process.
AU · Event Review
Evidence plan note (no CUI, no system names)
3.3.3[c]
AU.L2-3.3.3
Determine if event types being logged are updated based on the review.
AU · Event Review
Evidence plan note (no CUI, no system names)
3.3.4[a]
AU.L2-3.3.4
Determine if personnel or roles to be alerted in the event of an audit logging process failure are identified.
AU · Audit Failure Alerting
Evidence plan note (no CUI, no system names)
3.3.4[b]
AU.L2-3.3.4
Determine if types of audit logging process failures for which alert will be generated are defined.
AU · Audit Failure Alerting
Evidence plan note (no CUI, no system names)
3.3.4[c]
AU.L2-3.3.4
Determine if identified personnel or roles are alerted in the event of an audit logging process failure.
AU · Audit Failure Alerting
Evidence plan note (no CUI, no system names)
3.3.5[a]
AU.L2-3.3.5
Determine if audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined.
AU · Audit Correlation
Evidence plan note (no CUI, no system names)
3.3.5[b]
AU.L2-3.3.5
Determine if defined audit record review, analysis, and reporting processes are correlated.
AU · Audit Correlation
Evidence plan note (no CUI, no system names)
3.3.6[a]
AU.L2-3.3.6
Determine if an audit record reduction capability that supports on-demand analysis is provided.
AU · Reduction & Reporting
Evidence plan note (no CUI, no system names)
3.3.6[b]
AU.L2-3.3.6
Determine if a report generation capability that supports on-demand reporting is provided.
AU · Reduction & Reporting
Evidence plan note (no CUI, no system names)
3.3.7[a]
AU.L2-3.3.7
Determine if internal system clocks are used to generate time stamps for audit records.
AU · Authoritative Time Source
Evidence plan note (no CUI, no system names)
3.3.7[b]
AU.L2-3.3.7
Determine if an authoritative source with which to compare and synchronize internal system clocks is specified.
AU · Authoritative Time Source
Evidence plan note (no CUI, no system names)
3.3.7[c]
AU.L2-3.3.7
Determine if internal system clocks used to generate time stamps for audit records are compared to and synchronized with the specified authoritative time source.
AU · Authoritative Time Source
Evidence plan note (no CUI, no system names)
3.3.8[a]
AU.L2-3.3.8
Determine if audit information is protected from unauthorized access.
AU · Audit Protection
Evidence plan note (no CUI, no system names)
3.3.8[b]
AU.L2-3.3.8
Determine if audit information is protected from unauthorized modification.
AU · Audit Protection
Evidence plan note (no CUI, no system names)
3.3.8[c]
AU.L2-3.3.8
Determine if audit information is protected from unauthorized deletion.
AU · Audit Protection
Evidence plan note (no CUI, no system names)
3.3.8[d]
AU.L2-3.3.8
Determine if audit logging tools are protected from unauthorized access.
AU · Audit Protection
Evidence plan note (no CUI, no system names)
3.3.8[e]
AU.L2-3.3.8
Determine if audit logging tools are protected from unauthorized modification.
AU · Audit Protection
Evidence plan note (no CUI, no system names)
3.3.8[f]
AU.L2-3.3.8
Determine if audit logging tools are protected from unauthorized deletion.
AU · Audit Protection
Evidence plan note (no CUI, no system names)
3.3.9[a]
AU.L2-3.3.9
Determine if a subset of privileged users granted access to manage audit logging functionality is defined.
AU · Audit Management
Evidence plan note (no CUI, no system names)
3.3.9[b]
AU.L2-3.3.9
Determine if management of audit logging functionality is limited to the defined subset of privileged users.
AU · Audit Management
Evidence plan note (no CUI, no system names)
3.4.1[a]
CM.L2-3.4.1
Determine if a baseline configuration is established.
CM · System Baselining
Evidence plan note (no CUI, no system names)
3.4.1[b]
CM.L2-3.4.1
Determine if the baseline configuration includes hardware, software, firmware, and documentation.
CM · System Baselining
Evidence plan note (no CUI, no system names)
3.4.1[c]
CM.L2-3.4.1
Determine if the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle.
CM · System Baselining
Evidence plan note (no CUI, no system names)
3.4.1[d]
CM.L2-3.4.1
Determine if a system inventory is established.
CM · System Baselining
Evidence plan note (no CUI, no system names)
3.4.1[e]
CM.L2-3.4.1
Determine if the system inventory includes hardware, software, firmware, and documentation.
CM · System Baselining
Evidence plan note (no CUI, no system names)
3.4.1[f]
CM.L2-3.4.1
Determine if the inventory is maintained (reviewed and updated) throughout the system development life cycle.
CM · System Baselining
Evidence plan note (no CUI, no system names)
3.4.2[a]
CM.L2-3.4.2
Determine if security configuration settings for information technology products employed in the system are established and included in the baseline configuration.
CM · Security Configuration Enforcement
Evidence plan note (no CUI, no system names)
3.4.2[b]
CM.L2-3.4.2
Determine if security configuration settings for information technology products employed in the system are enforced.
CM · Security Configuration Enforcement
Evidence plan note (no CUI, no system names)
3.4.3[a]
CM.L2-3.4.3
Determine if changes to the system are tracked.
CM · System Change Management
Evidence plan note (no CUI, no system names)
3.4.3[b]
CM.L2-3.4.3
Determine if changes to the system are reviewed.
CM · System Change Management
Evidence plan note (no CUI, no system names)
3.4.3[c]
CM.L2-3.4.3
Determine if changes to the system are approved or disapproved.
CM · System Change Management
Evidence plan note (no CUI, no system names)
3.4.3[d]
CM.L2-3.4.3
Determine if changes to the system are logged.
CM · System Change Management
Evidence plan note (no CUI, no system names)
3.4.4[a]
CM.L2-3.4.4
Determine if the security impact of changes to the system is analyzed prior to implementation.
CM · Security Impact Analysis
Evidence plan note (no CUI, no system names)
3.4.5[a]
CM.L2-3.4.5
Determine if physical access restrictions associated with changes to the system are defined.
CM · Access Restrictions For Change
Evidence plan note (no CUI, no system names)
3.4.5[b]
CM.L2-3.4.5
Determine if physical access restrictions associated with changes to the system are documented.
CM · Access Restrictions For Change
Evidence plan note (no CUI, no system names)
3.4.5[c]
CM.L2-3.4.5
Determine if physical access restrictions associated with changes to the system are approved.
CM · Access Restrictions For Change
Evidence plan note (no CUI, no system names)
3.4.5[d]
CM.L2-3.4.5
Determine if physical access restrictions associated with changes to the system are enforced.
CM · Access Restrictions For Change
Evidence plan note (no CUI, no system names)
3.4.5[e]
CM.L2-3.4.5
Determine if logical access restrictions associated with changes to the system are defined.
