/cmmc-assessment-objectives

name: cmmc-assessment-objectives
description: "Source-based navigation for CMMC assessment objectives and revision transition; verify objective text and identifiers in official publications."
allowed-tools: Read, Glob, Grep, Write

CMMC Assessment Objective Source Guide

> **Review required:** This is an unverified working aid, not an authoritative assessment or legal determination. Verify objective wording, labels, applicability, scoring, and crosswalks in official sources and obtain qualified CMMC review. If a source or contract is unavailable, mark the conclusion unverified; do not infer compliance.

The previous local objective catalog and revision crosswalk have been removed because their exact wording, labels, and mappings were not verified. Do not reconstruct an exact catalog from memory or present this guide as a verbatim reference.

Source-based lookup

1. Check the solicitation or contract, assessment level and current program rules. Use [32 CFR 170.14](https://www.ecfr.gov/current/title-32/section-170.14), [170.15](https://www.ecfr.gov/current/title-32/section-170.15), [170.16](https://www.ecfr.gov/current/title-32/section-170.16), and [170.17](https://www.ecfr.gov/current/title-32/section-170.17) as appropriate. Level 1 mapping is specified separately; do not assume the Level 2 process applies unchanged. 2. Consult [NIST SP 800-171A (June 2018)](https://doi.org/10.6028/NIST.SP.800-171A) for assessment procedures and [NIST SP 800-171 Rev 2](https://doi.org/10.6028/NIST.SP.800-171r2) for requirement text where applicable. The NIST publication was withdrawn and superseded, but is incorporated by reference in the CMMC regulation; verify current incorporation and applicable edition. 3. Locate the precise requirement and copy only its source-verified determination statement and label. Some determination statements are lettered and others are not: 3.13.11 is unlettered in the June 2018 publication. Never invent a letter suffix. Record source, edition and location; if inaccessible, say the objective is unverified. 4. Identify appropriate examine, interview and test activities based on the source, assessment scope and evidence. These are potential methods, not a mandatory universal artifact list. Separate observations from decisions and avoid inventing evidence or certification outcomes. 5. For scoring and conditional status, check [32 CFR 170.24](https://www.ecfr.gov/current/title-32/section-170.24) and [32 CFR 170.21](https://www.ecfr.gov/current/title-32/section-170.21), including all restrictions. CA.L2-3.12.4 cannot be on a Level 2 POA&M; IA.L2-3.5.3 is subject to the point-value restrictions.

Revision transition

Use [NIST's CUI project resources](https://csrc.nist.gov/projects/protecting-controlled-unclassified-information) for revision comparison and verify individual mappings in NIST publications. A crosswalk is a planning aid, not proof that one revision satisfies another or that a requirement is met. Under Rev 2, 3.3.7 requires capability to compare and synchronize clocks with an authoritative source; it does not prescribe NTP. Do not change the contractually applicable edition based solely on a newer publication.