Comparison
CMMC vs NIS2
CMMC Level 2 · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27
Requirement-level comparison of CMMC Level 2 and NIS2 Implementing Regulation (EU) 2024/2690, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 40 map to something in CMMC, 8 are only loosely related, and 1 have no mapping in our data.
NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.
Likely new work: NIS2 requirements with no mapping to CMMC (1)
| NIS2 | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| 12. Asset management · 1 | ||||
| 12.5 | Deposit, return or deletion of assets upon termination of employment | No mapping in our data | — | No mapping to CMMC in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (8)
| NIS2 | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | ||||
| 1.1 | Policy on the security of network and information systems | AT.L2-3.2.2RA.L2-3.11.1CA.L2-3.12.1 | Only shares CSF PR.AT-02, GV.OC-02, GV.OC-03: related, not a mapping | |
| 1.2 | Roles, responsibilities and authorities | AT.L2-3.2.2 | Only shares CSF PR.AT-02: related, not a mapping | |
| 4. Business continuity and crisis management · 1 | ||||
| 4.1 | Business continuity and disaster recovery plan | IR.L2-3.6.1IR.L2-3.6.2 | Only shares CSF GV.SC-08, RC.RP-01, RC.RP-02: related, not a mapping | |
| 5. Supply chain security · 2 | ||||
| 5.1 | Supply chain security policy | RA.L2-3.11.1RA.L2-3.11.2RA.L2-3.11.3+1 | Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping | |
| 5.2 | Directory of suppliers and service providers | RA.L2-3.11.1 | Only shares CSF GV.SC-04: related, not a mapping | |
| 6. Security in acquisition, development and maintenance · 1 | ||||
| 6.4 | Change management, repairs and maintenance | CM.L2-3.4.3CM.L2-3.4.4 | Only shares CSF ID.RA-07: related, not a mapping | |
| 10. Human resources security · 2 | ||||
| 10.1 | Human resources security | AT.L2-3.2.2AT.L2-3.2.3AU.L2-3.3.2+1 | Only shares CSF PR.AT-02, GV.RR-04: related, not a mapping | |
| 10.3 | Termination or change of employment procedures | AT.L2-3.2.3AU.L2-3.3.2PS.L2-3.9.1 | Only shares CSF GV.RR-04: related, not a mapping | |
Mapped (40)
| NIS2 | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| 2. Risk management policy · 3 | ||||
| 2.1 | Risk management framework | Crosswalk | RA.L2-3.11.1 | Same topic: Risk Management, Risk Assessment |
| 2.2 | Compliance monitoring | Editorial | CA.L2-3.12.1 | Same topic: Compliance (editorial pick) |
| 2.3 | Independent review of information and network security | Editorial | CA.L2-3.12.1 | Same topic: Compliance (editorial pick) |
| 3. Incident handling · 6 | ||||
| 3.1 | Incident handling policy | Crosswalk | IR.L2-3.6.1IR.L2-3.6.3 | Same topic: Incident Response |
| 3.2 | Monitoring and logging | Crosswalk | AU.L2-3.3.1AU.L2-3.3.2AU.L2-3.3.5+3 | Same topic: Logging & Audit, SIEM / SOC |
| 3.3 | Event reporting | Crosswalk | IR.L2-3.6.2 | Same topic: Reporting |
| 3.4 | Event assessment and classification | Crosswalk | AU.L2-3.3.5SI.L2-3.14.7 | Same topic: SIEM / SOC, Anomaly Detection |
| 3.5 | Incident response | Crosswalk | AU.L2-3.3.6IR.L2-3.6.1IR.L2-3.6.3 | Same topic: Forensics, Incident Response, Mitigation |
| 3.6 | Post-incident reviews | Crosswalk | IR.L2-3.6.1 | Same topic: Lessons Learned |
| 4. Business continuity and crisis management · 2 | ||||
| 4.2 | Backup management | Crosswalk | MP.L2-3.8.9 | Same topic: Backup & Recovery |
| 4.3 | Crisis management | Crosswalk | IR.L2-3.6.2 | Same topic: Communication, Comms & Restore |
| 6. Security in acquisition, development and maintenance · 9 | ||||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | AC.L2-3.1.20 | Same topic: Cloud Security |