CM · Access Restrictions For Change
Evidence plan note (no CUI, no system names)
3.4.5[f]
CM.L2-3.4.5
Determine if logical access restrictions associated with changes to the system are documented.
CM · Access Restrictions For Change
Evidence plan note (no CUI, no system names)
3.4.5[g]
CM.L2-3.4.5
Determine if logical access restrictions associated with changes to the system are approved.
CM · Access Restrictions For Change
Evidence plan note (no CUI, no system names)
3.4.5[h]
CM.L2-3.4.5
Determine if logical access restrictions associated with changes to the system are enforced.
CM · Access Restrictions For Change
Evidence plan note (no CUI, no system names)
3.4.6[a]
CM.L2-3.4.6
Determine if essential system capabilities are defined based on the principle of least functionality.
CM · Least Functionality
Evidence plan note (no CUI, no system names)
3.4.6[b]
CM.L2-3.4.6
Determine if the system is configured to provide only the defined essential capabilities.
CM · Least Functionality
Evidence plan note (no CUI, no system names)
3.4.7[a]
CM.L2-3.4.7
Determine if essential programs are defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[b]
CM.L2-3.4.7
Determine if the use of nonessential programs is defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[c]
CM.L2-3.4.7
Determine if the use of nonessential programs is restricted, disabled, or prevented as defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[d]
CM.L2-3.4.7
Determine if essential functions are defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[e]
CM.L2-3.4.7
Determine if the use of nonessential functions is defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[f]
CM.L2-3.4.7
Determine if the use of nonessential functions is restricted, disabled, or prevented as defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[g]
CM.L2-3.4.7
Determine if essential ports are defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[h]
CM.L2-3.4.7
Determine if the use of nonessential ports is defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[i]
CM.L2-3.4.7
Determine if the use of nonessential ports is restricted, disabled, or prevented as defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[j]
CM.L2-3.4.7
Determine if essential protocols are defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[k]
CM.L2-3.4.7
Determine if the use of nonessential protocols is defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[l]
CM.L2-3.4.7
Determine if the use of nonessential protocols is restricted, disabled, or prevented as defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[m]
CM.L2-3.4.7
Determine if essential services are defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[n]
CM.L2-3.4.7
Determine if the use of nonessential services is defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.7[o]
CM.L2-3.4.7
Determine if the use of nonessential services is restricted, disabled, or prevented as defined.
CM · Nonessential Functionality
Evidence plan note (no CUI, no system names)
3.4.8[a]
CM.L2-3.4.8
Determine if a policy specifying whether whitelisting or blacklisting is to be implemented is specified.
CM · Application Execution Policy
Evidence plan note (no CUI, no system names)
3.4.8[b]
CM.L2-3.4.8
Determine if the software allowed to execute under whitelisting or denied use under blacklisting is specified.
CM · Application Execution Policy
Evidence plan note (no CUI, no system names)
3.4.8[c]
CM.L2-3.4.8
Determine if whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.
CM · Application Execution Policy
Evidence plan note (no CUI, no system names)
3.4.9[a]
CM.L2-3.4.9
Determine if a policy for controlling the installation of software by users is established.
CM · User-Installed Software
Evidence plan note (no CUI, no system names)
3.4.9[b]
CM.L2-3.4.9
Determine if installation of software by users is controlled based on the established policy.
CM · User-Installed Software
Evidence plan note (no CUI, no system names)
3.4.9[c]
CM.L2-3.4.9
Determine if installation of software by users is monitored.
CM · User-Installed Software
Evidence plan note (no CUI, no system names)
3.5.1[a]
IA.L2-3.5.1
Determine if system users are identified.
IA · Identification [Cui Data]
Evidence plan note (no CUI, no system names)
3.5.1[b]
IA.L2-3.5.1
Determine if processes acting on behalf of users are identified.
IA · Identification [Cui Data]
Evidence plan note (no CUI, no system names)
3.5.1[c]
IA.L2-3.5.1
Determine if devices accessing the system are identified.
IA · Identification [Cui Data]
Evidence plan note (no CUI, no system names)
3.5.2[a]
IA.L2-3.5.2
Determine if the identity of each user is authenticated or verified as a prerequisite to system access.
IA · Authentication [Cui Data]
Evidence plan note (no CUI, no system names)
3.5.2[b]
IA.L2-3.5.2
Determine if the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access.
IA · Authentication [Cui Data]
Evidence plan note (no CUI, no system names)
3.5.2[c]
IA.L2-3.5.2
Determine if the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.
IA · Authentication [Cui Data]
Evidence plan note (no CUI, no system names)
3.5.3[a]
IA.L2-3.5.3
Determine if privileged accounts are identified.
IA · Multifactor Authentication
Evidence plan note (no CUI, no system names)
3.5.3[b]
IA.L2-3.5.3
Determine if multifactor authentication is implemented for local access to privileged accounts.
IA · Multifactor Authentication
Evidence plan note (no CUI, no system names)
3.5.3[c]
IA.L2-3.5.3
Determine if multifactor authentication is implemented for network access to privileged accounts.
IA · Multifactor Authentication
Evidence plan note (no CUI, no system names)
3.5.3[d]
IA.L2-3.5.3
Determine if multifactor authentication is implemented for network access to non-privileged accounts.
IA · Multifactor Authentication
Evidence plan note (no CUI, no system names)
3.5.4[a]
IA.L2-3.5.4
Determine if replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts.
IA · Replay-Resistant Authentication
Evidence plan note (no CUI, no system names)
3.5.5[a]
IA.L2-3.5.5
Determine if a period within which identifiers cannot be reused is defined.
IA · Identifier Reuse
Evidence plan note (no CUI, no system names)
3.5.5[b]
IA.L2-3.5.5
Determine if reuse of identifiers is prevented within the defined period.
IA · Identifier Reuse
Evidence plan note (no CUI, no system names)
3.5.6[a]
IA.L2-3.5.6
Determine if a period of inactivity after which an identifier is disabled is defined.
IA · Identifier Handling
Evidence plan note (no CUI, no system names)
3.5.6[b]
IA.L2-3.5.6
Determine if identifiers are disabled after the defined period of inactivity.
IA · Identifier Handling
Evidence plan note (no CUI, no system names)
3.5.7[a]
IA.L2-3.5.7
