Objectives to Assess for SPAs

The CMMC Level 2 Scoping Guide includes a table describing the CMMC Assessment Requirements for each category of asset. For Security Protection Assets the Assessment Requirements are:

Assess against Level 2 security requirements that are relevant to the capabilities provided.

But what are the relevant security requirements for different types of SPAs? This page will try to answer that question.

SPA Types

• Password Manager
• SIEM Tool
• MFA Provider
• EDR/XDR Tool