SOC 2 Type II to CMMC Level 2 control mapping

SOC 2 Type II and CMMC Level 2 both map to 114 NIST SP 800-53 controls. Every one is listed below, with the controls on each side that map to it.

Shared NIST 800-53 controls: 114
SOC 2 Type II controls involved: 39
CMMC Level 2 controls involved: 67
NIST 800-53 families touched: 18

How this pairing is derived

Both frameworks are mapped to NIST SP 800-53 Rev 5 in the source dataset, so the ground they share is the set of NIST controls they both reference. That set is what the table shows. It is not an authored SOC 2 Type II to CMMC Level 2 crosswalk: two controls on the same row are related through the NIST control between them, not asserted to be equivalent to each other.

Shared controls in full

NIST SP 800-53 Rev 5 controls mapped by both SOC 2 Type II and CMMC Level 2, with the controls on each side that map to them.
NIST 800-53 control	Family	SOC 2 Type II controls	CMMC Level 2 controls
AC-1Policy and Procedures	ACAccess Control	CC5.3, CC6.1, CC6.6	AC.L1-3.1.1
AC-2Account Management	ACAccess Control	CC6.1, CC6.6	AC.L1-3.1.2
AC-2(7)Privileged User Accounts	ACAccess Control	CC6.1, CC6.3	AC.L1-3.1.1, AC.L1-3.1.2, AC.L2-3.1.3
AC-2(12)Account Monitoring for Atypical Usage	ACAccess Control	CC7.2	SI.L2-3.14.7
AC-3Access Enforcement	ACAccess Control	CC6.1, CC6.6	AC.L1-3.1.1
AC-4Information Flow Enforcement	ACAccess Control	CC6.1, CC6.6	AC.L2-3.1.3
AC-4(21)Physical or Logical Separation of Information Flows	ACAccess Control	CC6.1	SC.L1-3.13.5
AC-5Separation of Duties	ACAccess Control	CC5.1, CC6.6	AC.L2-3.1.4
AC-6Least Privilege	ACAccess Control	CC6.1	AC.L1-3.1.1, AC.L2-3.1.5
AC-17Remote Access	ACAccess Control	CC6.6	AC.L2-3.1.12
AC-17(6)Protection of Mechanism Information	ACAccess Control	CC6.6	AC.L2-3.1.12
AC-19(5)Full Device or Container-based Encryption	ACAccess Control	CC6.7	AC.L2-3.1.19
AC-20Use of External Systems	ACAccess Control	CC6.7	AC.L1-3.1.20
AC-20(2)Portable Storage Devices — Restricted Use	ACAccess Control	CC6.7	AC.L2-3.1.21
AC-20(5)Portable Storage Devices — Prohibited Use	ACAccess Control	CC6.7	AC.L2-3.1.21
AU-1Policy and Procedures	AUAudit and Accountability	CC5.3, CC7.2	AU.L2-3.3.3, SI.L2-3.14.6
AU-2Event Logging	AUAudit and Accountability	CC7.2, CC7.3	AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.5, AU.L2-3.3.6, AU.L2-3.3.8, AU.L2-3.3.9, SI.L2-3.14.3
AU-3Content of Audit Records	AUAudit and Accountability	PI1.4	AU.L2-3.3.2
AU-6Audit Record Review, Analysis, and Reporting	AUAudit and Accountability	CC7.2, CC7.3	AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.5, AU.L2-3.3.6, AU.L2-3.3.8, AU.L2-3.3.9
AU-6(3)Correlate Audit Record Repositories	AUAudit and Accountability	CC7.2, CC7.3	AU.L2-3.3.5, SI.L2-3.14.7
AU-6(9)Correlation with Information from Nontechnical Sources	AUAudit and Accountability	CC7.2, CC7.3	AU.L2-3.3.5, SI.L2-3.14.7
AU-7Audit Record Reduction and Report Generation	AUAudit and Accountability	CC7.2, CC7.3	AU.L2-3.3.6
AU-7(1)Automatic Processing	AUAudit and Accountability	CC7.2, CC7.3	AU.L2-3.3.6
AU-9Protection of Audit Information	AUAudit and Accountability	PI1.4, PI1.5	AU.L2-3.3.8
AU-11Audit Record Retention	AUAudit and Accountability	C1.2	AU.L2-3.3.1
AU-12Audit Record Generation	AUAudit and Accountability	CC7.2, CC7.3	AU.L2-3.3.6
