NIST CSF 2.0 to CMMC Level 1: A Practical Crosswalk for Audit-Ready Compliance

NIST CSF 2.0 Meets CMMC Level 1: A Practical Crosswalk for Compliance Architects

By Rana Jahandad Khan

Cybersecurity frameworks often feel like parallel universes, each with its own language, structure, and expectations. But what if you could align two major frameworks with a single set of controls? That’s exactly what I set out to do with this crosswalk between NIST Cybersecurity Framework 2.0 and CMMC Level 1.

Whether you're preparing for a defense audit or building a scalable security program, this mapping helps you satisfy both frameworks without duplicating effort.

    Why This Crosswalk Matters

• NIST CSF 2.0 introduces a new Govern function, elevating cybersecurity to a strategic, enterprise-level concern.
• CMMC Level 1 focuses on foundational security practices for contractors handling Federal Contract Information (FCI).
• By aligning the two, you can build once and comply twice, saving time, reducing risk, and strengthening audit posture.

NIST CSF 2.0 → CMMC Level 1 Crosswalk

NIST CSF 2.0 Function	CMMC Level 1 Practice(s)	How It Connects
Govern (new)	AC.L1-3.1.1, AC.L1-3.1.2, PE.L1-3.10.1	Establishes leadership accountability, policy oversight, and role clarity - directly supports CMMC’s governance and access control requirements.
Identify	AC.L1-3.1.1, AC.L1-3.1.2, PE.L1-3.10.1	Asset inventories, role mapping, and boundary definitions align with CMMC’s access and physical protection controls.
Protect	AC.L1-3.1.20, MP.L1-3.8.3, SI.L1-3.14.1	Technical safeguards (Defender, Intune, RBAC) meet CMMC’s protection, media sanitization, and malware update requirements.
Detect	SI.L1-3.14.3	Continuous monitoring via Defender alerts, Intune compliance, and log reviews satisfies detection requirements.
Respond	IR.L1-3.6.1	Incident response workflows, escalation paths, and remediation coordination fulfill CMMC’s IR process requirement.
Recover	(Not explicit in Level 1)	Recovery actions (backups, post-incident reviews) strengthen resilience and audit narratives even if not formally required at Level 1.

Final Thoughts

This crosswalk isn’t just a technical alignment - it’s a mindset shift. By treating governance as a strategic function and mapping controls across frameworks, we move from reactive compliance to proactive resilience.

If you're building audit-ready systems or guiding teams through compliance, I hope this helps you lead with clarity and confidence.

Rana Jahandad Khan

Cybersecurity Compliance Architect