| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | CMMC Level 1 vs ISO 27001 Controls | |||||||||||||||||||||||||
2 | CMMC ID | CMMC Family/Domain | CMMC Control | ISO 27001:2013 Control ID | ISO 27001:2013 Control Title | ISO 27001:2022 Control ID | ISO 27001:2022 Control Title | |||||||||||||||||||
3 | AC.L1-3.1.1 | Access Control | Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). | A.9.2.1 | User registration and de-registration | A.5.16 | Identity management | |||||||||||||||||||
4 | A.9.2.2 | User access provisioning | A.5.18 | Access rights | ||||||||||||||||||||||
5 | A.9.2.3 | Management of privileged access rights | A.8.2 | Privileged access rights | ||||||||||||||||||||||
6 | A.9.2.5 | Review of user access rights | A.5.18 | Access rights | ||||||||||||||||||||||
7 | A.9.2.6 | Removal or adjustment of access rights | A.5.18 | Access rights | ||||||||||||||||||||||
8 | A.6.2.2 | Teleworking | A.6.7 | Remote working | ||||||||||||||||||||||
9 | A.9.1.2 | Access to networks and network services | A.5.15 | Access control | ||||||||||||||||||||||
10 | A.9.4.1 | Information access restriction | A.8.3 | Information access restriction | ||||||||||||||||||||||
11 | A.9.4.4 | Use of privileged utility programs | A.8.18 | Use of privileged utility programs | ||||||||||||||||||||||
12 | A.9.4.5 | Access control to program source code | A.8.4 | Access to source code | ||||||||||||||||||||||
13 | A.13.1.1 | Network controls | A.8.20 | Network controls | ||||||||||||||||||||||
14 | A.14.1.2 | Securing application services on public networks | A.8.26 | Application security requirements | ||||||||||||||||||||||
15 | A.14.1.3 | Protecting application services transactions | A.8.32 | Change management | ||||||||||||||||||||||
16 | A.18.1.3 | Protection of records | A.5.33 | Protection of records | ||||||||||||||||||||||
17 | A.6.2.1 | Mobile device policy | A.8.1 | User endpoint devices | ||||||||||||||||||||||
18 | A.13.2.1 | Information transfer policies and procedures | A.5.14 | Information transfer | ||||||||||||||||||||||
19 | AC.L1-3.1.2 | Access Control | Limit system access to the types of transactions and functions that authorized users are permitted to execute. | A.9.2.1 | User registration and de-registration | A.5.16 | Identity management | |||||||||||||||||||
20 | A.9.2.2 | User access provisioning | A.5.18 | Access rights | ||||||||||||||||||||||
21 | A.9.2.3 | Management of privileged access rights | A.8.2 | Privileged access rights | ||||||||||||||||||||||
22 | A.9.2.5 | Review of user access rights | A.5.18 | Access rights | ||||||||||||||||||||||
23 | A.9.2.6 | Removal or adjustment of access rights | A.5.18 | Access rights | ||||||||||||||||||||||
24 | A.6.2.2 | Teleworking | A.6.7 | Remote working | ||||||||||||||||||||||
25 | A.9.1.2 | Access to networks and network services | A.5.15 | Access control | ||||||||||||||||||||||
26 | A.9.4.1 | Information access restriction | A.8.3 | Information access restriction | ||||||||||||||||||||||
27 | A.9.4.4 | Use of privileged utility programs | A.8.18 | Use of privileged utility programs | ||||||||||||||||||||||
28 | A.9.4.5 | Access control to program source code | A.8.4 | Access to source code | ||||||||||||||||||||||
29 | A.13.1.1 | Network controls | A.8.20 | Network controls | ||||||||||||||||||||||
30 | A.14.1.2 | Securing application services on public networks | A.8.26 | Application security requirements | ||||||||||||||||||||||
31 | A.14.1.3 | Protecting application services transactions | A.8.32 | Change management | ||||||||||||||||||||||
32 | A.18.1.3 | Protection of records | A.5.33 | Protection of records | ||||||||||||||||||||||
