# CMMC Level 2 Controls List: All 110 Requirements by Family

> Source: https://netray.co/tools/cmmc-level-2-controls-list-110-practices
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

All 110 NIST SP 800-171 Rev 2 requirements that make up CMMC Level 2, grouped into 14 families, with a shop-floor example and typical evidence for each.

## Category

compliance-legal

## Industry

Defense Electronics

## Audience

- IT manager
- Compliance manager
- Defense supplier

## Tool

**Kind:** worksheet

**Mode:** reference

**Columns:**

#### Control

**Key:** id

**Type:** text

#### Family

**Key:** family

**Type:** text

#### Requirement (paraphrased)

**Key:** requirement

**Type:** text

#### Manufacturing example

**Key:** example

**Type:** text

#### Typical evidence

**Key:** evidence

**Type:** text

**Rows:**

**Id:** 3.1.1

**Family:** Access Control

**Requirement:** Limit system access to authorized users, processes and devices.

**Example:** Only named staff accounts and registered CNC and inspection PCs can reach the CUI file share.

**Evidence:** Account list, group membership export, device inventory

**Id:** 3.1.2

**Family:** Access Control

**Requirement:** Limit access to the transactions and functions each user is permitted.

**Example:** Buyers see PO screens in the ERP but not engineering drawing vaults.

**Evidence:** ERP role matrix, permission screenshots

**Id:** 3.1.3

**Family:** Access Control

**Requirement:** Control the flow of CUI per approved authorizations.

**Example:** Drawings may go to approved subcontractors only through the managed portal, not personal email.

**Evidence:** Data flow diagram, DLP or mail rules

**Id:** 3.1.4

**Family:** Access Control

**Requirement:** Separate duties to reduce the risk of malicious activity.

**Example:** The person who approves a PLM release is not the one who administers the vault.

**Evidence:** Role definitions, access review record

**Id:** 3.1.5

**Family:** Access Control

**Requirement:** Apply least privilege, including to privileged accounts.

**Example:** Machinists have no local admin on HMI or CAM workstations.

**Evidence:** Admin group list, privilege review

**Id:** 3.1.6

**Family:** Access Control

**Requirement:** Use non-privileged accounts for non-security functions.

**Example:** IT admins read email with a standard account and elevate only for changes.

**Evidence:** Account naming standard, sample logon records

**Id:** 3.1.7

**Family:** Access Control

**Requirement:** Block non-privileged users from privileged functions and log such attempts.

**Example:** A standard user cannot install software on the quality lab PC and the attempt is logged.

**Evidence:** Group policy settings, event log sample

**Id:** 3.1.8

**Family:** Access Control

**Requirement:** Limit unsuccessful logon attempts.

**Example:** Five bad passwords lock the account for a set period.

**Evidence:** Lockout policy export

**Id:** 3.1.9

**Family:** Access Control

**Requirement:** Show privacy and security notices consistent with CUI rules.

**Example:** Logon banner on every workstation and VPN stating authorized use only.

**Evidence:** Banner screenshot, GPO setting

**Id:** 3.1.10

**Family:** Access Control

**Requirement:** Lock sessions after a period of inactivity with a pattern-hiding display.

**Example:** Office and engineering PCs lock after 10 to 15 minutes idle.

**Evidence:** Screen lock policy

**Id:** 3.1.11

**Family:** Access Control

**Requirement:** End a user session after a defined condition.

**Example:** VPN and remote desktop sessions drop after a fixed idle or maximum time.

**Evidence:** VPN and RDS configuration

**Id:** 3.1.12

**Family:** Access Control

**Requirement:** Monitor and control remote access sessions.

**Example:** Vendor support to a machine tool goes through a logged jump host.

**Evidence:** Remote access logs, procedure

**Id:** 3.1.13

**Family:** Access Control

**Requirement:** Use cryptography to protect remote access sessions.

**Example:** Remote staff connect over an encrypted VPN, not open RDP.

**Evidence:** VPN cipher settings

**Id:** 3.1.14

**Family:** Access Control

**Requirement:** Route remote access through managed access control points.

**Example:** One VPN gateway is the only door in from the internet.

**Evidence:** Network diagram, firewall rules

**Id:** 3.1.15

**Family:** Access Control

**Requirement:** Authorize remote execution of privileged commands and remote access to security data.

**Example:** Only named admins may run admin tools remotely, with approval on file.

**Evidence:** Approval record, access list

**Id:** 3.1.16

**Family:** Access Control

**Requirement:** Authorize wireless access before allowing connections.

**Example:** Shop floor Wi-Fi accepts only registered tablets.

**Evidence:** Wireless policy, authorized device list

**Id:** 3.1.17

**Family:** Access Control

**Requirement:** Protect wireless access with authentication and encryption.

**Example:** WPA2 or WPA3 Enterprise with certificates on the plant network.

**Evidence:** Wireless controller settings

**Id:** 3.1.18

**Family:** Access Control

**Requirement:** Control connection of mobile devices.

**Example:** Phones that read company email are enrolled in MDM.

**Evidence:** MDM enrollment list, policy

**Id:** 3.1.19

**Family:** Access Control

**Requirement:** Encrypt CUI on mobile devices and mobile computing platforms.

**Example:** Laptops used for first article reviews have full disk encryption.

**Evidence:** Encryption status report

**Id:** 3.1.20

**Family:** Access Control

**Requirement:** Verify and control connections to external systems.

**Example:** The link to a prime's supplier portal or a cloud MES is documented and approved.

**Evidence:** External connection register

**Id:** 3.1.21

**Family:** Access Control

**Requirement:** Limit use of organizational portable storage on external systems.

**Example:** Company USB drives are not plugged into customer or personal PCs.

