Testpage2022

NIST 800-171 to CMMC 1.02 & 2.0 Mapping

The table below contains a complete mapping of NIST 800-171 requirements to CMMC 2.0 practices, as well as their former CMMC 1.02 practice IDs.
Text in red indicates arbitrary changes in verbiage between NIST 800-171 and CMMC 2.0. Why? Who knows…

800-171 Requirement CMMC 2.0 Practice 800-171 CMMC 1.02 CMMC 2.0 CMMC 2.0 Name ID
Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). Limit information system access to authorized users, processes acting on behalf of authorized users, and devices (including other information systems). 3.1.1 AC.1.001 AC.L1-3.1.1 Authorized Access Control
Limit information system access to the types of transactions and functions that authorized users are permitted to execute. Limit information system access to the types of transactions and functions that authorized users are permitted to execute. 3.1.2 AC.1.002 AC.L1-3.1.2 Transaction & Function Control
Control the flow of CUI in accordance with approved authorizations. Control the flow of CUI in accordance with approved authorizations. 3.1.3 AC.2.016 AC.L2-3.1.3 Control CUI Flow
Separate the duties of individuals to reduce the risk of malevolent activity without collusion. Separate the duties of individuals to reduce the risk of malevolent activity without collusion. 3.1.4 AC.3.017 AC.L2-3.1.4 Separation of Duties
Employ the principle of least privilege, including for specific security functions and privileged accounts. Employ the principle of least privilege, including for specific security functions and privileged accounts. 3.1.5 AC.2.007 AC.L2-3.1.5 Least Privilege
Use non-privileged accounts or roles when accessing nonsecurity functions. Use non-privileged accounts or roles when accessing nonsecurity functions. 3.1.6 AC.2.008 AC.L2-3.1.6 Non-Privileged Account Use
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. 3.1.7 AC.3.018 AC.L2-3.1.7 Privileged Functions
Limit unsuccessful logon attempts. Limit unsuccessful logon attempts. 3.1.8 AC.2.009 AC.L2-3.1.8 Unsuccessful Logon Attempts
Provide privacy and security notices consistent with applicable CUI rules. Provide privacy and security notices consistent with applicable CUI rules. 3.1.9 AC.2.005 AC.L2-3.1.9 Privacy & Security Notices
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. 3.1.10 AC.2.010 AC.L2-3.1.10 Session Lock
Terminate (automatically) a user session after a defined condition. Terminate (automatically) a user session after a defined condition. 3.1.11 AC.3.019 AC.L2-3.1.11 Session Termination
Monitor and control remote access sessions. Monitor and control remote access sessions. 3.1.12 AC.2.013 AC.L2-3.1.12 Control Remote Access
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. 3.1.13 AC.3.014 AC.L2-3.1.13 Remote Access Confidentiality
Route remote access via managed access control points. Route remote access via managed access control points. 3.1.14 AC.2.015 AC.L2-3.1.14 Remote Access Routing
Authorize remote execution of privileged commands and remote access to security-relevant information. Authorize remote execution of privileged commands and remote access to security-relevant information. 3.1.15 AC.3.021 AC.L2-3.1.15 Privileged Remote Access
Authorize wireless access prior to allowing such connections. Authorize wireless access prior to allowing such connections. 3.1.16 AC.2.011 AC.L2-3.1.16 Wireless Access Authorization
Protect wireless access using authentication and encryption. Protect wireless access using authentication and encryption. 3.1.17 AC.3.012 AC.L2-3.1.17 Wireless Access Protection
Control connection of mobile devices. Control connection of mobile devices. 3.1.18 AC.3.020 AC.L2-3.1.18 Mobile Device Connection
Encrypt CUI on mobile devices and mobile computing platforms. Encrypt CUI on mobile devices and mobile computing platforms. 3.1.19 AC.3.022 AC.L2-3.1.19 Encrypt CUI on Mobile
Verify and control/limit connections to and use of external systems. Verify and control/limit connections to and use of external systems. 3.1.20 AC.1.003 AC.L1-3.1.20 External Connections
Limit use of portable storage devices on external systems. Limit use of portable storage devices on external systems. 3.1.21 AC.2.006 AC.L2-3.1.21 Portable Storage Use
Control CUI posted or processed on publicly accessible systems. Control information posted or processed on publicly accessible information systems. 3.1.22 AC.1.004 AC.L1-3.1.22 Control Public Information
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. 3.2.1 AT.2.056 AT.L2-3.2.1 Role-Based Risk Awareness
