Comparison
CMMC vs CPS 234
CMMC Level 2 · APRA CPS 234 Information Security · data 2026-10-27
Requirement-level comparison of CMMC Level 2 and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 24 APRA CPS 234 Information Security requirements, 17 map to something in CMMC, 3 are only loosely related, and 4 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to CMMC (4)
| CPS 234 | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 1 | ||||
| Para 14 | Define information security roles and responsibilities | No mapping in our data | — | No mapping to CMMC in our data. |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | No mapping in our data | — | No mapping to CMMC in our data. |
| Para 19 | Policies direct everyone with security obligations | No mapping in our data | — | No mapping to CMMC in our data. |
| Testing control effectiveness · 1 | ||||
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to CMMC in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (3)
| CPS 234 | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| Information security capability · 1 | ||||
| Para 16 | Assess third parties' information security capability | RA.L2-3.11.1CA.L2-3.12.3CM.L2-3.4.9+2 | Only shares CSF GV.SC-03, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| Implementation of controls · 1 | ||||
| Para 22 | Evaluate the design of third parties' controls | RA.L2-3.11.1CA.L2-3.12.3CM.L2-3.4.9+2 | Only shares CSF GV.SC-03, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| Testing control effectiveness · 1 | ||||
| Para 28 | Check third parties' control testing is adequate | RA.L2-3.11.1CA.L2-3.12.3CM.L2-3.4.9+2 | Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10…: related, not a mapping | |
Mapped (17)
| CPS 234 | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 1 | ||||
| Para 13 | Board ultimately responsible for information security | Editorial | RA.L2-3.11.1 | Same topic: Risk Management (editorial pick) |
| Information security capability · 2 | ||||
| Para 15 | Maintain a capability commensurate with threats | Editorial | RA.L2-3.11.1 | Same topic: Risk Management (editorial pick) |
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | RA.L2-3.11.1RA.L2-3.11.2RA.L2-3.11.3+1 | Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | CM.L2-3.4.1MP.L2-3.8.4 | Same topic: Asset Management, Data Classification (editorial pick) |
| Implementation of controls · 1 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | MP.L2-3.8.3RA.L2-3.11.1SC.L2-3.13.16 | Same topic: Data Protection, Risk Assessment (editorial pick) |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | Editorial | IR.L2-3.6.1IR.L2-3.6.3SI.L2-3.14.6 | Same topic: Incident Response, Intrusion Detection (editorial pick) |
| Para 24 | Maintain information security response plans | Editorial | IR.L2-3.6.1IR.L2-3.6.3 | Same topic: Incident Response (editorial pick) |
| Para 25 | Response plans cover all stages and escalation | Editorial | IR.L2-3.6.1IR.L2-3.6.2IR.L2-3.6.3 | Same topic: Incident Response, Lessons Learned, Communication (editorial pick) |
| Para 26 | Review and test response plans annually | Editorial | IR.L2-3.6.1IR.L2-3.6.3 | Same topic: Incident Response (editorial pick) |
| Testing control effectiveness · 3 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | RA.L2-3.11.1RA.L2-3.11.2RA.L2-3.11.3 | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | RA.L2-3.11.2RA.L2-3.11.3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 31 | Review the testing programme at least annually | Editorial | RA.L2-3.11.1 | Same topic: Risk Management (editorial pick) |
| Internal audit · 3 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | Editorial | CA.L2-3.12.1 | Same topic: Compliance (editorial pick) |
| Para 33 | Assurance provided by appropriately skilled personnel | Editorial | CA.L2-3.12.1 | Same topic: Compliance (editorial pick) |
| Para 34 | Internal audit assesses third-party assurance relied on | Editorial | CA.L2-3.12.1 | Same topic: Compliance (editorial pick) |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | Editorial | IR.L2-3.6.2 | Same topic: Reporting (editorial pick) |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | Editorial | IR.L2-3.6.2 | Same topic: Reporting (editorial pick) |
Of 110 CMMC Level 2 requirements, 13 map to something in CPS 234, 33 are only loosely related, and 64 have no mapping in our data.
