Words Matter: Defining the Intention of Verbs in CMMC's Objectives

Cybersecurity Maturity Model Certification (CMMC) Level 2 assesses 110 requirements from NIST SP 800-171 Revision 2, and NIST SP 800-171A breaks those requirements into 320 assessment objectives. Each objective is a short statement that ends in a verb: authorized users are identified, the session lock period is defined, remote access sessions are monitored. The verb tells you what kind of evidence an assessor looks for. This post explains what the common verbs require and where the answer changes with the requirement.

Our working definitions come from the regulation, the CMMC Assessment Guide, our work in assessments, and our discussions with other assessors and practitioners about what each objective requires. Where this post reports what assessors accepted or rejected, it reports what we have seen and what colleagues have told us, not a ruling. An assessor decides whether your evidence is adequate and sufficient, and assessors differ.

Three kinds of objective

Most objectives ask for one of three things:

WHAT THE VERB ASKS FOR · 3 KINDS

1. 01A decision written downDefinedSpecifiedYou choose a value, a rule, or a definition and record it.
2. 02A list you keep currentIdentifiedYou enumerate real things, such as users, devices, or software, and you maintain the list as they change.
3. 03Something you do, with a recordPerformedMonitoredEnforcedYou perform an activity or run a control, and you keep evidence that it operated.

A requirement usually mixes the three. AC.L2-3.1.10 asks you to define a session lock period in objective [a] and to show that the lock prevents access in objective [b]. Answer each objective with the kind of evidence its verb asks for, and you avoid a common mismatch: a policy offered where a record was needed, or a screenshot offered where a decision was needed.

Verbs that ask you to write a decision down

Defined and specified

These verbs ask you to choose a value or a rule and write it where an assessor can find it. The choice is yours, and the assessor then tests your practice against what you wrote. Practitioners agree on this more than on any other point, and they add three cautions:

• State a real value. "Periodically," "regularly," and "as needed" do not define anything. The CMMC rule defines periodically as "occurring at a regular interval as determined by the OSA that may not exceed one year" (32 CFR § 170.4(b)), so the word sets a ceiling, and you still have to state the interval.
• Keep the value testable. A value has to leave its paired objective something to test. If you specify that zero previous passwords are remembered, the objective that prohibits password reuse has nothing to check.
• Write the value the same way everywhere. A lockout threshold that reads one way in the policy, another way in the system security plan (SSP), and a third way in the configuration is not one value. Write each value once, in a place you point to, and refer to it from the other documents.

The definition can live in any document that your organization follows and points the assessor to, including the SSP. A sentence that only says a thing "shall be defined," or that hands the definition to a technical control, defines nothing. One Lead CMMC Certified Assessor (Lead CCA) put it this way:

Technical controls enforce but cannot define.

You can define some sets by what they exclude. CM.L2-3.4.7 asks you to define nonessential programs, functions, ports, protocols, and services. Practitioners commonly define the nonessential set as everything outside a maintained list of essential items, or by reference to a published hardening baseline that the organization applies. That approach works only if the list it depends on exists and is current.

Identified

This verb most often means that a decision is written down, but what you write depends on the requirement:

• Authorized users, processes, and devices (AC.L2-3.1.1). You need a record of who and what you authorized. Practitioners repeat one point more than any other: a directory export shows the accounts that exist, not the accounts someone approved. Lead CCAs report accepting a directory as the list when your policy names it as the list and an approval record, such as a ticket, stands behind each account.
• Identifiers (IA.L2-3.5.1). Here the verb means that each user, process, and device has a unique identifier. A directory or device-management listing that shows the identifiers answers it.
• External systems (AC.L2-3.1.20). You identify the connections to external systems and how each is used: the systems staff connect from, such as personal devices, and the systems that hold or receive your organization's data, with what data. A website that an employee visits is not on that list, and a firewall rule records the enforcement rather than the decision.

Verbs that ask for proof that something happened

Performed, reviewed, and tested

These verbs ask for a dated record: a report, a ticket, a log of reviews, or the notes from an exercise. A procedure that says the activity happens is not the record. Several practitioners report that a stated cadence becomes the test, so if your policy says you review a log monthly, have twelve dated reviews to show for the year.

