NIST SP 800-171 & CMMC 2.0 Handbook

• Access Control

  Ensure that only authorized persons can access your systems and information.

  22 controls

• Awareness and Training

  Ensure that users have proper security training before being allowed to access or administer your systems and information.

  3 controls

• Audit and Accountability

  Create, protect, and retain system logs, to monitor, analyze, investigate, and report unauthorized activity occurring on your systems.

  9 controls

• Configuration Management

  Securely configure and maintain your systems in accordance with best practices and prevent unauthorized changes from being made.

  9 controls

• Identification and Authentication

  Properly verify the identities of users, processes, and devices before allowing them to access your systems and information.

  11 controls

• Incident Response

  Build an incident response capability to react to cybersecurity incidents.

  3 controls

• Maintenance

  Schedule and perform authorized maintenance on your systems in accordance with manufacturer requirements.

  6 controls

• Media Protection

  Protect the confidentiality and integrity of digital media (e.g. hard drives) and non-digital media (e.g. paper).

  9 controls

• Personnel Security

  Minimize the risk your staff pose to your systems and information.

  2 controls

• Physical Protection

  Protect your facilities, personnel, and systems from physical threats such as unauthorized facility access.

  6 controls

• Risk Assessment

  Assess the risks your systems face from various threats and vulnerabilities and develop plans to mitigate risk.

  3 controls

• Security Assessment

  Assess your current cybersecurity program and develop a system security plan to implement the required cybersecurity controls.

  4 controls

• System and Communications Protections

  Implement encrypted communications and control communications to protect your data.

  16 controls

• System and Information Integrity

  Keep your systems updated with security patches to prevent malware infections, ensure that you have anti-malware software deployed and secure your email systems.

  7 controls

Need help putting this into practice? See our NIST SP 800-171 & CMMC compliance services or read our NIST SP 800-171 & CMMC articles.