# Cybersecurity Maturity Model Certification 2.0 Level 2

Framework id: `cmmc_2`. Defense Regulation. Publisher: U.S. Department of Defense (DoD). Version: 2.0 (2021). Region: USA. Mapping licence: CC BY-SA 4.0.
Source text: https://dodcio.defense.gov/CMMC/

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (14, average coverage 91%)
- AC Access Control: AC-01, AC-02, AC-03, AC-04, AC-05, AC-06, AC-07, AC-08, AC-09, AC-10, AC-11, AC-12, AC-13, AC-14, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AC-24, IA-02, IA-04, IA-05 (95%)
- AT Awareness and Training: AT-01, AT-02, AT-03, AT-04, AT-05, AT-06, PM-13, PM-14, PL-04 (90%)
- AU Audit and Accountability: AU-01, AU-02, AU-03, AU-04, AU-05, AU-06, AU-07, AU-08, AU-09, AU-10, AU-11, AU-12, AU-13, AU-14, AU-16, SI-04 (95%)
- CA Security Assessment: CA-01, CA-02, CA-03, CA-04, CA-05, CA-06, CA-07, CA-08, CA-09, PM-06, PM-10, PM-14, PL-01, PL-02 (80%)
- CM Configuration Management: CM-01, CM-02, CM-03, CM-04, CM-05, CM-06, CM-07, CM-08, CM-09, CM-10, CM-11, CM-12, CM-13, CM-14, SA-10 (95%)
- IA Identification and Authentication: IA-01, IA-02, IA-03, IA-04, IA-05, IA-06, IA-07, IA-08, IA-09, IA-10, IA-11, IA-12 (95%)
- IR Incident Response: IR-01, IR-02, IR-03, IR-04, IR-05, IR-06, IR-07, IR-08, IR-09, PM-12, SI-05 (83%)
- MA Maintenance: MA-01, MA-02, MA-03, MA-04, MA-05, MA-06, MA-07 (92%)
- MP Media Protection: MP-01, MP-02, MP-03, MP-04, MP-05, MP-06, MP-07, MP-08, CP-09, SC-28 (92%)
- PE Physical Protection: PE-01, PE-02, PE-03, PE-04, PE-05, PE-06, PE-07, PE-08, PE-09, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-16, PE-17, PE-18 (92%)
- PS Personnel Security: PS-01, PS-02, PS-03, PS-04, PS-05, PS-06, PS-07, PS-08, PS-09 (88%)
- RA Risk Assessment: RA-01, RA-02, RA-03, RA-04, RA-05, RA-06, RA-07, RA-08, RA-09, RA-10, PM-09, PM-28, CA-02, CA-08 (90%)
- SC System and Communications Protection: SC-01, SC-02, SC-03, SC-04, SC-05, SC-07, SC-08, SC-10, SC-11, SC-12, SC-13, SC-15, SC-17, SC-18, SC-20, SC-21, SC-22, SC-23, SC-28, SC-39, SA-08 (92%)
- SI System and Information Integrity: SI-01, SI-02, SI-03, SI-04, SI-05, SI-06, SI-07, SI-08, SI-10, SI-11, SI-12, SI-16, RA-05 (92%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=cmmc_2
- Control-to-clause mappings as JSON: /api/v1/frameworks/cmmc_2?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/cmmc-2.json
- Page for people: /frameworks/cmmc-2/