Does ISO 27001 cover NIST SP 800-171? What our crosswalk reaches, requirement by requirement
Of the 110 requirements of CMMC Level 2 (NIST SP 800-171 Rev 2), 93 are reuse candidates at high confidence, requirements ISO/IEC 27001:2022 may supply evidence toward, and 10 more at medium confidence; 7 have no candidate and need CMMC-specific evidence. A reuse candidate means a ISO/IEC 27001:2022 requirement points at the same thing; it is not evidence that anything is in place, and every one of the 110 is still assessed on its own evidence against NIST SP 800-171 Rev 2.
reuse candidate, high 93reuse candidate, medium 10no candidate, CMMC-specific evidence needed 7
The 110, one by one
ISO/IEC 27001:2022| Requirement | Reuse | ISO 27001 requirements that may supply evidence |
|---|---|---|
| Access Control | ||
| AC.L2-3.1.1 Authorized Access Control | reuse candidate (high) | 8.3, 5.15 |
| AC.L2-3.1.10 Session Lock | reuse candidate (high) | 8.1, 7.7, 7.7 |
| AC.L2-3.1.11 Session Termination | reuse candidate (high) | 7.7 |
| AC.L2-3.1.12 Control Remote Access | reuse candidate (high) | 6.7, 8.20 |
| AC.L2-3.1.13 Remote Access Confidentiality | reuse candidate (high) | 6.7 |
| AC.L2-3.1.14 Remote Access Routing | reuse candidate (high) | 8.20 |
| AC.L2-3.1.15 Privileged Remote Access | reuse candidate (high) | 8.5 |
| AC.L2-3.1.16 Wireless Access Authorization | reuse candidate (medium) | 8.20 |
| AC.L2-3.1.17 Wireless Access Protection | reuse candidate (high) | 8.21 |
| AC.L2-3.1.18 Mobile Device Connection | reuse candidate (high) | 8.1 |
| AC.L2-3.1.19 Encrypt CUI on Mobile | reuse candidate (high) | 8.1 |
| AC.L2-3.1.2 Transaction & Function Control | reuse candidate (high) | 5.15, 8.3 |
| AC.L2-3.1.20 External Connections | reuse candidate (high) | 8.21, 5.23, 5.23 |
| AC.L2-3.1.21 Portable Storage Use | reuse candidate (high) | 7.10 |
| AC.L2-3.1.22 Control Public Information | reuse candidate (medium) | 5.12 |
| AC.L2-3.1.3 Control CUI Flow | reuse candidate (high) | 5.14, 8.22, 8.12, 5.14, 8.12 |
| AC.L2-3.1.4 Separation of Duties | reuse candidate (high) | 5.3 |
| AC.L2-3.1.5 Least Privilege | reuse candidate (high) | 5.18, 8.2 |
| AC.L2-3.1.6 Non-Privileged Account Use | reuse candidate (high) | 8.2 |
| AC.L2-3.1.7 Privileged Functions | reuse candidate (high) | 8.2, 8.18 |
| AC.L2-3.1.8 Unsuccessful Logon Attempts | reuse candidate (medium) | 8.5 |
| AC.L2-3.1.9 Privacy & Security Notices | reuse candidate (medium) | 5.10 |
| Awareness and Training | ||
| AT.L2-3.2.1 Role-Based Risk Awareness | reuse candidate (high) | 6.3, 5.10 |
| AT.L2-3.2.2 Role-Based Training | reuse candidate (high) | 6.3 |
| AT.L2-3.2.3 Insider Threat Awareness | reuse candidate (high) | 6.8, 6.3 |
| Audit and Accountability | ||
| AU.L2-3.3.1 System Auditing | reuse candidate (high) | 8.15 |
| AU.L2-3.3.2 User Accountability | reuse candidate (high) | 5.16, 8.15 |
| AU.L2-3.3.3 Event Review | reuse candidate (high) | 8.16 |
| AU.L2-3.3.4 Audit Failure Alerting | reuse candidate (medium) | 8.16 |
| AU.L2-3.3.5 Audit Correlation | reuse candidate (high) | 8.16 |
| AU.L2-3.3.6 Reduction & Reporting | reuse candidate (high) | 8.15 |
| AU.L2-3.3.7 Time Stamps & Synchronization | reuse candidate (high) | 8.17 |
