Every NIST SP 800-171 Revision 2 control below is translated into one plain-English sentence — the same translations we maintain inside CMMC Map — with its DoD Assessment Methodology point value alongside. The weights are what your SPRS score is built from: you start at 110 and every unmet control subtracts its points, down to a floor of −203. Bookmark it, or work through all 110 interactively for free.
How to read the weights: 5-point controls are the "basic safeguarding" backbone — fail one and DoD assumes broad exposure. 3-pointers have specific and confined effect; 1-pointers are indirect. Two controls (3.5.3 MFA and 3.13.11 FIPS encryption) can score partial credit while in progress; one (3.12.4, the SSP itself) carries no points because without it there is no valid assessment at all. Full arithmetic in the scoring guide.
JUMP TO FAMILY: AC · AT · AU · CM · IA · IR · MA · MP · PS · PE · RA · CA · SC · SI
Access Control (AC) — 22 controls, 54 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.1.1 | Authorized Access Control Only people you have approved can get into systems holding CUI — each with their own account, on devices you control. | 5 |
| 3.1.2 | Transaction & Function Control People can only do what their job requires — a bookkeeper should not be able to change security settings. | 5 |
| 3.1.3 | CUI Flow Enforcement Control where CUI is allowed to move — it must not flow to personal email, random cloud apps, or anywhere outside your approved systems. | 1 |
| 3.1.4 | Separation of Duties Split risky duties so no one person can do damage alone — e.g., the person making admin changes is not the only one reviewing what admins did. | 1 |
| 3.1.5 | Least Privilege Give everyone the least access needed — including admins, who should hold admin rights only where required. | 3 |
| 3.1.6 | Non-Privileged Account Use Admins use a normal account for email and browsing, and a separate admin account only for admin tasks. | 1 |
| 3.1.7 | Privileged Function Logging Regular users technically cannot run admin functions — and admin actions get logged. | 1 |
| 3.1.8 | Unsuccessful Logon Attempts Lock accounts after repeated wrong passwords so attackers cannot guess forever. | 1 |
| 3.1.9 | Privacy & Security Notices Show a notice at sign-in telling users the system is for authorized use and may be monitored. | 1 |
| 3.1.10 | Session Lock Screens lock automatically when idle and hide whatever was showing. | 1 |
| 3.1.11 | Session Termination Sessions end by themselves after a defined condition — nobody stays logged in forever. | 1 |
| 3.1.12 | Remote Access Control Remote access happens only through approved doors you can watch — no random remote-desktop tools. | 5 |
| 3.1.13 | Remote Access Encryption Remote sessions are encrypted, period. | 5 |
| 3.1.14 | Remote Access Routing All remote access funnels through specific, controlled entry points. | 1 |
| 3.1.15 | Privileged Remote Access Decide in advance who may run admin commands remotely, and write it down. | 1 |
| 3.1.16 | Wireless Access Authorization Approve Wi-Fi networks before they are allowed anywhere near CUI systems. | 5 |
| 3.1.17 | Wireless Access Protection Wi-Fi requires a password AND strong encryption (WPA2/WPA3). | 5 |
| 3.1.18 | Mobile Device Connection Decide which phones and tablets may connect, and control them. | 5 |
| 3.1.19 | Mobile Device Encryption If CUI can land on a phone or laptop, it must be encrypted there. | 3 |
| 3.1.20 | External System Connections Check and limit connections to systems you do not control — personal devices, other companies’ networks. | 1 |
| 3.1.21 | Portable Storage Use Do not put CUI on portable drives for use on outside systems. | 1 |
| 3.1.22 | Publicly Accessible Content Make sure nobody posts CUI on your website or social media. | 1 |
Awareness & Training (AT) — 3 controls, 11 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.2.1 | Security Awareness Everyone who touches CUI gets security awareness training — before access, then yearly. | 5 |
| 3.2.2 | Role-Based Training People are trained for their specific security duties (admin work, CUI handling) — not just generic awareness. | 5 |
| 3.2.3 | Insider Threat Awareness Yearly training covers spotting and reporting insider threats. | 1 |
Audit & Accountability (AU) — 9 controls, 19 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.3.1 | System Auditing Systems keep logs of who did what — logins, file access, changes — and you keep those logs. | 5 |
| 3.3.2 | User Accountability Logs can tie every action to one specific person — which requires individual accounts. | 3 |
| 3.3.3 | Event Review Once a year, sanity-check that you are logging the right kinds of events. | 1 |
| 3.3.4 | Audit Failure Alerting Get alerted if logging breaks or storage fills up. | 1 |
| 3.3.5 | Audit Record Correlation Actually review the logs, connecting dots across systems to spot suspicious activity. | 5 |
| 3.3.6 | Audit Reduction & Reporting Be able to search, filter, and report on logs when investigating. | 1 |
| 3.3.7 | Authoritative Time Source All system clocks sync to a standard time source so log timestamps line up. | 1 |