Likely new work: CMMC requirements with no mapping to CPS 234 (64)
| CMMC | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| AC Access Control · 15 | ||||
| AC.L2-3.1.4 | Separation of Duties | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.5 | Least Privilege | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.6 | Non-Privileged Account Use | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.7 | Privileged Functions | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.8 | Unsuccessful Logon Attempts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.9 | Privacy & Security Notices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.10 | Session Lock | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.11 | Session Termination | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.12 | Control Remote Access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.14 | Remote Access Routing | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.15 | Privileged Remote Access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.16 | Wireless Access Authorization | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.17 | Wireless Access Protection | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.18 | Mobile Device Connection | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AC.L2-3.1.22 | Control Public Information | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AT Awareness and Training · 3 | ||||
| AT.L2-3.2.1 | Role-Based Risk Awareness | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AT.L2-3.2.2 | Role-Based Training | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AT.L2-3.2.3 | Insider Threat Awareness | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AU Audit and Accountability · 5 | ||||
| AU.L2-3.3.1 | System Auditing | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AU.L2-3.3.2 | User Accountability | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AU.L2-3.3.4 | Audit Failure Alerting | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AU.L2-3.3.6 | Reduction & Reporting | No mapping in our data | — | No mapping to CPS 234 in our data. |
| AU.L2-3.3.7 | Authoritative Time Source | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CA Security Assessment · 1 | ||||
| CA.L2-3.12.2 | Plan of Action | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CM Configuration Management · 6 | ||||
| CM.L2-3.4.2 | Security Configuration Enforcement | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CM.L2-3.4.4 | Security Impact Analysis | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CM.L2-3.4.5 | Access Restrictions for Change | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CM.L2-3.4.6 | Least Functionality | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CM.L2-3.4.7 | Nonessential Functionality | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CM.L2-3.4.8 | Application Execution Policy | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA Identification and Authentication · 11 | ||||
| IA.L2-3.5.1 | Identification | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.2 | Authentication | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.3 | Multifactor Authentication | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.4 | Replay-Resistant Authentication | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.5 | Identifier Reuse | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.6 | Identifier Handling | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.7 | Password Complexity | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.8 | Password Reuse | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.9 | Temporary Passwords | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.10 | Cryptographically-Protected Passwords | No mapping in our data | — | No mapping to CPS 234 in our data. |
| IA.L2-3.5.11 | Obscure Feedback | No mapping in our data | — | No mapping to CPS 234 in our data. |
| MA Maintenance · 4 | ||||
| MA.L2-3.7.2 | System Maintenance Control | No mapping in our data | — | No mapping to CPS 234 in our data. |
| MA.L2-3.7.4 | Media Inspection | No mapping in our data | — | No mapping to CPS 234 in our data. |
| MA.L2-3.7.5 | Nonlocal Maintenance | No mapping in our data | — | No mapping to CPS 234 in our data. |
| MA.L2-3.7.6 | Maintenance Personnel | No mapping in our data | — | No mapping to CPS 234 in our data. |
| MP Media Protection · 4 | ||||
| MP.L2-3.8.1 | Media Protection | No mapping in our data | — | No mapping to CPS 234 in our data. |
| MP.L2-3.8.2 | Media Access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| MP.L2-3.8.7 | Removable Media | No mapping in our data | — | No mapping to CPS 234 in our data. |
| MP.L2-3.8.8 | Shared Media | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PE Physical Protection · 6 | ||||
| PE.L2-3.10.1 | Limit Physical Access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PE.L2-3.10.2 | Monitor Facility | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PE.L2-3.10.3 | Escort Visitors | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PE.L2-3.10.4 | Physical Access Logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PE.L2-3.10.5 | Manage Physical Access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PE.L2-3.10.6 | Alternative Work Sites | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PS Personnel Security · 2 | ||||
| PS.L2-3.9.1 | Screen Individuals | No mapping in our data | — | No mapping to CPS 234 in our data. |
| PS.L2-3.9.2 | Personnel Actions | No mapping in our data | — | No mapping to CPS 234 in our data. |
| SC System and Communications Protection · 6 | ||||
| SC.L2-3.13.7 | Split Tunneling | No mapping in our data | — | No mapping to CPS 234 in our data. |
| SC.L2-3.13.9 | Connections Termination | No mapping in our data | — | No mapping to CPS 234 in our data. |
| SC.L2-3.13.12 | Collaborative Device Control | No mapping in our data | — | No mapping to CPS 234 in our data. |
| SC.L2-3.13.13 | Mobile Code | No mapping in our data | — | No mapping to CPS 234 in our data. |
| SC.L2-3.13.14 | Voice over Internet Protocol | No mapping in our data | — | No mapping to CPS 234 in our data. |
| SC.L2-3.13.15 | Communications Authenticity | No mapping in our data | — | No mapping to CPS 234 in our data. |
| SI System and Information Integrity · 1 | ||||