| AU.L2-3.3.8 Audit Protection | reuse candidate (high) | 5.33, 5.33, 5.28 |
| AU.L2-3.3.9 Audit Management | reuse candidate (high) | 8.18 |
| Security Assessment | ||
| CA.L2-3.12.1 Security Control Assessment | reuse candidate (high) | 5.35, 5.36, 5.35, 8.29 |
| CA.L2-3.12.2 Plan of Action | reuse candidate (high) | 5.36 |
| CA.L2-3.12.3 Security Control Monitoring | reuse candidate (high) | 7.4, 5.36, 5.36 |
| CA.L2-3.12.4 System Security Plan | reuse candidate (medium) | 5.2, 5.37, 5.1 |
| Configuration Management | ||
| CM.L2-3.4.1 System Baselining | reuse candidate (high) | 5.9, 8.9 |
| CM.L2-3.4.2 Security Configuration Enforcement | reuse candidate (high) | 8.9 |
| CM.L2-3.4.3 System Change Management | reuse candidate (high) | 8.32 |
| CM.L2-3.4.4 Security Impact Analysis | reuse candidate (high) | 8.32 |
| CM.L2-3.4.5 Access Restrictions for Change | reuse candidate (high) | 8.4, 8.32 |
| CM.L2-3.4.6 Least Functionality | reuse candidate (medium) | 8.27 |
| CM.L2-3.4.7 Nonessential Functionality | reuse candidate (high) | 8.9 |
| CM.L2-3.4.8 Application Execution Policy | reuse candidate (high) | 8.19 |
| CM.L2-3.4.9 User-Installed Software | reuse candidate (high) | 8.19 |
| Identification and Authentication | ||
| IA.L2-3.5.1 Identification | reuse candidate (high) | 5.16 |
| IA.L2-3.5.10 Cryptographically-Protected Passwords | reuse candidate (high) | 5.17 |
| IA.L2-3.5.11 Obscure Feedback | no candidate: CMMC-specific evidence | |
| IA.L2-3.5.2 Authentication | reuse candidate (high) | 5.17, 8.5 |
| IA.L2-3.5.3 Multifactor Authentication | reuse candidate (high) | 8.5 |
| IA.L2-3.5.4 Replay-Resistant Authentication | reuse candidate (high) | 8.21, 8.5 |
| IA.L2-3.5.5 Identifier Reuse | reuse candidate (high) | 5.16 |
| IA.L2-3.5.6 Identifier Handling | reuse candidate (high) | 5.18 |
| IA.L2-3.5.7 Password Complexity | reuse candidate (high) | 5.17 |
| IA.L2-3.5.8 Password Reuse | reuse candidate (high) | 5.17 |
| IA.L2-3.5.9 Temporary Passwords | no candidate: CMMC-specific evidence | |
| Incident Response | ||
| IR.L2-3.6.1 Incident Handling | reuse candidate (high) | 5.24, 5.26, 5.25 |
| IR.L2-3.6.2 Incident Reporting | reuse candidate (high) | 5.5, 6.8 |
| IR.L2-3.6.3 Incident Response Testing | reuse candidate (high) | 5.24, 5.27 |
| Maintenance | ||
| MA.L2-3.7.1 Perform Maintenance | reuse candidate (high) | 7.13 |
| MA.L2-3.7.2 System Maintenance Control | reuse candidate (high) | 7.13 |
| MA.L2-3.7.3 Equipment Sanitization | reuse candidate (high) | 7.14 |
| MA.L2-3.7.4 Media Inspection | reuse candidate (high) | 8.7 |
| MA.L2-3.7.5 Nonlocal Maintenance | reuse candidate (high) | 6.7 |
| MA.L2-3.7.6 Maintenance Personnel | reuse candidate (medium) | 7.6 |
| Media Protection | ||
| MP.L2-3.8.1 Media Protection | reuse candidate (high) | 7.10 |
| MP.L2-3.8.2 Media Access | reuse candidate (high) | 8.3, 7.10 |
| MP.L2-3.8.3 Media Disposal | reuse candidate (high) | 7.14, 8.10, 7.10 |
| MP.L2-3.8.4 Media Markings | reuse candidate (high) | 5.13, 5.12 |
| MP.L2-3.8.5 Media Accountability | reuse candidate (high) | 7.10 |
| MP.L2-3.8.6 Portable Storage Encryption | reuse candidate (medium) | 8.24 |
| MP.L2-3.8.7 Removable Media | reuse candidate (high) | 5.10 |
| MP.L2-3.8.8 Shared Media | no candidate: CMMC-specific evidence | |
