The CMMC Level 2 Control Map by Qanapi

Every CMMC Level 2 practice, arranged by domain. Color shows who carries the practice once Qanapi Flow is deployed on Google Workspace.

Try Qanapi Download the workbook CMMC on Google (Guide)

Bar length is the number of practices in the domain, on the same scale for all fourteen. The filled part is what Qanapi Flow carries or supports. Tap a domain to open it.

AC22

Access Control

AT3

Awareness and Training

AU9

Audit and Accountability

CA4

Security Assessment

CM9

Configuration Management

IA11

Identification and Authentication

IR3

Incident Response

MA6

Maintenance

MP9

Media Protection

PE6

Physical Protection

PS2

Personnel Security

RA3

Risk Assessment

SC16

System and Communications Protection

SI7

System and Information Integrity

Responsibility determination

Satisfied by Qanapi Flow10
Supported by Qanapi Flow33
Shared with Google Workspace12
Inherited from Google Workspace37
Organization responsibility18
Corner mark: Qanapi Flow contributes evidence to a practice it does not carry 16

How to read a cell

3.13.11
NIST ref is the 800-171 Rev 2 control number. Prefix it with the column code for the full practice identifier, SC.L2-3.13.11.
Column is the CMMC domain, alphabetical by code. The figure beside each code is its practice count.

Client-side encryption 16Key access logging 13Independent key authorization 11Administration and enablement 10Key lifecycle and revocation 5Classification and redaction 3Hosted S/MIME 2

Determinations reflect a Qanapi Flow deployment on Google Workspace Enterprise Plus with Assured Controls Plus. Assessment responsibility remains with the organization. Source: Qanapi CMMC Level 2 Control Responsibility Mapping workbook, version 1.0.  ·  qanapi.com