Compliance & ContractsFree referencePDF, Excel, Word exportDefense Electronics

CMMC Level 2 Controls List: All 110 Requirements by Family

CMMC Level 2 is built on the 110 security requirements in NIST SP 800-171 Rev 2. This list gives you every control by family in one searchable table, with a plain-language example from a machine shop or plant and the evidence an assessor usually asks to see.

Download:

Control	Family	Requirement (paraphrased)	Manufacturing example	Typical evidence
3.1.1	Access Control	Limit system access to authorized users, processes and devices.	Only named staff accounts and registered CNC and inspection PCs can reach the CUI file share.	Account list, group membership export, device inventory
3.1.2	Access Control	Limit access to the transactions and functions each user is permitted.	Buyers see PO screens in the ERP but not engineering drawing vaults.	ERP role matrix, permission screenshots
3.1.3	Access Control	Control the flow of CUI per approved authorizations.	Drawings may go to approved subcontractors only through the managed portal, not personal email.	Data flow diagram, DLP or mail rules
3.1.4	Access Control	Separate duties to reduce the risk of malicious activity.	The person who approves a PLM release is not the one who administers the vault.	Role definitions, access review record
3.1.5	Access Control	Apply least privilege, including to privileged accounts.	Machinists have no local admin on HMI or CAM workstations.	Admin group list, privilege review
3.1.6	Access Control	Use non-privileged accounts for non-security functions.	IT admins read email with a standard account and elevate only for changes.	Account naming standard, sample logon records
3.1.7	Access Control	Block non-privileged users from privileged functions and log such attempts.	A standard user cannot install software on the quality lab PC and the attempt is logged.	Group policy settings, event log sample
3.1.8	Access Control	Limit unsuccessful logon attempts.	Five bad passwords lock the account for a set period.	Lockout policy export
3.1.9	Access Control	Show privacy and security notices consistent with CUI rules.	Logon banner on every workstation and VPN stating authorized use only.	Banner screenshot, GPO setting
3.1.10	Access Control	Lock sessions after a period of inactivity with a pattern-hiding display.	Office and engineering PCs lock after 10 to 15 minutes idle.	Screen lock policy
3.1.11	Access Control	End a user session after a defined condition.	VPN and remote desktop sessions drop after a fixed idle or maximum time.	VPN and RDS configuration
3.1.12	Access Control	Monitor and control remote access sessions.	Vendor support to a machine tool goes through a logged jump host.	Remote access logs, procedure
3.1.13	Access Control	Use cryptography to protect remote access sessions.	Remote staff connect over an encrypted VPN, not open RDP.	VPN cipher settings
3.1.14	Access Control	Route remote access through managed access control points.	One VPN gateway is the only door in from the internet.	Network diagram, firewall rules
3.1.15	Access Control	Authorize remote execution of privileged commands and remote access to security data.	Only named admins may run admin tools remotely, with approval on file.	Approval record, access list
3.1.16	Access Control	Authorize wireless access before allowing connections.	Shop floor Wi-Fi accepts only registered tablets.	Wireless policy, authorized device list
3.1.17	Access Control	Protect wireless access with authentication and encryption.	WPA2 or WPA3 Enterprise with certificates on the plant network.	Wireless controller settings
3.1.18	Access Control	Control connection of mobile devices.	Phones that read company email are enrolled in MDM.	MDM enrollment list, policy
3.1.19	Access Control	Encrypt CUI on mobile devices and mobile computing platforms.	Laptops used for first article reviews have full disk encryption.	Encryption status report
3.1.20	Access Control	Verify and control connections to external systems.	The link to a prime's supplier portal or a cloud MES is documented and approved.	External connection register
3.1.21	Access Control	Limit use of organizational portable storage on external systems.	Company USB drives are not plugged into customer or personal PCs.	Policy, endpoint control settings
3.1.22	Access Control	Control CUI posted or processed on publicly accessible systems.	Marketing reviews website and social posts so drawings never appear.	Review procedure, posting approvals
3.2.1	Awareness and Training	Make managers and users aware of security risks and applicable policies.	Annual briefing covers handling export-controlled drawings.	Training deck, attendance
3.2.2	Awareness and Training	Train personnel to carry out their assigned security duties.	The IT admin and the program manager each have role training records.	Role-based training records
