框架
CMMC Level 2
概述
美国国防部的网络安全成熟度模型认证。二级要求即 NIST SP 800-171 Rev 2 的 110 项安全要求，用于保护受控非密信息（CUI）。该项目规则于 2024 年 12 月生效，合同要求将自 2025 年 11 月起分阶段落地。
适用人群
处理、存储或传输 CUI 的国防承包商及分包商。
评估方式
可选择自评，或者对于大多数 CUI 合同，由认可的第三方评估机构（C3PAO）进行认证评估，每三年一次，并需每年提交一次确认声明。对于部分要求，允许采用有限的行动计划与里程碑，并须在 180 天内完成整改。
110
实践
109
映射到其他框架
78%
已覆盖主题（39/50）
对比分析
要求
要求编号和标题均按各框架官方发布的英文原文显示。
| ID | 要求 | 主题 | 映射于 |
|---|---|---|---|
| AC Access Control · 22 | |||
| AC.L2-3.1.1 | Authorized Access Control | 访问控制, 零信任 | 11 / 13 |
| AC.L2-3.1.2 | Transaction & Function Control | 访问控制 | 11 / 13 |
| AC.L2-3.1.3 | Control CUI Flow | DLP | 7 / 13 |
| AC.L2-3.1.4 | Separation of Duties | — | 1 / 13 |
| AC.L2-3.1.5 | Least Privilege | 特权访问 | 10 / 13 |
| AC.L2-3.1.6 | Non-Privileged Account Use | 特权访问 | 10 / 13 |
| AC.L2-3.1.7 | Privileged Functions | 特权访问 | 10 / 13 |
| AC.L2-3.1.8 | Unsuccessful Logon Attempts | — | 1 / 13 |
| AC.L2-3.1.9 | Privacy & Security Notices | — | 1 / 13 |
| AC.L2-3.1.10 | Session Lock | — | 1 / 13 |
| AC.L2-3.1.11 | Session Termination | — | 1 / 13 |
| AC.L2-3.1.12 | Control Remote Access | — | 1 / 13 |
| AC.L2-3.1.13 | Remote Access Confidentiality | 加密 | 10 / 13 |
| AC.L2-3.1.14 | Remote Access Routing | — | 1 / 13 |
| AC.L2-3.1.15 | Privileged Remote Access | — | 1 / 13 |
| AC.L2-3.1.16 | Wireless Access Authorization | — | 1 / 13 |
| AC.L2-3.1.17 | Wireless Access Protection | — | 1 / 13 |
| AC.L2-3.1.18 | Mobile Device Connection | 移动安全 | 7 / 13 |
| AC.L2-3.1.19 | Encrypt CUI on Mobile | 加密, 移动安全 | 11 / 13 |
| AC.L2-3.1.20 | External Connections | 云安全 | 11 / 13 |
| AC.L2-3.1.21 | Portable Storage Use | — | 1 / 13 |
| AC.L2-3.1.22 | Control Public Information | — | 1 / 13 |
| AT Awareness and Training · 3 | |||
| AT.L2-3.2.1 | Role-Based Risk Awareness | 意识与培训 | 10 / 13 |
| AT.L2-3.2.2 | Role-Based Training | 意识与培训 | 10 / 13 |
| AT.L2-3.2.3 | Insider Threat Awareness | 意识与培训, 内部威胁 | 10 / 13 |
| AU Audit and Accountability · 9 | |||
| AU.L2-3.3.1 | System Auditing | 日志与审计 | 10 / 13 |
| AU.L2-3.3.2 | User Accountability | 日志与审计, 内部威胁 | 11 / 13 |
| AU.L2-3.3.3 | Event Review | — | 1 / 13 |
| AU.L2-3.3.4 | Audit Failure Alerting | — | 1 / 13 |
| AU.L2-3.3.5 | Audit Correlation | SIEM / SOC | 10 / 13 |
| AU.L2-3.3.6 | Reduction & Reporting | 取证分析 | 7 / 13 |
| AU.L2-3.3.7 | Authoritative Time Source | 日志与审计 | 10 / 13 |
| AU.L2-3.3.8 | Audit Protection | — | 1 / 13 |
| AU.L2-3.3.9 | Audit Management | — | 1 / 13 |
| CA Security Assessment · 4 | |||