| 6.2 | Secure development life cycle | Crosswalk | SC.L2-3.13.2 | Same topic: Secure Development |
| 6.3 | Configuration management | Crosswalk | CM.L2-3.4.1CM.L2-3.4.2CM.L2-3.4.6+1 | Same topic: Secure Config |
| 6.5 | Security testing | Crosswalk | RA.L2-3.11.2RA.L2-3.11.3 | Same topic: Vulnerability Mgmt |
| 6.6 | Security patch management | Crosswalk | SI.L2-3.14.1 | Same topic: Patch Management |
| 6.7 | Network security | Crosswalk | SC.L2-3.13.1SC.L2-3.13.5SC.L2-3.13.6 | Same topic: Firewall / Net Seg |
| 6.8 | Network segmentation | Crosswalk | AC.L2-3.1.1SC.L2-3.13.1SC.L2-3.13.5+1 | Same topic: Zero Trust, Firewall / Net Seg |
| 6.9 | Protection against malicious and unauthorised software | Crosswalk | SI.L2-3.14.2SI.L2-3.14.4 | Same topic: Endpoint Protection, Email Security |
| 6.10 | Vulnerability handling and disclosure | Crosswalk | RA.L2-3.11.2RA.L2-3.11.3 | Same topic: Vulnerability Mgmt |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | ||||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Crosswalk | RA.L2-3.11.1 | Same topic: Risk Management |
| 8. Basic cyber hygiene practices and security training · 2 | ||||
| 8.1 | Awareness raising and basic cyber hygiene practices | Crosswalk | AT.L2-3.2.1AT.L2-3.2.2AT.L2-3.2.3 | Same topic: Awareness & Training |
| 8.2 | Security training | Crosswalk | AT.L2-3.2.1AT.L2-3.2.2AT.L2-3.2.3 | Same topic: Awareness & Training |
| 9. Cryptography · 1 | ||||
| 9.1 | Cryptography | Crosswalk | AC.L2-3.1.13MP.L2-3.8.6SC.L2-3.13.8+4 | Same topic: Encryption |
| 10. Human resources security · 2 | ||||
| 10.2 | Verification of Background | Editorial | AT.L2-3.2.3AU.L2-3.3.2PS.L2-3.9.1 | Same topic: Insider Threat (editorial pick) |
| 10.4 | Disciplinary process | Editorial | AT.L2-3.2.3AU.L2-3.3.2PS.L2-3.9.1 | Same topic: Insider Threat (editorial pick) |
| 11. Access control · 7 | ||||
| 11.1 | Access control policy | Crosswalk | AC.L2-3.1.1AC.L2-3.1.2SC.L2-3.13.1+1 | Same topic: Access Control, Zero Trust |
| 11.2 | Management of access rights | Crosswalk | AC.L2-3.1.1AC.L2-3.1.2 | Same topic: Access Control |
| 11.3 | Privileged accounts and system administration accounts | Crosswalk | AC.L2-3.1.5AC.L2-3.1.6AC.L2-3.1.7 | Same topic: Privileged Access |
| 11.4 | Administration systems | Crosswalk | AC.L2-3.1.5AC.L2-3.1.6AC.L2-3.1.7 | Same topic: Privileged Access |
| 11.5 | Identification | Crosswalk | AC.L2-3.1.1AC.L2-3.1.2 | Same topic: Access Control |
| 11.6 | Authentication | Crosswalk | AC.L2-3.1.1IA.L2-3.5.3SC.L2-3.13.1+1 | Same topic: Zero Trust, Multi-Factor Auth |
| 11.7 | Multi-factor authentication | Crosswalk | IA.L2-3.5.3 | Same topic: Multi-Factor Auth |
| 12. Asset management · 4 | ||||
| 12.1 | Asset classification | Editorial | MP.L2-3.8.4 | Same topic: Data Classification (editorial pick) |
| 12.2 | Handling of assets | Crosswalk | SC.L2-3.13.16MP.L2-3.8.3 | Same topic: Data Protection |
| 12.3 | Removable media policy | Crosswalk | AC.L2-3.1.3SC.L2-3.13.16MP.L2-3.8.3 | Same topic: DLP, Data Protection |
| 12.4 | Asset inventory | Crosswalk | CM.L2-3.4.1 | Same topic: Asset Management |
| 13. Environmental and physical security · 3 | ||||
| 13.1 | Supporting utilities | Crosswalk | PE.L2-3.10.1PE.L2-3.10.2PE.L2-3.10.3+3 | Same topic: Physical Security |
| 13.2 | Protection against physical and environmental threats | Crosswalk | PE.L2-3.10.1PE.L2-3.10.2PE.L2-3.10.3+3 | Same topic: Physical Security |
| 13.3 | Perimeter and physical access control | Crosswalk | PE.L2-3.10.1PE.L2-3.10.2PE.L2-3.10.3+3 | Same topic: Physical Security |
Of 110 CMMC Level 2 requirements, 53 map to something in NIS2, 38 are only loosely related, and 19 have no mapping in our data.