3.2.3	Awareness and Training	Provide insider threat awareness training.	A short module on spotting unusual data copying or access.	Module content, completion list
3.3.1	Audit and Accountability	Create and retain system audit logs to support monitoring and investigation.	File server, firewall, VPN and domain controller logs kept for a set period.	Log retention settings, sample logs
3.3.2	Audit and Accountability	Make each user's actions uniquely traceable.	No shared logons on the quality or engineering systems.	Unique ID policy, log sample
3.3.3	Audit and Accountability	Review and update logged events.	Quarterly check that the right events are still being captured.	Log scope review record
3.3.4	Audit and Accountability	Alert when audit logging fails.	An alert fires if the log collector stops receiving events.	Alert rule, test result
3.3.5	Audit and Accountability	Correlate audit review, analysis and reporting for suspicious activity.	A SIEM or managed service links VPN logons with file access.	Correlation rules, review reports
3.3.6	Audit and Accountability	Provide audit reduction and report generation.	Searchable log platform produces on-demand reports for an incident.	Sample report, search query
3.3.7	Audit and Accountability	Synchronize system clocks with an authoritative time source.	All servers and CNC-connected PCs use the domain time source.	NTP configuration
3.3.8	Audit and Accountability	Protect audit information and tools from unauthorized access, change and deletion.	Log store is write-protected from ordinary admins.	Permissions on log store
3.3.9	Audit and Accountability	Limit management of audit logging to a subset of privileged users.	Only the security admin group can change log settings.	Group membership
3.4.1	Configuration Management	Establish and maintain baseline configurations and inventories.	Hardware and software list covering servers, PCs, CNC controllers on the network.	Asset inventory, baseline images
3.4.2	Configuration Management	Establish and enforce security configuration settings.	CIS or DISA STIG style hardening applied to Windows hosts.	Hardening standard, scan results
3.4.3	Configuration Management	Track, review, approve or disapprove, and log changes.	Firewall and server changes go through a ticket with approval.	Change tickets
3.4.4	Configuration Management	Analyze the security impact of changes before implementation.	A new MES connector is reviewed for data flow before go-live.	Impact review notes
3.4.5	Configuration Management	Define and enforce physical and logical access restrictions on changes.	Only the admin group can edit server configuration.	Admin rights list
3.4.6	Configuration Management	Provide only essential capabilities (least functionality).	Machine-side PCs run only the CAM or DNC software they need.	Baseline software list
3.4.7	Configuration Management	Restrict or disable nonessential programs, functions, ports, protocols and services.	Disable SMBv1, unused ports and default services.	Port scan, service configuration
3.4.8	Configuration Management	Apply deny-by-exception or permit-by-exception software policy.	Application allow-listing on engineering workstations.	Allow-list policy export
3.4.9	Configuration Management	Control and monitor user-installed software.	Users cannot install apps; exceptions are logged.	Install restrictions, exception log
3.5.1	Identification and Authentication	Identify users, processes acting for users, and devices.	Every person and managed device has a unique identity in the directory.	Directory export
3.5.2	Identification and Authentication	Authenticate identities before allowing access.	Logon is required on ERP, PLM and file systems.	Authentication settings
3.5.3	Identification and Authentication	Use multifactor authentication for local and network access to privileged accounts and network access to non-privileged accounts.	MFA on VPN, email, cloud and admin logons.	MFA policy and enrollment report
3.5.4	Identification and Authentication	Use replay-resistant authentication for network access.	Kerberos or modern token-based sign-in rather than plain challenge reuse.	Protocol configuration
3.5.5	Identification and Authentication	Prevent reuse of identifiers for a defined period.	A departed employee's username is not reissued.	Account naming procedure
3.5.6	Identification and Authentication	Disable identifiers after a defined period of inactivity.	Accounts idle for 90 days are disabled.	Inactivity script or policy
3.5.7	Identification and Authentication	Enforce minimum password complexity and character change on new passwords.	Length and complexity rules set in the domain policy.	Password policy
3.5.8	Identification and Authentication	Prohibit password reuse for a set number of generations.	Password history remembers prior passwords.	Password history setting