| CA.L2-3.12.1 | Security Control Assessment | 合规 | 10 / 13 |
| CA.L2-3.12.2 | Plan of Action | — | 1 / 13 |
| CA.L2-3.12.3 | Security Control Monitoring | — | 1 / 13 |
| CA.L2-3.12.4 | System Security Plan | — | 1 / 13 |
| CM Configuration Management · 9 | |||
| CM.L2-3.4.1 | System Baselining | 资产管理, 安全配置 | 13 / 13 |
| CM.L2-3.4.2 | Security Configuration Enforcement | 安全配置 | 9 / 13 |
| CM.L2-3.4.3 | System Change Management | — | 1 / 13 |
| CM.L2-3.4.4 | Security Impact Analysis | — | 1 / 13 |
| CM.L2-3.4.5 | Access Restrictions for Change | — | 1 / 13 |
| CM.L2-3.4.6 | Least Functionality | 安全配置 | 9 / 13 |
| CM.L2-3.4.7 | Nonessential Functionality | 安全配置 | 9 / 13 |
| CM.L2-3.4.8 | Application Execution Policy | — | 1 / 13 |
| CM.L2-3.4.9 | User-Installed Software | — | 1 / 13 |
| IA Identification and Authentication · 11 | |||
| IA.L2-3.5.1 | Identification | — | 1 / 13 |
| IA.L2-3.5.2 | Authentication | — | 1 / 13 |
| IA.L2-3.5.3 | Multifactor Authentication | 多因素认证 | 10 / 13 |
| IA.L2-3.5.4 | Replay-Resistant Authentication | — | 1 / 13 |
| IA.L2-3.5.5 | Identifier Reuse | — | 1 / 13 |
| IA.L2-3.5.6 | Identifier Handling | — | 1 / 13 |
| IA.L2-3.5.7 | Password Complexity | — | 1 / 13 |
| IA.L2-3.5.8 | Password Reuse | — | 1 / 13 |
| IA.L2-3.5.9 | Temporary Passwords | — | 1 / 13 |
| IA.L2-3.5.10 | Cryptographically-Protected Passwords | — | 1 / 13 |
| IA.L2-3.5.11 | Obscure Feedback | — | 1 / 13 |
| IR Incident Response · 3 | |||
| IR.L2-3.6.1 | Incident Handling | 事件响应, 缓解, 经验教训 | 12 / 13 |
| IR.L2-3.6.2 | Incident Reporting | 沟通, 报告, 沟通与恢复 | 12 / 13 |
| IR.L2-3.6.3 | Incident Response Testing | 事件响应 | 12 / 13 |
| MA Maintenance · 6 | |||
| MA.L2-3.7.1 | Perform Maintenance | — | 1 / 13 |
| MA.L2-3.7.2 | System Maintenance Control | — | 1 / 13 |
| MA.L2-3.7.3 | Equipment Sanitization | — | 1 / 13 |
| MA.L2-3.7.4 | Media Inspection | — | 1 / 13 |
| MA.L2-3.7.5 | Nonlocal Maintenance | — | 1 / 13 |
| MA.L2-3.7.6 | Maintenance Personnel | — | 1 / 13 |
| MP Media Protection · 9 | |||
| MP.L2-3.8.1 | Media Protection | — | 1 / 13 |
| MP.L2-3.8.2 | Media Access | — | 1 / 13 |
| MP.L2-3.8.3 | Media Disposal | 数据保护 | 11 / 13 |
| MP.L2-3.8.4 | Media Markings | 数据分类 | 9 / 13 |
| MP.L2-3.8.5 | Media Accountability | — | 1 / 13 |
| MP.L2-3.8.6 | Portable Storage Encryption | 加密 | 10 / 13 |
| MP.L2-3.8.7 | Removable Media | — | 1 / 13 |
| MP.L2-3.8.8 | Shared Media | — | 1 / 13 |