**Evidence:** Policy, endpoint control settings

**Id:** 3.1.22

**Family:** Access Control

**Requirement:** Control CUI posted or processed on publicly accessible systems.

**Example:** Marketing reviews website and social posts so drawings never appear.

**Evidence:** Review procedure, posting approvals

**Id:** 3.2.1

**Family:** Awareness and Training

**Requirement:** Make managers and users aware of security risks and applicable policies.

**Example:** Annual briefing covers handling export-controlled drawings.

**Evidence:** Training deck, attendance

**Id:** 3.2.2

**Family:** Awareness and Training

**Requirement:** Train personnel to carry out their assigned security duties.

**Example:** The IT admin and the program manager each have role training records.

**Evidence:** Role-based training records

**Id:** 3.2.3

**Family:** Awareness and Training

**Requirement:** Provide insider threat awareness training.

**Example:** A short module on spotting unusual data copying or access.

**Evidence:** Module content, completion list

**Id:** 3.3.1

**Family:** Audit and Accountability

**Requirement:** Create and retain system audit logs to support monitoring and investigation.

**Example:** File server, firewall, VPN and domain controller logs kept for a set period.

**Evidence:** Log retention settings, sample logs

**Id:** 3.3.2

**Family:** Audit and Accountability

**Requirement:** Make each user's actions uniquely traceable.

**Example:** No shared logons on the quality or engineering systems.

**Evidence:** Unique ID policy, log sample

**Id:** 3.3.3

**Family:** Audit and Accountability

**Requirement:** Review and update logged events.

**Example:** Quarterly check that the right events are still being captured.

**Evidence:** Log scope review record

**Id:** 3.3.4

**Family:** Audit and Accountability

**Requirement:** Alert when audit logging fails.

**Example:** An alert fires if the log collector stops receiving events.

**Evidence:** Alert rule, test result

**Id:** 3.3.5

**Family:** Audit and Accountability

**Requirement:** Correlate audit review, analysis and reporting for suspicious activity.

**Example:** A SIEM or managed service links VPN logons with file access.

**Evidence:** Correlation rules, review reports

**Id:** 3.3.6

**Family:** Audit and Accountability

**Requirement:** Provide audit reduction and report generation.

**Example:** Searchable log platform produces on-demand reports for an incident.

**Evidence:** Sample report, search query

**Id:** 3.3.7

**Family:** Audit and Accountability

**Requirement:** Synchronize system clocks with an authoritative time source.

**Example:** All servers and CNC-connected PCs use the domain time source.

**Evidence:** NTP configuration

**Id:** 3.3.8

**Family:** Audit and Accountability

**Requirement:** Protect audit information and tools from unauthorized access, change and deletion.

**Example:** Log store is write-protected from ordinary admins.

**Evidence:** Permissions on log store

**Id:** 3.3.9

**Family:** Audit and Accountability

**Requirement:** Limit management of audit logging to a subset of privileged users.

**Example:** Only the security admin group can change log settings.

**Evidence:** Group membership

**Id:** 3.4.1

**Family:** Configuration Management

**Requirement:** Establish and maintain baseline configurations and inventories.

**Example:** Hardware and software list covering servers, PCs, CNC controllers on the network.

**Evidence:** Asset inventory, baseline images

**Id:** 3.4.2

**Family:** Configuration Management

**Requirement:** Establish and enforce security configuration settings.

**Example:** CIS or DISA STIG style hardening applied to Windows hosts.

**Evidence:** Hardening standard, scan results

**Id:** 3.4.3

**Family:** Configuration Management

**Requirement:** Track, review, approve or disapprove, and log changes.

**Example:** Firewall and server changes go through a ticket with approval.

**Evidence:** Change tickets

**Id:** 3.4.4

**Family:** Configuration Management

**Requirement:** Analyze the security impact of changes before implementation.

**Example:** A new MES connector is reviewed for data flow before go-live.

**Evidence:** Impact review notes

**Id:** 3.4.5

**Family:** Configuration Management

**Requirement:** Define and enforce physical and logical access restrictions on changes.

**Example:** Only the admin group can edit server configuration.

**Evidence:** Admin rights list

**Id:** 3.4.6

**Family:** Configuration Management

**Requirement:** Provide only essential capabilities (least functionality).

**Example:** Machine-side PCs run only the CAM or DNC software they need.

**Evidence:** Baseline software list

**Id:** 3.4.7

**Family:** Configuration Management

**Requirement:** Restrict or disable nonessential programs, functions, ports, protocols and services.

**Example:** Disable SMBv1, unused ports and default services.

**Evidence:** Port scan, service configuration

**Id:** 3.4.8

**Family:** Configuration Management

**Requirement:** Apply deny-by-exception or permit-by-exception software policy.

**Example:** Application allow-listing on engineering workstations.

**Evidence:** Allow-list policy export

**Id:** 3.4.9

**Family:** Configuration Management

**Requirement:** Control and monitor user-installed software.

**Example:** Users cannot install apps; exceptions are logged.

**Evidence:** Install restrictions, exception log

**Id:** 3.5.1

**Family:** Identification and Authentication

**Requirement:** Identify users, processes acting for users, and devices.

**Example:** Every person and managed device has a unique identity in the directory.

**Evidence:** Directory export

**Id:** 3.5.2

**Family:** Identification and Authentication

**Requirement:** Authenticate identities before allowing access.

**Example:** Logon is required on ERP, PLM and file systems.

**Evidence:** Authentication settings

**Id:** 3.5.3

**Family:** Identification and Authentication

**Requirement:** Use multifactor authentication for local and network access to privileged accounts and network access to non-privileged accounts.