| 3.3.8 | Audit Protection Logs are protected — users cannot edit or delete them. | 1 |
| 3.3.9 | Audit Management Protection Only a small, named set of admins can manage the logging itself. | 1 |
Configuration Management (CM) — 9 controls, 33 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.4.1 | System Baselining Keep a baseline — what “correctly configured” looks like — plus an inventory of your hardware and software. | 5 |
| 3.4.2 | Security Configuration Enforcement Enforce secure settings with tools, not habit. | 5 |
| 3.4.3 | System Change Tracking Track and approve changes to CUI systems before making them. | 1 |
| 3.4.4 | Security Impact Analysis Before any change, ask “does this affect security?” and write the answer down. | 1 |
| 3.4.5 | Access Restrictions for Change Only authorized people can make changes — physically and logically. | 5 |
| 3.4.6 | Least Functionality Turn off what you do not use — features, services, ports. | 5 |
| 3.4.7 | Nonessential Functionality Restriction Specifically identify and restrict nonessential programs, ports, and services. | 5 |
| 3.4.8 | Application Execution Policy Only approved software can run — deny by default. | 5 |
| 3.4.9 | User-Installed Software Users cannot install their own software. | 1 |
Identification & Authentication (IA) — 11 controls, 27 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.5.1 | User Identification Every user, device, and process has its own identity. | 5 |
| 3.5.2 | Device & Process Authentication Verify identity before granting access — real authentication everywhere. | 5 |
| 3.5.3 | Multifactor Authentication MFA on privileged accounts always, and on any network access for everyone else. | 5 |
| 3.5.4 | Replay-Resistant Authentication Sign-ins resist capture-and-replay attacks — modern cloud login with MFA already does this. | 1 |
| 3.5.5 | Identifier Reuse Prevention Do not recycle usernames to new people for a long time. | 1 |
| 3.5.6 | Identifier Inactivity Disable accounts nobody has used in 90 days. | 1 |
| 3.5.7 | Password Complexity Enforce password strength rules whenever passwords are created or changed. | 1 |
| 3.5.8 | Password Reuse Prevention Block reuse of recent passwords. | 1 |
| 3.5.9 | Temporary Passwords Temporary passwords must be changed immediately at first sign-in. | 1 |
| 3.5.10 | Cryptographic Password Storage Passwords are stored and sent only in protected (hashed/encrypted) form — never plain-text files. | 5 |
| 3.5.11 | Obscured Authentication Feedback Hide passwords as they are typed, and do not reveal which half of a failed login was wrong. | 1 |
Incident Response (IR) — 3 controls, 11 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.6.1 | Incident Handling Have a working plan to detect, contain, and recover from security incidents — with people who know their roles. | 5 |
| 3.6.2 | Incident Reporting & Tracking Track and document incidents, and report them to the right people — including DoD via DIBNet within 72 hours when CUI is involved. | 5 |
| 3.6.3 | Incident Response Testing Test the plan at least yearly — a tabletop walkthrough counts. | 1 |
Maintenance (MA) — 6 controls, 18 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.7.1 | System Maintenance Maintain your systems — patches, repairs — and document the work. | 3 |
| 3.7.2 | Maintenance Control Control the tools, methods, and people doing maintenance. | 5 |
| 3.7.3 | Offsite Maintenance Sanitization Wipe CUI off equipment before it leaves the building for repair. | 1 |
| 3.7.4 | Maintenance Media Inspection Scan diagnostic tools and media for malware before they touch CUI systems. | 3 |
| 3.7.5 | Remote Maintenance MFA Remote maintenance sessions require MFA and get shut down when the work is done. | 5 |
| 3.7.6 | Maintenance Personnel Supervision Supervise maintenance people who are not cleared for CUI. | 1 |
Media Protection (MP) — 9 controls, 23 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.8.1 | Media Protection Protect and securely store anything that holds CUI — paper or digital. | 3 |
| 3.8.2 | Media Access Restriction Only authorized people can get at CUI media. | 3 |
| 3.8.3 | Media Sanitization Destroy or properly wipe CUI media before disposal — shred the paper, wipe the drives. | 5 |
| 3.8.4 | Media Marking Label CUI media so people know what they are holding. | 1 |
| 3.8.5 | Media Accountability Track and control CUI media that leaves your site. | 1 |
| 3.8.6 | Portable Storage Encryption Encrypt CUI on media in transit unless it is physically guarded the whole way. | 1 |
| 3.8.7 | Removable Media Control Control the use of USB and removable media on CUI systems. | 5 |
| 3.8.8 | Unidentified Media Prohibition Never use a storage device whose owner you cannot identify. | 3 |
| 3.8.9 | Backup Media Protection Backups containing CUI are protected too. | 1 |
Personnel Security (PS) — 2 controls, 8 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.9.1 | Personnel Screening Screen people (background check) before giving them CUI access. | 3 |
| 3.9.2 | Personnel Actions When someone leaves or changes roles, cut their CUI access fast and get the equipment back. | 5 |