Likely new work: CMMC requirements with no mapping to NIS2 (19)
| CMMC | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| AC Access Control · 3 | ||||
| AC.L2-3.1.9 | Privacy & Security Notices | No mapping in our data | — | No mapping to NIS2 in our data. |
| AC.L2-3.1.10 | Session Lock | No mapping in our data | — | No mapping to NIS2 in our data. |
| AC.L2-3.1.22 | Control Public Information | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU Audit and Accountability · 3 | ||||
| AU.L2-3.3.4 | Audit Failure Alerting | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU.L2-3.3.8 | Audit Protection | No mapping in our data | — | No mapping to NIS2 in our data. |
| AU.L2-3.3.9 | Audit Management | No mapping in our data | — | No mapping to NIS2 in our data. |
| CA Security Assessment · 1 | ||||
| CA.L2-3.12.2 | Plan of Action | No mapping in our data | — | No mapping to NIS2 in our data. |
| MA Maintenance · 2 | ||||
| MA.L2-3.7.5 | Nonlocal Maintenance | No mapping in our data | — | No mapping to NIS2 in our data. |
| MA.L2-3.7.6 | Maintenance Personnel | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP Media Protection · 4 | ||||
| MP.L2-3.8.1 | Media Protection | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP.L2-3.8.2 | Media Access | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP.L2-3.8.7 | Removable Media | No mapping in our data | — | No mapping to NIS2 in our data. |
| MP.L2-3.8.8 | Shared Media | No mapping in our data | — | No mapping to NIS2 in our data. |
| PS Personnel Security · 1 | ||||
| PS.L2-3.9.2 | Personnel Actions | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC System and Communications Protection · 5 | ||||
| SC.L2-3.13.9 | Connections Termination | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC.L2-3.13.12 | Collaborative Device Control | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC.L2-3.13.13 | Mobile Code | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC.L2-3.13.14 | Voice over Internet Protocol | No mapping in our data | — | No mapping to NIS2 in our data. |
| SC.L2-3.13.15 | Communications Authenticity | No mapping in our data | — | No mapping to NIS2 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (38)
| CMMC | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| AC Access Control · 10 | ||||
| AC.L2-3.1.4 | Separation of Duties | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.8 | Unsuccessful Logon Attempts | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| AC.L2-3.1.11 | Session Termination | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| AC.L2-3.1.12 | Control Remote Access | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.14 | Remote Access Routing | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.15 | Privileged Remote Access | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.16 | Wireless Access Authorization | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.17 | Wireless Access Protection | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.18 | Mobile Device Connection | 11.111.211.5+2 | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.21 | Portable Storage Use | 12.4 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| AU Audit and Accountability · 1 | ||||
| AU.L2-3.3.3 | Event Review | 6.94.36.6+1 | Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping | |
| CA Security Assessment · 2 | ||||
| CA.L2-3.12.3 | Security Control Monitoring | 4.36.913.1+5 | Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-09…: related, not a mapping | |
| CA.L2-3.12.4 | System Security Plan | 12.44.36.2 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| CM Configuration Management · 5 | ||||
| CM.L2-3.4.3 | System Change Management | 6.94.36.3+3 | Only shares CSF DE.CM-01, DE.CM-09, PR.PS-01: related, not a mapping | |
| CM.L2-3.4.4 | Security Impact Analysis | 6.36.4 | Only shares CSF PR.PS-01, ID.RA-07: related, not a mapping | |
| CM.L2-3.4.5 | Access Restrictions for Change | 6.3 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.8 | Application Execution Policy | 6.3 | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.9 | User-Installed Software | 4.36.913.1+5 | Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-09…: related, not a mapping | |
