CMMC Level 2 traced to SP 800-53: what NIST's Appendix D tells you

The US Department of Defense's CMMC programme is now rolling out through defence contracts, and Level 2 is where most contractors handling Controlled Unclassified Information land. Level 2 is the 110 security requirements of NIST SP 800-171 Revision 2, and those requirements were derived from SP 800-53, the federal control catalogue. NIST documented exactly how, in Appendix D of SP 800-171 Rev 2.

That mapping is the most useful single document for a contractor that already follows 800-53, and it's the backbone of how ControlMapping links CMMC to everything else.

How complete the trace is

Of the 110 CMMC practices, 109 (99%) map to something in 800-53, 0 are only loosely related and 1 have no mapping in our data. Open the gap report →

All but one CMMC Level 2 practice maps to an SP 800-53 control we list. The links come from NIST's own Appendix D, so they are labelled crosswalk.

By family

CMMC section	Mapped	Loosely related	No mapping
AC Access Control	22 of 22	0	0
AT Awareness and Training	3 of 3	0	0
AU Audit and Accountability	9 of 9	0	0
CA Security Assessment	4 of 4	0	0
CM Configuration Management	9 of 9	0	0
IA Identification and Authentication	11 of 11	0	0
IR Incident Response	3 of 3	0	0
MA Maintenance	6 of 6	0	0
MP Media Protection	9 of 9	0	0
PE Physical Protection	6 of 6	0	0
PS Personnel Security	2 of 2	0	0
RA Risk Assessment	3 of 3	0	0
SC System and Communications Protection	15 of 16	0	1
SI System and Information Integrity	7 of 7	0	0

Have 800-53, need CMMC. Requirement by requirement: open the gap report →

How Appendix D works

Appendix D has a table for each of the 14 requirement families, listing each requirement beside the 800-53 controls it came from. Two details matter when you use it:

• Basic requirements are mapped jointly. In each family, the "basic" requirements (taken from FIPS 200) share one merged cell of 800-53 controls. For example, 3.1.1 and 3.1.2 both trace to AC-2, AC-3 and AC-17. "Derived" requirements have their own rows.
• The IDs are SP 800-53 Revision 4. Most carry over to Revision 5 unchanged. Seven were withdrawn in Rev 5 and folded into other controls; NIST's Rev 5 catalogue says where each went (for example, AU-8(1) moved to SC-45(1), and MP-5(4) was incorporated into SC-28(1)). We follow those links.

The one practice without a match

SC.L2-3.13.14 requires you to control and monitor Voice over Internet Protocol. Appendix D maps it to SC-19, which NIST withdrew in Rev 5 with no successor: VoIP is now treated like any other technology, under the general boundary and communications controls. So in a Rev 5 world, this CMMC practice has no dedicated 800-53 control, though SC-7 and SC-8 cover most of its substance.

Going the other way

Of the 300 800-53 base controls, 114 (38%) map to something in CMMC, 78 are only loosely related and 108 have no mapping in our data. Open the gap report →

Most of SP 800-53 has no CMMC counterpart, and that's by design. SP 800-171 selects the controls relevant to protecting CUI confidentiality in non-federal systems and leaves out the rest: privacy controls, federal-specific programme management, many enhancements, and controls the "Non-Federal Organization" baseline assumes you do anyway (the -1 policy controls among them).

What it means for contractors

1. If you run an 800-53 moderate baseline, you have most of the substance. Your work is evidence in CMMC's format, a System Security Plan scoped to CUI, and an assessment.
2. Use Appendix D to reuse evidence. For each practice, the listed 800-53 controls tell you which of your existing control evidence applies.
3. Watch the Rev 2 to Rev 3 gap. NIST's Revision 3 rewrote several requirements, but CMMC remains pinned to Revision 2. Assess against what your contract requires.

The CMMC → SP 800-53 gap report lists every practice with its Appendix D controls, and the CMMC vs SP 800-53 comparison covers both directions. CMMC practice names on this site are DoD's; the requirement text is NIST's (public domain).

Questions

Is CMMC Level 2 the same as NIST SP 800-171?

Level 2 is the 110 security requirements of SP 800-171 Revision 2, assessed under DoD's CMMC rules with its own practice names. NIST has published Revision 3, but CMMC remains pinned to Revision 2.

Which CMMC practice has no SP 800-53 Rev 5 match?

SC.L2-3.13.14 (control and monitor Voice over IP). Appendix D maps it to SC-19, which NIST withdrew in Rev 5 without a successor, as VoIP is now handled like any other technology.