Physical Protection (PE) — 6 controls, 14 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.10.1 | Physical Access Limitation Limit who can physically reach the computers and papers holding CUI. | 5 |
| 3.10.2 | Facility Protection Protect and keep an eye on the facility itself. | 5 |
| 3.10.3 | Visitor Escort Escort visitors anywhere CUI lives. | 1 |
| 3.10.4 | Physical Access Logs Keep a record of physical access — a visitor log counts. | 1 |
| 3.10.5 | Physical Access Devices Track keys, badges, and door codes — and recover them when people leave. | 1 |
| 3.10.6 | Alternative Work Site Security Protect CUI at home offices and on travel with the same intent as at the office. | 1 |
Risk Assessment (RA) — 3 controls, 9 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.11.1 | Risk Assessments At least yearly, step back and assess: what could hurt our CUI, and how likely is it? | 3 |
| 3.11.2 | Vulnerability Scanning Scan systems for vulnerabilities regularly — and when big new ones hit the news. | 5 |
| 3.11.3 | Vulnerability Remediation Fix the vulnerabilities you find, ordered by severity. | 1 |
Security Assessment (CA) — 4 controls, 13 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.12.1 | Security Control Assessment Test your own controls at least yearly — are they real and working? | 5 |
| 3.12.2 | Plan of Action Keep a POA&M — a dated to-do list for every gap, with owners and deadlines. | 3 |
| 3.12.3 | Continuous Monitoring Monitor continuously — small recurring checks like log reviews, access reviews, and scans. | 5 |
| 3.12.4 | System Security Plan Have a System Security Plan describing your boundary and how each control is handled. | 0 |
System & Communications Protection (SC) — 16 controls, 42 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.13.1 | Boundary Protection Guard the borders of your network and systems — firewall on-prem, controlled sign-in for cloud. | 5 |
| 3.13.2 | Security Engineering Build security in when you buy or configure systems — do not bolt it on later. | 5 |
| 3.13.3 | Role-Based Security Separate everyday use from system administration. | 1 |
| 3.13.4 | Shared Resource Control Stop information from leaking between users through shared resources. | 1 |
| 3.13.5 | Public Network Protection Anything public-facing sits separated from your internal systems. | 5 |
| 3.13.6 | Network Communication by Exception Network traffic is denied by default and allowed only by exception. | 5 |
| 3.13.7 | Split Tunneling Prevention No split tunneling — a remote device must not bridge your protected path and the open internet around your controls. | 1 |
| 3.13.8 | CUI in Transit Encryption Encrypt CUI whenever it travels across a network. | 3 |
| 3.13.9 | Network Disconnect Network connections close when sessions end or sit idle. | 1 |
| 3.13.10 | Cryptographic Key Management Manage your encryption keys — including device recovery keys — deliberately. | 1 |
| 3.13.11 | FIPS-Validated Cryptography The encryption protecting CUI must be FIPS-validated — the specific certified kind. This one trips up almost everyone. | 5 |
| 3.13.12 | Collaborative Device Control Cameras and microphones must not be remotely switched on without the user knowing. | 1 |
| 3.13.13 | Mobile Code Control Control risky active content — macros, plug-ins, scripts. | 1 |
| 3.13.14 | Voice over IP Control VoIP phone technology if you use it. | 1 |
| 3.13.15 | Communication Authenticity Protect sessions from hijacking — modern authenticated TLS handles this. | 5 |
| 3.13.16 | CUI at Rest Encryption Encrypt CUI where it is stored (at rest). | 1 |
System & Information Integrity (SI) — 7 controls, 31 points at stake
| ID | Control, in plain English | Pts |
|---|---|---|
| 3.14.1 | Flaw Remediation Patch security flaws promptly. | 5 |
| 3.14.2 | Malicious Code Protection Run malware protection where it matters — every computer, plus email. | 5 |
| 3.14.3 | Security Alerts & Advisories Watch security alerts (CISA, vendors) and act on the ones that apply to you. | 5 |
| 3.14.4 | Malicious Code Updates Keep malware protection itself up to date. | 5 |
| 3.14.5 | System & File Scanning Scan on a schedule, and scan files from outside in real time. | 3 |
| 3.14.6 | Inbound/Outbound Traffic Monitoring Watch traffic and systems for signs of attack. | 5 |
| 3.14.7 | Unauthorized Use Detection Be able to spot unauthorized use of your systems. | 3 |
What to Do With This List
Reading 110 requirements is the easy 30%. The work is deciding each control's honest status for your shop, keeping evidence, and turning the result into the SSP and POA&M someone will eventually ask for. That's the loop CMMC Map runs: the same plain English you just read, as a guided assessment with a live score — free — and documents generated from your answers when you need them.
This list, as a working assessment
Walk all 110 controls with these translations, assessor objectives, and evidence checklists — your SPRS score calculates live as you answer. Free, no credit card.
Start the free assessment →Free to assess · No credit card · Documents $149/mo