CMMC Level 2

Access Control Controls

Controls related to limiting system access to authorized users, processes, and devices, and managing what authorized users are allowed to do.

CMMC-RP Certified Team 22 Controls in Family 3.1 24+ Years Experience

About the Access Control Family (AC)

Controls related to limiting system access to authorized users, processes, and devices, and managing what authorized users are allowed to do. This family contains 22 security requirements that organizations must implement to achieve CMMC Level 2 certification and protect Controlled Unclassified Information (CUI). Petronella Technology Group's CMMC-RP certified team provides expert guidance on implementing every control in this family.

CMMC Level 2 - Access Control Controls

All 22 Access Control controls with CMMC-focused implementation guidance.

3.1.1Limit System Access→ 3.1.2Limit System Access to Authorized Functions→ 3.1.3Control CUI Flow→ 3.1.4Separation of Duties→ 3.1.5Least Privilege→ 3.1.6Use Non-Privileged Accounts for Non-Security Functions→ 3.1.7Prevent Non-Privileged Users from Executing Privileged Functions→ 3.1.8Limit Unsuccessful Logon Attempts→ 3.1.9Provide Privacy and Security Notices→ 3.1.10Session Lock→ 3.1.11Terminate Sessions→ 3.1.12Monitor and Control Remote Access→ 3.1.13Employ Cryptographic Mechanisms for Remote Access→ 3.1.14Route Remote Access via Managed Access Control Points→ 3.1.15Authorize Remote Execution of Privileged Commands→ 3.1.16Authorize Wireless Access→ 3.1.17Protect Wireless Access Using Authentication and Encryption→ 3.1.18Control Connection of Mobile Devices→ 3.1.19Encrypt CUI on Mobile Devices→ 3.1.20Verify and Control Connections to External Systems→ 3.1.21Limit Use of Portable Storage on External Systems→ 3.1.22Control CUI Posted or Processed on Publicly Accessible Systems→

NIST SP 800-171 - Access Control Requirements

The same 22 controls with NIST 800-171-focused assessment preparation guidance.

3.1.1Limit System Access→ 3.1.2Limit System Access to Authorized Functions→ 3.1.3Control CUI Flow→ 3.1.4Separation of Duties→ 3.1.5Least Privilege→ 3.1.6Use Non-Privileged Accounts for Non-Security Functions→ 3.1.7Prevent Non-Privileged Users from Executing Privileged Functions→ 3.1.8Limit Unsuccessful Logon Attempts→ 3.1.9Provide Privacy and Security Notices→ 3.1.10Session Lock→ 3.1.11Terminate Sessions→ 3.1.12Monitor and Control Remote Access→ 3.1.13Employ Cryptographic Mechanisms for Remote Access→ 3.1.14Route Remote Access via Managed Access Control Points→ 3.1.15Authorize Remote Execution of Privileged Commands→ 3.1.16Authorize Wireless Access→ 3.1.17Protect Wireless Access Using Authentication and Encryption→ 3.1.18Control Connection of Mobile Devices→ 3.1.19Encrypt CUI on Mobile Devices→ 3.1.20Verify and Control Connections to External Systems→ 3.1.21Limit Use of Portable Storage on External Systems→ 3.1.22Control CUI Posted or Processed on Publicly Accessible Systems→
All CMMC Families
AC: Access Control AT: Awareness and Training AU: Audit and Accountability CM: Configuration Management IA: Identification and Authentication IR: Incident Response MA: Maintenance MP: Media Protection PS: Personnel Security PE: Physical Protection RA: Risk Assessment CA: Security Assessment SC: System and Communications Protection SI: System and Information Integrity

Need Help With Access Control Controls?

Our CMMC-RP certified team has helped 2,500+ organizations implement these controls and pass assessments.

Schedule a Compliance Assessment