Role Separation

frameworkCMMC Level 2 sectionSC System and Communications Protection csf 2.0DE.CM-01 DE.CM-03 DE.CM-09 PR.AA-01 PR.AA-05 PR.DS-10 PR.IR-01 topics— frameworks1 0 0

Official textSeparate user functionality from system management functionality.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of SC.L2-3.13.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-01 DE.CM-03 DE.CM-09 PR.AA-01	Networks and network services are monitored to find potentially adverse events; Personnel activity and technology usage are monitored to find potentially adverse events…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.AA-01: related, not a mapping +3 more loosely related (not mappings) PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Loosely related Only shares CSF PR.IR-01: related, not a mapping
ISO 27001	A.5.15 A.8.2 A.8.16 A.5.3	Access control; Privileged access rights…	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10, DE.CM-01…: related, not a mapping +30 more loosely related (not mappings) A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.16 Identity management Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping A.5.18 Access rights Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping A.8.3 Information access restriction Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping …and 26 more in the downloads
CIS v8.1	CIS 3.12 CIS 5.1 CIS 10.7 CIS 3.3	Segment Data Processing and Storage Based on Sensitivity; Establish and Maintain an Inventory of Accounts…	Loosely related	No mapping. Only shares CSF PR.DS-10, PR.IR-01, PR.AA-01, PR.AA-05…: related, not a mapping +55 more loosely related (not mappings) CIS 5.6 Centralize Account Management Loosely related Only shares CSF PR.AA-01: related, not a mapping CIS 6.7 Centralize Access Control Loosely related Only shares CSF PR.AA-01: related, not a mapping CIS 6.8 Define and Maintain Role-Based Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 10.1 Deploy and Maintain Anti-Malware Software Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 51 more in the downloads
SOC 2	CC6.6 CC7.2 CC6.1 CC6.2	Protection against threats from outside system boundaries; Monitoring system components for anomalies…	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.AA-05, PR.IR-01, DE.CM-03…: related, not a mapping +6 more loosely related (not mappings) CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-10: related, not a mapping …and 2 more in the downloads
PCI DSS	10.2.1 1.2.4 5.2.1 5.2.2	Audit logs enabled and active; Accurate account-data flow diagram maintained…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, PR.IR-01, DE.CM-09: related, not a mapping +43 more loosely related (not mappings) 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping 7.2.2 Access assigned by job function and least privilege Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping …and 39 more in the downloads
800-53	AC-2 AC-3 AC-4 AC-5 AC-6 AC-6(5)AU-9 SC-2	Account Management; Access Enforcement…	Crosswalk	NIST SP 800-171r3 03.01.01 → SP 800-53; NIST SP 800-171r3 03.01.02 → SP 800-53; NIST SP 800-171r3 03.01.03 → SP 800-53; NIST SP 800-171r3 03.01.04 → SP 800-53; NIST SP 800-171r3 03.01.05 → SP 800-53; NIST SP 800-171r3 03.01.06 → SP 800-53; NIST SP 800-171r2 Appendix D 55 loosely related (not mappings) AU-12 Audit Record Generation Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF DE.CM-01, DE.CM-09, PR.DS-10: related, not a mapping AU-13 Monitoring for Information Disclosure Loosely related Only shares CSF DE.CM-03, PR.DS-10: related, not a mapping CM-3 Configuration Change Control Loosely related Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping CM-10 Software Usage Restrictions Loosely related Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping CM-11 User-installed Software Loosely related Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping …and 47 more in the downloads
HIPAA	§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)§164.308(a)(3)§164.312(a)(2)(i)	Authorization and/or Supervision; Access Authorization…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.AA-01…: related, not a mapping +27 more loosely related (not mappings) §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping …and 23 more in the downloads
GDPR	Art.32(1)(b)Art.25(2)Art.5(1)(e)Art.5(1)(f)	Security of processing; Data protection by design and by default…	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping +3 more loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF DE.CM-03: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF DE.CM-03: related, not a mapping
NIS2	6.7 6.9 11.5 4.3	Network security; Protection against malicious and unauthorised software…	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.IR-01, DE.CM-09, PR.AA-01…: related, not a mapping +6 more loosely related (not mappings) 6.6 Security patch management Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 11.1 Access control policy Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.2 Management of access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 2 more in the downloads
Essential Eight	ISM-0109 ISM-1906 ISM-1907 ISM-0445	Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber……	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.AA-05: related, not a mapping +26 more loosely related (not mappings) ISM-0843 Application control is implemented on workstations Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 22 more in the downloads
DORA	Art.9(1)Art.10(3)Art.9(4)(c)Art.10(1)	Protection and prevention; Detection…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.AA-01…: related, not a mapping +7 more loosely related (not mappings) Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 3 more in the downloads
CPS 234	Para 21 Para 23	Timely controls commensurate with risk and asset life-cycle; Detect and respond to incidents in a timely manner	Loosely related	No mapping. Only shares CSF PR.DS-10, DE.CM-01: related, not a mapping
Cyber Essentials	CE 4 CE 1 CE 2 CE 5	User Access Control; Firewalls…	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01, DE.CM-09: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.