| IA Identification and Authentication · 10 | ||||
| IA.L2-3.5.1 | Identification | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.2 | Authentication | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.4 | Replay-Resistant Authentication | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.5 | Identifier Reuse | 11.5 | Only shares CSF PR.AA-01: related, not a mapping | |
| IA.L2-3.5.6 | Identifier Handling | 11.5 | Only shares CSF PR.AA-01: related, not a mapping | |
| IA.L2-3.5.7 | Password Complexity | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.8 | Password Reuse | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.9 | Temporary Passwords | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.10 | Cryptographically-Protected Passwords | 11.511.611.7 | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.11 | Obscure Feedback | 11.5 | Only shares CSF PR.AA-01: related, not a mapping | |
| MA Maintenance · 4 | ||||
| MA.L2-3.7.1 | Perform Maintenance | 6.26.66.10+1 | Only shares CSF ID.AM-08, PR.PS-02: related, not a mapping | |
| MA.L2-3.7.2 | System Maintenance Control | 6.66.10 | Only shares CSF PR.PS-02: related, not a mapping | |
| MA.L2-3.7.3 | Equipment Sanitization | 6.212.4 | Only shares CSF ID.AM-08: related, not a mapping | |
| MA.L2-3.7.4 | Media Inspection | 6.66.10 | Only shares CSF PR.PS-02: related, not a mapping | |
| MP Media Protection · 1 | ||||
| MP.L2-3.8.5 | Media Accountability | 9.112.3 | Only shares CSF PR.DS-01: related, not a mapping | |
| SC System and Communications Protection · 3 | ||||
| SC.L2-3.13.3 | Role Separation | 6.76.911.5+5 | Only shares CSF DE.CM-01, PR.IR-01, DE.CM-09, PR.AA-01…: related, not a mapping | |
| SC.L2-3.13.4 | Shared Resource Control | 9.16.76.8+1 | Only shares CSF PR.DS-01, PR.DS-02, PR.IR-01: related, not a mapping | |
| SC.L2-3.13.7 | Split Tunneling | 6.36.66.9+5 | Only shares CSF PR.PS-01, DE.CM-09: related, not a mapping | |
| SI System and Information Integrity · 2 | ||||
| SI.L2-3.14.3 | Security Alerts & Advisories | 2.16.56.10 | Only shares CSF ID.RA-01, ID.RA-03: related, not a mapping | |
| SI.L2-3.14.5 | System & File Scanning | 9.112.3 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
Mapped (53)
| CMMC | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| AC Access Control · 9 | ||||
| AC.L2-3.1.1 | Authorized Access Control | Crosswalk | 6.811.111.2+2 | Same topic: Zero Trust, Access Control |
| AC.L2-3.1.2 | Transaction & Function Control | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| AC.L2-3.1.3 | Control CUI Flow | Crosswalk | 12.3 | Same topic: DLP |
| AC.L2-3.1.5 | Least Privilege | Crosswalk | 11.311.4 | Same topic: Privileged Access |
| AC.L2-3.1.6 | Non-Privileged Account Use | Crosswalk | 11.311.4 | Same topic: Privileged Access |
| AC.L2-3.1.7 | Privileged Functions | Crosswalk | 11.311.4 | Same topic: Privileged Access |
| AC.L2-3.1.13 | Remote Access Confidentiality | Crosswalk | 9.1 | Same topic: Encryption |
| AC.L2-3.1.19 | Encrypt CUI on Mobile | Editorial | 9.1 | Same topic: Encryption (editorial pick) |
| AC.L2-3.1.20 | External Connections | Crosswalk | 6.1 | Same topic: Cloud Security |
| AT Awareness and Training · 3 | ||||
| AT.L2-3.2.1 | Role-Based Risk Awareness | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| AT.L2-3.2.2 | Role-Based Training | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| AT.L2-3.2.3 | Insider Threat Awareness | Crosswalk | 8.18.210.2+1 | Same topic: Awareness & Training, Insider Threat |
| AU Audit and Accountability · 5 | ||||
| AU.L2-3.3.1 | System Auditing | Crosswalk | 3.2 | Same topic: Logging & Audit |
| AU.L2-3.3.2 | User Accountability | Crosswalk | 3.210.210.4 | Same topic: Logging & Audit, Insider Threat |
| AU.L2-3.3.5 | Audit Correlation | Crosswalk | 3.23.4 | Same topic: SIEM / SOC |
| AU.L2-3.3.6 | Reduction & Reporting | Crosswalk | 3.5 | Same topic: Forensics |
| AU.L2-3.3.7 | Authoritative Time Source | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| CA Security Assessment · 1 | ||||
| CA.L2-3.12.1 | Security Control Assessment | Editorial | 2.22.3 | Same topic: Compliance (editorial pick) |
