Find anything: A to Z

Pages

• Crew security training kit, in English and Spanish
• Disclaimer
• FAQ: Level 2 questions movers ask
• Find resources by your NAICS code
• Free tools and templates
• Glossary
• How to post your Level 2 self-assessment in SPRS
• How we checked these guides
• Level 2 guide: how Level 2 works, and all 110 requirements by family
• Level 2 workbook: score and track your progress
• Project Spectrum: free CMMC help for movers
• Resources home
• Security policies and plans for a moving company
• Start here
• System Security Plan template for movers
• Vendor and agent kit
• What's in scope at a moving company
• Worked example: how a 12-person mover gets to Level 2
• Your first hour on Project Spectrum

Downloads

• Level 2 workbook (Excel)
• System Security Plan template (Word)
• Security policies and plans (Word)
• Crew security training kit, English and Spanish (Word)
• Vendor and agent kit (Word)

Requirements by number

All 110 CMMC Level 2 requirements, by family, with our short title for each. The first two numbers give the family: 3.1 is Access Control, 3.5 is Identification and Authentication.

Access Control (AC): 3.1.1 to 3.1.22

• 3.1.1 Only approved people and devices get in
• 3.1.2 Each person does only their job
• 3.1.3 Control where the information goes
• 3.1.4 No one person can do it all
• 3.1.5 Least access, few administrators
• 3.1.6 Everyday login for everyday work
• 3.1.7 Administrator tasks for administrators only, and logged
• 3.1.8 Lock out password guessing
• 3.1.9 Show a notice at sign-in
• 3.1.10 Lock unattended screens
• 3.1.11 End sessions automatically
• 3.1.12 Watch remote access
• 3.1.13 Encrypt remote connections
• 3.1.14 Remote access through managed entry points
• 3.1.15 Approve remote administrator work
• 3.1.16 Approve wireless connections first
• 3.1.17 Protect your Wi-Fi
• 3.1.18 Control phones and tablets
• 3.1.19 Encrypt phones, tablets and laptops
• 3.1.20 Check and limit outside systems
• 3.1.21 Limit USB drives on other people's computers
• 3.1.22 Keep it off public pages

Awareness and Training (AT): 3.2.1 to 3.2.3

• 3.2.1 Everyone knows the risks
• 3.2.2 Train people for their security duties
• 3.2.3 Spot inside warning signs

Audit and Accountability (AU): 3.3.1 to 3.3.9

• 3.3.1 Keep activity records
• 3.3.2 Trace every action to a person
• 3.3.3 Review what you record
• 3.3.4 Get an alert if recording stops
• 3.3.5 Connect the dots
• 3.3.6 Pull a report when needed
• 3.3.7 Keep clocks in sync
• 3.3.8 Protect the records
• 3.3.9 Few people manage the recording

Configuration Management (CM): 3.4.1 to 3.4.9

• 3.4.1 Know what you have
• 3.4.2 Set things up securely
• 3.4.3 Track changes
• 3.4.4 Think before you change
• 3.4.5 Control who can make changes
• 3.4.6 Only what the business needs
• 3.4.7 Turn off what the business does not need
• 3.4.8 Control which software can run
• 3.4.9 Watch what people install

Identification and Authentication (IA): 3.5.1 to 3.5.11

• 3.5.1 Name every user and device
• 3.5.2 Prove who you are before getting in
• 3.5.3 A second step to sign in
• 3.5.4 Sign-ins that cannot be replayed
• 3.5.5 Do not recycle usernames
• 3.5.6 Switch off idle accounts
• 3.5.7 Strong passwords
• 3.5.8 No going back to old passwords
• 3.5.9 Temporary passwords are changed at once
• 3.5.10 Passwords are never stored or sent in the open
• 3.5.11 Hide passwords as they are typed

Incident Response (IR): 3.6.1 to 3.6.3

• 3.6.1 Be ready to handle incidents
• 3.6.2 Record and report incidents
• 3.6.3 Practice the plan

