CMMC 14 Domains Explained (NIST SP 800-171 Families)

CMMC Level 2 organizes its 110 NIST SP 800-171 Rev 2 requirements into 14 domains that mirror the 800-171 families. Use this page as the domain hub; deepen AU with our logging guide and levels with L1/L2/L3 pages.

Related: CMMC hub · Level 2 · AU + SIEM · CMMC vs 800-171.

Locked mapping: AC, AT, AU, CM, IA, IR, MA, MP, PE, PS, RA, CA, SC, SI — fourteen families, 110 requirements total at Level 2.

14 Domains

Domain

Focus

Access Control

Least privilege, remote access, CUI flow control

Awareness and Training

Role-based cyber training

Audit and Accountability

Logging, retention, review — often SIEM-backed

Configuration Management

Baselines, change control

Identification and Authentication

MFA, authenticator management

Incident Response

IR capability + DFARS 7012 reporting interfaces

Maintenance

Controlled maintenance tools and media

Media Protection

CUI media mark, store, sanitize, destroy

Physical Protection

Facility and device physical access

Personnel Security

Screening and termination handling

Risk Assessment

Periodic risk assessment / scan cadence

Security Assessment

Control assessment, plans, POA&M linkages

System and Communications Protection

Boundary protection, encryption in transit

System and Information Integrity

Malware, monitoring, flaw remediation

How CyberSilo Helps

CSA organizes evidence by domain and requirement ID
ThreatHawk emphasizes AU and SI monitoring artefacts

Work Domain by Domain With Traceable Proof

Assign owners per family and link artefacts so Level 2’s 110 requirements stay assessment-ready.

Talk to CyberSilo CMMC Automation

Frequently Asked Questions

How many domains does CMMC Level 2 use?

Fourteen — matching NIST SP 800-171 Rev 2 families.

How many requirements sit under those domains?

110 requirements at Level 2.

Does Level 1 use the 14 domains?

Level 1 uses 15 FAR 52.204-21 basic safeguarding requirements — a different, smaller set focused on FCI.

CMMC hub · Level 1 · Level 2 · Level 3 · CSA

CMMC 14 Domains Explained (NIST SP 800-171 Families)

14 Domains

How CyberSilo Helps

Work Domain by Domain With Traceable Proof

Frequently Asked Questions

How many domains does CMMC Level 2 use?

How many requirements sit under those domains?

Does Level 1 use the 14 domains?

Latest Articles

Fintech Compliance Automation: Multi-Jurisdiction Requirements (PCI, SOC 2, GDPR, MAS, SAMA)

How MSSPs Help Clients Achieve PCI DSS Compliance at Scale

The 5 Biggest Operational Mistakes MSSPs Make When Managing Multiple Client SOCs

What Is ISO 27001? A Practical 2026 Guide for Security and GRC Teams

What Is the NIST Cybersecurity Framework? CSF 2.0 Explained for 2026

How NIST Helps Cybersecurity Programs Mature in 2026

CMMC 14 Domains Explained (NIST SP 800-171 Families)

14 Domains

How CyberSilo Helps

Work Domain by Domain With Traceable Proof

Frequently Asked Questions

How many domains does CMMC Level 2 use?

How many requirements sit under those domains?

Does Level 1 use the 14 domains?

Related CMMC Resources

Latest Articles

Fintech Compliance Automation: Multi-Jurisdiction Requirements (PCI, SOC 2, GDPR, MAS, SAMA)

How MSSPs Help Clients Achieve PCI DSS Compliance at Scale

The 5 Biggest Operational Mistakes MSSPs Make When Managing Multiple Client SOCs

What Is ISO 27001? A Practical 2026 Guide for Security and GRC Teams

What Is the NIST Cybersecurity Framework? CSF 2.0 Explained for 2026

How NIST Helps Cybersecurity Programs Mature in 2026