Comparison
CMMC vs Cyber Essentials
CMMC Level 2 · UK Cyber Essentials (NCSC) · data 2026-10-27
Requirement-level comparison of CMMC Level 2 and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 5 UK Cyber Essentials (NCSC) requirements, 5 map to something in CMMC, 0 are only loosely related, and 0 have no mapping in our data.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Mapped (5)
| Cyber Essentials | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| Technical controls · 5 | ||||
| CE 1 | Firewalls | Editorial | SC.L2-3.13.1SC.L2-3.13.5SC.L2-3.13.6 | Same topic: Firewall / Net Seg (editorial pick) |
| CE 2 | Secure Configuration | Editorial | AC.L2-3.1.18AC.L2-3.1.19CM.L2-3.4.1+3 | Same topic: Mobile Security, Secure Config (editorial pick) |
| CE 3 | Security Update Management | Editorial | CM.L2-3.4.1RA.L2-3.11.2RA.L2-3.11.3+1 | Same topic: Asset Management, Vulnerability Mgmt (editorial pick) |
| CE 4 | User Access Control | Editorial | AC.L2-3.1.1AC.L2-3.1.2AC.L2-3.1.5+4 | Same topic: Access Control, Privileged Access (editorial pick) |
| CE 5 | Malware protection | Editorial | SI.L2-3.14.2SI.L2-3.14.4 | Same topic: Endpoint Protection (editorial pick) |
Of 110 CMMC Level 2 requirements, 21 map to something in Cyber Essentials, 45 are only loosely related, and 44 have no mapping in our data.
Likely new work: CMMC requirements with no mapping to Cyber Essentials (44)
| CMMC | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| AC Access Control · 3 | ||||
| AC.L2-3.1.9 | Privacy & Security Notices | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AC.L2-3.1.10 | Session Lock | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AC.L2-3.1.22 | Control Public Information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AT Awareness and Training · 3 | ||||
| AT.L2-3.2.1 | Role-Based Risk Awareness | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AT.L2-3.2.2 | Role-Based Training | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AT.L2-3.2.3 | Insider Threat Awareness | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AU Audit and Accountability · 8 | ||||
| AU.L2-3.3.1 | System Auditing | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AU.L2-3.3.2 | User Accountability | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AU.L2-3.3.4 | Audit Failure Alerting | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AU.L2-3.3.5 | Audit Correlation | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AU.L2-3.3.6 | Reduction & Reporting | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AU.L2-3.3.7 | Authoritative Time Source | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AU.L2-3.3.8 | Audit Protection | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| AU.L2-3.3.9 | Audit Management | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CA Security Assessment · 1 | ||||
| CA.L2-3.12.2 | Plan of Action | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| IR Incident Response · 3 | ||||
| IR.L2-3.6.1 | Incident Handling | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| IR.L2-3.6.2 | Incident Reporting | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| IR.L2-3.6.3 | Incident Response Testing | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MA Maintenance · 2 | ||||
| MA.L2-3.7.5 | Nonlocal Maintenance | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MA.L2-3.7.6 | Maintenance Personnel | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MP Media Protection · 8 | ||||
| MP.L2-3.8.1 | Media Protection | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MP.L2-3.8.2 | Media Access | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MP.L2-3.8.3 | Media Disposal | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MP.L2-3.8.4 | Media Markings | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MP.L2-3.8.5 | Media Accountability | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MP.L2-3.8.7 | Removable Media | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MP.L2-3.8.8 | Shared Media | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| MP.L2-3.8.9 | Protect Backups | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PE Physical Protection · 6 | ||||
| PE.L2-3.10.1 | Limit Physical Access | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PE.L2-3.10.2 | Monitor Facility | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PE.L2-3.10.3 | Escort Visitors | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PE.L2-3.10.4 | Physical Access Logs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PE.L2-3.10.5 | Manage Physical Access | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PE.L2-3.10.6 | Alternative Work Sites | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PS Personnel Security · 2 | ||||
