User-Installed Software

frameworkCMMC Level 2 sectionCM Configuration Management csf 2.0DE.AE-02 DE.AE-03 DE.CM-01 DE.CM-02 DE.CM-03 DE.CM-06 DE.CM-09 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 PR.AA-05 PR.PS-01 topics— frameworks1 0 0

Official textControl and monitor user-installed software.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of CM.L2-3.4.9 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.AE-02 DE.AE-03 DE.CM-01 DE.CM-02	Potentially adverse events are analyzed to better understand associated activities; Information is correlated from multiple sources…	Loosely related	No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-02: related, not a mapping +6 more loosely related (not mappings) DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-03: related, not a mapping DE.CM-06 External service provider activities and services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-06: related, not a mapping DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-09: related, not a mapping ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 2 more in the downloads
ISO 27001	A.8.16 A.7.4 A.8.8 A.8.15	Monitoring activities; Physical security monitoring…	Loosely related	No mapping. Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-06…: related, not a mapping +22 more loosely related (not mappings) Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF DE.CM-03, ID.IM-03: related, not a mapping Clause 9.3 Management review Loosely related Only shares CSF ID.IM-02, PR.PS-01: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 18 more in the downloads
CIS v8.1	CIS 10.7 CIS 13.1 CIS 3.3 CIS 4.1	Use Behavior-Based Anti-Malware Software; Centralize Security Event Alerting…	Loosely related	No mapping. Only shares CSF DE.CM-03, DE.CM-09, DE.AE-03, DE.CM-01…: related, not a mapping +70 more loosely related (not mappings) CIS 4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 5.1 Establish and Maintain an Inventory of Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 6.8 Define and Maintain Role-Based Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 7.1 Establish and Maintain a Vulnerability Management Process Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 66 more in the downloads
SOC 2	CC7.2 CC6.6 CC6.7 CC7.1	Monitoring system components for anomalies; Protection against threats from outside system boundaries…	Loosely related	No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping +8 more loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF DE.CM-06, PR.PS-01: related, not a mapping CC5.2 General controls over technology Loosely related Only shares CSF PR.PS-01: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.2 User registration, authorization and removal Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 4 more in the downloads
PCI DSS	10.2.1 10.4.1 11.3.1 11.3.2	Audit logs enabled and active; Security event and critical logs reviewed daily…	Loosely related	No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping +38 more loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF DE.AE-02, ID.RA-01: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Loosely related Only shares CSF DE.CM-06, PR.AA-05: related, not a mapping 10.3.3 Logs promptly backed up to a central server Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping …and 34 more in the downloads
800-53	AC-6 AC-6(5)AU-9 CA-7 CM-7(5)CM-11	Least Privilege; Privileged Accounts…	Crosswalk	NIST SP 800-171r3 03.01.05 → SP 800-53; NIST SP 800-171r3 03.01.06 → SP 800-53; NIST SP 800-171r3 03.12.03 → SP 800-53; NIST SP 800-171r3 03.04.08 → SP 800-53; NIST SP 800-171r2 Appendix D 57 loosely related (not mappings) SI-4 System Monitoring Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-06…: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA-8 Penetration Testing Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR-8 Incident Response Plan Loosely related Only shares CSF DE.AE-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA-5 Vulnerability Monitoring and Scanning Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SA-11 Developer Testing and Evaluation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping …and 49 more in the downloads
HIPAA	§164.308(a)(1)(ii)(D)§164.308(a)(8)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)	Information System Activity Review; Evaluation…	Loosely related	No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-02…: related, not a mapping +39 more loosely related (not mappings) §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, ID.IM-01…: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping …and 35 more in the downloads
GDPR	Art.28(1)Art.25(2)Art.28(3)Art.29	Processor; Data protection by design and by default…	Loosely related	No mapping. Only shares CSF DE.CM-06, PR.PS-01, PR.AA-05, DE.CM-03: related, not a mapping +3 more loosely related (not mappings) Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.AA-05: related, not a mapping Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF DE.CM-03: related, not a mapping
NIS2	4.3 6.9 13.1 2.1	Crisis management; Protection against malicious and unauthorised software…	Loosely related	No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-09…: related, not a mapping +11 more loosely related (not mappings) 6.3 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping 6.5 Security testing Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.6 Security patch management Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.7 Network security Loosely related Only shares CSF DE.CM-01: related, not a mapping …and 7 more in the downloads
Essential Eight	ISM-0109 ISM-1906 ISM-1907 ISM-1228	Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber……	Loosely related	No mapping. Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping +88 more loosely related (not mappings) ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF DE.CM-09, PR.PS-01: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF DE.AE-03, PR.AA-05: related, not a mapping ISM-1623 PowerShell module logging, script block logging and transcription events are centrally… Loosely related Only shares CSF DE.AE-03, PR.PS-01: related, not a mapping ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 84 more in the downloads
DORA	Art.10(3)Art.9(1)Art.10(1)Art.10(2)	Detection; Protection and prevention…	Loosely related	No mapping. Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-09…: related, not a mapping +12 more loosely related (not mappings) Art.9(4)(c) Protection and prevention Loosely related Only shares CSF DE.CM-02, PR.AA-05: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF DE.CM-06, PR.PS-01: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF DE.CM-06, PR.PS-01: related, not a mapping Art.6(2) ICT risk management framework Loosely related Only shares CSF DE.CM-02: related, not a mapping …and 8 more in the downloads
CPS 234	Para 23 Para 16 Para 17 Para 22	Detect and respond to incidents in a timely manner; Assess third parties' information security capability…	Loosely related	No mapping. Only shares CSF DE.AE-02, DE.CM-01, DE.CM-06, ID.RA-01: related, not a mapping +4 more loosely related (not mappings) Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF DE.CM-06: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Loosely related Only shares CSF ID.RA-01: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF DE.CM-06: related, not a mapping
Cyber Essentials	CE 2 CE 4 CE 3 CE 5	Secure Configuration; User Access Control…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.PS-01, ID.RA-01, DE.CM-09: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.