3.5.9	Identification and Authentication	Allow temporary passwords only with immediate change to a permanent one.	New hire or reset passwords force change at first logon.	Reset procedure, setting
3.5.10	Identification and Authentication	Store and transmit only cryptographically protected passwords.	No passwords in plain text files or spreadsheets.	Hashing configuration, scan
3.5.11	Identification and Authentication	Obscure feedback of authentication information.	Password fields mask characters on all systems.	Screenshot of logon
3.6.1	Incident Response	Establish an incident handling capability covering preparation, detection, analysis, containment, recovery and response.	Written plan with roles for IT, quality and management.	Incident response plan
3.6.2	Incident Response	Track, document and report incidents to designated officials and authorities.	Incident log and DoD reporting path for cyber incidents under DFARS 252.204-7012.	Incident log, reporting procedure
3.6.3	Incident Response	Test the incident response capability.	A yearly tabletop on a ransomware event at the plant.	Exercise report
3.7.1	Maintenance	Perform maintenance on systems.	Patching and hardware service are scheduled and recorded.	Maintenance log
3.7.2	Maintenance	Control tools, techniques, mechanisms and personnel used for maintenance.	Approved vendor technicians and approved diagnostic tools only.	Approved tool and vendor list
3.7.3	Maintenance	Sanitize equipment removed for off-site maintenance of CUI.	Wipe drives before a server or CNC controller leaves the site.	Sanitization record
3.7.4	Maintenance	Check diagnostic media for malicious code before use.	Vendor USB sticks are scanned before connecting to a controller.	Scan procedure, log
3.7.5	Maintenance	Require MFA for nonlocal maintenance and end sessions when complete.	Remote vendor sessions use MFA and are closed after the job.	Remote maintenance logs
3.7.6	Maintenance	Supervise maintenance personnel who lack required authorization.	An escort stays with an uncleared service engineer.	Escort log
3.8.1	Media Protection	Protect paper and digital media containing CUI.	Printed drawings stay in locked cabinets; backups are encrypted.	Media handling procedure
3.8.2	Media Protection	Limit access to CUI on media to authorized users.	Only program staff can open the CUI drawer or share.	Access list
3.8.3	Media Protection	Sanitize or destroy media before disposal or reuse.	Shred paper travelers; wipe or destroy drives.	Destruction certificates
3.8.4	Media Protection	Mark media with CUI markings and distribution limits.	CUI banner on drawings and cover sheets.	Marked samples
3.8.5	Media Protection	Control access to media and keep accountability in transport outside controlled areas.	Tracked courier for shipped drives.	Transport log
3.8.6	Media Protection	Use cryptography to protect CUI on digital media in transport unless otherwise protected.	Encrypted drives for shipping data.	Encryption evidence
3.8.7	Media Protection	Control the use of removable media.	USB ports blocked except for approved devices.	Endpoint policy
3.8.8	Media Protection	Prohibit portable storage with no identifiable owner.	Found USB sticks are turned in, not plugged in.	Policy
3.8.9	Media Protection	Protect the confidentiality of backup CUI.	Backups encrypted and stored with access limits.	Backup encryption settings
3.9.1	Personnel Security	Screen individuals before authorizing access to CUI.	Background check and, where needed, US person verification before hire.	Screening records
3.9.2	Personnel Security	Protect CUI during and after personnel actions such as terminations and transfers.	Same-day account disable and badge return on exit.	Offboarding checklist
3.10.1	Physical Protection	Limit physical access to systems, equipment and operating environments.	Badge control on server room and engineering area.	Access lists, door controls
3.10.2	Physical Protection	Protect and monitor the physical facility and support infrastructure.	Cameras and alarms on entrances and the server room.	Camera and alarm records
3.10.3	Physical Protection	Escort visitors and monitor their activity.	Auditors and customers are escorted on the floor.	Visitor log
3.10.4	Physical Protection	Maintain audit logs of physical access.	Badge system reports retained.	Badge logs
3.10.5	Physical Protection	Control and manage physical access devices.	Key and badge inventory with issue and return records.	Key register
3.10.6	Physical Protection	Enforce safeguarding at alternate work sites.	Rules for home or traveling staff handling CUI.	Remote work policy
3.11.1	Risk Assessment	Periodically assess risk to operations, assets and individuals from CUI processing.	Annual risk assessment covering the plant network.	Risk assessment report
3.11.2	Risk Assessment	Scan for vulnerabilities periodically and when new ones are identified.	Monthly authenticated scan of servers and PCs.	Scan reports
