CMMC 14 Domains Explained (NIST SP 800-171 Families)

CMMC Level 2 organizes its 110 NIST SP 800-171 Rev 2 requirements into 14 domains that mirror the 800-171 families. Use this page as the domain hub; deepen AU with our logging guide and levels with L1/L2/L3 pages.

Related: CMMC hub · Level 2 · AU + SIEM · CMMC vs 800-171.

Locked mapping: AC, AT, AU, CM, IA, IR, MA, MP, PE, PS, RA, CA, SC, SI — fourteen families, 110 requirements total at Level 2.

14 Domains

Domain

Focus

Access Control

Least privilege, remote access, CUI flow control

Awareness and Training

Role-based cyber training

Audit and Accountability

Logging, retention, review — often SIEM-backed

Configuration Management

Baselines, change control

Identification and Authentication

MFA, authenticator management

Incident Response

IR capability + DFARS 7012 reporting interfaces

Maintenance

Controlled maintenance tools and media

Media Protection

CUI media mark, store, sanitize, destroy

Physical Protection

Facility and device physical access

Personnel Security

Screening and termination handling

Risk Assessment

Periodic risk assessment / scan cadence

Security Assessment

Control assessment, plans, POA&M linkages

System and Communications Protection

Boundary protection, encryption in transit

System and Information Integrity

Malware, monitoring, flaw remediation

How CyberSilo Helps

CSA organizes evidence by domain and requirement ID
ThreatHawk emphasizes AU and SI monitoring artefacts

Work Domain by Domain With Traceable Proof

Assign owners per family and link artefacts so Level 2’s 110 requirements stay assessment-ready.

Talk to CyberSilo CMMC Automation

Frequently Asked Questions

How many domains does CMMC Level 2 use?

Fourteen — matching NIST SP 800-171 Rev 2 families.

How many requirements sit under those domains?

110 requirements at Level 2.

Does Level 1 use the 14 domains?

Level 1 uses 15 FAR 52.204-21 basic safeguarding requirements — a different, smaller set focused on FCI.

CMMC hub · Level 1 · Level 2 · Level 3 · CSA

CMMC 14 Domains Explained (NIST SP 800-171 Families)

14 Domains

How CyberSilo Helps

Work Domain by Domain With Traceable Proof

Frequently Asked Questions

How many domains does CMMC Level 2 use?

How many requirements sit under those domains?

Does Level 1 use the 14 domains?

Latest Articles

US State Privacy Laws (redirects to 2026 evergreen hub)

What Is FedRAMP? Authorization Explained for Cloud Service Providers

GDPR Breach Notification: Articles 33 and 34 (72-Hour Guide)

How Much Does ISO 27001 Certification Cost in 2026? (US, EU, GCC, Pakistan)

ISO 27001 Certification in Pakistan, UAE and Saudi Arabia: Process and Cost

How to Define ISO 27001 ISMS Scope (with Examples)

CMMC 14 Domains Explained (NIST SP 800-171 Families)

14 Domains

How CyberSilo Helps

Work Domain by Domain With Traceable Proof

Frequently Asked Questions

How many domains does CMMC Level 2 use?

How many requirements sit under those domains?

Does Level 1 use the 14 domains?

Related CMMC Resources

Latest Articles

US State Privacy Laws (redirects to 2026 evergreen hub)

What Is FedRAMP? Authorization Explained for Cloud Service Providers

GDPR Breach Notification: Articles 33 and 34 (72-Hour Guide)

How Much Does ISO 27001 Certification Cost in 2026? (US, EU, GCC, Pakistan)

ISO 27001 Certification in Pakistan, UAE and Saudi Arabia: Process and Cost

How to Define ISO 27001 ISMS Scope (with Examples)