**Example:** MFA on VPN, email, cloud and admin logons.

**Evidence:** MFA policy and enrollment report

**Id:** 3.5.4

**Family:** Identification and Authentication

**Requirement:** Use replay-resistant authentication for network access.

**Example:** Kerberos or modern token-based sign-in rather than plain challenge reuse.

**Evidence:** Protocol configuration

**Id:** 3.5.5

**Family:** Identification and Authentication

**Requirement:** Prevent reuse of identifiers for a defined period.

**Example:** A departed employee's username is not reissued.

**Evidence:** Account naming procedure

**Id:** 3.5.6

**Family:** Identification and Authentication

**Requirement:** Disable identifiers after a defined period of inactivity.

**Example:** Accounts idle for 90 days are disabled.

**Evidence:** Inactivity script or policy

**Id:** 3.5.7

**Family:** Identification and Authentication

**Requirement:** Enforce minimum password complexity and character change on new passwords.

**Example:** Length and complexity rules set in the domain policy.

**Evidence:** Password policy

**Id:** 3.5.8

**Family:** Identification and Authentication

**Requirement:** Prohibit password reuse for a set number of generations.

**Example:** Password history remembers prior passwords.

**Evidence:** Password history setting

**Id:** 3.5.9

**Family:** Identification and Authentication

**Requirement:** Allow temporary passwords only with immediate change to a permanent one.

**Example:** New hire or reset passwords force change at first logon.

**Evidence:** Reset procedure, setting

**Id:** 3.5.10

**Family:** Identification and Authentication

**Requirement:** Store and transmit only cryptographically protected passwords.

**Example:** No passwords in plain text files or spreadsheets.

**Evidence:** Hashing configuration, scan

**Id:** 3.5.11

**Family:** Identification and Authentication

**Requirement:** Obscure feedback of authentication information.

**Example:** Password fields mask characters on all systems.

**Evidence:** Screenshot of logon

**Id:** 3.6.1

**Family:** Incident Response

**Requirement:** Establish an incident handling capability covering preparation, detection, analysis, containment, recovery and response.