3.11.3	Risk Assessment	Remediate vulnerabilities in line with risk assessments.	Critical findings patched within a defined window.	Remediation tracking
3.12.1	Security Assessment	Periodically assess the security controls for effectiveness.	Annual self-assessment against all 110 requirements.	Assessment results
3.12.2	Security Assessment	Develop and implement plans of action to fix deficiencies and reduce vulnerabilities.	A POA&M with owners and dates.	POA&M
3.12.3	Security Assessment	Monitor security controls on an ongoing basis.	Monthly control checks and metrics.	Monitoring reports
3.12.4	Security Assessment	Develop, document and update system security plans.	SSP describes boundary, controls and connections.	Current SSP
3.13.1	System and Communications Protection	Monitor, control and protect communications at external and key internal boundaries.	Firewall with logging between the internet, office and shop floor.	Firewall configuration
3.13.2	System and Communications Protection	Use architectural designs and engineering principles that promote security.	Segmented network design documented by IT.	Architecture document
3.13.3	System and Communications Protection	Separate user functionality from system management functionality.	Admin consoles reachable only from admin workstations.	Admin network rules
3.13.4	System and Communications Protection	Prevent unauthorized information transfer via shared system resources.	Virtual machine and memory isolation configured.	Hypervisor settings
3.13.5	System and Communications Protection	Place publicly accessible components in subnetworks separated from internal networks.	Public web server sits in a DMZ.	Network diagram
3.13.6	System and Communications Protection	Deny network traffic by default and allow by exception.	Firewall ends in deny all.	Rule base
3.13.7	System and Communications Protection	Prevent remote devices from simultaneous non-remote and remote connections (split tunneling).	VPN forces all traffic through the company gateway.	VPN client policy
3.13.8	System and Communications Protection	Use cryptography to prevent unauthorized disclosure of CUI in transit.	TLS for web, SFTP or encrypted mail for files.	TLS configuration
3.13.9	System and Communications Protection	End network connections after inactivity or at session end.	Idle timeouts on VPN and remote sessions.	Timeout settings
3.13.10	System and Communications Protection	Establish and manage cryptographic keys.	Documented key ownership, rotation and escrow.	Key management procedure
3.13.11	System and Communications Protection	Use FIPS-validated cryptography when protecting the confidentiality of CUI.	FIPS mode enabled or validated modules in use.	Validation certificate numbers
3.13.12	System and Communications Protection	Prohibit remote activation of collaborative computing devices and indicate use.	Conference room cameras and mics cannot be turned on remotely without notice.	Device settings
3.13.13	System and Communications Protection	Control and monitor the use of mobile code.	Macros and scripts from the internet are restricted.	Office and browser policy
3.13.14	System and Communications Protection	Control and monitor the use of Voice over IP.	Voice VLAN and logged call controllers.	VoIP configuration
3.13.15	System and Communications Protection	Protect the authenticity of communications sessions.	Certificates validate the servers users connect to.	Certificate settings
3.13.16	System and Communications Protection	Protect the confidentiality of CUI at rest.	Encrypted file server volumes and laptops.	Encryption status
3.14.1	System and Information Integrity	Identify, report and correct system flaws in a timely manner.	Monthly patch cycle with exceptions logged.	Patch reports
3.14.2	System and Information Integrity	Provide protection from malicious code at designated locations.	Endpoint protection on servers, PCs and email gateway.	Console coverage report
3.14.3	System and Information Integrity	Monitor security alerts and advisories and take action.	IT subscribes to CISA and vendor advisories and records actions.	Advisory log
3.14.4	System and Information Integrity	Update malicious code protection when new releases are available.	Signatures update automatically.	Update status
3.14.5	System and Information Integrity	Run periodic scans and real-time scans of files from external sources.	Scheduled full scans and on-access scanning of downloads.	Scan settings
3.14.6	System and Information Integrity	Monitor systems, including inbound and outbound traffic, for attacks and indicators.	IDS or managed detection on the firewall and endpoints.	Monitoring tool output
3.14.7	System and Information Integrity	Identify unauthorized use of systems.	Alerts for off-hours logons or new devices.	Alert rules and cases