CA-2Control Assessments	CAAssessment, Authorization, and Monitoring	CC3.1, CC4.1, CC5.2	CA.L2-3.12.1
CA-5Plan of Action and Milestones	CAAssessment, Authorization, and Monitoring	CC4.2	CA.L2-3.12.2
CA-7Continuous Monitoring	CAAssessment, Authorization, and Monitoring	CC1.1, CC2.2, CC2.3	CA.L2-3.12.1, CA.L2-3.12.3
CA-7(1)Independent Assessment	CAAssessment, Authorization, and Monitoring	CC1.1, CC2.2, CC2.3	CA.L2-3.12.1, CA.L2-3.12.3
CM-2Baseline Configuration	CMConfiguration Management	CC7.1, CC8.1	AU.L2-3.3.3, CM.L2-3.4.1, CM.L2-3.4.2
CM-3Configuration Change Control	CMConfiguration Management	CC3.4, CC8.1	CM.L2-3.4.3
CM-4Impact Analyses	CMConfiguration Management	CC3.4	CM.L2-3.4.4
CM-6Configuration Settings	CMConfiguration Management	CC7.1, CC8.1	AU.L2-3.3.3, CM.L2-3.4.1, CM.L2-3.4.2
CP-9System Backup	CPContingency Planning	A1.2, CC7.5	MP.L2-3.8.9
CP-9(8)Cryptographic Protection	CPContingency Planning	A1.2	MP.L2-3.8.9
IA-1Policy and Procedures	IAIdentification and Authentication	CC5.3, CC6.1, CC6.6	AC.L1-3.1.1
IA-2Identification and Authentication (Organizational Users)	IAIdentification and Authentication	CC6.1	AC.L1-3.1.1, IA.L1-3.5.1, IA.L1-3.5.2
IA-3Device Identification and Authentication	IAIdentification and Authentication	CC6.1	IA.L1-3.5.1, IA.L1-3.5.2
IA-3(1)Cryptographic Bidirectional Authentication	IAIdentification and Authentication	CC6.1	IA.L1-3.5.1, IA.L1-3.5.2
IA-3(4)Device Attestation	IAIdentification and Authentication	CC6.1	IA.L1-3.5.1, IA.L1-3.5.2
IA-4Identifier Management	IAIdentification and Authentication	CC6.1, CC6.6	IA.L2-3.5.5
IA-5Authenticator Management	IAIdentification and Authentication	CC6.1	IA.L2-3.5.8, IA.L2-3.5.9
IA-5(1)Password-based Authentication	IAIdentification and Authentication	CC6.1	IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9
IR-4Incident Handling	IRIncident Response	CC7.3, CC7.4	IR.L2-3.6.1, IR.L2-3.6.2
IR-4(4)Information Correlation	IRIncident Response	CC7.2, CC7.3	AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.5, AU.L2-3.3.6, AU.L2-3.3.8, AU.L2-3.3.9, SI.L2-3.14.7
IR-4(13)Behavior Analysis	IRIncident Response	CC7.2	SI.L2-3.14.7
PE-1Policy and Procedures	PEPhysical and Environmental Protection	A1.2, CC5.3, CC6.4	PE.L2-3.10.2
PE-2Physical Access Authorizations	PEPhysical and Environmental Protection	CC6.4	PE.L1-3.10.1
PE-2(1)Access by Position or Role	PEPhysical and Environmental Protection	CC6.4	PE.L1-3.10.1
PE-3Physical Access Control	PEPhysical and Environmental Protection	CC6.4	PE.L1-3.10.3, PE.L1-3.10.5
PE-3(2)Facility and Systems	PEPhysical and Environmental Protection	CC6.4	PE.L1-3.10.3, PE.L1-3.10.5
PE-3(3)Continuous Guards	PEPhysical and Environmental Protection	CC6.4	PE.L1-3.10.3, PE.L1-3.10.5
PE-5Access Control for Output Devices	PEPhysical and Environmental Protection	PI1.4	PE.L1-3.10.1
PE-17Alternate Work Site	PEPhysical and Environmental Protection	A1.2	PE.L2-3.10.6
PE-18Location of System Components	PEPhysical and Environmental Protection	A1.2	PE.L1-3.10.1
PE-23Facility Location	PEPhysical and Environmental Protection	A1.2, CC6.4, CC9.1	PE.L1-3.10.1, PE.L2-3.10.2
PL-2System Security and Privacy Plans	PLPlanning	CC2.1, CC4.1	CA.L2-3.12.4
PL-4Rules of Behavior	PLPlanning	CC1.1	AC.L1-3.1.22
