Access Control (AC)
Access control is one of the largest and most scrutinized families in CMMC. The foundation is deceptively simple: do you know where your CUI flows? Organizations that can’t answer that question struggle to enforce access controls across identity systems, applications, and cloud services. When it’s done right, CUI is mapped from the start, systems are in sync, and privilege is assigned based on mission need — no more, no less.
Awareness + Training (AT)
Awareness and Training is often treated as a once-a-year checkbox — and that’s the problem. The foundation is simple: does your team actually recognize a threat, not just know one exists? Organizations that rely on annual training struggle when AI-enhanced phishing attacks hit. Done right, general awareness is reinforced with role-based training for sensitive positions, backed by technology, and tested through real-world drills.
Audit + Accountability (AU)
Audit and Accountability is the family that answers one question when something goes wrong: can you actually trace it back to who or what did it? Organizations that struggle here usually have shared accounts or logs that aren’t tied to individual identities, which means accountability disappears right when you need it most. When it’s done right, every device feeds logs to a person or SIEM, logs trigger real tickets and investigations, and the team can walk an assessor from the moment an alert fired to the moment it was resolved.
Configuration Management (CM)
Identification + Authentication (IA)
Identification and authentication is the engine beneath Access Control — and it’s where assessors find the most preventable failures. The premise is simple: can you prove every user, device, and process is who it claims to be? Organizations that can’t tend to share the same blind spots — default credentials never changed, MFA gaps on legacy apps, shared accounts with no individual accountability. When it’s done right, every identity is unique, every device is inventoried, and MFA has no exceptions.
Incident Response (IR)
Maintenance (MA)
Media Protection (MP)
Personnel Security (PS)
Physical + Environmental Protection (PE)
Risk Assessment (RA)
Security Assessment (CA)
Security Assessment is the family that determines whether every other control actually holds up. The foundation is simple but easy to skip: have you rigorously assessed your own system before an assessor walks in? Organizations that treat this as a checkbox get caught flat-footed by gaps they should’ve found first. When it’s done right, the System Security Plan tells the full story end to end, POA&Ms get tracked and closed, and monitoring runs on a defined, risk-based cadence.
