CMMC Level 1 to ISO/IEC 27001:2022 Alignment
CMMC Level 1 Practice | ISO/IEC 27001:2022 Annex A Control(s) |
1. Limit system access to authorized users | A.5.18 Access control |
2. Limit system access to permitted transactions/functions | A.5.18 Access control |
3. Verify and control/limit external connections | A.5.15 Access to network and network services |
4. Control information on publicly accessible systems | A.8.23 Web filtering |
5. Identify system users and devices | A.5.17 Identification and authentication |
6. Authenticate/verify identities of users, processes, or devices | A.5.17 Identification and authentication |
7. Sanitize/destroy media before disposal or reuse | A.8.10 Information deletion |
8. Limit physical access to systems, equipment, and environments | A.7.4 Physical security monitoring |
9. Escort visitors and monitor activity | A.7.4 Physical security monitoring |
10. Maintain audit logs of physical access | A.7.8 Physical access logs |
11. Control/manage physical access devices | A.7.7 Visitor management |
12. Monitor, control, and protect communications (networks) | A.8.20 Network security |
13. Implement boundary protection (firewalls, routers, gateways) | A.8.20 Network security |
14. Identify, report, and correct system flaws | A.8.8 Management of technical vulnerabilities |
15. Protect malicious code | A.8.7 Protection against malware |