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. 3.2.2 AT.2.057 AT.L2-3.2.2 Role-Based Training
Provide security awareness training on recognizing and reporting potential indicators of insider threat. Provide security awareness training on recognizing and reporting potential indicators of insider threat. 3.2.3 AT.3.058 AT.L2-3.2.3 Insider Threat Awareness
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. 3.3.1 AU.2.042 AU.L2-3.3.1 System Auditing
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. 3.3.2 AU.2.041 AU.L2-3.3.2 User Accountability
Review and update logged events. Review and update logged events. 3.3.3 AU.3.045 AU.L2-3.3.3 Event Review
Alert in the event of an audit logging process failure. Alert in the event of an audit logging process failure. 3.3.4 AU.3.046 AU.L2-3.3.4 Audit Failure Alerting
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. 3.3.5 AU.3.051 AU.L2-3.3.5 Audit Correlation
Provide audit record reduction and report generation to support on-demand analysis and reporting. Provide audit record reduction and report generation to support on-demand analysis and reporting. 3.3.6 AU.3.052 AU.L2-3.3.6 Reduction & Reporting
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. 3.3.7 AU.2.043 AU.L2-3.3.7 Authoritative Time Source
Protect audit information and audit logging tools from unauthorized access, modification, and deletion. Protect audit information and audit logging tools from unauthorized access, modification, and deletion. 3.3.8 AU.3.049 AU.L2-3.3.8 Audit Protection
Limit management of audit logging functionality to a subset of privileged users. Limit management of audit logging functionality to a subset of privileged users. 3.3.9 AU.3.050 AU.L2-3.3.9 Audit Management
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. 3.4.1 CM.2.061 CM.L2-3.4.1 System Baselining
Establish and enforce security configuration settings for information technology products employed in organizational systems. Establish and enforce security configuration settings for information technology products employed in organizational systems. 3.4.2 CM.2.064 CM.L2-3.4.2 Security Configuration Enforcement
Track, review, approve or disapprove, and log changes to organizational systems. Track, review, approve or disapprove, and log changes to organizational systems. 3.4.3 CM.2.065 CM.L2-3.4.3 System Change Management
Analyze the security impact of changes prior to implementation. Analyze the security impact of changes prior to implementation. 3.4.4 CM.2.066 CM.L2-3.4.4 Security Impact Analysis
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. 3.4.5 CM.3.067 CM.L2-3.4.5 Access Restrictions for Change
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. 3.4.6 CM.2.062 CM.L2-3.4.6 Least Functionality
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. 3.4.7 CM.3.068 CM.L2-3.4.7 Nonessential Functionality
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. 3.4.8 CM.3.069, CM.4.073 CM.L2-3.4.8 Application Exectuion Policy
Control and monitor user-installed software. Control and monitor user-installed software. 3.4.9 CM.2.063 CM.L2-3.4.9 User-Installed Software
Identify system users, processes acting on behalf of users, and devices. Identify information system users, processes acting on behalf of users, and devices. 3.5.1 IA.1.076 IA.L1-3.5.1 Identification
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. 3.5.2 IA.1.077 IA.L1-3.5.2 Authentication
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. 3.5.3 IA.3.083 IA.L2-3.5.3 Multifactor Authentication
Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts. Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. 3.5.4 IA.3.084 IA.L2-3.5.4 Replay-Resistant Authentication
Prevent reuse of identifiers for a defined period. Prevent reuse of identifiers for a defined period. 3.5.5 IA.3.085 IA.L2-3.5.5 Identifier Reuse
Disable identifiers after a defined period of inactivity. Disable identifiers after a defined period of inactivity. 3.5.6 IA.3.086 IA.L2-3.5.6 Identifier Handling
Enforce a minimum password complexity and change of characters when new passwords are created. Enforce a minimum password complexity and change of characters when new passwords are created. 3.5.7 IA.2.078 IA.L2-3.5.7 Password Complexity
Prohibit password reuse for a specified number of generations. Prohibit password reuse for a specified number of generations. 3.5.8 IA.2.079 IA.L2-3.5.8 Password Reuse
Allow temporary password use for system logons with an immediate change to a permanent password. Allow temporary password use for system logons with an immediate change to a permanent password. 3.5.9 IA.2.080 IA.L2-3.5.9 Temporary Passwords