PL-10Baseline Selection	PLPlanning	CC7.1, CC8.1	AU.L2-3.3.3, CM.L2-3.4.1, CM.L2-3.4.2
RA-3Risk Assessment	RARisk Assessment	A1.2, CC4.1, CC7.3	RA.L2-3.11.1
RA-5Vulnerability Monitoring and Scanning	RARisk Assessment	CC7.1	RA.L2-3.11.2
SA-4Acquisition Process	SASystem and Services Acquisition	CC3.3, CC3.4, CC5.2, CC9.1, CC9.2, P6.4, PI1.2, PI1.3	AC.L1-3.1.1
SA-8Security and Privacy Engineering Principles	SASystem and Services Acquisition	CC2.2, CC3.2, CC5.1, CC5.2, CC7.1, CC8.1	AU.L2-3.3.3, CM.L2-3.4.1, CM.L2-3.4.2, SC.L2-3.13.2
SA-8(14)Least Privilege	SASystem and Services Acquisition	CC6.1	AC.L2-3.1.5
SA-8(31)Secure System Modification	SASystem and Services Acquisition	CC3.4, CC8.1	CM.L2-3.4.3
SA-15(2)Security and Privacy Tracking Tools	SASystem and Services Acquisition	CC4.2	CA.L2-3.12.2
SA-15(5)Attack Surface Reduction	SASystem and Services Acquisition	CC2.2, CC3.2, CC5.1, CC5.2, CC7.1, CC8.1	AU.L2-3.3.3, CM.L2-3.4.1, CM.L2-3.4.2, SC.L2-3.13.2
SC-1Policy and Procedures	SCSystem and Communications Protection	CC2.2, CC3.2, CC5.1, CC5.2, CC5.3, CC6.1, CC6.6	SC.L1-3.13.1, SC.L2-3.13.2
SC-7Boundary Protection	SCSystem and Communications Protection	CC6.1, CC6.6, CC6.8	SC.L1-3.13.1
SC-7(5)Deny by Default — Allow by Exception	SCSystem and Communications Protection	CC6.6	SC.L2-3.13.6
SC-7(9)Restrict Threatening Outgoing Communications Traffic	SCSystem and Communications Protection	CC6.1, CC6.6, CC6.8	SC.L1-3.13.1
SC-7(11)Restrict Incoming Communications Traffic	SCSystem and Communications Protection	CC6.1, CC6.6, CC6.8	SC.L1-3.13.1, SC.L2-3.13.6
SC-7(14)Protect Against Unauthorized Physical Connections	SCSystem and Communications Protection	A1.2	PE.L1-3.10.1
SC-7(18)Fail Secure	SCSystem and Communications Protection	CC2.2, CC3.2, CC5.1, CC5.2	SC.L2-3.13.2
SC-7(29)Separate Subnets to Isolate Functions	SCSystem and Communications Protection	CC6.1	SC.L2-3.13.2
SC-8Transmission Confidentiality and Integrity	SCSystem and Communications Protection	CC6.1, CC6.7	SC.L2-3.13.8
SC-8(1)Cryptographic Protection	SCSystem and Communications Protection	CC6.1, CC6.7	MP.L2-3.8.6, SC.L2-3.13.11, SC.L2-3.13.8
SC-8(2)Pre- and Post-transmission Handling	SCSystem and Communications Protection	CC6.1, CC6.7	MP.L2-3.8.7, SC.L2-3.13.11
SC-8(3)Cryptographic Protection for Message Externals	SCSystem and Communications Protection	CC6.6, CC6.7	SC.L2-3.13.14
SC-12Cryptographic Key Establishment and Management	SCSystem and Communications Protection	CC6.1	SC.L2-3.13.10
SC-13Cryptographic Protection	SCSystem and Communications Protection	CC6.1, CC6.7	MP.L2-3.8.6, SC.L2-3.13.11, SC.L2-3.13.16
SC-17Public Key Infrastructure Certificates	SCSystem and Communications Protection	CC6.1	SC.L2-3.13.10
SC-18(1)Identify Unacceptable Code and Take Corrective Actions	SCSystem and Communications Protection	CC4.2	RA.L2-3.11.3, SC.L2-3.13.13, SI.L1-3.14.1
SC-28Protection of Information at Rest	SCSystem and Communications Protection	CC6.1, CC6.7	MP.L2-3.8.6, SC.L2-3.13.16
SC-28(1)Cryptographic Protection	SCSystem and Communications Protection	A1.2, CC6.1, CC6.7	MP.L2-3.8.6, MP.L2-3.8.9, SC.L2-3.13.16
SC-28(2)Offline Storage	SCSystem and Communications Protection	A1.2, CC7.5	MP.L2-3.8.9
