Compliance FrameworksAmericas
CMMC 2.0
US DoD supply chain security requirements for defense contractors.
US DoD supply chain security requirements for defense contractors.
| Short name | CMMC |
| Region | Americas |
| Country or scope | United States |
| Sector | Defense |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers CMMC
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 13 controls from Safeguard's control catalog for CMMC.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for CMMC and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
CMMC-CM.2.061 Software Inventory Baseline | Establish and maintain baseline configurations including software inventory (CMMC CM.2.061) | Scan |
CMMC-CM.2.062 Security Configuration | Establish and maintain security configuration settings (CMMC CM.2.062) | Scan |
CMMC-SI.1.210 Vulnerability Identification | Identify, report, and correct system flaws: components must be identifiable for vulnerability scanning (CMMC SI.1.210) | Scan |
CMMC-SR.2.111 Supply Chain Risk Management | Manage supply chain risk associated with development of systems (CMMC SR.2.111) | Scan |
CMMC-AU.2.041 Audit Record Review | Review and update logged events: SBOM must have audit trail via timestamps (CMMC AU.2.041) | Scan |
CMMC-IA.1.076 Identifier Management | Manage system and user identifiers: components need unique identifiers (CMMC IA.1.076) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
AC.L1-3.1.1 | Limit system access to authorized users (CMMC L1) |
AC.L1-3.1.2 | Limit access to authorized transaction types |
AC.L2-3.1.3 | Control CUI flow based on approved authorizations |
IA.L1-3.5.1 | Identify information system users and devices |
IA.L2-3.5.3 | Use MFA for access to CUI systems |
SC.L2-3.13.8 | Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI |
CM.L2-3.4.1 | Establish baseline configurations for CUI systems |
IR.L2-3.6.1 | Establish incident handling capability for CUI systems |
IR.L2-3.6.2 | Track, document, and report CUI incidents |
MA.L2-3.7.5 | Require MFA for remote maintenance of CUI systems |
RM.L2-3.11.1 | Periodically assess risk to CUI |
PS.L2-3.9.2 | Protect CUI during and after personnel actions |
AT.L2-3.2.1 | Provide security awareness training for CUI handling |
Policy templates
Written for CMMC:
- CMMC Level 1 Basic Cyber Hygiene Policy
- CMMC Level 2 CUI Protection Policy
- CMMC Third-Party Assessment Preparation Policy
And 22 from the standard set, adapted to CMMC.