CMMC · CA Security Assessment
CA.L2-3.12.3
Security Control Monitoring
frameworkCMMC Level 2
sectionCA Security Assessment
csf 2.0DE.AE-02 DE.AE-03 DE.CM-01 DE.CM-02 DE.CM-03 DE.CM-06 DE.CM-09 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01
topics—
frameworks1 0 0
Official textMonitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-02DE.AE-03DE.CM-01DE.CM-02 | Potentially adverse events are analyzed to better understand associated activities; Information is correlated from multiple sources… | No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-02: related, not a mapping+4 more loosely related (not mappings)DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events Only shares CSF DE.CM-03: related, not a mapping DE.CM-06 External service provider activities and services are monitored to find potentially adverse events Only shares CSF DE.CM-06: related, not a mapping DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Only shares CSF DE.CM-09: related, not a mapping ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Only shares CSF ID.RA-01: related, not a mapping | |
| ISO 27001 | A.8.16A.7.4A.8.15Clause 9.1 | Monitoring activities; Physical security monitoring… | No mapping. Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-06…: related, not a mapping+7 more loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF DE.CM-06: related, not a mapping A.5.24 Information security incident management planning and preparation Only shares CSF DE.AE-02: related, not a mapping A.5.25 Assessment and decision on information security events Only shares CSF DE.AE-02: related, not a mapping …and 3 more in the downloads | |
| CIS v8.1 | CIS 10.7CIS 13.1CIS 7.1CIS 8.11 | Use Behavior-Based Anti-Malware Software; Centralize Security Event Alerting… | No mapping. Only shares CSF DE.CM-03, DE.CM-09, DE.AE-03, DE.CM-01…: related, not a mapping | |
| SOC 2 | CC7.2CC6.4CC6.6CC6.8 | Monitoring system components for anomalies; Physical access restrictions… | No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping | |
| PCI DSS | 10.2.110.4.111.3.111.3.2 | Audit logs enabled and active; Security event and critical logs reviewed daily… | No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping+29 more loosely related (not mappings)1.2.4 Accurate account-data flow diagram maintained Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF DE.AE-02, ID.RA-01: related, not a mapping 10.3.3 Logs promptly backed up to a central server Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping …and 25 more in the downloads | |
| 800-53 | CA-2CA-5CA-7PL-2 | Control Assessments; Plan of Action and Milestones… | Crosswalk | NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.12.03 → SP 800-5340 loosely related (not mappings)SI-4 System Monitoring Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-06…: related, not a mapping IR-4 Incident Handling Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping CA-8 Penetration Testing Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR-8 Incident Response Plan Only shares CSF DE.AE-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping RA-5 Vulnerability Monitoring and Scanning Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SA-11 Developer Testing and Evaluation Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping …and 32 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(D)§164.308(a)(8)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B) | Information System Activity Review; Evaluation… | No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-02…: related, not a mapping+34 more loosely related (not mappings)§164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, ID.IM-01…: related, not a mapping §164.308(a)(3) Workforce Security Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(4) Information Access Management Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping …and 30 more in the downloads | |
| GDPR | Art.28(1)Art.28(3)Art.29Art.32(1)(d) | Processor; Processor… | No mapping. Only shares CSF DE.CM-06, DE.CM-03, ID.RA-01: related, not a mapping+1 more loosely related (not mappings) | |
| NIS2 | 4.36.913.12.1 | Crisis management; Protection against malicious and unauthorised software… | No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-09…: related, not a mapping+5 more loosely related (not mappings)…and 1 more in the downloads | |
| Essential Eight | ISM-0109ISM-1906ISM-1907ISM-1228 | Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber…… | No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping+40 more loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01: related, not a mapping ISM-0843 Application control is implemented on workstations Only shares CSF DE.CM-09: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF DE.CM-09: related, not a mapping …and 36 more in the downloads | |
| DORA | Art.10(3)Art.9(1)Art.10(1)Art.10(2) | Detection; Protection and prevention… | No mapping. Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-09…: related, not a mapping+12 more loosely related (not mappings)…and 8 more in the downloads | |
| CPS 234 | Para 23Para 16Para 17Para 22 | Detect and respond to incidents in a timely manner; Assess third parties' information security capability… | No mapping. Only shares CSF DE.AE-02, DE.CM-01, DE.CM-06, ID.RA-01: related, not a mapping+4 more loosely related (not mappings)Para 27 Systematic testing programme for control effectiveness Only shares CSF ID.RA-01: related, not a mapping Para 28 Check third parties' control testing is adequate Only shares CSF DE.CM-06: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Only shares CSF ID.RA-01: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF DE.CM-06: related, not a mapping | |
| Cyber Essentials | CE 3CE 5 | Security Update Management; Malware protection | No mapping. Only shares CSF ID.RA-01, DE.CM-09: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.