| MP.L2-3.8.9 | Protect Backups | 备份与恢复 | 11 / 13 |
| PE Physical Protection · 6 | |||
| PE.L2-3.10.1 | Limit Physical Access | 物理安全 | 8 / 13 |
| PE.L2-3.10.2 | Monitor Facility | 物理安全 | 8 / 13 |
| PE.L2-3.10.3 | Escort Visitors | 物理安全 | 8 / 13 |
| PE.L2-3.10.4 | Physical Access Logs | 物理安全 | 8 / 13 |
| PE.L2-3.10.5 | Manage Physical Access | 物理安全 | 8 / 13 |
| PE.L2-3.10.6 | Alternative Work Sites | 物理安全 | 8 / 13 |
| PS Personnel Security · 2 | |||
| PS.L2-3.9.1 | Screen Individuals | 内部威胁 | 8 / 13 |
| PS.L2-3.9.2 | Personnel Actions | — | 1 / 13 |
| RA Risk Assessment · 3 | |||
| RA.L2-3.11.1 | Risk Assessments | 风险管理, 风险评估 | 10 / 13 |
| RA.L2-3.11.2 | Vulnerability Scan | 漏洞管理 | 13 / 13 |
| RA.L2-3.11.3 | Vulnerability Remediation | 漏洞管理 | 13 / 13 |
| SC System and Communications Protection · 16 | |||
| SC.L2-3.13.1 | Boundary Protection | 防火墙 / 网络分段, Web 安全, 零信任 | 9 / 13 |
| SC.L2-3.13.2 | Security Engineering | 安全开发 | 8 / 13 |
| SC.L2-3.13.3 | Role Separation | — | 1 / 13 |
| SC.L2-3.13.4 | Shared Resource Control | — | 1 / 13 |
| SC.L2-3.13.5 | Public-Access System Separation | 防火墙 / 网络分段 | 9 / 13 |
| SC.L2-3.13.6 | Network Communication by Exception | 防火墙 / 网络分段, 零信任 | 9 / 13 |
| SC.L2-3.13.7 | Split Tunneling | — | 1 / 13 |
| SC.L2-3.13.8 | Data in Transit | 加密 | 10 / 13 |
| SC.L2-3.13.9 | Connections Termination | — | 1 / 13 |
| SC.L2-3.13.10 | Key Management | 加密 | 10 / 13 |
| SC.L2-3.13.11 | CUI Encryption | 加密 | 10 / 13 |
| SC.L2-3.13.12 | Collaborative Device Control | — | 1 / 13 |
| SC.L2-3.13.13 | Mobile Code | — | 1 / 13 |
| SC.L2-3.13.14 | Voice over Internet Protocol | — | 无 |
| SC.L2-3.13.15 | Communications Authenticity | — | 1 / 13 |
| SC.L2-3.13.16 | Data at Rest | 加密, 数据保护 | 11 / 13 |
| SI System and Information Integrity · 7 | |||
| SI.L2-3.14.1 | Flaw Remediation | 补丁管理 | 10 / 13 |
| SI.L2-3.14.2 | Malicious Code Protection | 终端防护, 邮件安全 | 10 / 13 |
| SI.L2-3.14.3 | Security Alerts & Advisories | 威胁情报 | 6 / 13 |
| SI.L2-3.14.4 | Update Malicious Code Protection | 终端防护 | 10 / 13 |
| SI.L2-3.14.5 | System & File Scanning | — | 1 / 13 |
| SI.L2-3.14.6 | Monitor Communications for Attacks | 持续监控, 入侵检测 | 11 / 13 |
| SI.L2-3.14.7 | Identify Unauthorized Use | 持续监控, 异常检测 | 10 / 13 |
主题覆盖情况
已映射 CMMC 要求的主题（39）：
意识与培训风险管理合规资产管理风险评估数据分类漏洞管理威胁情报访问控制多因素认证加密数据保护备份与恢复特权访问防火墙 / 网络分段终端防护补丁管理安全配置安全开发邮件安全Web 安全零信任移动安全云安全DLP持续监控日志与审计入侵检测异常检测SIEM / SOC事件响应取证分析沟通缓解报告经验教训沟通与恢复内部威胁物理安全
本站数据中无映射 无 CMMC 要求（11）：