What this requirement asks
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
This is a CMMC Level 2 requirement in the System & Communications Protection family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (6)
- 3.13.2[a] — architectural designs that promote effective information security are identified
- 3.13.2[b] — software development techniques that promote effective information security are identified
- 3.13.2[c] — systems engineering principles that promote effective information security are identified
- 3.13.2[d] — identified architectural designs that promote effective information security are employed
- 3.13.2[e] — identified software development techniques that promote effective information security are employed
- 3.13.2[f] — identified systems engineering principles that promote effective information security are employed
What an assessor examines
Examine:
- Security planning policy
- procedures addressing system security plan development and implementation
- procedures addressing system security plan reviews and updates
- enterprise architecture documentation
- system security plan
- records of system security plan reviews and updates
- system and communications protection policy
- procedures addressing security engineering principles used in the specification, design, development, implementation, and modification of the system
- security architecture documentation
- security requirements and specifications for the system
- system design documentation
- system configuration settings and associated documentation
- other relevant documents or records
Interview:
- Personnel with responsibility for determining information system security requirements
- personnel with information system design, development, implementation, and modification responsibilities
- personnel with security planning and system security plan implementation responsibilities
- personnel with information security responsibilities
Test:
- Organizational processes for system security plan development, review, update, and approval
- mechanisms supporting the system security plan
- processes for applying security engineering principles in system specification, design, development, implementation, and modification
- automated mechanisms supporting the application of security engineering principles in information system specification, design, development, implementation, and modification
Evidence that defends it
Document design principles, segmentation
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.