Frameworks a subcontractor already holds, against the 110
Seven frameworks a subcontractor can tick on the collection form: for each, the CMMC Level 2 requirements it may supply evidence toward (reuse candidates), high and medium confidence apart, and the number that needs CMMC-specific evidence.
- ISO/IEC 27001:2022reuse candidates 93 high, 10 medium; 7 need CMMC-specific evidence
- SOC 2reuse candidates 52 high, 24 medium; 34 need CMMC-specific evidence
- NIST CSF 2.0reuse candidates 61 high, 32 medium; 17 need CMMC-specific evidence
- FedRAMP Moderatereuse candidates 108 high, 1 medium; 1 need CMMC-specific evidence
- CIS Controls v8reuse candidates 73 high, 12 medium; 25 need CMMC-specific evidence
- NIST SP 800-53 Rev 5reuse candidates 109 high, 0 medium; 1 need CMMC-specific evidence
- NIST SP 800-171 Rev 3reuse candidates 105 high, 1 medium; 4 need CMMC-specific evidence