| PS.L2-3.9.1 | Screen Individuals | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| PS.L2-3.9.2 | Personnel Actions | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| SC System and Communications Protection · 7 | ||||
| SC.L2-3.13.9 | Connections Termination | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| SC.L2-3.13.10 | Key Management | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| SC.L2-3.13.11 | CUI Encryption | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| SC.L2-3.13.12 | Collaborative Device Control | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| SC.L2-3.13.13 | Mobile Code | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| SC.L2-3.13.14 | Voice over Internet Protocol | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| SC.L2-3.13.15 | Communications Authenticity | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| SI System and Information Integrity · 1 | ||||
| SI.L2-3.14.5 | System & File Scanning | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (45)
| CMMC | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| AC Access Control · 11 | ||||
| AC.L2-3.1.3 | Control CUI Flow | CE 1CE 4CE 5 | Only shares CSF PR.IR-01, DE.CM-09: related, not a mapping | |
| AC.L2-3.1.4 | Separation of Duties | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.8 | Unsuccessful Logon Attempts | CE 4 | Only shares CSF PR.AA-03: related, not a mapping | |
| AC.L2-3.1.11 | Session Termination | CE 4 | Only shares CSF PR.AA-03: related, not a mapping | |
| AC.L2-3.1.12 | Control Remote Access | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.13 | Remote Access Confidentiality | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.14 | Remote Access Routing | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.15 | Privileged Remote Access | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.16 | Wireless Access Authorization | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.17 | Wireless Access Protection | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.21 | Portable Storage Use | CE 3CE 4 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| AU Audit and Accountability · 1 | ||||
| AU.L2-3.3.3 | Event Review | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| CA Security Assessment · 3 | ||||
| CA.L2-3.12.1 | Security Control Assessment | CE 3 | Only shares CSF ID.RA-01: related, not a mapping | |
| CA.L2-3.12.3 | Security Control Monitoring | CE 3CE 5 | Only shares CSF ID.RA-01, DE.CM-09: related, not a mapping | |
| CA.L2-3.12.4 | System Security Plan | CE 1CE 3 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| CM Configuration Management · 5 | ||||
| CM.L2-3.4.3 | System Change Management | CE 2CE 4CE 5 | Only shares CSF PR.PS-01, DE.CM-09: related, not a mapping | |
| CM.L2-3.4.4 | Security Impact Analysis | CE 2CE 4 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.5 | Access Restrictions for Change | CE 2CE 4 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.8 | Application Execution Policy | CE 2CE 4 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.9 | User-Installed Software | CE 2CE 4CE 3+1 | Only shares CSF PR.AA-05, PR.PS-01, ID.RA-01: related, not a mapping | |
| IA Identification and Authentication · 10 | ||||
| IA.L2-3.5.1 | Identification | CE 4 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.2 | Authentication | CE 4 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.4 | Replay-Resistant Authentication | CE 4 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.5 | Identifier Reuse | CE 4 | Only shares CSF PR.AA-01: related, not a mapping | |
| IA.L2-3.5.6 | Identifier Handling | CE 4 | Only shares CSF PR.AA-01: related, not a mapping | |
| IA.L2-3.5.7 | Password Complexity | CE 4 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.8 | Password Reuse | CE 4 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.9 | Temporary Passwords | CE 4 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.10 | Cryptographically-Protected Passwords | CE 4 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.11 | Obscure Feedback | CE 4 | Only shares CSF PR.AA-01: related, not a mapping | |
| MA Maintenance · 4 | ||||
| MA.L2-3.7.1 | Perform Maintenance | CE 3 | Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping | |
| MA.L2-3.7.2 | System Maintenance Control | CE 3 | Only shares CSF PR.PS-02: related, not a mapping | |