Determine if password complexity requirements are defined.
IA · Password Complexity
Evidence plan note (no CUI, no system names)
3.5.7[b]
IA.L2-3.5.7
Determine if password change of character requirements are defined.
IA · Password Complexity
Evidence plan note (no CUI, no system names)
3.5.7[c]
IA.L2-3.5.7
Determine if minimum password complexity requirements as defined are enforced when new passwords are created.
IA · Password Complexity
Evidence plan note (no CUI, no system names)
3.5.7[d]
IA.L2-3.5.7
Determine if minimum password change of character requirements as defined are enforced when new passwords are created.
IA · Password Complexity
Evidence plan note (no CUI, no system names)
3.5.8[a]
IA.L2-3.5.8
Determine if the number of generations during which a password cannot be reused is specified.
IA · Password Reuse
Evidence plan note (no CUI, no system names)
3.5.8[b]
IA.L2-3.5.8
Determine if reuse of passwords is prohibited during the specified number of generations.
IA · Password Reuse
Evidence plan note (no CUI, no system names)
3.5.9[a]
IA.L2-3.5.9
Determine if an immediate change to a permanent password is required when a temporary password is used for system logon.
IA · Temporary Passwords
Evidence plan note (no CUI, no system names)
3.5.10[a]
IA.L2-3.5.10
Determine if passwords are cryptographically protected in storage.
IA · Cryptographically-Protected Passwords
Evidence plan note (no CUI, no system names)
3.5.10[b]
IA.L2-3.5.10
Determine if passwords are cryptographically protected in transit.
IA · Cryptographically-Protected Passwords
Evidence plan note (no CUI, no system names)
3.5.11[a]
IA.L2-3.5.11
Determine if authentication information is obscured during the authentication process.
IA · Obscure Feedback
Evidence plan note (no CUI, no system names)
3.6.1[a]
IR.L2-3.6.1
Determine if an operational incident-handling capability is established.
IR · Incident Handling
Evidence plan note (no CUI, no system names)
3.6.1[b]
IR.L2-3.6.1
Determine if the operational incident-handling capability includes preparation.
IR · Incident Handling
Evidence plan note (no CUI, no system names)
3.6.1[c]
IR.L2-3.6.1
Determine if the operational incident-handling capability includes detection.
IR · Incident Handling
Evidence plan note (no CUI, no system names)
3.6.1[d]
IR.L2-3.6.1
Determine if the operational incident-handling capability includes analysis.
IR · Incident Handling
Evidence plan note (no CUI, no system names)
3.6.1[e]
IR.L2-3.6.1
Determine if the operational incident-handling capability includes containment.
IR · Incident Handling
Evidence plan note (no CUI, no system names)
3.6.1[f]
IR.L2-3.6.1
Determine if the operational incident-handling capability includes recovery.
IR · Incident Handling
Evidence plan note (no CUI, no system names)
3.6.1[g]
IR.L2-3.6.1
Determine if the operational incident-handling capability includes user response activities.
IR · Incident Handling
Evidence plan note (no CUI, no system names)
3.6.2[a]
IR.L2-3.6.2
Determine if incidents are tracked.
IR · Incident Reporting
Evidence plan note (no CUI, no system names)
3.6.2[b]
IR.L2-3.6.2
Determine if incidents are documented.
IR · Incident Reporting
Evidence plan note (no CUI, no system names)
3.6.2[c]
IR.L2-3.6.2
Determine if authorities to whom incidents are to be reported are identified.
IR · Incident Reporting
Evidence plan note (no CUI, no system names)
3.6.2[d]
IR.L2-3.6.2
Determine if organizational officials to whom incidents are to be reported are identified.
IR · Incident Reporting
Evidence plan note (no CUI, no system names)
3.6.2[e]
IR.L2-3.6.2
Determine if identified authorities are notified of incidents.
IR · Incident Reporting
Evidence plan note (no CUI, no system names)
3.6.2[f]
IR.L2-3.6.2
Determine if identified organizational officials are notified of incidents.
IR · Incident Reporting
Evidence plan note (no CUI, no system names)
3.6.3[a]
IR.L2-3.6.3
Determine if the incident response capability is tested.
IR · Incident Response Testing
Evidence plan note (no CUI, no system names)
3.7.1[a]
MA.L2-3.7.1
Determine if system maintenance is performed.
MA · Perform Maintenance
Evidence plan note (no CUI, no system names)
3.7.2[a]
MA.L2-3.7.2
Determine if tools used to conduct system maintenance are controlled.
MA · System Maintenance Control
Evidence plan note (no CUI, no system names)
3.7.2[b]
MA.L2-3.7.2
Determine if techniques used to conduct system maintenance are controlled.
MA · System Maintenance Control
Evidence plan note (no CUI, no system names)
3.7.2[c]
MA.L2-3.7.2
Determine if mechanisms used to conduct system maintenance are controlled.
MA · System Maintenance Control
Evidence plan note (no CUI, no system names)
3.7.2[d]
MA.L2-3.7.2
Determine if personnel used to conduct system maintenance are controlled.
MA · System Maintenance Control
Evidence plan note (no CUI, no system names)
3.7.3[a]
MA.L2-3.7.3
Determine if equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.
MA · Equipment Sanitization
Evidence plan note (no CUI, no system names)
3.7.4[a]
MA.L2-3.7.4
Determine if media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI.
MA · Media Inspection
Evidence plan note (no CUI, no system names)
3.7.5[a]
MA.L2-3.7.5
Determine if multifactor authentication is used to establish nonlocal maintenance sessions via external network connections.
MA · Nonlocal Maintenance
Evidence plan note (no CUI, no system names)
3.7.5[b]
MA.L2-3.7.5
Determine if nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.
MA · Nonlocal Maintenance
Evidence plan note (no CUI, no system names)
3.7.6[a]
MA.L2-3.7.6
Determine if maintenance personnel without required access authorization are supervised during maintenance activities.
MA · Maintenance Personnel
Evidence plan note (no CUI, no system names)
3.8.1[a]
MP.L2-3.8.1
Determine if paper media containing CUI is physically controlled.
MP · Media Protection
Evidence plan note (no CUI, no system names)
3.8.1[b]
MP.L2-3.8.1
Determine if digital media containing CUI is physically controlled.
MP · Media Protection
Evidence plan note (no CUI, no system names)
3.8.1[c]
MP.L2-3.8.1
Determine if paper media containing CUI is securely stored.
MP · Media Protection
Evidence plan note (no CUI, no system names)
3.8.1[d]
MP.L2-3.8.1
Determine if digital media containing CUI is securely stored.
MP · Media Protection
Evidence plan note (no CUI, no system names)
3.8.2[a]
MP.L2-3.8.2
Determine if access to CUI on system media is limited to authorized users.
MP · Media Access
Evidence plan note (no CUI, no system names)
3.8.3[a]
MP.L2-3.8.3
Determine if system media containing CUI is sanitized or destroyed before disposal.
MP · Media Disposal [Cui Data]
Evidence plan note (no CUI, no system names)
3.8.3[b]
MP.L2-3.8.3