| CM Configuration Management · 4 | ||||
| CM.L2-3.4.1 | System Baselining | Crosswalk | 6.312.4 | Same topic: Secure Config, Asset Management |
| CM.L2-3.4.2 | Security Configuration Enforcement | Crosswalk | 6.3 | Same topic: Secure Config |
| CM.L2-3.4.6 | Least Functionality | Crosswalk | 6.3 | Same topic: Secure Config |
| CM.L2-3.4.7 | Nonessential Functionality | Crosswalk | 6.3 | Same topic: Secure Config |
| IA Identification and Authentication · 1 | ||||
| IA.L2-3.5.3 | Multifactor Authentication | Crosswalk | 11.611.7 | Same topic: Multi-Factor Auth |
| IR Incident Response · 3 | ||||
| IR.L2-3.6.1 | Incident Handling | Crosswalk | 3.13.53.6 | Same topic: Incident Response, Mitigation, Lessons Learned |
| IR.L2-3.6.2 | Incident Reporting | Crosswalk | 3.34.3 | Same topic: Reporting, Communication, Comms & Restore |
| IR.L2-3.6.3 | Incident Response Testing | Editorial | 3.13.5 | Same topic: Incident Response (editorial pick) |
| MP Media Protection · 4 | ||||
| MP.L2-3.8.3 | Media Disposal | Editorial | 12.212.3 | Same topic: Data Protection (editorial pick) |
| MP.L2-3.8.4 | Media Markings | Editorial | 12.1 | Same topic: Data Classification (editorial pick) |
| MP.L2-3.8.6 | Portable Storage Encryption | Crosswalk | 9.1 | Same topic: Encryption |
| MP.L2-3.8.9 | Protect Backups | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| PE Physical Protection · 6 | ||||
| PE.L2-3.10.1 | Limit Physical Access | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE.L2-3.10.2 | Monitor Facility | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE.L2-3.10.3 | Escort Visitors | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE.L2-3.10.4 | Physical Access Logs | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE.L2-3.10.5 | Manage Physical Access | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PE.L2-3.10.6 | Alternative Work Sites | Editorial | 13.113.213.3 | Same topic: Physical Security (editorial pick) |
| PS Personnel Security · 1 | ||||
| PS.L2-3.9.1 | Screen Individuals | Editorial | 10.210.4 | Same topic: Insider Threat (editorial pick) |
| RA Risk Assessment · 3 | ||||
| RA.L2-3.11.1 | Risk Assessments | Crosswalk | 2.17.1 | Same topic: Risk Management, Risk Assessment |
| RA.L2-3.11.2 | Vulnerability Scan | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| RA.L2-3.11.3 | Vulnerability Remediation | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| SC System and Communications Protection · 8 | ||||
| SC.L2-3.13.1 | Boundary Protection | Crosswalk | 6.76.811.1+1 | Same topic: Firewall / Net Seg, Zero Trust |
| SC.L2-3.13.2 | Security Engineering | Crosswalk | 6.2 | Same topic: Secure Development |
| SC.L2-3.13.5 | Public-Access System Separation | Crosswalk | 6.76.8 | Same topic: Firewall / Net Seg |
| SC.L2-3.13.6 | Network Communication by Exception | Crosswalk | 6.76.811.1+1 | Same topic: Firewall / Net Seg, Zero Trust |
| SC.L2-3.13.8 | Data in Transit | Crosswalk | 9.1 | Same topic: Encryption |
| SC.L2-3.13.10 | Key Management | Crosswalk | 9.1 | Same topic: Encryption |
| SC.L2-3.13.11 | CUI Encryption | Crosswalk | 9.1 | Same topic: Encryption |
| SC.L2-3.13.16 | Data at Rest | Crosswalk | 9.112.212.3 | Same topic: Encryption, Data Protection |
| SI System and Information Integrity · 5 | ||||
| SI.L2-3.14.1 | Flaw Remediation | Crosswalk | 6.6 | Same topic: Patch Management |
| SI.L2-3.14.2 | Malicious Code Protection | Crosswalk | 6.9 | Same topic: Endpoint Protection, Email Security |
| SI.L2-3.14.4 | Update Malicious Code Protection | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| SI.L2-3.14.6 | Monitor Communications for Attacks | Crosswalk | 3.2 | Same topic: Cont. Monitoring, Intrusion Detection |
| SI.L2-3.14.7 | Identify Unauthorized Use | Crosswalk | 3.23.4 | Same topic: Cont. Monitoring, Anomaly Detection |
By topic
Both cover (36):
Awareness & TrainingRisk ManagementComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityZero TrustCloud SecurityDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingLessons LearnedComms & RestoreInsider ThreatPhysical Security
Only CMMC (3):
Only NIS2 (7):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.