33 | A.6.2.1 | Mobile device policy | A.8.1 | User endpoint devices | ||||||||||||||||||||||
34 | A.13.2.1 | Information transfer policies and procedures | A.5.14 | Information transfer | ||||||||||||||||||||||
35 | AC.L1-3.1.10 | Access Control | Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. | A.11.2.8 | Unattended user equipment | A.8.1 | User endpoint devices | |||||||||||||||||||
36 | A.11.2.9 | Clear desk and clear screen policy | A.7.7 | Clear desk and clear screen | ||||||||||||||||||||||
37 | AC.L1-3.1.20 | Access Control | Verify and control/limit connections to and use of external systems. | A.11.2.6 | Security of equipment and assets off-premises | A.7.9 | Security of assets off-premises | |||||||||||||||||||
38 | A.13.1.1 | Network controls | A.8.20 | Network controls | ||||||||||||||||||||||
39 | A.13.2.1 | Information transfer policies and procedures | A.5.14 | Information transfer | ||||||||||||||||||||||
40 | AC.L1-3.1.22 | Access Control | Control CUI posted or processed on publicly accessible systems. | No direct mapping to ISO 27001. | ||||||||||||||||||||||
41 | IA.L1-3.5.1 | Identification and Authentication | Identify system users, processes acting on behalf of users, and devices. | A.9.2.1 | User registration and de-registration | A.5.16 | Identity management | |||||||||||||||||||
42 | A.9.2.4 | Management of secret authentication information of users | A.5.17 | Authentication information | ||||||||||||||||||||||
43 | A.9.3.1 | Use of secret authentication information | A.5.17 | Authentication information | ||||||||||||||||||||||
44 | A.9.4.3 | Password management system | A.5.17 | Authentication information | ||||||||||||||||||||||
45 | IA.L1-3.5.2 | Identification and Authentication | Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems | A.9.2.1 | User registration and de-registration | A.5.16 | Identity management | |||||||||||||||||||
46 | A.9.2.4 | Management of secret authentication information of users | A.5.17 | Authentication information | ||||||||||||||||||||||
47 | A.9.3.1 | Use of secret authentication information | A.5.17 | Authentication information | ||||||||||||||||||||||
48 | A.9.4.3 | Password management system | A.5.17 | Authentication information | ||||||||||||||||||||||
49 | MP.L1-3.8.3 | Media Protection | Sanitize or destroy system media containing CUI before disposal or release for reuse. | A.8.2.3 | Handling of Assets | A.5.10 | Acceptable use of information and other associated assets | |||||||||||||||||||
50 | A.8.3.1 | Management of removable media | A.7.10 | Storage media | ||||||||||||||||||||||
51 | A.8.3.2 | Disposal of media | A.7.10 | Storage media | ||||||||||||||||||||||
52 | A.11.2.7 | Secure disposal or reuse of equipment | A.7.14 | Secure disposal or re-use of equipment | ||||||||||||||||||||||
53 | PE.L1-3.10.1 | Physical Protection | Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. | A.11.1.2 | Cabling security | A.7.2 | Physical entry controls | |||||||||||||||||||
54 | A.11.2.3 | Securing offices, rooms, and facilities | A.7.12 | Cabling security | ||||||||||||||||||||||
55 | PE.L1-3.10.3 | Physical Protection | Escort visitors and monitor visitor activity. | A.11.1.1 | Physical security perimeter | A.7.1 | Physical security perimeter | |||||||||||||||||||
56 | A.11.1.2 | Physical entry controls | A.7.2 | Physical entry controls | ||||||||||||||||||||||
57 | A.11.1.3 | Securing offices, rooms, and facilities | A.7.3 | Securing offices, rooms and facilities | ||||||||||||||||||||||
58 | PE.L1-3.10.4 | Physical Protection | Maintain audit logs of physical access. | A.11.1.1 | Physical security perimeter | A.7.1 | Physical security perimeter | |||||||||||||||||||
