Forum Discussion

chriskeeling's avatar
chriskeeling
Brass Contributor
Aug 25, 2020

CMMC Control Mapping

Hi! Is there a map for NIST 800-53 or 800-171 or any of the CMMC levels available that I can use to show which controls my Microsoft 365 G5 usage maps to for compliance auditing?
TJBanasik's avatar
TJBanasik
Icon for Microsoft rankMicrosoft
Aug 25, 2020

chriskeeling We've published a CMMC with Microsoft Azure (10 Part Blog Series) which will be helpful for your CMMC control mapping requirements. 

  1. Access Control Maturity 
  2. Audit & Accountability Maturity 
  3. Asset & Configuration Management Maturity 
  4. Identification & Authentication Maturity 
  5. Incident Response Maturity 
  6. Maintenance & Media Protection Maturity 
  7. Recovery & Risk Management Maturity 
  8. Security Assessment & Situational Awareness Maturity 
  9. System & Communications Protection Maturity 
  10. System & Information Integrity Maturity 
  • rybo3000's avatar
    rybo3000
    Brass Contributor
    Aug 25, 2020

    Thanks, TJBanasik! Now that Azure Blueprints for 800-171 (which is kinda sorta CMMC) have been announced: do you think we'll see a blog post on Configuration Management in the coming months?

      • rybo3000's avatar
        rybo3000
        Brass Contributor
        Aug 25, 2020

        TJBanasika big focus in the CM domain (at least for me) is demonstrating the logical access restrictions for changes made to the system. My concern is that CMMC assessors could struggle with a cloud-first architecture, and so extra diligence would be required to prove how changes to Azure resources or Microsoft 365 resources (by way of Azure AD) are restricted. I'm guessing that JIT/PIM/PAM, admin role assignments, and conditional access policies are key here, although I'm sure there are network-level restrictions and other tools I'm not thinking of.

  • chriskeeling's avatar
    chriskeeling
    Brass Contributor
    Aug 25, 2020

    TJBanasik Thanks! This is very useful and the mapping is straightforward. I particularly appreciate that you have included the steps for how to assign the policies and controls through Azure. Can I do them from within Microsoft 365 G5 or can I only do them by logging into our Azure portal to perform all of these tasks (as you describe on the blog)?

    • TJBanasik's avatar
      TJBanasik
      Icon for Microsoft rankMicrosoft
      Aug 25, 2020
      This blog series was geared towards CMMC with Azure, so I'd recommend leveraging the Azure portal as a starting point.

Resources