Determine if system media containing CUI is sanitized before it is released for reuse.
MP · Media Disposal [Cui Data]
Evidence plan note (no CUI, no system names)
3.8.4[a]
MP.L2-3.8.4
Determine if media containing CUI is marked with applicable CUI markings.
MP · Media Markings
Evidence plan note (no CUI, no system names)
3.8.4[b]
MP.L2-3.8.4
Determine if media containing CUI is marked with distribution limitations.
MP · Media Markings
Evidence plan note (no CUI, no system names)
3.8.5[a]
MP.L2-3.8.5
Determine if access to media containing CUI is controlled.
MP · Media Accountability
Evidence plan note (no CUI, no system names)
3.8.5[b]
MP.L2-3.8.5
Determine if accountability for media containing CUI is maintained during transport outside of controlled areas.
MP · Media Accountability
Evidence plan note (no CUI, no system names)
3.8.6[a]
MP.L2-3.8.6
Determine if the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.
MP · Portable Storage Encryption
Evidence plan note (no CUI, no system names)
3.8.7[a]
MP.L2-3.8.7
Determine if the use of removable media on system components is controlled.
MP · Removeable Media
Evidence plan note (no CUI, no system names)
3.8.8[a]
MP.L2-3.8.8
Determine if the use of portable storage devices is prohibited when such devices have no identifiable owner.
MP · Shared Media
Evidence plan note (no CUI, no system names)
3.8.9[a]
MP.L2-3.8.9
Determine if the confidentiality of backup CUI is protected at storage locations.
MP · Protect Backups
Evidence plan note (no CUI, no system names)
3.9.1[a]
PS.L2-3.9.1
Determine if individuals are screened prior to authorizing access to organizational systems containing CUI.
PS · Screen Individuals
Evidence plan note (no CUI, no system names)
3.9.2[a]
PS.L2-3.9.2
Determine if a policy and/or process for terminating system access and any credentials coincident with personnel actions is established.
PS · Personnel Actions
Evidence plan note (no CUI, no system names)
3.9.2[b]
PS.L2-3.9.2
Determine if system access and credentials are terminated consistent with personnel actions such as termination or transfer.
PS · Personnel Actions
Evidence plan note (no CUI, no system names)
3.9.2[c]
PS.L2-3.9.2
Determine if the system is protected during and after personnel transfer actions.
PS · Personnel Actions
Evidence plan note (no CUI, no system names)
3.10.1[a]
PE.L2-3.10.1
Determine if authorized individuals allowed physical access are identified.
PE · Limit Physical Access [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.1[b]
PE.L2-3.10.1
Determine if physical access to organizational systems is limited to authorized individuals.
PE · Limit Physical Access [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.1[c]
PE.L2-3.10.1
Determine if physical access to equipment is limited to authorized individuals.
PE · Limit Physical Access [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.1[d]
PE.L2-3.10.1
Determine if physical access to operating environments is limited to authorized individuals.
PE · Limit Physical Access [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.2[a]
PE.L2-3.10.2
Determine if the physical facility where organizational systems reside is protected.
PE · Monitor Facility
Evidence plan note (no CUI, no system names)
3.10.2[b]
PE.L2-3.10.2
Determine if the support infrastructure for organizational systems is protected.
PE · Monitor Facility
Evidence plan note (no CUI, no system names)
3.10.2[c]
PE.L2-3.10.2
Determine if the physical facility where organizational systems reside is monitored.
PE · Monitor Facility
Evidence plan note (no CUI, no system names)
3.10.2[d]
PE.L2-3.10.2
Determine if the support infrastructure for organizational systems is monitored.
PE · Monitor Facility
Evidence plan note (no CUI, no system names)
3.10.3[a]
PE.L2-3.10.3
Determine if visitors are escorted.
PE · Escort Visitors [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.3[b]
PE.L2-3.10.3
Determine if visitor activity is monitored.
PE · Escort Visitors [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.4[a]
PE.L2-3.10.4
Determine if audit logs of physical access are maintained.
PE · Physical Access Logs [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.5[a]
PE.L2-3.10.5
Determine if physical access devices are identified.
PE · Manage Physical Access [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.5[b]
PE.L2-3.10.5
Determine if physical access devices are controlled.
PE · Manage Physical Access [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.5[c]
PE.L2-3.10.5
Determine if physical access devices are managed.
PE · Manage Physical Access [Cui Data]
Evidence plan note (no CUI, no system names)
3.10.6[a]
PE.L2-3.10.6
Determine if safeguarding measures for CUI are defined for alternate work sites.
PE · Alternative Work Sites
Evidence plan note (no CUI, no system names)
3.10.6[b]
PE.L2-3.10.6
Determine if safeguarding measures for CUI are enforced for alternate work sites.
PE · Alternative Work Sites
Evidence plan note (no CUI, no system names)
3.11.1[a]
RA.L2-3.11.1
Determine if the frequency to assess risk to organizational operations, organizational assets, and individuals is defined.
RA · Risk Assessments
Evidence plan note (no CUI, no system names)
3.11.1[b]
RA.L2-3.11.1
Determine if risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency.
RA · Risk Assessments
Evidence plan note (no CUI, no system names)
3.11.2[a]
RA.L2-3.11.2
Determine if the frequency to scan for vulnerabilities in organizational systems and applications is defined.
RA · Vulnerability Scan
Evidence plan note (no CUI, no system names)
3.11.2[b]
RA.L2-3.11.2
Determine if vulnerability scans are performed on organizational systems with the defined frequency.
RA · Vulnerability Scan
Evidence plan note (no CUI, no system names)
3.11.2[c]
RA.L2-3.11.2
Determine if vulnerability scans are performed on applications with the defined frequency.
RA · Vulnerability Scan
Evidence plan note (no CUI, no system names)
3.11.2[d]
RA.L2-3.11.2
Determine if vulnerability scans are performed on organizational systems when new vulnerabilities are identified.
RA · Vulnerability Scan
Evidence plan note (no CUI, no system names)
3.11.2[e]
RA.L2-3.11.2
Determine if vulnerability scans are performed on applications when new vulnerabilities are identified.
RA · Vulnerability Scan
Evidence plan note (no CUI, no system names)
3.11.3[a]
RA.L2-3.11.3
Determine if vulnerabilities are identified.
RA · Vulnerability Remediation
Evidence plan note (no CUI, no system names)
3.11.3[b]
RA.L2-3.11.3
Determine if vulnerabilities are remediated in accordance with risk assessments.
RA · Vulnerability Remediation
Evidence plan note (no CUI, no system names)
3.12.1[a]
CA.L2-3.12.1
Determine if the frequency of security control assessments is defined.