Requirement wording is paraphrased from NIST SP 800-171 Rev 2, which CMMC Level 2 uses. Check the official text and NIST SP 800-171A assessment objectives for the exact determination statements. Examples are illustrations, not a complete implementation.

Want your evidence searchable on-prem?

We can show how a private AI layer indexes your policies and evidence inside your own network. Optional, no obligation.

Optional. The tool and every export work without this. No spam.

How to use the controls list

Search by control number, a keyword such as MFA or backup, or a family name. Filter down to one family when you brief the owner of that area, for example the IT lead for Access Control or the facilities manager for Physical Protection. Use the Typical evidence column as your starting evidence request list, then track status in your own self-assessment. Export to Excel or CSV to build a working tracker.

Search a keyword to find every control that touches it
Filter by family to assign owners
Export to Excel to add status, owner and due date columns
Use the evidence column to prepare for assessor questions

The 14 families and counts

The 110 requirements split into 14 families: Access Control (22), Awareness and Training (3), Audit and Accountability (9), Configuration Management (9), Identification and Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System and Communications Protection (16) and System and Information Integrity (7). Access Control and System and Communications Protection together make up over a third of the total, so they usually deserve the most effort.

Controls versus assessment objectives

Each of the 110 requirements is assessed through the determination statements in NIST SP 800-171A, roughly 320 in all, and a C3PAO checks every one using examine, interview and test methods. A requirement is met only if all its objectives are met. Read this list for the intent, then use 800-171A for the exact objectives when you write your SSP narratives and gather evidence.

Common mistakes

Teams often treat the list as a purchase checklist. Many requirements are about written policy plus proof that people follow it, such as access reviews and incident exercises. Another miss is scope: requirements apply to every asset that stores, processes or transmits CUI, plus security protection assets, not only the file server. Finally, wording matters, so confirm anything marked FIPS or MFA against the official text.

Do not rely on a tool alone without a documented procedure
Scope the assets before scoring any control
Collect dated evidence, not just screenshots of settings

Frequently Asked Questions

How many controls are in CMMC Level 2?

CMMC Level 2 aligns to the 110 security requirements of NIST SP 800-171 Rev 2, organized into 14 families. Each requirement is assessed against several objectives from NIST SP 800-171A, so the working assessment is larger than 110 line items.

What are the 14 control families?

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Is this list the official text?

No. The wording here is a paraphrase to help planning. For an assessment, work from the official NIST SP 800-171 Rev 2 text and the 800-171A objectives, and confirm the current CMMC program rules with the Cyber AB or DoD guidance.

Can I download the controls as a spreadsheet or PDF?

Yes. Use the export buttons to download the full table as Excel, CSV or PDF, and add your own status, owner and evidence columns in Excel to run your self-assessment.

Netray adds a private AI layer on your on-prem systems, which can help you search your own policies and evidence against this list without sending anything to a public AI service. Ask if you want that set up inside your boundary.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools

Keep exploring

Free tools

Guides

AI on your ERP

TermsNIST SP 800-171 CMMC (Cybersecurity Maturity Model Certification)Item Revision