Security Engineering

frameworkCMMC Level 2 sectionSC System and Communications Protection csf 2.0DE.CM-01 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 PR.DS-01 PR.DS-02 PR.DS-10 PR.IR-01 PR.IR-03 PR.PS-06 topicsSecure Development frameworks6 2 0

Official textEmploy architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of SC.L2-3.13.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-06	Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	Crosswalk	Same topic: Secure Development 7 loosely related (not mappings) DE.CM-01 Networks and network services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-01: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Loosely related Only shares CSF PR.DS-01: related, not a mapping PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected Loosely related Only shares CSF PR.DS-02: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Loosely related Only shares CSF PR.IR-01: related, not a mapping PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations Loosely related Only shares CSF PR.IR-03: related, not a mapping
ISO 27001	A.8.25 A.8.26 A.8.28 A.8.29	Secure development life cycle; Application security requirements…	Crosswalk	Same topic: Secure Development 48 loosely related (not mappings) A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.17 Clock synchronization Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-03: related, not a mapping A.8.22 Segregation of networks Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-03: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 40 more in the downloads
CIS v8.1	CIS 16.1 CIS 16.2 CIS 16.3 CIS 16.5 CIS 16.8 CIS 16.9 CIS 16.11 CIS 16.12 CIS 16.13 CIS 16.14	Establish and Maintain a Secure Application Development Process; Establish and Maintain a Process to Accept and Address Software Vulnerabilities…	Crosswalk	Same topic: Secure Development 45 loosely related (not mappings) CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 12.2 Establish and Maintain a Secure Network Architecture Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.CM-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 37 more in the downloads
SOC 2	CC8.1	Change management for infrastructure, data and software	Editorial	Same topic: Secure Development (editorial pick) 12 loosely related (not mappings) C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-08, PR.DS-01, PR.DS-02: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF DE.CM-01, PR.IR-01, PR.PS-06: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF PR.IR-03: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF PR.IR-03: related, not a mapping A1.3 Testing recovery plan procedures Loosely related Only shares CSF PR.IR-03: related, not a mapping …and 4 more in the downloads
PCI DSS	6.2.2 6.2.3 6.2.1	Developers trained in secure software development; Custom code reviewed before release…	Crosswalk	Same topic: Secure Development 49 loosely related (not mappings) 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF ID.AM-08, PR.IR-01, PR.PS-06: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF ID.IM-02, PR.PS-06: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF ID.AM-08, ID.IM-01: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF ID.IM-02, PR.IR-03: related, not a mapping …and 41 more in the downloads
800-53	SA-3 SA-8 SA-11 SA-15 SC-7	System Development Life Cycle; Security and Privacy Engineering Principles…	Crosswalk	Same topic: Secure Development NIST SP 800-171r2 Appendix D 55 loosely related (not mappings) SI-4 System Monitoring Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping PL-2 System Security and Privacy Plans Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-39 Process Isolation Loosely related Only shares CSF PR.DS-01, PR.DS-10, PR.IR-03: related, not a mapping …and 47 more in the downloads
HIPAA	§164.308(a)(1)(ii)(D)§164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)	Information System Activity Review; Workforce Security…	Loosely related	No mapping. Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping +36 more loosely related (not mappings) §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01…: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping …and 32 more in the downloads
GDPR	Art.25(1)	Data protection by design and by default	Editorial	Same topic: Secure Development (editorial pick) 8 loosely related (not mappings) Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-03: related, not a mapping Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.32(1)(a) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.32(1)(c) Security of processing Loosely related Only shares CSF PR.IR-03: related, not a mapping
NIS2	6.2	Secure development life cycle	Crosswalk	Same topic: Secure Development 7 loosely related (not mappings) 4.3 Crisis management Loosely related Only shares CSF DE.CM-01, PR.IR-03: related, not a mapping 6.7 Network security Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01: related, not a mapping 12.3 Removable media policy Loosely related Only shares CSF PR.DS-01: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping
Essential Eight	ISM-0109 ISM-1488 ISM-1515 ISM-1807	Event logs from workstations are analysed in a timely manner to detect cyber security…; Microsoft Office macros in files originating from the internet are blocked…	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.DS-02, PR.IR-03, ID.AM-08: related, not a mapping +2 more loosely related (not mappings) ISM-1906 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… Loosely related Only shares CSF DE.CM-01: related, not a mapping ISM-1907 Event logs from non-internet-facing servers are analysed in a timely manner to detect… Loosely related Only shares CSF DE.CM-01: related, not a mapping
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)Art.9(3)(a)	Protection and prevention; Protection and prevention…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +15 more loosely related (not mappings) Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 11 more in the downloads
CPS 234	Para 21 Para 20 Para 23	Timely controls commensurate with risk and asset life-cycle; Classify information assets by criticality and sensitivity…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, ID.AM-08…: related, not a mapping
Cyber Essentials	CE 1 CE 3 CE 4	Firewalls; Security Update Management…	Loosely related	No mapping. Only shares CSF PR.IR-01, ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.