| MP.L2-3.8.9 Protect Backups | reuse candidate (high) | 8.13, 8.13 |
| Physical Protection | ||
| PE.L2-3.10.1 Limit Physical Access | reuse candidate (high) | 7.1, 7.2, 7.3, 7.8 |
| PE.L2-3.10.2 Monitor Facility | reuse candidate (high) | 7.4, 7.5 |
| PE.L2-3.10.3 Escort Visitors | reuse candidate (high) | 7.2, 7.6 |
| PE.L2-3.10.4 Physical Access Logs | reuse candidate (high) | 7.2, 7.4 |
| PE.L2-3.10.5 Manage Physical Access | reuse candidate (high) | 7.1, 7.3, 7.2 |
| PE.L2-3.10.6 Alternative Work Sites | reuse candidate (high) | 7.9, 6.7 |
| Personnel Security | ||
| PS.L2-3.9.1 Screen Individuals | reuse candidate (high) | 6.1 |
| PS.L2-3.9.2 Personnel Actions | reuse candidate (high) | 5.11, 6.5, 5.18 |
| Risk Assessment | ||
| RA.L2-3.11.1 Risk Assessments | reuse candidate (medium) | 5.7 |
| RA.L2-3.11.2 Vulnerability Scan | reuse candidate (high) | 8.8 |
| RA.L2-3.11.3 Vulnerability Remediation | reuse candidate (high) | 8.8 |
| System and Communications Protection | ||
| SC.L2-3.13.1 Boundary Protection | reuse candidate (high) | 8.22, 8.21, 8.20 |
| SC.L2-3.13.10 Key Management | reuse candidate (high) | 8.24 |
| SC.L2-3.13.11 CUI Encryption | reuse candidate (high) | 8.24 |
| SC.L2-3.13.12 Collaborative Device Control | no candidate: CMMC-specific evidence | |
| SC.L2-3.13.13 Mobile Code | reuse candidate (high) | 8.19 |
| SC.L2-3.13.14 Voice over Internet Protocol | no candidate: CMMC-specific evidence | |
| SC.L2-3.13.15 Communications Authenticity | reuse candidate (high) | 8.21 |
| SC.L2-3.13.16 Data at Rest | reuse candidate (high) | 8.24 |
| SC.L2-3.13.2 Security Engineering | reuse candidate (high) | 8.25, 8.27, 8.28 |
| SC.L2-3.13.3 Role Separation | reuse candidate (high) | 5.3 |
| SC.L2-3.13.4 Shared Resource Control | no candidate: CMMC-specific evidence | |
| SC.L2-3.13.5 Public-Access System Separation | reuse candidate (high) | 8.22 |
| SC.L2-3.13.6 Network Communication by Exception | reuse candidate (high) | 8.20, 8.20 |
| SC.L2-3.13.7 Split Tunneling | no candidate: CMMC-specific evidence | |
| SC.L2-3.13.8 Data in Transit | reuse candidate (high) | 5.14 |
| SC.L2-3.13.9 Connections Termination | reuse candidate (high) | 7.7 |
| System and Information Integrity | ||
| SI.L2-3.14.1 Flaw Remediation | reuse candidate (high) | 8.8 |
| SI.L2-3.14.2 Malicious Code Protection | reuse candidate (high) | 8.7 |
| SI.L2-3.14.3 Security Alerts & Advisories | reuse candidate (high) | 5.7, 5.6 |
| SI.L2-3.14.4 Update Malicious Code Protection | reuse candidate (high) | 8.7 |
| SI.L2-3.14.5 System & File Scanning | reuse candidate (high) | 8.7, 8.7 |
| SI.L2-3.14.6 Monitor Communications for Attacks | reuse candidate (high) | 8.16 |
| SI.L2-3.14.7 Identify Unauthorized Use | reuse candidate (high) | 8.15, 8.16 |
A subcontractor that ticks ISO/IEC 27001:2022 on the collection form sees these counts back as a courtesy, and the prime's Solo plan exports them as a starting sheet with the evidence an assessor asks for. High and medium confidence are shown apart and never added into one figure, and the count with no candidate is always shown beside them. Compare the two frameworks in full on compliance.theartofservice.com; ISO/IEC 27001:2022 itself: ISO/IEC 27001:2022.