**Example:** Written plan with roles for IT, quality and management.

**Evidence:** Incident response plan

**Id:** 3.6.2

**Family:** Incident Response

**Requirement:** Track, document and report incidents to designated officials and authorities.

**Example:** Incident log and DoD reporting path for cyber incidents under DFARS 252.204-7012.

**Evidence:** Incident log, reporting procedure

**Id:** 3.6.3

**Family:** Incident Response

**Requirement:** Test the incident response capability.

**Example:** A yearly tabletop on a ransomware event at the plant.

**Evidence:** Exercise report

**Id:** 3.7.1

**Family:** Maintenance

**Requirement:** Perform maintenance on systems.

**Example:** Patching and hardware service are scheduled and recorded.

**Evidence:** Maintenance log

**Id:** 3.7.2

**Family:** Maintenance

**Requirement:** Control tools, techniques, mechanisms and personnel used for maintenance.

**Example:** Approved vendor technicians and approved diagnostic tools only.

**Evidence:** Approved tool and vendor list

**Id:** 3.7.3

**Family:** Maintenance

**Requirement:** Sanitize equipment removed for off-site maintenance of CUI.

**Example:** Wipe drives before a server or CNC controller leaves the site.

**Evidence:** Sanitization record

**Id:** 3.7.4

**Family:** Maintenance

**Requirement:** Check diagnostic media for malicious code before use.

**Example:** Vendor USB sticks are scanned before connecting to a controller.

**Evidence:** Scan procedure, log

**Id:** 3.7.5

**Family:** Maintenance

**Requirement:** Require MFA for nonlocal maintenance and end sessions when complete.

**Example:** Remote vendor sessions use MFA and are closed after the job.

**Evidence:** Remote maintenance logs

**Id:** 3.7.6

**Family:** Maintenance

**Requirement:** Supervise maintenance personnel who lack required authorization.

**Example:** An escort stays with an uncleared service engineer.

**Evidence:** Escort log

**Id:** 3.8.1

**Family:** Media Protection

**Requirement:** Protect paper and digital media containing CUI.

**Example:** Printed drawings stay in locked cabinets; backups are encrypted.

**Evidence:** Media handling procedure

**Id:** 3.8.2

**Family:** Media Protection

**Requirement:** Limit access to CUI on media to authorized users.

**Example:** Only program staff can open the CUI drawer or share.

**Evidence:** Access list

**Id:** 3.8.3

**Family:** Media Protection

**Requirement:** Sanitize or destroy media before disposal or reuse.

**Example:** Shred paper travelers; wipe or destroy drives.

**Evidence:** Destruction certificates

**Id:** 3.8.4

**Family:** Media Protection

**Requirement:** Mark media with CUI markings and distribution limits.

**Example:** CUI banner on drawings and cover sheets.

**Evidence:** Marked samples

**Id:** 3.8.5

**Family:** Media Protection

**Requirement:** Control access to media and keep accountability in transport outside controlled areas.

**Example:** Tracked courier for shipped drives.

**Evidence:** Transport log

**Id:** 3.8.6

**Family:** Media Protection

**Requirement:** Use cryptography to protect CUI on digital media in transport unless otherwise protected.

**Example:** Encrypted drives for shipping data.

**Evidence:** Encryption evidence

**Id:** 3.8.7

**Family:** Media Protection

**Requirement:** Control the use of removable media.

**Example:** USB ports blocked except for approved devices.

**Evidence:** Endpoint policy

**Id:** 3.8.8

**Family:** Media Protection

**Requirement:** Prohibit portable storage with no identifiable owner.

**Example:** Found USB sticks are turned in, not plugged in.

**Evidence:** Policy

**Id:** 3.8.9

**Family:** Media Protection

**Requirement:** Protect the confidentiality of backup CUI.

**Example:** Backups encrypted and stored with access limits.

**Evidence:** Backup encryption settings

**Id:** 3.9.1

**Family:** Personnel Security

**Requirement:** Screen individuals before authorizing access to CUI.

**Example:** Background check and, where needed, US person verification before hire.

**Evidence:** Screening records

**Id:** 3.9.2

**Family:** Personnel Security

**Requirement:** Protect CUI during and after personnel actions such as terminations and transfers.

