PolicyCortex
Request Access

The 14 families

  1. 3.1 Access ControlAC22 requirements, up to 54 SPRS points, 11 can go on a CMMC POA&M
  2. 3.2 Awareness and TrainingAT3 requirements, up to 11 SPRS points, 1 can go on a CMMC POA&M
  3. 3.3 Audit and AccountabilityAU9 requirements, up to 19 SPRS points, 6 can go on a CMMC POA&M
  4. 3.4 Configuration ManagementCM9 requirements, up to 33 SPRS points, 3 can go on a CMMC POA&M
  5. 3.5 Identification and AuthenticationIA11 requirements, up to 27 SPRS points, 7 can go on a CMMC POA&M
  6. 3.6 Incident ResponseIR3 requirements, up to 11 SPRS points, 1 can go on a CMMC POA&M
  7. 3.7 MaintenanceMA6 requirements, up to 18 SPRS points, 2 can go on a CMMC POA&M
  8. 3.8 Media ProtectionMP9 requirements, up to 23 SPRS points, 4 can go on a CMMC POA&M
  9. 3.9 Personnel SecurityPS2 requirements, up to 8 SPRS points, 0 can go on a CMMC POA&M
  10. 3.10 Physical ProtectionPE6 requirements, up to 14 SPRS points, 1 can go on a CMMC POA&M
  11. 3.11 Risk AssessmentRA3 requirements, up to 9 SPRS points, 1 can go on a CMMC POA&M
  12. 3.12 Security AssessmentCA4 requirements, up to 13 SPRS points, 0 can go on a CMMC POA&M
  13. 3.13 System and Communications ProtectionSC16 requirements, up to 42 SPRS points, 10 can go on a CMMC POA&M
  14. 3.14 System and Information IntegritySI7 requirements, up to 31 SPRS points, 0 can go on a CMMC POA&M