CA · Security Control Assessment
Evidence plan note (no CUI, no system names)
3.12.1[b]
CA.L2-3.12.1
Determine if security controls are assessed with the defined frequency to determine if the controls are effective in their application.
CA · Security Control Assessment
Evidence plan note (no CUI, no system names)
3.12.2[a]
CA.L2-3.12.2
Determine if deficiencies and vulnerabilities to be addressed by the plan of action are identified.
CA · Operational Plan Of Action
Evidence plan note (no CUI, no system names)
3.12.2[b]
CA.L2-3.12.2
Determine if a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities.
CA · Operational Plan Of Action
Evidence plan note (no CUI, no system names)
3.12.2[c]
CA.L2-3.12.2
Determine if the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.
CA · Operational Plan Of Action
Evidence plan note (no CUI, no system names)
3.12.3[a]
CA.L2-3.12.3
Determine if security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.
CA · Security Control Monitoring
Evidence plan note (no CUI, no system names)
3.12.4[a]
CA.L2-3.12.4
Determine if a system security plan is developed.
CA · System Security Plan
Evidence plan note (no CUI, no system names)
3.12.4[b]
CA.L2-3.12.4
Determine if the system boundary is described and documented in the system security plan.
CA · System Security Plan
Evidence plan note (no CUI, no system names)
3.12.4[c]
CA.L2-3.12.4
Determine if the system environment of operation is described and documented in the system security plan.
CA · System Security Plan
Evidence plan note (no CUI, no system names)
3.12.4[d]
CA.L2-3.12.4
Determine if the security requirements identified and approved by the designated authority as non-applicable are identified.
CA · System Security Plan
Evidence plan note (no CUI, no system names)
3.12.4[e]
CA.L2-3.12.4
Determine if the method of security requirement implementation is described and documented in the system security plan.
CA · System Security Plan
Evidence plan note (no CUI, no system names)
3.12.4[f]
CA.L2-3.12.4
Determine if the relationship with or connection to other systems is described and documented in the system security plan.
CA · System Security Plan
Evidence plan note (no CUI, no system names)
3.12.4[g]
CA.L2-3.12.4
Determine if the frequency to update the system security plan is defined.
CA · System Security Plan
Evidence plan note (no CUI, no system names)
3.12.4[h]
CA.L2-3.12.4
Determine if system security plan is updated with the defined frequency.
CA · System Security Plan
Evidence plan note (no CUI, no system names)
3.13.1[a]
SC.L2-3.13.1
Determine if the external system boundary is defined.
SC · Boundary Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.1[b]
SC.L2-3.13.1
Determine if key internal system boundaries are defined.
SC · Boundary Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.1[c]
SC.L2-3.13.1
Determine if communications are monitored at the external system boundary.
SC · Boundary Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.1[d]
SC.L2-3.13.1
Determine if communications are monitored at key internal boundaries.
SC · Boundary Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.1[e]
SC.L2-3.13.1
Determine if communications are controlled at the external system boundary.
SC · Boundary Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.1[f]
SC.L2-3.13.1
Determine if communications are controlled at key internal boundaries.
SC · Boundary Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.1[g]
SC.L2-3.13.1
Determine if communications are protected at the external system boundary.
SC · Boundary Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.1[h]
SC.L2-3.13.1
Determine if communications are protected at key internal boundaries.
SC · Boundary Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.2[a]
SC.L2-3.13.2
Determine if architectural designs that promote effective information security are identified.
SC · Security Engineering
Evidence plan note (no CUI, no system names)
3.13.2[b]
SC.L2-3.13.2
Determine if software development techniques that promote effective information security are identified.
SC · Security Engineering
Evidence plan note (no CUI, no system names)
3.13.2[c]
SC.L2-3.13.2
Determine if systems engineering principles that promote effective information security are identified.
SC · Security Engineering
Evidence plan note (no CUI, no system names)
3.13.2[d]
SC.L2-3.13.2
Determine if identified architectural designs that promote effective information security are employed.
SC · Security Engineering
Evidence plan note (no CUI, no system names)
3.13.2[e]
SC.L2-3.13.2
Determine if identified software development techniques that promote effective information security are employed.
SC · Security Engineering
Evidence plan note (no CUI, no system names)
3.13.2[f]
SC.L2-3.13.2
Determine if identified systems engineering principles that promote effective information security are employed.
SC · Security Engineering
Evidence plan note (no CUI, no system names)
3.13.3[a]
SC.L2-3.13.3
Determine if user functionality is identified.
SC · Role Separation
Evidence plan note (no CUI, no system names)
3.13.3[b]
SC.L2-3.13.3
Determine if system management functionality is identified.
SC · Role Separation
Evidence plan note (no CUI, no system names)
3.13.3[c]
SC.L2-3.13.3
Determine if user functionality is separated from system management functionality.
SC · Role Separation
Evidence plan note (no CUI, no system names)
3.13.4[a]
SC.L2-3.13.4
Determine if unauthorized and unintended information transfer via shared system resources is prevented.
SC · Shared Resource Control
Evidence plan note (no CUI, no system names)
3.13.5[a]
SC.L2-3.13.5
Determine if publicly accessible system components are identified.
SC · Public-Access System Separation [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.5[b]
SC.L2-3.13.5
Determine if subnetworks for publicly accessible system components are physically or logically separated from internal networks.
SC · Public-Access System Separation [Cui Data]
Evidence plan note (no CUI, no system names)
3.13.6[a]
SC.L2-3.13.6
Determine if network communications traffic is denied by default.
SC · Network Communication By Exception
Evidence plan note (no CUI, no system names)
3.13.6[b]
SC.L2-3.13.6
Determine if network communications traffic is allowed by exception.
SC · Network Communication By Exception
Evidence plan note (no CUI, no system names)
3.13.7[a]
SC.L2-3.13.7
Determine if remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).
SC · Split Tunneling
Evidence plan note (no CUI, no system names)
3.13.8[a]
SC.L2-3.13.8
Determine if cryptographic mechanisms intended to prevent unauthorized disclosure of CUI are identified.
SC · Data In Transit
