System Security Plan

frameworkCMMC Level 2 sectionCA Security Assessment csf 2.0ID.AM-03 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 topics— frameworks1 0 0

Official textDevelop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of CA.L2-3.12.4 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-03 ID.AM-08	Representations of the organization's authorized network communication and internal and external network data flows are maintained; Systems, hardware, software, services, and data are managed throughout their life cycles	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping
ISO 27001	A.5.19 A.5.8 A.5.9 A.5.11	Information security in supplier relationships; Information security in project management…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.IM-02: related, not a mapping +10 more loosely related (not mappings) A.5.12 Classification of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.5 CIS 3.8 CIS 1.2	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping +13 more loosely related (not mappings) CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
SOC 2	CC6.1 CC6.6	Logical access security over information assets; Protection against threats from outside system boundaries	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping
PCI DSS	6.3.3 12.3.4 1.2.3 1.2.4	Security patches installed promptly; Hardware and software technologies reviewed annually…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.IM-03, ID.IM-01, ID.AM-03: related, not a mapping +11 more loosely related (not mappings) 6.2.1 Bespoke and custom software developed securely Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.2 Developers trained in secure software development Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
800-53	CA-2 CA-5 CA-7 PL-2	Control Assessments; Plan of Action and Milestones…	Crosswalk	NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.15.02 → SP 800-53 19 loosely related (not mappings) SA-8 Security and Privacy Engineering Principles Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF ID.AM-03: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF ID.AM-03: related, not a mapping CA-9 Internal System Connections Loosely related Only shares CSF ID.AM-03: related, not a mapping CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 11 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.310(a)(2)(ii)§164.314(b)§164.314(b)(2)(i)	Risk Management; Facility Security Plan…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping +16 more loosely related (not mappings) §164.314(b)(2)(ii) Group Health Plan Implementation Specification Loosely related Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping §164.316(b) Documentation Loosely related Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping §164.316(b)(2)(iii) Updates Loosely related Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping …and 12 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
NIS2	12.4 4.3 6.2	Asset inventory; Crisis management…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)Art.9(4)(b)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
Cyber Essentials	CE 1 CE 3	Firewalls; Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.