AOI 1- NCODE Automation_Attachment_SRM_Requirements_07 March.xlsx
XLSX spreadsheet 22 KB Posted
- Solicitation number
- W918Z25SA001
- Issued by
-
Department of the Army
About this file
The file is a NIST SP 800-171 Control Security Requirements Matrix (SRM) spreadsheet detailing cybersecurity control responsibilities across multiple control families. The matrix comprehensively breaks down 172 control identifiers, categorizing responsibility between "Shared" and "Provider" parties, with coverage metrics indicating 62.73% full coverage and 80% weighted coverage for CMMC Level 2 requirements. The document includes both Level 1 and Level 2 control identifiers across access control (AC), awareness and training (AT), audit and accountability (AU), configuration management (CM), identification and authentication (IA), incident response (IR), maintenance (MA), media protection (MP), personnel security (PS), physical and environmental protection (PE), risk assessment (RA), security assessment (CA), system and communications protection (SC), and system and information integrity (SI) domains.
The spreadsheet also includes an additional section for CMMC Level 3 extended control requirements, which focuses primarily on provider-level responsibilities across similar control families. The document appears to be part of a cybersecurity compliance framework, potentially supporting the Department of the Army's NCODE (Network Command and Data Engineering) initiative outlined in the related Commercial Solutions Opening (CSO) solicitation for protecting Army modernization and supply chains, with a specific focus on enhancing cybersecurity for defense industrial base small businesses.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
NIST SP 800-171 Control SRM
| Control Identifier | Threshold Reqs. Responsible Party * | Objective Reqs. Responsible Party |
| AC.L1-3.1.1 | Shared | Shared |
| AC.L1-3.1.2 | Shared | Shared |
| AC.L2-3.1.3 | Shared | Shared |
| AC.L2-3.1.4 | Shared | Shared |
| AC.L2-3.1.5 | Shared | Shared |
| AC.L2-3.1.6 | Provider | Provider |
| AC.L2-3.1.7 | Provider | Provider |
| AC.L2-3.1.8 | Provider | Provider |
| AC.L2-3.1.9 | Shared | Provider |
| AC.L2-3.1.10 | Provider | Provider |
| AC.L2-3.1.11 | Provider | Provider |
| AC.L2-3.1.12 | Shared | Provider |
| AC.L2-3.1.13 | Shared | Provider |
| AC.L2-3.1.14 | Shared | Provider |
| AC.L2-3.1.15 | Shared | Provider |
| AC.L2-3.1.16 | Shared | Provider |
| AC.L2-3.1.17 | Shared | Provider |
| AC.L2-3.1.18 | Shared | Provider |
| AC.L2-3.1.19 | Shared | Provider |
| AC.L1-3.1.20 | Shared | Provider |
| AC.L2-3.1.21 | Shared | Shared |
| AC.L1-3.1.22 | Customer | Customer |
| AT.L2-3.2.1 | Shared | Shared |
| AT.L2-3.2.2 | Shared | Shared |
| AT.L2-3.2.3 | Shared | Shared |
| AU.L2-3.3.1 | Provider | Provider |
| AU.L2-3.3.2 | Provider | Provider |
| AU.L2-3.3.3 | Provider | Provider |
| AU.L2-3.3.4 | Provider | Provider |
| AU.L2-3.3.5 | Provider | Provider |
| AU.L2-3.3.6 | Provider | Provider |
| AU.L2-3.3.7 | Provider | Provider |
| AU.L2-3.3.8 | Provider | Provider |
| AU.L2-3.3.9 | Provider | Provider |
| CM.L2-3.4.1 | Shared | Provider |
| CM.L2-3.4.2 | Shared | Provider |
| CM.L2-3.4.3 | Shared | Provider |
| CM.L2-3.4.4 | Provider | Provider |
| CM.L2-3.4.5 | Provider | Provider |
| CM.L2-3.4.6 | Provider | Provider |
| CM.L2-3.4.7 | Provider | Provider |
| CM.L2-3.4.8 | Provider | Provider |
| CM.L2-3.4.9 | Provider | Provider |
| IA.L1-3.5.1 | Provider | Provider |