Evidence plan note (no CUI, no system names)
3.13.8[b]
SC.L2-3.13.8
Determine if alternative physical safeguards intended to prevent unauthorized disclosure of CUI are identified.
SC · Data In Transit
Evidence plan note (no CUI, no system names)
3.13.8[c]
SC.L2-3.13.8
Determine if either cryptographic mechanisms or alternative physical safeguards are implemented to prevent unauthorized disclosure of CUI during transmission.
SC · Data In Transit
Evidence plan note (no CUI, no system names)
3.13.9[a]
SC.L2-3.13.9
Determine if a period of inactivity to terminate network connections associated with communications sessions is defined.
SC · Connections Termination
Evidence plan note (no CUI, no system names)
3.13.9[b]
SC.L2-3.13.9
Determine if network connections associated with communications sessions are terminated at the end of the sessions.
SC · Connections Termination
Evidence plan note (no CUI, no system names)
3.13.9[c]
SC.L2-3.13.9
Determine if network connections associated with communications sessions are terminated after the defined period of inactivity.
SC · Connections Termination
Evidence plan note (no CUI, no system names)
3.13.10[a]
SC.L2-3.13.10
Determine if cryptographic keys are established whenever cryptography is employed.
SC · Key Management
Evidence plan note (no CUI, no system names)
3.13.10[b]
SC.L2-3.13.10
Determine if cryptographic keys are managed whenever cryptography is employed.
SC · Key Management
Evidence plan note (no CUI, no system names)
3.13.11[a]
SC.L2-3.13.11
Determine if FIPS-validated cryptography is employed to protect the confidentiality of CUI.
SC · Cui Encryption
Evidence plan note (no CUI, no system names)
3.13.12[a]
SC.L2-3.13.12
Determine if collaborative computing devices are identified.
SC · Collaborative Device Control
Evidence plan note (no CUI, no system names)
3.13.12[b]
SC.L2-3.13.12
Determine if collaborative computing devices provide indication to users of devices in use.
SC · Collaborative Device Control
Evidence plan note (no CUI, no system names)
3.13.12[c]
SC.L2-3.13.12
Determine if remote activation of collaborative computing devices is prohibited.
SC · Collaborative Device Control
Evidence plan note (no CUI, no system names)
3.13.13[a]
SC.L2-3.13.13
Determine if use of mobile code is controlled.
SC · Mobile Code
Evidence plan note (no CUI, no system names)
3.13.13[b]
SC.L2-3.13.13
Determine if use of mobile code is monitored.
SC · Mobile Code
Evidence plan note (no CUI, no system names)
3.13.14[a]
SC.L2-3.13.14
Determine if use of Voice over Internet Protocol (VoIP) technologies is controlled.
SC · Voice Over Internet Protocol
Evidence plan note (no CUI, no system names)
3.13.14[b]
SC.L2-3.13.14
Determine if use of Voice over Internet Protocol (VoIP) technologies is monitored.
SC · Voice Over Internet Protocol
Evidence plan note (no CUI, no system names)
3.13.15[a]
SC.L2-3.13.15
Determine if the authenticity of communications sessions is protected.
SC · Communications Authenticity
Evidence plan note (no CUI, no system names)
3.13.16[a]
SC.L2-3.13.16
Determine if the confidentiality of CUI at rest is protected.
SC · Data At Rest
Evidence plan note (no CUI, no system names)
3.14.1[a]
SI.L2-3.14.1
Determine if the time within which to identify system flaws is specified.
SI · Flaw Remediation [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.1[b]
SI.L2-3.14.1
Determine if system flaws are identified within the specified time frame.
SI · Flaw Remediation [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.1[c]
SI.L2-3.14.1
Determine if the time within which to report system flaws is specified.
SI · Flaw Remediation [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.1[d]
SI.L2-3.14.1
Determine if system flaws are reported within the specified time frame.
SI · Flaw Remediation [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.1[e]
SI.L2-3.14.1
Determine if the time within which to correct system flaws is specified.
SI · Flaw Remediation [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.1[f]
SI.L2-3.14.1
Determine if system flaws are corrected within the specified time frame.
SI · Flaw Remediation [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.2[a]
SI.L2-3.14.2
Determine if designated locations for malicious code protection are identified.
SI · Malicious Code Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.2[b]
SI.L2-3.14.2
Determine if protection from malicious code at designated locations is provided.
SI · Malicious Code Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.3[a]
SI.L2-3.14.3
Determine if response actions to system security alerts and advisories are identified.
SI · Security Alerts & Advisories
Evidence plan note (no CUI, no system names)
3.14.3[b]
SI.L2-3.14.3
Determine if system security alerts and advisories are monitored.
SI · Security Alerts & Advisories
Evidence plan note (no CUI, no system names)
3.14.3[c]
SI.L2-3.14.3
Determine if actions in response to system security alerts and advisories are taken.
SI · Security Alerts & Advisories
Evidence plan note (no CUI, no system names)
3.14.4[a]
SI.L2-3.14.4
Determine if malicious code protection mechanisms are updated when new releases are available.
SI · Update Malicious Code Protection [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.5[a]
SI.L2-3.14.5
Determine if the frequency for malicious code scans is defined.
SI · System & File Scanning [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.5[b]
SI.L2-3.14.5
Determine if malicious code scans are performed with the defined frequency.
SI · System & File Scanning [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.5[c]
SI.L2-3.14.5
Determine if real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.
SI · System & File Scanning [Cui Data]
Evidence plan note (no CUI, no system names)
3.14.6[a]
SI.L2-3.14.6
Determine if the system is monitored to detect attacks and indicators of potential attacks.
SI · Monitor Communications For Attacks
Evidence plan note (no CUI, no system names)
3.14.6[b]
SI.L2-3.14.6
Determine if inbound communications traffic is monitored to detect attacks and indicators of potential attacks.
SI · Monitor Communications For Attacks
Evidence plan note (no CUI, no system names)
3.14.6[c]
SI.L2-3.14.6
Determine if outbound communications traffic is monitored to detect attacks and indicators of potential attacks.
SI · Monitor Communications For Attacks
Evidence plan note (no CUI, no system names)
3.14.7[a]
SI.L2-3.14.7
Determine if authorized use of the system is defined.
SI · Identify Unauthorized Use
Evidence plan note (no CUI, no system names)
3.14.7[b]
SI.L2-3.14.7
Determine if unauthorized use of the system is identified.
SI · Identify Unauthorized Use
Evidence plan note (no CUI, no system names)