Store and transmit only cryptographically-protected passwords. Store and transmit only cryptographically-protected passwords. 3.5.10 IA.2.081 IA.L2-3.5.10 Cryptographically-Protected Passwords
Obscure feedback of authentication information. Obscure feedback of authentication information. 3.5.11 IA.2.082 IA.L2-3.5.11 Obsecure Feedback
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. 3.6.1 IR.2.092 IR.L2-3.6.1 Incident Handling
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. 3.6.2 IR.3.098 IR.L2-3.6.2 Incident Reporting
Test the organizational incident response capability. Test the organizational incident response capability. 3.6.3 IR.3.099 IR.L2-3.6.3 Incident Response Testing
Perform maintenance on organizational systems. Perform maintenance on organizational systems. 3.7.1 MA.2.111 MA.L2-3.7.1 Perform Maintenance
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. 3.7.2 MA.2.112 MA.L2-3.7.2 System Maintenance Control
Ensure equipment removed for off-site maintenance is sanitized of any CUI. Ensure equipment removed for off-site maintenance is sanitized of any CUI. 3.7.3 MA.3.115 MA.L2-3.7.3 Equipment Sanitization
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. 3.7.4 MA.3.116 MA.L2-3.7.4 Media Inspection
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. 3.7.5 MA.2.113 MA.L2-3.7.5 Nonlocal Maintenance
Supervise the maintenance activities of maintenance personnel without required access authorization. Supervise the maintenance activities of maintenance personnel without required access authorization. 3.7.6 MA.2.114 MA.L2-3.7.6 Maintenance Personnel
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. 3.8.1 MP.2.119 MP.L2-3.8.1 Media Protection
Limit access to CUI on system media to authorized users. Limit access to CUI on system media to authorized users. 3.8.2 MP.2.120 MP.L2-3.8.2 Media Access
Sanitize or destroy system media containing CUI before disposal or release for reuse. Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. 3.8.3 MP.1.118 MP.L1-3.8.3 Media Disposal
Mark media with necessary CUI markings and distribution limitations. Mark media with necessary CUI markings and distribution limitations. 3.8.4 MP.3.122 MP.L2-3.8.4 Media Markings
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. 3.8.5 MP.3.124 MP.L2-3.8.5 Media Accountability
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. 3.8.6 MP.3.125 MP.L2-3.8.6 Portable Storage Encryption
Control the use of removable media on system components. Control the use of removable media on system components. 3.8.7 MP.2.121 MP.L2-3.8.7 Removable Media
Prohibit the use of portable storage devices when such devices have no identifiable owner. Prohibit the use of portable storage devices when such devices have no identifiable owner. 3.8.8 MP.3.123 MP.L2-3.8.8 Shared Media
Protect the confidentiality of backup CUI at storage locations. Protect the confidentiality of backup CUI at storage locations. 3.8.9 RE.2.138 MP.L2-3.8.9 Protect Backups
Screen individuals prior to authorizing access to organizational systems containing CUI. Screen individuals prior to authorizing access to organizational systems containing CUI. 3.9.1 PS.2.127 PS.L2-3.9.1 Screen Individuals
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. 3.9.2 PS.2.128 PS.L2-3.9.2 Personnel Actions
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. 3.10.1 PE.1.131 PE.L1-3.10.1 Limit Physical Access
Protect and monitor the physical facility and support infrastructure for organizational systems. Protect and monitor the physical facility and support infrastructure for organizational systems. 3.10.2 PE.2.135 PE.L2-3.10.2 Monitor Facility
Escort visitors and monitor visitor activity. Escort visitors and monitor visitor activity. 3.10.3 PE.1.132 PE.L1-3.10.3 Escort Visitors
Maintain audit logs of physical access. Maintain audit logs of physical access. 3.10.4 PE.1.133 PE.L1-3.10.4 Physical Access logs
Control and manage physical access devices. Control and manage physical access devices. 3.10.5 PE.1.134 PE.L1-3.10.5 Manage Physical Access
Enforce safeguarding measures for CUI at alternate work sites. Enforce safeguarding measures for CUI at alternate work sites. 3.10.6 PE.3.136 PE.L2-3.10.6 Alternative Work Sites
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. 3.11.1 RM.2.141 RA.L2-3.11.1 Risk Assessments
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. 3.11.2 RM.2.142 RA.L2-3.11.2 Vulnerability Scan
