The CMMC Level 2 Control Map by Qanapi

Every CMMC Level 2 practice, arranged by domain. Color shows who carries the practice once Qanapi Flow is deployed on Google Workspace.

Try Qanapi Back to the CMMC guide

Bar length is the number of practices in the domain, on the same scale for all fourteen. The filled part is what Qanapi Flow carries or supports. Tap a domain to open it.

AC22
Access Control
AT3
Awareness and Training
AU9
Audit and Accountability
CA4
Security Assessment
CM9
Configuration Management
IA11
Identification and Authentication
IR3
Incident Response
MA6
Maintenance
MP9
Media Protection
PE6
Physical Protection
PS2
Personnel Security
RA3
Risk Assessment
SC16
System and Communications Protection
SI7
System and Information Integrity

Responsibility determination

Satisfied by Qanapi Flow10
Supported by Qanapi Flow32
Shared with Google Workspace12
Inherited from Google Workspace37
Organization responsibility19
Corner mark: Qanapi Flow contributes evidence to a practice it does not carry 16

How to read a cell

3.13.11
NIST ref is the 800-171 Rev 2 control number. Prefix it with the column code for the full practice identifier, SC.L2-3.13.11.
Column is the CMMC domain, alphabetical by code. The figure beside each code is its practice count.

Client-side encryption 16Key access logging 13Independent key authorization 11Administration and enablement 10Key lifecycle and revocation 5Classification and redaction 3Hosted S/MIME 2

Determinations reflect a Qanapi Flow deployment on Google Workspace Enterprise Plus with Assured Controls Plus. Assessment responsibility remains with the organization. Source: Qanapi CMMC Level 2 Control Responsibility Mapping workbook, version 1.1.  ·  qanapi.com