Sanitized example

Fictional contractor "Northgate Precision LLC". No real system names, hostnames, IPs, or findings — deliberately generic so it is safe to share.

For 3.1.1[c] Northgate Precision plans: "Device inventory export from endpoint manager, reviewed quarterly; procedure section 4.2 defines authorization; interview the IT lead; test by attempting to join an unenrolled laptop." That single line names the artifact, the corroborating interview, and the test — which is what an assessor needs, and it contains no CUI.

One path forward

Free result → $129 CMMC Survival Report → Athena workspace

Free, right now: keep the result and downloads from this tool. No account, no e-mail required.
$129 CMMC Survival Report: an objective-level readiness snapshot with your weakest practices, prioritized remediation order, and an assessor-facing narrative.
Athena workspace / evidence sprint: continuous objective-level tracking, evidence defensibility scoring, and assessor-ready artifacts.

Get the $129 Survival Report See the Athena workspace

Athena works at the assessment-objective level, keeps a provenance trail for every artifact, and scores how defensible your evidence is. We do not guarantee a certification outcome — no tool or consultant can.

Official primary references

The other free CMMC tools

SPRS score calculator

Score all 110 requirements with official weighted deductions.

Level 2 self-assessment

Met / Not Met / N/A across 110 requirements with a gap report.

CMMC scoping tool

Categorize assets and define your assessment boundary.

POA&M builder

Build a DoD-oriented POA&M with eligibility warnings.

C3PAO assessment prep

Day-one evidence list, mock intake, and readiness verdict.

