Equipment Sanitization

frameworkCMMC Level 2 sectionMA Maintenance csf 2.0ID.AM-08 topics— frameworks1 0 0

Official textEnsure equipment removed for off-site maintenance is sanitized of any CUI.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of MA.L2-3.7.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-08	Systems, hardware, software, services, and data are managed throughout their life cycles	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
ISO 27001	A.5.8 A.5.9 A.5.11 A.5.12	Information security in project management; Inventory of information and other associated assets…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +6 more loosely related (not mappings) A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.10 Storage media Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 2 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.5 CIS 1.2 CIS 1.3	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +5 more loosely related (not mappings) CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads
SOC 2	CC6.1	Logical access security over information assets	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
PCI DSS	6.2.1 6.2.2 6.2.3 6.2.3.1	Bespoke and custom software developed securely; Developers trained in secure software development…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +5 more loosely related (not mappings) 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF ID.AM-08: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads
800-53	MA-2 MP-6	Controlled Maintenance; Media Sanitization	Crosswalk	NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.08.03 → SP 800-53 14 loosely related (not mappings) CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-08: related, not a mapping MA-6 Timely Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping PL-2 System Security and Privacy Plans Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-22 Personally Identifiable Information Quality Management Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-23 Data Governance Body Loosely related Only shares CSF ID.AM-08: related, not a mapping SA-3 System Development Life Cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.308(b)(4)§164.310(a)(2)(ii)§164.310(a)(2)(iv)	Risk Management; Written Contract or Other Arrangement…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +10 more loosely related (not mappings) §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(b) Requirements for Group Health Plans Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
NIS2	6.2 12.4	Secure development life cycle; Asset inventory	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.