Implemented and enforced

These verbs ask you to show the control in force, not merely available. A license or a capability does not show that the control is turned on. Practitioners report that CMMC Third-Party Assessment Organizations (C3PAOs) commonly accept a configuration screenshot with the SSP and that some assessors ask to see the setting live. Be ready for either. For multifactor authentication, practitioners report that break-glass and local administrator accounts are included, and that a risk acceptance letter does not substitute.

Monitored

This verb asks for evidence that someone attends to what a tool collects. A log or an alerting tool alone records events. Show who reviews the output, how often, and what they did about it. For security control monitoring under CA.L2-3.12.3, practitioners read the verb as checking, on a recurring basis, that the controls your SSP claims still work. For physical monitoring under PE.L2-3.10.2, badge records, perimeter alarms, and a visitor log reviewed by a named person are common answers, and cameras are not required.

Maintained

This verb asks for a pattern over time that matches the cadence you wrote down. No instrument sets a minimum operating period. Practitioners report assessors asking for anything from one completed instance of each recurring task to six months of history, so start your records early.

Verbs about control, and what the difference costs

Controlled is not prevented

Controlled, limited, and restricted ask for a rule and a mechanism that gives the rule effect. Prevented asks for a technical block. Reading every control requirement as a requirement to block is a common error, and it can lead an organization to buy a tool that the objective does not ask for.

When no technical control is available

Practitioners disagree most about whether policy and training can control something. Their reports converge on a workable position for cases where no technical control is reasonably available, such as forbidding staff to use a personal email service for company data:

1. Write the rule.
2. Record that each person received it.
3. Have a way to detect and respond to a violation.
4. State in the SSP why you use no technical control.

Where a technical control is available, assessors are reported to expect it.

When the block decides your scope

Prevented matters most when a control is what keeps an asset out of your assessment scope. A policy that tells users not to move Controlled Unclassified Information (CUI) to a system leaves that system in scope. Only a technical block removes it.

A plan of action needs no deadline, and dates still help

CA.L2-3.12.2 asks you to develop and implement a plan of action for deficiencies. The CMMC rule is explicit about how that plan differs from the POA&M:

OPERATIONAL PLAN OF ACTION · 32 CFR § 170.4(b)

“…the formal artifact which identifies temporary vulnerabilities and temporary deficiencies … and documents how they will be mitigated, corrected, or eliminated. … An operational plan of action does not identify a timeline for remediation and is not the same as a POA&M, which is associated with an assessment for remediation of deficiencies that must be completed within 180 days.”

1. 1TemporaryProblems that arise in controls you already run.
2. 2How, not whenThe plan records the fix.
3. 3No deadlineThe rule sets no remediation timeline.
4. 4Not a POA&MThe 180-day clock belongs to the assessment POA&M.

The 180-day deadline belongs to the separate Plan of Action and Milestones (POA&M) under 32 CFR § 170.21, which holds requirements scored NOT MET at an assessment. (More on that in CMMC POA&Ms and the 180-day closeout.)

The CMMC Assessment Guide, which is guidance and not binding, asks under objective [c] whether the plan designates "remediation dates and milestones for each item." We recommend recording your own target dates. A missing date does not mean the plan was not developed, but an assessor working from the Guide may ask for one when examining whether the plan is implemented.

Put this into your program

• Read each objective's verb before you choose its evidence, and decide whether it asks for a decision, a list, or a record.
• Write each organization-defined value once, in a place you point to, and make every other document refer to it.
• Keep authorization records beside the systems that enforce them, so that each account and device traces to an approval.
• Start dated records for every recurring activity well before your assessment.
• Where you rely on policy instead of a technical control, record why, and show how you detect a violation.

Want an assessor to read your evidence against the verbs?

A mock assessment puts your evidence in front of CMMC Certified Assessors objective by objective, the same way the real assessment will, so a policy offered where a record was needed shows up while there's still time to fix it.

Sources: 32 CFR Part 170, § 170.4(b) and § 170.21; NIST SP 800-171 Revision 2 (February 2020); NIST SP 800-171A (June 2018); CMMC Assessment Guide, Level 2, version 2.13, assessment considerations for CA.L2-3.12.2.