External Connections

frameworkCMMC Level 2 sectionAC Access Control csf 2.0ID.AM-02 ID.AM-04 topicsCloud Security frameworks7 4 0

Official textVerify and control/limit connections to and use of external systems.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of AC.L2-3.1.20 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-04 PR.IR-01 PR.PS-01	Inventories of services provided by suppliers are maintained; Networks and environments are protected from unauthorized logical access and usage…	Crosswalk	Same topic: Cloud Security 1 loosely related (not mappings) ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained Loosely related Only shares CSF ID.AM-02: related, not a mapping
ISO 27001	A.5.23	Information security for use of cloud services	Crosswalk	Same topic: Cloud Security 2 loosely related (not mappings) A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-02: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-04: related, not a mapping
CIS v8.1	CIS 15.1	Establish and Maintain an Inventory of Service Providers	Crosswalk	Same topic: Cloud Security 8 loosely related (not mappings) CIS 2.1 Establish and Maintain a Software Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 16.4 Establish and Manage an Inventory of Third-Party Software Components Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Cloud Security (editorial pick) 1 loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
PCI DSS	12.8.1 12.8.5	List of third-party service providers kept; Responsibilities split with each provider documented	Crosswalk	Same topic: Cloud Security 5 loosely related (not mappings) 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF ID.AM-02: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF ID.AM-02: related, not a mapping 12.5.1 Inventory of in-scope system components Loosely related Only shares CSF ID.AM-02: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF ID.AM-04: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF ID.AM-04: related, not a mapping
800-53	AC-20 SA-9	Use of External Systems; External System Services	Crosswalk	Same topic: Cloud Security 4 loosely related (not mappings) CM-8 System Component Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping PM-5 System Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping SA-5 System Documentation Loosely related Only shares CSF ID.AM-02: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF ID.AM-04: related, not a mapping
HIPAA	§164.308(b)(1)	Business Associate Contracts and Other Arrangements	Crosswalk	Same topic: Cloud Security 8 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF ID.AM-02: related, not a mapping §164.310(d)(2)(iii) Accountability Loosely related Only shares CSF ID.AM-02: related, not a mapping
GDPR	Art.28(1)	Processor	Editorial	Same topic: Cloud Security (editorial pick) 1 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
NIS2	6.1	Security in acquisition of ICT services, ICT systems or ICT products	Crosswalk	Same topic: Cloud Security 1 loosely related (not mappings) 12.4 Asset inventory Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
DORA	Art.28(8)Art.30(2)	General principles; Key contractual provisions	Editorial	Same topic: Cloud Security (editorial pick) 3 loosely related (not mappings) Art.8(1) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Cloud Security (editorial pick) 1 loosely related (not mappings) CE 3 Security Update Management Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.