Remediate vulnerabilities in accordance with risk assessments. Remediate vulnerabilities in accordance with risk assessments. 3.11.3 RM.2.143 RA.L2-3.11.3 Vulnerability Remediation
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. 3.12.1 CA.2.158 CA.L2-3.12.1 Security Control Assessment
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. 3.12.2 CA.2.159 CA.L2-3.12.2 Plan of Action
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. 3.12.3 CA.3.161 CA.L2-3.12.3 Security Control Monitoring
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. 3.12.4 CA.2.157 CA.L2-3.12.4 System Security Plan
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of organizational systems. 3.13.1 SC.1.175 SC.L1-3.13.1 Boundary Protection
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. 3.13.2 SC.3.180, SC.4.228 SC.L2-3.13.2 Security Engineering
Separate user functionality from system management functionality. Separate user functionality from system management functionality. 3.13.3 SC.3.181 SC.L2-3.13.3 Role Separation
Prevent unauthorized and unintended information transfer via shared system resources. Prevent unauthorized and unintended information transfer via shared system resources. 3.13.4 SC.3.182 SC.L2-3.13.4 Shared Resource Control
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. 3.13.5 SC.1.176 SC.L1-3.13.5 Public-Access System Separation
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). 3.13.6 SC.3.183 SC.L2-3.13.6 Network Communication by Exception
Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). 3.13.7 SC.3.184 SC.L2-3.13.7 Split Tunneling
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. 3.13.8 SC.3.185 SC.L2-3.13.8 Data in Transit
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. 3.13.9 SC.3.186 SC.L2-3.13.9 Connections Termination
Establish and manage cryptographic keys for cryptography employed in organizational systems. Establish and manage cryptographic keys for cryptography employed in organizational systems. 3.13.10 SC.3.187 SC.L2-3.13.10 Key Management
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. 3.13.11 SC.3.177 SC.L2-3.13.11 CUI Encryption
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. 3.13.12 SC.2.178 SC.L2-3.13.12 Collaborative Device Control
Control and monitor the use of mobile code. Control and monitor the use of mobile code. 3.13.13 SC.3.188 SC.L2-3.13.13 Mobile Code
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. 3.13.14 SC.3.189 SC.L2-3.13.14 Voice over Internet Protocol
Protect the authenticity of communications sessions. Protect the authenticity of communications sessions. 3.13.15 SC.3.190 SC.L2-3.13.15 Communications Authenticity
Protect the confidentiality of CUI at rest. Protect the confidentiality of CUI at rest. 3.13.16 SC.3.191 SC.L2-3.13.16 Data at Rest
Identify, report, and correct system flaws in a timely manner. Identify, report, and correct information and information system flaws in a timely manner. 3.14.1 SI.1.210 SI.L1-3.14.1 Flaw Remediation
Provide protection from malicious code at designated locations within organizational systems. Provide protection from malicious code at appropriate locations within organizational information systems. 3.14.2 SI.1.211 SI.L1-3.14.2 Malicious Code Protection
Monitor system security alerts and advisories and take action in response. Monitor system security alerts and advisories and take action in response 3.14.3 SI.2.214 SI.L2-3.14.3 Security Alerts & Advisories
Update malicious code protection mechanisms when new releases are available. Update malicious code protection mechanisms when new releases are available. 3.14.4 SI.1.212 SI.L1-3.14.4 Update Malicious Code Protection
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. 3.14.5 SI.1.213 SI.L1-3.14.5 System & File Scanning
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. 3.14.6 SI.2.216 SI.L2-3.14.6 Monitor Communications for Attacks
Identify unauthorized use of organizational systems. Identify unauthorized use of organizational systems. 3.14.7 SI.2.217 SI.L2-3.14.7 Identify Unauthorized Use
N/A N/A N/A AU.2.044 N/A N/A
N/A N/A N/A IR.2.093 N/A N/A
N/A N/A N/A IR.2.094 N/A N/A
N/A N/A N/A IR.2.096 N/A N/A
N/A N/A N/A IR.2.097 N/A N/A
N/A N/A N/A RE.2.137 N/A N/A
N/A N/A N/A SC.2.179 N/A N/A
N/A N/A N/A AM.3.036 N/A N/A
N/A N/A N/A AU.3.048 N/A N/A
N/A N/A N/A RE.3.139 N/A N/A
N/A N/A N/A RM.3.144 N/A N/A
N/A N/A N/A RM.3.146 N/A N/A
N/A N/A N/A RM.3.147 N/A N/A
N/A N/A N/A CA.3.162 N/A N/A
N/A N/A N/A SA.3.169 N/A N/A
N/A N/A N/A SC.3.192 N/A N/A
N/A N/A N/A SC.3.193 N/A N/A
N/A N/A N/A SI.3.218 N/A N/A
N/A N/A N/A SI.3.219 N/A N/A
N/A N/A N/A SI.3.220 N/A N/A