Security Control Assessment

frameworkCMMC Level 2 sectionCA Security Assessment csf 2.0GV.OC-03 GV.OV-03 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 topicsCompliance frameworks1 9 0

Official textPeriodically assess the security controls in organizational systems to determine if the controls are effective in their application.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of CA.L2-3.12.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-03 GV.OV-03	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed; Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed	Editorial	Same topic: Compliance (editorial pick) 1 loosely related (not mappings) ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Loosely related Only shares CSF ID.RA-01: related, not a mapping
ISO 27001	A.5.31 A.5.36 Clause 9.1	Legal, statutory, regulatory and contractual requirements; Compliance with policies, rules and standards for information security…	Editorial	Same topic: Compliance (editorial pick) 8 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-03, ID.IM-02: related, not a mapping A.8.8 Management of technical vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-03: related, not a mapping A.8.30 Outsourced development Loosely related Only shares CSF GV.OV-03: related, not a mapping A.8.32 Change management Loosely related Only shares CSF GV.OV-03: related, not a mapping A.8.34 Protection of information systems during audit testing Loosely related Only shares CSF GV.OV-03: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-03: related, not a mapping
CIS v8.1	CIS 7.1 CIS 7.5 CIS 7.6 CIS 7.7	Establish and Maintain a Vulnerability Management Process; Perform Automated Vulnerability Scans of Internal Enterprise Assets…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +6 more loosely related (not mappings) CIS 16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 18.1 Establish and Maintain a Penetration Testing Program Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 18.2 Perform Periodic External Penetration Tests Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 18.3 Remediate Penetration Test Findings Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 2 more in the downloads
SOC 2	CC4.1 CC4.2	Ongoing and/or separate evaluations of controls; Communicating and remediating control deficiencies	Editorial	Same topic: Compliance (editorial pick) 1 loosely related (not mappings) CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF ID.RA-01: related, not a mapping
PCI DSS	12.4.2	Service providers: quarterly reviews of operational tasks	Editorial	Same topic: Compliance (editorial pick) 18 loosely related (not mappings) 11.3.1 Internal vulnerability scans every three months Loosely related Only shares CSF GV.OV-03, ID.IM-03, ID.RA-01: related, not a mapping 11.3.2 External ASV scans every three months Loosely related Only shares CSF GV.OV-03, ID.IM-03, ID.RA-01: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF GV.OV-03, ID.IM-02, ID.RA-01: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-03, ID.IM-03: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Loosely related Only shares CSF GV.OV-03, ID.IM-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-03, ID.IM-01: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.OC-03, ID.IM-02: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 10 more in the downloads
800-53	CA-2 PM-4 PM-6 CA-5 CA-7 PL-2	Control Assessments; Plan of Action and Milestones Process…	Crosswalk	Same topic: Compliance (editorial pick) NIST SP 800-171r2 Appendix D 10 loosely related (not mappings) CA-8 Penetration Testing Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA-5 Vulnerability Monitoring and Scanning Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OV-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SA-11 Developer Testing and Evaluation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SA-15 Development Process, Standards, and Tools Loosely related Only shares CSF ID.RA-01: related, not a mapping SI-5 Security Alerts, Advisories, and Directives Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 2 more in the downloads
HIPAA	§164.308(a)(8)	Evaluation	Editorial	Same topic: Compliance (editorial pick) 26 loosely related (not mappings) §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(1) Security Management Process Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 18 more in the downloads
GDPR	Art.5(2)	Principles relating to processing of personal data	Editorial	Same topic: Compliance (editorial pick) 1 loosely related (not mappings) Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-01: related, not a mapping
NIS2	2.2 2.3	Compliance monitoring; Independent review of information and network security	Editorial	Same topic: Compliance (editorial pick) 6 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.5 Security testing Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-01: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	ISM-0304 ISM-1407 ISM-1501 ISM-1690	Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used…	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping +25 more loosely related (not mappings) ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 21 more in the downloads
DORA	Art.5(2)(f)Art.6(6)Art.6(7)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Compliance (editorial pick) 4 loosely related (not mappings) Art.8(2) Identification Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.25(1) Testing of ICT tools and systems Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.26(1) Advanced testing of ICT tools, systems and processes based on TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.27(1) Requirements for testers for the carrying out of TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping
CPS 234	Para 32 Para 33 Para 34	Internal audit reviews control design and effectiveness; Assurance provided by appropriately skilled personnel…	Editorial	Same topic: Compliance (editorial pick) 3 loosely related (not mappings) Para 17 Keep capability current as threats and vulnerabilities change Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Loosely related Only shares CSF ID.RA-01: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.RA-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.