All 110 requirements

RequirementCMMC practiceSPRS pointsCMMC POA&M
3.1.1 Authorized AccessAC.L2-3.1.15 pointsNot allowed
3.1.2 Transaction ControlAC.L2-3.1.25 pointsNot allowed
3.1.3 CUI Flow ControlAC.L2-3.1.31 pointAllowed
3.1.4 Separation of DutiesAC.L2-3.1.41 pointAllowed
3.1.5 Least PrivilegeAC.L2-3.1.53 pointsNot allowed
3.1.6 Non-Privileged AccountsAC.L2-3.1.61 pointAllowed
3.1.7 Privileged FunctionsAC.L2-3.1.71 pointAllowed
3.1.8 Unsuccessful LogonsAC.L2-3.1.81 pointAllowed
3.1.9 System Use NoticesAC.L2-3.1.91 pointAllowed
3.1.10 Session LockAC.L2-3.1.101 pointAllowed
3.1.11 Session TerminationAC.L2-3.1.111 pointAllowed
3.1.12 Remote Access ControlAC.L2-3.1.125 pointsNot allowed
3.1.13 Remote Access EncryptionAC.L2-3.1.135 pointsNot allowed
3.1.14 Remote Access RoutingAC.L2-3.1.141 pointAllowed
3.1.15 Privileged Remote AccessAC.L2-3.1.151 pointAllowed
3.1.16 Wireless AuthorizationAC.L2-3.1.165 pointsNot allowed
3.1.17 Wireless ProtectionAC.L2-3.1.175 pointsNot allowed
3.1.18 Mobile Device ConnectionAC.L2-3.1.185 pointsNot allowed
3.1.19 Encrypt CUI on MobileAC.L2-3.1.193 pointsNot allowed
3.1.20 External ConnectionsAC.L2-3.1.201 pointNever
3.1.21 Portable Storage UseAC.L2-3.1.211 pointAllowed
3.1.22 Public InformationAC.L2-3.1.221 pointNever
3.2.1 Security AwarenessAT.L2-3.2.15 pointsNot allowed
3.2.2 Role-Based TrainingAT.L2-3.2.25 pointsNot allowed
3.2.3 Insider ThreatAT.L2-3.2.31 pointAllowed
3.3.1 System Audit LogsAU.L2-3.3.15 pointsNot allowed
3.3.2 User AccountabilityAU.L2-3.3.23 pointsNot allowed
3.3.3 Review Logged EventsAU.L2-3.3.31 pointAllowed
3.3.4 Audit Failure AlertsAU.L2-3.3.41 pointAllowed
3.3.5 Audit CorrelationAU.L2-3.3.55 pointsNot allowed
3.3.6 Audit ReductionAU.L2-3.3.61 pointAllowed
3.3.7 Authoritative TimeAU.L2-3.3.71 pointAllowed
3.3.8 Audit ProtectionAU.L2-3.3.81 pointAllowed
3.3.9 Audit ManagementAU.L2-3.3.91 pointAllowed
3.4.1 Baseline and InventoryCM.L2-3.4.15 pointsNot allowed
3.4.2 Security SettingsCM.L2-3.4.25 pointsNot allowed
3.4.3 Change ControlCM.L2-3.4.31 pointAllowed
3.4.4 Security Impact AnalysisCM.L2-3.4.41 pointAllowed
3.4.5 Change Access LimitsCM.L2-3.4.55 pointsNot allowed
3.4.6 Least FunctionalityCM.L2-3.4.65 pointsNot allowed
3.4.7 Nonessential ServicesCM.L2-3.4.75 pointsNot allowed
3.4.8 Application ExecutionCM.L2-3.4.85 pointsNot allowed
3.4.9 User-Installed SoftwareCM.L2-3.4.91 pointAllowed
3.5.1 IdentificationIA.L2-3.5.15 pointsNot allowed
3.5.2 AuthenticationIA.L2-3.5.25 pointsNot allowed
3.5.3 Multifactor AuthenticationIA.L2-3.5.33 or 5 pointsNot allowed
3.5.4 Replay ResistanceIA.L2-3.5.41 pointAllowed
3.5.5 Identifier ReuseIA.L2-3.5.51 pointAllowed
3.5.6 Inactive AccountsIA.L2-3.5.61 pointAllowed
3.5.7 Password ComplexityIA.L2-3.5.71 pointAllowed
3.5.8 Password ReuseIA.L2-3.5.81 pointAllowed
3.5.9 Temporary PasswordsIA.L2-3.5.91 pointAllowed
3.5.10 Protected PasswordsIA.L2-3.5.105 pointsNot allowed
3.5.11 Obscured FeedbackIA.L2-3.5.111 pointAllowed
3.6.1 Incident HandlingIR.L2-3.6.15 pointsNot allowed
3.6.2 Incident ReportingIR.L2-3.6.25 pointsNot allowed
3.6.3 Incident Response TestingIR.L2-3.6.31 pointAllowed
3.7.1 System MaintenanceMA.L2-3.7.13 pointsNot allowed
3.7.2 Maintenance ToolsMA.L2-3.7.25 pointsNot allowed
3.7.3 Off-Site MaintenanceMA.L2-3.7.31 pointAllowed
3.7.4 Diagnostic Media ChecksMA.L2-3.7.43 pointsNot allowed
3.7.5 Nonlocal MaintenanceMA.L2-3.7.55 pointsNot allowed
3.7.6 Maintenance PersonnelMA.L2-3.7.61 pointAllowed
3.8.1 Media ProtectionMP.L2-3.8.13 pointsNot allowed
3.8.2 Media AccessMP.L2-3.8.23 pointsNot allowed
3.8.3 Media SanitizationMP.L2-3.8.35 pointsNot allowed
3.8.4 Media MarkingMP.L2-3.8.41 pointAllowed
3.8.5 Media TransportMP.L2-3.8.51 pointAllowed
3.8.6 Encrypt Media in TransitMP.L2-3.8.61 pointAllowed
3.8.7 Removable MediaMP.L2-3.8.75 pointsNot allowed
3.8.8 Ownerless StorageMP.L2-3.8.83 pointsNot allowed
3.8.9 Backup ConfidentialityMP.L2-3.8.91 pointAllowed
3.9.1 Personnel ScreeningPS.L2-3.9.13 pointsNot allowed
3.9.2 Personnel ActionsPS.L2-3.9.25 pointsNot allowed
3.10.1 Physical AccessPE.L2-3.10.15 pointsNot allowed
3.10.2 Facility MonitoringPE.L2-3.10.25 pointsNot allowed
3.10.3 Visitor EscortPE.L2-3.10.31 pointNever
3.10.4 Physical Access LogsPE.L2-3.10.41 pointNever
3.10.5 Physical Access DevicesPE.L2-3.10.51 pointNever
3.10.6 Alternate Work SitesPE.L2-3.10.61 pointAllowed
3.11.1 Risk AssessmentRA.L2-3.11.13 pointsNot allowed
3.11.2 Vulnerability ScanningRA.L2-3.11.25 pointsNot allowed
3.11.3 Fixing VulnerabilitiesRA.L2-3.11.31 pointAllowed
3.12.1 Control AssessmentCA.L2-3.12.15 pointsNot allowed
3.12.2 Plans of ActionCA.L2-3.12.23 pointsNot allowed
3.12.3 Ongoing MonitoringCA.L2-3.12.35 pointsNot allowed
3.12.4 System Security PlanCA.L2-3.12.4No point valueNever
3.13.1 Boundary ProtectionSC.L2-3.13.15 pointsNot allowed
3.13.2 Security EngineeringSC.L2-3.13.25 pointsNot allowed
3.13.3 Management SeparationSC.L2-3.13.31 pointAllowed
3.13.4 Shared ResourcesSC.L2-3.13.41 pointAllowed
3.13.5 Public-Facing SubnetsSC.L2-3.13.55 pointsNot allowed
3.13.6 Deny by DefaultSC.L2-3.13.65 pointsNot allowed
3.13.7 Split TunnelingSC.L2-3.13.71 pointAllowed
3.13.8 Encryption in TransitSC.L2-3.13.83 pointsNot allowed
3.13.9 Connection TerminationSC.L2-3.13.91 pointAllowed
3.13.10 Key ManagementSC.L2-3.13.101 pointAllowed
3.13.11 FIPS CryptographySC.L2-3.13.113 or 5 pointsOnly if not FIPS validated
3.13.12 Collaborative DevicesSC.L2-3.13.121 pointAllowed
3.13.13 Mobile CodeSC.L2-3.13.131 pointAllowed
3.13.14 Voice over IPSC.L2-3.13.141 pointAllowed
3.13.15 Session AuthenticitySC.L2-3.13.155 pointsNot allowed
3.13.16 CUI at RestSC.L2-3.13.161 pointAllowed
3.14.1 Flaw RemediationSI.L2-3.14.15 pointsNot allowed
3.14.2 Malware ProtectionSI.L2-3.14.25 pointsNot allowed
3.14.3 Security AdvisoriesSI.L2-3.14.35 pointsNot allowed
3.14.4 Malware UpdatesSI.L2-3.14.45 pointsNot allowed
3.14.5 Malware ScanningSI.L2-3.14.53 pointsNot allowed
3.14.6 Attack MonitoringSI.L2-3.14.65 pointsNot allowed
3.14.7 Unauthorized UseSI.L2-3.14.73 pointsNot allowed