**Example:** Same-day account disable and badge return on exit.

**Evidence:** Offboarding checklist

**Id:** 3.10.1

**Family:** Physical Protection

**Requirement:** Limit physical access to systems, equipment and operating environments.

**Example:** Badge control on server room and engineering area.

**Evidence:** Access lists, door controls

**Id:** 3.10.2

**Family:** Physical Protection

**Requirement:** Protect and monitor the physical facility and support infrastructure.

**Example:** Cameras and alarms on entrances and the server room.

**Evidence:** Camera and alarm records

**Id:** 3.10.3

**Family:** Physical Protection

**Requirement:** Escort visitors and monitor their activity.

**Example:** Auditors and customers are escorted on the floor.

**Evidence:** Visitor log

**Id:** 3.10.4

**Family:** Physical Protection

**Requirement:** Maintain audit logs of physical access.

**Example:** Badge system reports retained.

**Evidence:** Badge logs

**Id:** 3.10.5

**Family:** Physical Protection

**Requirement:** Control and manage physical access devices.

**Example:** Key and badge inventory with issue and return records.

**Evidence:** Key register

**Id:** 3.10.6

**Family:** Physical Protection

**Requirement:** Enforce safeguarding at alternate work sites.

**Example:** Rules for home or traveling staff handling CUI.

**Evidence:** Remote work policy

**Id:** 3.11.1

**Family:** Risk Assessment

**Requirement:** Periodically assess risk to operations, assets and individuals from CUI processing.

**Example:** Annual risk assessment covering the plant network.

**Evidence:** Risk assessment report

**Id:** 3.11.2

**Family:** Risk Assessment

**Requirement:** Scan for vulnerabilities periodically and when new ones are identified.

**Example:** Monthly authenticated scan of servers and PCs.

**Evidence:** Scan reports

**Id:** 3.11.3

**Family:** Risk Assessment

**Requirement:** Remediate vulnerabilities in line with risk assessments.

**Example:** Critical findings patched within a defined window.

**Evidence:** Remediation tracking

**Id:** 3.12.1

**Family:** Security Assessment

**Requirement:** Periodically assess the security controls for effectiveness.

**Example:** Annual self-assessment against all 110 requirements.

**Evidence:** Assessment results

**Id:** 3.12.2

**Family:** Security Assessment

**Requirement:** Develop and implement plans of action to fix deficiencies and reduce vulnerabilities.

**Example:** A POA&M with owners and dates.

**Evidence:** POA&M

**Id:** 3.12.3

**Family:** Security Assessment

**Requirement:** Monitor security controls on an ongoing basis.

**Example:** Monthly control checks and metrics.

**Evidence:** Monitoring reports

**Id:** 3.12.4

**Family:** Security Assessment

**Requirement:** Develop, document and update system security plans.

**Example:** SSP describes boundary, controls and connections.

**Evidence:** Current SSP

**Id:** 3.13.1

**Family:** System and Communications Protection

**Requirement:** Monitor, control and protect communications at external and key internal boundaries.

**Example:** Firewall with logging between the internet, office and shop floor.

**Evidence:** Firewall configuration

**Id:** 3.13.2

**Family:** System and Communications Protection

**Requirement:** Use architectural designs and engineering principles that promote security.

**Example:** Segmented network design documented by IT.

**Evidence:** Architecture document

**Id:** 3.13.3

**Family:** System and Communications Protection

**Requirement:** Separate user functionality from system management functionality.

**Example:** Admin consoles reachable only from admin workstations.

**Evidence:** Admin network rules

**Id:** 3.13.4

**Family:** System and Communications Protection

**Requirement:** Prevent unauthorized information transfer via shared system resources.

**Example:** Virtual machine and memory isolation configured.

**Evidence:** Hypervisor settings

**Id:** 3.13.5

**Family:** System and Communications Protection

**Requirement:** Place publicly accessible components in subnetworks separated from internal networks.

**Example:** Public web server sits in a DMZ.

**Evidence:** Network diagram

**Id:** 3.13.6

**Family:** System and Communications Protection

**Requirement:** Deny network traffic by default and allow by exception.