| SI.L2-3.14.1 | Flaw Remediation | No mapping in our data | — | No mapping to CPS 234 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (33)
| CMMC | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| AC Access Control · 7 | ||||
| AC.L2-3.1.1 | Authorized Access Control | Para 21Para 23 | Only shares CSF PR.DS-10, DE.CM-01: related, not a mapping | |
| AC.L2-3.1.2 | Transaction & Function Control | Para 21 | Only shares CSF PR.DS-10: related, not a mapping | |
| AC.L2-3.1.3 | Control CUI Flow | Para 21 | Only shares CSF PR.DS-10: related, not a mapping | |
| AC.L2-3.1.13 | Remote Access Confidentiality | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| AC.L2-3.1.19 | Encrypt CUI on Mobile | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| AC.L2-3.1.20 | External Connections | Para 20 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| AC.L2-3.1.21 | Portable Storage Use | Para 20 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| AU Audit and Accountability · 4 | ||||
| AU.L2-3.3.3 | Event Review | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| AU.L2-3.3.5 | Audit Correlation | Para 23 | Only shares CSF DE.AE-02: related, not a mapping | |
| AU.L2-3.3.8 | Audit Protection | Para 21 | Only shares CSF PR.DS-10: related, not a mapping | |
| AU.L2-3.3.9 | Audit Management | Para 21 | Only shares CSF PR.DS-10: related, not a mapping | |
| CA Security Assessment · 2 | ||||
| CA.L2-3.12.3 | Security Control Monitoring | Para 23Para 16Para 17+5 | Only shares CSF DE.AE-02, DE.CM-01, DE.CM-06, ID.RA-01: related, not a mapping | |
| CA.L2-3.12.4 | System Security Plan | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| CM Configuration Management · 2 | ||||
| CM.L2-3.4.3 | System Change Management | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| CM.L2-3.4.9 | User-Installed Software | Para 23Para 16Para 17+5 | Only shares CSF DE.AE-02, DE.CM-01, DE.CM-06, ID.RA-01: related, not a mapping | |
| MA Maintenance · 2 | ||||
| MA.L2-3.7.1 | Perform Maintenance | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| MA.L2-3.7.3 | Equipment Sanitization | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| MP Media Protection · 3 | ||||
| MP.L2-3.8.5 | Media Accountability | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| MP.L2-3.8.6 | Portable Storage Encryption | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| MP.L2-3.8.9 | Protect Backups | Para 21 | Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping | |
| SC System and Communications Protection · 9 | ||||
| SC.L2-3.13.1 | Boundary Protection | Para 21Para 23 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01: related, not a mapping | |
| SC.L2-3.13.2 | Security Engineering | Para 21Para 20Para 23 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, ID.AM-08…: related, not a mapping | |
| SC.L2-3.13.3 | Role Separation | Para 21Para 23 | Only shares CSF PR.DS-10, DE.CM-01: related, not a mapping | |
| SC.L2-3.13.4 | Shared Resource Control | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SC.L2-3.13.5 | Public-Access System Separation | Para 21Para 23 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01: related, not a mapping | |
| SC.L2-3.13.6 | Network Communication by Exception | Para 21Para 23 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01: related, not a mapping | |
| SC.L2-3.13.8 | Data in Transit | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| SC.L2-3.13.10 | Key Management | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| SC.L2-3.13.11 | CUI Encryption | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SI System and Information Integrity · 4 | ||||
| SI.L2-3.14.2 | Malicious Code Protection | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SI.L2-3.14.4 | Update Malicious Code Protection | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SI.L2-3.14.5 | System & File Scanning | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SI.L2-3.14.7 | Identify Unauthorized Use | Para 21Para 23Para 16+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, DE.AE-02…: related, not a mapping | |
Mapped (13)
| CMMC | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| CA Security Assessment · 1 | ||||
| CA.L2-3.12.1 | Security Control Assessment | Editorial | Para 32Para 33Para 34 | Same topic: Compliance (editorial pick) |
| CM Configuration Management · 1 | ||||
| CM.L2-3.4.1 | System Baselining | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| IR Incident Response · 3 | ||||
| IR.L2-3.6.1 | Incident Handling | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response, Lessons Learned (editorial pick) |
| IR.L2-3.6.2 | Incident Reporting | Editorial | Para 25Para 35Para 36 | Same topic: Communication, Reporting (editorial pick) |
| IR.L2-3.6.3 | Incident Response Testing | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| MP Media Protection · 2 | ||||
| MP.L2-3.8.3 | Media Disposal | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| MP.L2-3.8.4 | Media Markings | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| RA Risk Assessment · 3 | ||||
| RA.L2-3.11.1 | Risk Assessments | Editorial | Para 13Para 15Para 17+3 | Same topic: Risk Management, Risk Assessment (editorial pick) |
| RA.L2-3.11.2 | Vulnerability Scan | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| RA.L2-3.11.3 | Vulnerability Remediation | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| SC System and Communications Protection · 1 | ||||
| SC.L2-3.13.16 | Data at Rest | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| SI System and Information Integrity · 2 | ||||
| SI.L2-3.14.3 | Security Alerts & Advisories | Editorial | Para 17 | Same topic: Threat Intelligence (editorial pick) |
| SI.L2-3.14.6 | Monitor Communications for Attacks | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
By topic
Both cover (13):
Risk ManagementComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtThreat IntelligenceData ProtectionIntrusion DetectionIncident ResponseCommunicationReportingLessons Learned
Only CMMC (26):
Awareness & TrainingAccess ControlMulti-Factor AuthEncryptionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityWeb SecurityZero TrustMobile SecurityCloud SecurityDLPCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCForensicsMitigationComms & RestoreInsider ThreatPhysical Security
Only CPS 234 (4):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.