| IA.L1-3.5.2 | Provider | Provider |
| IA.L2-3.5.3 | Provider | Provider |
| IA.L2-3.5.4 | Provider | Provider |
| IA.L2-3.5.5 | Provider | Provider |
| IA.L2-3.5.6 | Provider | Provider |
| IA.L2-3.5.7 | Provider | Provider |
| IA.L2-3.5.8 | Provider | Provider |
| IA.L2-3.5.9 | Provider | Provider |
| IA.L2-3.5.10 | Provider | Provider |
| IA.L2-3.5.11 | Provider | Provider |
| IR.L2-3.6.1 | Shared | Shared |
| IR.L2-3.6.2 | Shared | Shared |
| IR.L2-3.6.3 | Shared | Shared |
| MA.L2-3.7.1 | Provider | Provider |
| MA.L2-3.7.2 | Provider | Provider |
| MA.L2-3.7.3 | Provider | Provider |
| MA.L2-3.7.4 | Provider | Provider |
| MA.L2-3.7.5 | Provider | Provider |
| MA.L2-3.7.6 | Provider | Provider |
| MP.L2-3.8.1 | Provider | Provider |
| MP.L2-3.8.2 | Provider | Provider |
| MP.L1-3.8.3 | Provider | Provider |
| MP.L2-3.8.4 | Shared | Shared |
| MP.L2-3.8.5 | Provider | Provider |
| MP.L2-3.8.6 | Provider | Provider |
| MP.L2-3.8.7 | Provider | Provider |
| MP.L2-3.8.8 | Provider | Provider |
| MP.L2-3.8.9 | Provider | Provider |
| PS.L2-3.9.1 | Shared | Shared |
| PS.L2-3.9.2 | Shared | Shared |
| PE.L1-3.10.1 | Shared | Provider |
| PE.L2-3.10.2 | Shared | Provider |
| PE.L1-3.10.3 | Shared | Provider |
| PE.L1-3.10.4 | Shared | Provider |
| PE.L1-3.10.5 | Shared | Provider |
| PE.L2-3.10.6 | Customer | Shared |
| RA.L2-3.11.1 | Shared | Shared |
| RA.L2-3.11.2 | Provider | Provider |
| RA.L2-3.11.3 | Provider | Provider |
| CA.L2-3.12.1 | Shared | Provider |
| CA.L2-3.12.2 | Shared | Provider |
| CA.L2-3.12.3 | Shared | Provider |
| CA.L2-3.12.4 | Shared | Shared |
| SC.L1-3.13.1 | Provider | Provider |
| SC.L2-3.13.2 | Provider | Provider |
| SC.L2-3.13.3 | Provider | Provider |
| SC.L2-3.13.4 | Provider | Provider |
| SC.L1-3.13.5 | Provider | Provider |
| SC.L2-3.13.6 | Provider | Provider |
| SC.L2-3.13.7 | Provider | Provider |
| SC.L2-3.13.8 | Provider | Provider |
| SC.L2-3.13.9 | Provider | Provider |
| SC.L2-3.13.10 | Provider | Provider |
| SC.L2-3.13.11 | Provider | Provider |
| SC.L2-3.13.12 | Provider | Provider |
| SC.L2-3.13.13 | Provider | Provider |
| SC.L2-3.13.14 | Provider | Provider |
| SC.L2-3.13.15 | Provider | Provider |
| SC.L2-3.13.16 | Provider | Provider |
| SI.L1-3.14.1 | Provider | Provider |
| SI.L1-3.14.2 | Provider | Provider |
| SI.L2-3.14.3 | Provider | Provider |
| SI.L1-3.14.4 | Provider | Provider |
| SI.L1-3.14.5 | Provider | Provider |
| SI.L2-3.14.6 | Provider | Provider |
| SI.L2-3.14.7 | Shared | Provider |
| Full coverage | 62.73% | 82.73% |
| Weighted Coverage | 80% | 91% |
| * | Control coverage may vary depending on implementation |
CMMC L3 - NIST 172 Control SRM
| Control Identifier | Objective Reqs. Responsible Party |
| AC.L3-3.1.2E | Provider |
| AC.L3-3.1.3E | Provider |
| AT.L3-3.2.1E | Provider |
| AT.L3-3.2.2E | Provider |
| CM.L3-3.4.1E | Provider |
| CM.L3-3.4.2E | Provider |
| CM.L3-3.4.3E | Provider |
| IA.L3-3.5.1E | Provider |
| IA.L3-3.5.3E | Provider |
| IR.L3-3.6.1E | Provider |
| IR.L3-3.6.2E | Provider |
| PS.L3-3.9.2E | Shared |
| RA.L3-3.11.1E | Provider |
| RA.L3-3.11.2E | Provider |
| RA.L3-3.11.3E | Provider |
| RA.L3-3.11.4E | Provider |
| RA.L3-3.11.5E | Provider |
| RA.L3-3.11.6E | Provider |
| RA.L3-3.11.7E | Provider |
| CA.L3-3.12.1E | Provider |
| SC.L3-3.13.4E | Provider |
| SI.L3-3.14.1E | Provider |
| SI.L3-3.14.3E | Provider |
| SI.L3-3.14.6E | Provider |
File details come from the government source that posted it. Updated .