How SPRS points and the CMMC POA&M work

Score
An SPRS score starts at 110 and loses each unmet requirement's value: 5, 3 or 1 point. The lowest possible score is -203.
Partial credit
Only 3.5.3 (multifactor authentication) and 3.13.11 (FIPS-validated cryptography) can lose 3 points instead of 5.
CMMC POA&M
Under 32 CFR 170.21 a POA&M can hold only requirements worth 1 point, plus 3.13.11 when encryption is used but not FIPS validated, never 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 or 3.12.4, and only with a score of at least 88. That leaves 47 of the 110.
Practice numbers
32 CFR 170.14(c) numbers each CMMC requirement DD.L#-REQ, and CMMC Level 2's requirements are identical to NIST SP 800-171 Rev. 2, so requirement 3.1.1 is practice AC.L2-3.1.1.

Sources

Requirements
NIST SP 800-171 Rev. 2 (February 2020, updated January 28, 2021)
Assessment objectives
NIST SP 800-171A (June 2018)
Point values
NIST SP 800-171 DoD Assessment Methodology, version 1.2.1, Annex A
POA&M rules
32 CFR 170.21, Plan of Action and Milestones requirements
Practice numbers
32 CFR 170.14(c), CMMC level requirements

Questions about the NIST 800-171 requirements

  1. Q-01

    How many requirements are in NIST SP 800-171?

    Rev. 2 has 110 security requirements in 14 families, from Access Control (22) to Personnel Security (2). An SPRS score counts all 110, and CMMC Level 2 assesses the same 110.

  2. Q-02

    Is a CMMC Level 2 practice the same as a NIST 800-171 requirement?

    Yes. Under 32 CFR 170.14(c), CMMC Level 2's security requirements are identical to NIST SP 800-171 Rev. 2 and are numbered DD.L2-REQ, so AC.L2-3.1.1 is requirement 3.1.1 in the Access Control domain.

  3. Q-03

    Which NIST 800-171 requirements can go on a CMMC POA&M?

    47 of the 110: those worth 1 point, plus 3.13.11 when encryption is used but not FIPS validated, minus the 6 that 32 CFR 170.21(a)(2)(iii) never allows. The score must also be at least 88, and each item must be closed within 180 days.

  4. Q-04

    Where do the assessment objectives come from?

    From NIST SP 800-171A (June 2018), which gives 320 determination statements for the 110 requirements. An assessor finds each statement satisfied or other than satisfied.

  5. Q-05

    Are these the Rev. 3 requirements?

    No. These are the 110 requirements of NIST SP 800-171 Rev. 2, the version CMMC Level 2 assesses. NIST published Rev. 3 in May 2024 with a different structure; Rev. 3 requirements are not in PolicyCortex yet.

Related pages

Calculator
SPRS score calculator: all 110 requirements, one score, in your browser.
Sample package
Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.
NIST 800-171
NIST 800-171 compliance evidence, ready for review.
SPRS score
SPRS score evidence: the records behind the score you affirm.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where the evidence is stored in each delivery mode.
authorization
Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
baseline
NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.

One record for all 110 requirements, ready for the assessor.

Request AccessBook a call
Published
Last updated
Unchanged since publication