SC-28(3)Cryptographic Keys	SCSystem and Communications Protection	CC6.1	SC.L2-3.13.10
SI-1Policy and Procedures	SISystem and Information Integrity	CC2.2, CC3.2, CC5.1, CC5.2, CC5.3	SC.L2-3.13.2
SI-3Malicious Code Protection	SISystem and Information Integrity	CC6.6, CC6.8	RA.L2-3.11.3, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5
SI-4System Monitoring	SISystem and Information Integrity	CC6.6, CC7.2, CC7.3	AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.5, AU.L2-3.3.6, AU.L2-3.3.8, AU.L2-3.3.9, SI.L2-3.14.6
SI-4(4)Inbound and Outbound Communications Traffic	SISystem and Information Integrity	CC7.2	SI.L2-3.14.6
SI-4(11)Analyze Communications Traffic Anomalies	SISystem and Information Integrity	CC7.2	SI.L2-3.14.7
SI-4(16)Correlate Monitoring Information	SISystem and Information Integrity	CC7.2, CC7.3	AU.L2-3.3.5, SI.L2-3.14.7
SI-4(24)Indicators of Compromise	SISystem and Information Integrity	CC6.8, CC7.1	SI.L2-3.14.7
SI-5Security Alerts, Advisories, and Directives	SISystem and Information Integrity	CC6.6	CA.L2-3.12.3, SI.L2-3.14.3
SI-7(6)Cryptographic Protection	SISystem and Information Integrity	CC6.1	SC.L2-3.13.11
MP-1Policy and Procedures	MPMedia Protection	C1.1, CC2.1, CC5.3, CC6.5, CC6.7, PI1.5	MP.L1-3.8.3, MP.L2-3.8.1
MP-2Media Access	MPMedia Protection	C1.1	AC.L2-3.1.3, MP.L2-3.8.2, SI.L1-3.14.2
MP-6Media Sanitization	MPMedia Protection	CC6.5, P4.3	MA.L2-3.7.3, MP.L1-3.8.3
MP-6(3)Nondestructive Techniques	MPMedia Protection	CC6.5, P4.3	MA.L2-3.7.3, MP.L1-3.8.3
MP-7Media Use	MPMedia Protection	CC6.7, PI1.5	MP.L2-3.8.7, MP.L2-3.8.8
PS-1Policy and Procedures	PSPersonnel Security	CC1.1, CC1.4, CC5.3	AC.L1-3.1.22
PS-4Personnel Termination	PSPersonnel Security	CC1.5	PS.L2-3.9.2
PS-5Personnel Transfer	PSPersonnel Security	CC1.5	PS.L2-3.9.2
PM-4Plan of Action and Milestones Process	PMProgram Management	CC4.2	CA.L2-3.12.2, SI.L1-3.14.1
PM-14Testing, Training, and Monitoring	PMProgram Management	CC1.1, CC2.2, CC2.3	CA.L2-3.12.1, CA.L2-3.12.3
PM-15Security and Privacy Groups and Associations	PMProgram Management	CC2.3, CC3.3, CC9.1	CA.L2-3.12.3, SI.L2-3.14.3
PM-16Threat Awareness Program	PMProgram Management	CC3.3, CC9.1	CA.L2-3.12.3, SI.L2-3.14.3
PM-31Continuous Monitoring Strategy	PMProgram Management	CC7.2	AU.L2-3.3.3, SI.L2-3.14.6
PT-1Policy and Procedures	PTPII Processing and Transparency	CC2.2, CC3.2, CC5.1, CC5.2, CC5.3	SC.L2-3.13.2
SR-1Policy and Procedures	SRSupply Chain Risk Management	CC3.3, CC5.3, CC9.1, CC9.2	AC.L1-3.1.1
SR-3(3)Sub-tier Flow Down	SRSupply Chain Risk Management	CC9.1	AC.L1-3.1.1
SR-12Component Disposal	SRSupply Chain Risk Management	CC6.5	MP.L1-3.8.3

Source and method

Derived from the Top Floor framework mapping dataset: 4,123 cross-framework control mappings across 19 frameworks, every one pivoted through NIST SP 800-53 Rev 5.

Cross-framework mappings on this page are derived from the 2026.2 release of the Secure Controls Framework, used under CC BY-ND 4.0.

Mappings are illustrative aids for planning and are not a substitute for the official text of any framework or for an assessor’s judgment. Always verify control requirements against the authoritative publication. Where no official crosswalk exists, the mapping judgment is our own analysis.

Related pairings

All framework mappings