Educational readiness aid. This is not legal advice, not an official assessment, not a certification, and not a submitted SPRS score. Your assessment results and any affirmation remain your organization's responsibility.

The 320-objective problem

CMMC Level 2 has 110 controls. NIST 800-171A breaks those 110 controls into 320 discrete assessment objectives. A C3PAO grades you against the objectives, not the controls. A spreadsheet with 110 rows cannot capture which objectives within a partially-implemented control are met, which are not, and what evidence backs each. This is why most manual evidence collection efforts collapse: the unit of work is the objective, not the control.

Evidence types C3PAOs accept

Policy. The "what we do" document — signed, dated, version-controlled.
Procedure. The "how we do it" document — referenced from the policy, with named owners.
Configuration. A baseline export, group policy dump, IaC manifest, or system-generated configuration report.
Log / telemetry. SIEM output, EDR alerts, authentication logs, vulnerability scan results — operational proof the control is running.
Screenshot. Time-stamped UI capture for controls that cannot be exported as data (e.g., admin console settings).
Interview. Auditor interview with the named responsible party. Backed by documentation, not the only evidence.
Inherited evidence. Cloud provider or MSSP artifacts surfaced through your SRM.

Mapping evidence to objectives

A worked example for five common controls:

AC.L2-3.1.1 (account management): identity provider user export + JML procedure + recent provisioning ticket.
AU.L2-3.3.1 (audit logging): SIEM ingest configuration + 90-day log sample + log retention policy.
CM.L2-3.4.1 (baseline configuration): baseline document + IaC manifest + drift detection report.
IA.L2-3.5.3 (MFA): MFA enforcement policy + admin console screenshot + 30-day MFA challenge log.
SI.L2-3.14.1 (flaw remediation): patch policy + vulnerability scan output + closed remediation tickets.

Each row is one objective, multiple evidence artifacts, mapped at ingest. The trail does not work if the mapping happens at export time.

Freshness — why a 14-month-old screenshot fails

C3PAOs expect evidence that proves the control is operating currently, not that it operated once. The accepted freshness window varies by evidence type: configuration baselines within 90 days, log samples covering the last 30–90 days, policies reviewed in the last 12 months, screenshots dated within 30 days of submission. A screenshot from a year ago is not evidence — it is a historical artifact. Athena's evidence freshness radar tags every artifact with its age and flags drift before the C3PAO sees it.

How Athena automates this

Athena ingests evidence from your stack — identity provider, EDR, SIEM, vulnerability scanner, configuration tools, document repositories — and auto-links it to the NIST 800-171A objectives it satisfies. Reviewers approve or reject each link. The SSP, POA&M, and assessor evidence bundle all generate from the same ledger, so the three artifacts tell the same story by assessment day. See the workflow automation pillar for the full pipeline.

Frequently asked questions

What is the difference between evidence and artifacts?

Practically interchangeable in CMMC conversations. 'Artifact' tends to refer to the discrete file (a policy PDF, a log export). 'Evidence' refers to artifacts in the context of proving a specific objective. A single artifact can serve as evidence for multiple objectives.

How fresh does CMMC evidence have to be?

Depends on the evidence type. Configuration baselines and screenshots within 30–90 days; log samples covering the last 30–90 days; policies reviewed annually. The C3PAO judgment is whether the evidence proves the control operates today, not whether it operated once.

Does a screenshot count as evidence?

Yes, for controls that cannot be exported as data — admin console settings, UI configurations, dashboards. Screenshots must be time-stamped, dated within 30 days of submission, and supported by procedure documentation. They should not be the only evidence for a technical control.

Can I reuse SOC 2 or ISO 27001 evidence for CMMC?

Some, with caveats. SOC 2 and ISO controls overlap with NIST 800-171 in the 60–70% range. The mapping is not 1:1 — a SOC 2 control may satisfy two NIST objectives and miss a third. Reuse evidence where the underlying control is identical; supplement where it is not.

What if I cannot produce evidence for a control?

If the control is POA&M-eligible, document the gap in the POA&M with a closure plan and date. If it is not POA&M-eligible (some controls are not, per the final rule), you must close the gap before assessment. The C3PAO will not accept 'we are working on it' as evidence.

Ready to act on this?

Run the free Quick Score, then walk through the Assessment Pack.

Free CMMC Quick Score See the Assessment Pack Pricing & demo

Assessment Operations · CMMC Level 2

Athena — the operating system for CMMC assessments.

Upload evidence. Athena drafts the SAR, POA&M, SPRS score, eMASS JSON, and OSCAL package — every finding mapped to an assessment objective, every artifact hashed for defense.

Other GRCs stop at contractor readiness. Athena owns the assessor-facing submission layer — SAR drafting, eMASS packaging, OSCAL output, and SHA-256 integrity provenance — that C3PAOs, DIBCAC, and program offices actually open on engagement day.

Built to the rule

32 CFR Part 170 — the CMMC Program rule, finalized by DoD in October 2024. CMMC requirements now appear in DoD solicitations.
110 controls from NIST SP 800-171 Rev. 2.
320 assessment objectives from NIST SP 800-171A.
CMMC Level 1 (FCI) and Level 2 (CUI) scopes covered.

What Athena produces

SAR · POA&M · SPRS submission · eMASS-ready JSON · OSCAL package · evidence binder with SHA-256 hashes · signed chain-of-custody manifest.

Explore Athena

Athena CMMC LLM — gap extraction with citations
Assessment module — score 320 objectives
Readiness snapshot — $129 survival report
SPRS score engine
SSP generator
POA&M manager
Event-sourced SAR
eMASS export
OSCAL export
L2 evidence binder
DIBCAC mock assessor
Pricing · About · Sitemap

Authored & maintained by Athena Consulting Group — CMMC Level 2 practitioners aligned to 32 CFR Part 170, NIST SP 800-171 Rev. 2, and NIST SP 800-171A. This page requires JavaScript for the interactive experience.