**Example:** Firewall ends in deny all.

**Evidence:** Rule base

**Id:** 3.13.7

**Family:** System and Communications Protection

**Requirement:** Prevent remote devices from simultaneous non-remote and remote connections (split tunneling).

**Example:** VPN forces all traffic through the company gateway.

**Evidence:** VPN client policy

**Id:** 3.13.8

**Family:** System and Communications Protection

**Requirement:** Use cryptography to prevent unauthorized disclosure of CUI in transit.

**Example:** TLS for web, SFTP or encrypted mail for files.

**Evidence:** TLS configuration

**Id:** 3.13.9

**Family:** System and Communications Protection

**Requirement:** End network connections after inactivity or at session end.

**Example:** Idle timeouts on VPN and remote sessions.

**Evidence:** Timeout settings

**Id:** 3.13.10

**Family:** System and Communications Protection

**Requirement:** Establish and manage cryptographic keys.

**Example:** Documented key ownership, rotation and escrow.

**Evidence:** Key management procedure

**Id:** 3.13.11

**Family:** System and Communications Protection

**Requirement:** Use FIPS-validated cryptography when protecting the confidentiality of CUI.

**Example:** FIPS mode enabled or validated modules in use.

**Evidence:** Validation certificate numbers

**Id:** 3.13.12

**Family:** System and Communications Protection

**Requirement:** Prohibit remote activation of collaborative computing devices and indicate use.

**Example:** Conference room cameras and mics cannot be turned on remotely without notice.

**Evidence:** Device settings

**Id:** 3.13.13

**Family:** System and Communications Protection

**Requirement:** Control and monitor the use of mobile code.

**Example:** Macros and scripts from the internet are restricted.

**Evidence:** Office and browser policy

**Id:** 3.13.14

**Family:** System and Communications Protection

**Requirement:** Control and monitor the use of Voice over IP.

**Example:** Voice VLAN and logged call controllers.

**Evidence:** VoIP configuration

**Id:** 3.13.15

**Family:** System and Communications Protection

**Requirement:** Protect the authenticity of communications sessions.

**Example:** Certificates validate the servers users connect to.

**Evidence:** Certificate settings

**Id:** 3.13.16

**Family:** System and Communications Protection

**Requirement:** Protect the confidentiality of CUI at rest.

**Example:** Encrypted file server volumes and laptops.

**Evidence:** Encryption status

**Id:** 3.14.1

**Family:** System and Information Integrity

**Requirement:** Identify, report and correct system flaws in a timely manner.

**Example:** Monthly patch cycle with exceptions logged.

**Evidence:** Patch reports

**Id:** 3.14.2

**Family:** System and Information Integrity

**Requirement:** Provide protection from malicious code at designated locations.

**Example:** Endpoint protection on servers, PCs and email gateway.

**Evidence:** Console coverage report

**Id:** 3.14.3

**Family:** System and Information Integrity

**Requirement:** Monitor security alerts and advisories and take action.

**Example:** IT subscribes to CISA and vendor advisories and records actions.

**Evidence:** Advisory log

**Id:** 3.14.4

**Family:** System and Information Integrity

**Requirement:** Update malicious code protection when new releases are available.

**Example:** Signatures update automatically.

**Evidence:** Update status

**Id:** 3.14.5

**Family:** System and Information Integrity

**Requirement:** Run periodic scans and real-time scans of files from external sources.

**Example:** Scheduled full scans and on-access scanning of downloads.

**Evidence:** Scan settings

**Id:** 3.14.6

**Family:** System and Information Integrity

**Requirement:** Monitor systems, including inbound and outbound traffic, for attacks and indicators.

**Example:** IDS or managed detection on the firewall and endpoints.

**Evidence:** Monitoring tool output

**Id:** 3.14.7

**Family:** System and Information Integrity

**Requirement:** Identify unauthorized use of systems.

**Example:** Alerts for off-hours logons or new devices.

