CMMC · AC Access Control
AC.L2-3.1.3
Control CUI Flow
frameworkCMMC Level 2
sectionAC Access Control
csf 2.0DE.CM-09 PR.DS-10 PR.IR-01
topicsDLP
frameworks4 3 0
Official textControl the flow of CUI in accordance with approved authorizations.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.DS-01PR.DS-02PR.DS-10 | The confidentiality, integrity, and availability of data-at-rest are protected; The confidentiality, integrity, and availability of data-in-transit are protected… | Crosswalk | Same topic: DLP2 loosely related (not mappings)DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Only shares CSF DE.CM-09: related, not a mapping PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Only shares CSF PR.IR-01: related, not a mapping |
| ISO 27001 | A.8.12 | Data leakage prevention | Crosswalk | Same topic: DLP |
| CIS v8.1 | CIS 3.13 | Deploy a Data Loss Prevention Solution | Editorial | Same topic: DLP (editorial pick)36 loosely related (not mappings)CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping CIS 12.2 Establish and Maintain a Secure Network Architecture Only shares CSF PR.IR-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Only shares CSF PR.DS-10: related, not a mapping …and 28 more in the downloads |
| SOC 2 | CC6.7 | Restricting transmission, movement and removal of information | Editorial | Same topic: DLP (editorial pick)6 loosely related (not mappings)CC6.5 Protection of data when assets are disposed of Only shares CSF PR.DS-10: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF PR.IR-01: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF DE.CM-09: related, not a mapping |
| PCI DSS | 3.4.2 | PAN copying prevented over remote-access technologies | Editorial | Same topic: DLP (editorial pick)25 loosely related (not mappings)5.2.1 Anti-malware deployed on system components Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping 5.2.2 Anti-malware detects, removes or contains known malware Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF PR.IR-01: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Only shares CSF PR.DS-10: related, not a mapping 5.2.3 Systems without anti-malware periodically re-evaluated Only shares CSF PR.IR-01: related, not a mapping …and 17 more in the downloads |
| 800-53 | AC-4SC-7(10) | Information Flow Enforcement; Prevent Exfiltration | Crosswalk | Same topic: DLP |
| HIPAA | §164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)§164.310(b)§164.308(a)(1)(ii)(D) | Authorization and/or Supervision; Access Authorization… | No mapping. Only shares CSF DE.CM-09, PR.DS-10, PR.IR-01: related, not a mapping+22 more loosely related (not mappings)§164.312(a)(2)(i) Unique User Identification Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping …and 18 more in the downloads | |
| GDPR | Art.5(1)(e)Art.5(1)(f)Art.28(1)Art.32(1)(b) | Principles relating to processing of personal data; Principles relating to processing of personal data… | No mapping. Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping | |
| NIS2 | 12.3 | Removable media policy | Crosswalk | Same topic: DLP4 loosely related (not mappings)6.9 Protection against malicious and unauthorised software Only shares CSF DE.CM-09: related, not a mapping |
| Essential Eight | ISM-0109ISM-0843ISM-1228ISM-1488 | Event logs from workstations are analysed in a timely manner to detect cyber security…; Application control is implemented on workstations… | No mapping. Only shares CSF DE.CM-09: related, not a mapping+6 more loosely related (not mappings)ISM-1490 Application control is implemented on internet-facing servers Only shares CSF DE.CM-09: related, not a mapping ISM-1544 Microsoft’s recommended application blocklist is implemented Only shares CSF DE.CM-09: related, not a mapping ISM-1657 Application control restricts the execution of executables, libraries, scripts… Only shares CSF DE.CM-09: related, not a mapping ISM-1870 Application control is applied to user profiles and temporary folders used by operating… Only shares CSF DE.CM-09: related, not a mapping …and 2 more in the downloads | |
| DORA | Art.9(1)Art.9(2)Art.9(3)(c)Art.9(3)(d) | Protection and prevention; Protection and prevention… | No mapping. Only shares CSF DE.CM-09, PR.DS-10: related, not a mapping+5 more loosely related (not mappings)…and 1 more in the downloads | |
| CPS 234 | Para 21 | Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF PR.DS-10: related, not a mapping | |
| Cyber Essentials | CE 1CE 4CE 5 | Firewalls; User Access Control… | No mapping. Only shares CSF PR.IR-01, DE.CM-09: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.