| MA.L2-3.7.3 | Equipment Sanitization | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| MA.L2-3.7.4 | Media Inspection | CE 3 | Only shares CSF PR.PS-02: related, not a mapping | |
| MP Media Protection · 1 | ||||
| MP.L2-3.8.6 | Portable Storage Encryption | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| RA Risk Assessment · 1 | ||||
| RA.L2-3.11.1 | Risk Assessments | CE 3 | Only shares CSF ID.RA-01: related, not a mapping | |
| SC System and Communications Protection · 6 | ||||
| SC.L2-3.13.2 | Security Engineering | CE 1CE 3CE 4 | Only shares CSF PR.IR-01, ID.AM-08: related, not a mapping | |
| SC.L2-3.13.3 | Role Separation | CE 4CE 1CE 2+1 | Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping | |
| SC.L2-3.13.4 | Shared Resource Control | CE 1CE 4 | Only shares CSF PR.IR-01: related, not a mapping | |
| SC.L2-3.13.7 | Split Tunneling | CE 2CE 4CE 5 | Only shares CSF PR.AA-05, PR.PS-01, DE.CM-09: related, not a mapping | |
| SC.L2-3.13.8 | Data in Transit | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| SC.L2-3.13.16 | Data at Rest | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| SI System and Information Integrity · 3 | ||||
| SI.L2-3.14.3 | Security Alerts & Advisories | CE 3 | Only shares CSF ID.RA-01: related, not a mapping | |
| SI.L2-3.14.6 | Monitor Communications for Attacks | CE 3CE 5 | Only shares CSF ID.RA-01, DE.CM-09: related, not a mapping | |
| SI.L2-3.14.7 | Identify Unauthorized Use | CE 3CE 5 | Only shares CSF ID.RA-01, DE.CM-09: related, not a mapping | |
Mapped (21)
| CMMC | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| AC Access Control · 8 | ||||
| AC.L2-3.1.1 | Authorized Access Control | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| AC.L2-3.1.2 | Transaction & Function Control | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| AC.L2-3.1.5 | Least Privilege | Editorial | CE 4 | Same topic: Privileged Access (editorial pick) |
| AC.L2-3.1.6 | Non-Privileged Account Use | Editorial | CE 4 | Same topic: Privileged Access (editorial pick) |
| AC.L2-3.1.7 | Privileged Functions | Editorial | CE 4 | Same topic: Privileged Access (editorial pick) |
| AC.L2-3.1.18 | Mobile Device Connection | Editorial | CE 2 | Same topic: Mobile Security (editorial pick) |
| AC.L2-3.1.19 | Encrypt CUI on Mobile | Editorial | CE 2 | Same topic: Mobile Security (editorial pick) |
| AC.L2-3.1.20 | External Connections | Editorial | CE 4 | Same topic: Cloud Security (editorial pick) |
| CM Configuration Management · 4 | ||||
| CM.L2-3.4.1 | System Baselining | Editorial | CE 2CE 3 | Same topic: Secure Config, Asset Management (editorial pick) |
| CM.L2-3.4.2 | Security Configuration Enforcement | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CM.L2-3.4.6 | Least Functionality | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CM.L2-3.4.7 | Nonessential Functionality | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| IA Identification and Authentication · 1 | ||||
| IA.L2-3.5.3 | Multifactor Authentication | Editorial | CE 4 | Same topic: Multi-Factor Auth (editorial pick) |
| RA Risk Assessment · 2 | ||||
| RA.L2-3.11.2 | Vulnerability Scan | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| RA.L2-3.11.3 | Vulnerability Remediation | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| SC System and Communications Protection · 3 | ||||
| SC.L2-3.13.1 | Boundary Protection | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| SC.L2-3.13.5 | Public-Access System Separation | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| SC.L2-3.13.6 | Network Communication by Exception | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| SI System and Information Integrity · 3 | ||||
| SI.L2-3.14.1 | Flaw Remediation | Editorial | CE 3 | Same topic: Patch Management (editorial pick) |
| SI.L2-3.14.2 | Malicious Code Protection | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| SI.L2-3.14.4 | Update Malicious Code Protection | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
By topic
Both cover (11):
Asset ManagementVulnerability MgmtAccess ControlMulti-Factor AuthPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigMobile SecurityCloud Security
Only CMMC (28):
Awareness & TrainingRisk ManagementComplianceRisk AssessmentData ClassificationThreat IntelligenceEncryptionData ProtectionBackup & RecoverySecure DevelopmentEmail SecurityWeb SecurityZero TrustDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingLessons LearnedComms & RestoreInsider ThreatPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.