Maintenance (MA): 3.7.1 to 3.7.6

• 3.7.1 Keep systems maintained
• 3.7.2 Control maintenance tools and people
• 3.7.3 Wipe devices before outside repair
• 3.7.4 Check a technician's drives for malware
• 3.7.5 A second step for remote IT support
• 3.7.6 Supervise outside technicians

Media Protection (MP): 3.8.1 to 3.8.9

• 3.8.1 Lock up paper and drives
• 3.8.2 Only approved people handle them
• 3.8.3 Shred and wipe before disposal
• 3.8.4 Mark CUI
• 3.8.5 Keep track of it on the road
• 3.8.6 Encrypt drives that travel
• 3.8.7 Control USB drives
• 3.8.8 No unknown USB drives
• 3.8.9 Protect backups

Personnel Security (PS): 3.9.1 to 3.9.2

• 3.9.1 Screen people before access
• 3.9.2 Close access when people leave

Physical Protection (PE): 3.10.1 to 3.10.6

• 3.10.1 Limit who can walk in
• 3.10.2 Protect and watch the building
• 3.10.3 Escort visitors
• 3.10.4 Log who comes in
• 3.10.5 Manage keys, badges and codes
• 3.10.6 Rules for working from home

Risk Assessment (RA): 3.11.1 to 3.11.3

• 3.11.1 Assess your risks
• 3.11.2 Scan for weaknesses
• 3.11.3 Fix what you find

Security Assessment (CA): 3.12.1 to 3.12.4

• 3.12.1 Check your protections
• 3.12.2 Keep an operational plan of action
• 3.12.3 Keep watching
• 3.12.4 Write your System Security Plan

System and Communications Protection (SC): 3.13.1 to 3.13.16

• 3.13.1 Guard the edges of your network
• 3.13.2 Build security in
• 3.13.3 Keep administration separate
• 3.13.4 No leftovers in shared resources
• 3.13.5 Keep public-facing systems separate
• 3.13.6 Block by default
• 3.13.7 No side doors during remote work
• 3.13.8 Encrypt information on the move
• 3.13.9 Close idle network connections
• 3.13.10 Manage encryption keys
• 3.13.11 Use government-validated encryption
• 3.13.12 No remote switching-on of cameras and microphones
• 3.13.13 Control code that runs in documents and browsers
• 3.13.14 Control internet phones
• 3.13.15 Make sure connections are genuine
• 3.13.16 Protect stored information

System and Information Integrity (SI): 3.14.1 to 3.14.7

• 3.14.1 Find and fix flaws on time
• 3.14.2 Use protection against malware
• 3.14.3 Act on security alerts
• 3.14.4 Keep malware protection updated
• 3.14.5 Scan regularly, and scan files as they arrive
• 3.14.6 Watch for attacks
• 3.14.7 Spot misuse

Glossary terms

• Affirmation
• Affirming Official
• Assessment scope
• C3PAO (CMMC Third-Party Assessment Organization)
• CAGE code (Commercial and Government Entity code)
• CAM (Contractor Account Administrator)
• CMMC (Cybersecurity Maturity Model Certification)
• CMMC Level 1
• CMMC Level 2
• CMMC Status Date
• CMMC UID (CMMC Unique Identifier)
• Conditional and Final status
• CUI (Controlled Unclassified Information)
• Cyber Advisor
• DIB (Defense Industrial Base)
• DoD (Department of Defense, also called the Department of War)
• DP3 (Defense Personal Property Program)
• Eccalon, LLC
• FCI (Federal Contract Information)
• FedRAMP Moderate
• LYNX
• NAICS code (North American Industry Classification System)
• NIST SP 800-171
• Operational plan of action
• Phase I and Phase II
• PIEE (Procurement Integrated Enterprise Environment)
• POA&M (Plan of Action and Milestones)
• SAM.gov (System for Award Management)
• SPRS (Supplier Performance Risk System)
• SPRS Cyber Vendor User
• SSP (System Security Plan)
• Tender of Service (ToS)
• TSP (Transportation Service Provider)