59 | A.11.1.2 | Physical entry controls | A.7.2 | Physical entry controls | ||||||||||||||||||||||
60 | A.11.1.3 | Securing offices, rooms, and facilities | A.7.3 | Securing offices, rooms and facilities | ||||||||||||||||||||||
61 | PE.L1-3.10.5 | Physical Protection | Control and manage physical access devices. | A.11.1.1 | Physical security perimeter | A.7.1 | Physical security perimeter | |||||||||||||||||||
62 | A.11.1.2 | Physical entry controls | A.7.2 | Physical entry controls | ||||||||||||||||||||||
63 | A.11.1.3 | Securing offices, rooms, and facilities | A.7.3 | Securing offices, rooms and facilities | ||||||||||||||||||||||
64 | SC.L1-3.13.1 | System and Communications Protection | Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. | A.13.1.1 | Network controls | A.7.3 | Securing offices, rooms and facilities | |||||||||||||||||||
65 | A.13.1.3 | Segregation in networks | A.8.23 | Segregation in networks | ||||||||||||||||||||||
66 | A.13.2.1 | Information transfer policies and procedures | A.5.14 | Information transfer | ||||||||||||||||||||||
67 | A.14.1.3 | Protecting application services transactions | A.8.32 | Change management | ||||||||||||||||||||||
68 | SC.L1-3.13.5 | System and Communications Protection | Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. | A.13.1.1 | Network controls | A.7.3 | Securing offices, rooms and facilities | |||||||||||||||||||
69 | A.13.1.3 | Segregation in networks | A.8.23 | Segregation in networks | ||||||||||||||||||||||
70 | A.13.2.1 | Information transfer policies and procedures | A.5.14 | Information transfer | ||||||||||||||||||||||
71 | A.14.1.3 | Protecting application services transactions | A.8.32 | Change management | ||||||||||||||||||||||
72 | SI.L1-3.14.2 | System and Information Integrity | Provide protection from malicious code at designated locations within organizational systems. | A.12.6.1 | Management of technical vulnerabilities | A.8.8 | Management of technical vulnerabilities | |||||||||||||||||||
73 | A.14.2.2 | System change control procedures | A.8.32 | Change management | ||||||||||||||||||||||
74 | A.14.2.3 | Technical review of applications after operating platform changes | A.8.32 | Change management | ||||||||||||||||||||||
75 | A.16.1.3 | Reporting information security weaknesses | A.6.8 | Information security event reporting | ||||||||||||||||||||||
76 | A.12.2.1 | Controls against malware | A.8.7 | Protection against malware | ||||||||||||||||||||||
77 | A.6.1.4 | Contact with special interest groups | A.5.6 | Contact with special interest groups | ||||||||||||||||||||||
78 | SI.L1-3.14.4 | System and Information Integrity | Update malicious code protection mechanisms when new releases are available. | A.12.2.1 | Controls against malware | A.8.7 | Protection against malware | |||||||||||||||||||
79 | SI.L1-3.14.5 | System and Information Integrity | Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. | A.12.2.1 | Controls against malware | A.8.7 | Protection against malware | |||||||||||||||||||
80 | ||||||||||||||||||||||||||
81 | ||||||||||||||||||||||||||
82 | ||||||||||||||||||||||||||
83 | ||||||||||||||||||||||||||
84 | ||||||||||||||||||||||||||
85 | ||||||||||||||||||||||||||
86 | ||||||||||||||||||||||||||
87 | ||||||||||||||||||||||||||
88 | ||||||||||||||||||||||||||
89 | ||||||||||||||||||||||||||
90 | ||||||||||||||||||||||||||
91 | ||||||||||||||||||||||||||
92 | ||||||||||||||||||||||||||
93 | ||||||||||||||||||||||||||
94 | ||||||||||||||||||||||||||
95 | ||||||||||||||||||||||||||
96 | ||||||||||||||||||||||||||
97 | ||||||||||||||||||||||||||
98 | ||||||||||||||||||||||||||
99 | ||||||||||||||||||||||||||
100 | ||||||||||||||||||||||||||