**Evidence:** Alert rules and cases

**Notes:** Requirement wording is paraphrased from NIST SP 800-171 Rev 2, which CMMC Level 2 uses. Check the official text and NIST SP 800-171A assessment objectives for the exact determination statements. Examples are illustrations, not a complete implementation.

## Content

**Intro:** CMMC Level 2 is built on the 110 security requirements in NIST SP 800-171 Rev 2. This list gives you every control by family in one searchable table, with a plain-language example from a machine shop or plant and the evidence an assessor usually asks to see.

**Sections:**

#### How to use the controls list

**Body:** Search by control number, a keyword such as MFA or backup, or a family name. Filter down to one family when you brief the owner of that area, for example the IT lead for Access Control or the facilities manager for Physical Protection. Use the Typical evidence column as your starting evidence request list, then track status in your own self-assessment. Export to Excel or CSV to build a working tracker.

**Bullets:**

- Search a keyword to find every control that touches it
- Filter by family to assign owners
- Export to Excel to add status, owner and due date columns
- Use the evidence column to prepare for assessor questions

#### The 14 families and counts

**Body:** The 110 requirements split into 14 families: Access Control (22), Awareness and Training (3), Audit and Accountability (9), Configuration Management (9), Identification and Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System and Communications Protection (16) and System and Information Integrity (7). Access Control and System and Communications Protection together make up over a third of the total, so they usually deserve the most effort.

#### Controls versus assessment objectives

**Body:** Each of the 110 requirements is assessed through the determination statements in NIST SP 800-171A, roughly 320 in all, and a C3PAO checks every one using examine, interview and test methods. A requirement is met only if all its objectives are met. Read this list for the intent, then use 800-171A for the exact objectives when you write your SSP narratives and gather evidence.

#### Common mistakes

**Body:** Teams often treat the list as a purchase checklist. Many requirements are about written policy plus proof that people follow it, such as access reviews and incident exercises. Another miss is scope: requirements apply to every asset that stores, processes or transmits CUI, plus security protection assets, not only the file server. Finally, wording matters, so confirm anything marked FIPS or MFA against the official text.

**Bullets:**

- Do not rely on a tool alone without a documented procedure
- Scope the assets before scoring any control
- Collect dated evidence, not just screenshots of settings

**Cta:** Netray adds a private AI layer on your on-prem systems, which can help you search your own policies and evidence against this list without sending anything to a public AI service. Ask if you want that set up inside your boundary.

**Faq:**

#### How many controls are in CMMC Level 2?

**Answer:** CMMC Level 2 aligns to the 110 security requirements of NIST SP 800-171 Rev 2, organized into 14 families. Each requirement is assessed against several objectives from NIST SP 800-171A, so the working assessment is larger than 110 line items.

#### What are the 14 control families?

**Answer:** Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

#### Is this list the official text?

**Answer:** No. The wording here is a paraphrase to help planning. For an assessment, work from the official NIST SP 800-171 Rev 2 text and the 800-171A objectives, and confirm the current CMMC program rules with the Cyber AB or DoD guidance.

#### Can I download the controls as a spreadsheet or PDF?

**Answer:** Yes. Use the export buttons to download the full table as Excel, CSV or PDF, and add your own status, owner and evidence columns in Excel to run your self-assessment.

## Search terms

cmmc level 2 controls list, cmmc level 2 control families, cmmc level 2 controls spreadsheet, cmmc level 2 controls pdf, cmmc level 2 controls and objectives, 110 controls nist 800-171, cmmc level 2 requirements list

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json