urn: urn:intuitem:risk:library:cmmc-2.0
locale: en
ref_id: CMMC-2.0
name: CMMC version 2.0
description: Cybersecurity Maturity Model Certification (CMMC)
copyright: "Copyright 2020, 2021 Carnegie Mellon University and The Johns Hopkins
  University Applied\nPhysics Laboratory LLC.\nCopyright 2021 Futures, Inc.\nThis
  material is based upon work funded and supported by the Department of Defense under\n
  Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation
  of the\nSoftware Engineering Institute, a federally funded research and development
  center, and\nunder Contract No. HQ0034-13-D-0003 and Contract No. N00024-13-D-6400
  with the Johns\nHopkins University Applied Physics Laboratory LLC, a University
  Affiliated Research Center.\nThe view, opinions, and/or findings contained in this
  material are those of the author(s) and\nshould not be construed as an official
  Government position, policy, or decision, unless\ndesignated by other documentation.\n
  NO WARRANTY. THIS MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON\nUNIVERSITY
  AND THE JOHNS HOPKINS UNIVERSITY APPLIED PHYSICS LABORATORY LLC\nMAKE NO WARRANTIES
  OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY\nMATTER INCLUDING, BUT NOT LIMITED
  TO, WARRANTY OF FITNESS FOR PURPOSE OR\nMERCHANTABILITY, EXCLUSIVITY, OR RESULTS
  OBTAINED FROM USE OF THE MATERIAL\nNOR ANY WARRANTY OF ANY KIND WITH RESPECT TO
  FREEDOM FROM PATENT,\nTRADEMARK, OR COPYRIGHT INFRINGEMENT.\n[DISTRIBUTION STATEMENT
  A] Approved for public release.\nThis work is licensed to the public under the Creative
  Commons Attribution 4.0 International\nLicense."
version: 5
publication_date: 2024-03-02
provider: DoD
packager: intuitem
objects:
  framework:
    urn: urn:intuitem:risk:framework:cmmc-2.0
    ref_id: CMMC-2.0
    name: CMMC version 2.0
    description: Cybersecurity Maturity Model Certification (CMMC)
    implementation_groups_definition:
      - ref_id: L1
        name: Level 1
        description:
      - ref_id: L2
        name: Level 2
        description:
    requirement_nodes:
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        assessable: false
        depth: 1
        ref_id: AC
        name: ACCESS CONTROL
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L1-3.1.1
        name: Authorized Access Control
        description: "Limit information system access to authorized users, processes
          acting on behalf of authorized users, or devices (including other information
          systems).\n• FAR Clause 52.204-21 b.1.i\n• NIST SP 800-171 Rev 2 3.1.1"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:1:
            type: unique_choice
            text: '[a] authorized users are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:2:
            type: unique_choice
            text: '[b] processes acting on behalf of authorized users are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:3:
            type: unique_choice
            text: '[c] devices (and other systems) authorized to connect to the system
              are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:4:
            type: unique_choice
            text: '[d] system access is limited to authorized users;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:5:
            type: unique_choice
            text: '[e] system access is limited to processes acting on behalf of authorized
              users; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:6:
            type: unique_choice
            text: '[f] system access is limited to authorized devices (including other
              systems).'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.1:question:6:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L1-3.1.2
        name: Transaction & Function Control
        description: "Limit information system access to the types of transactions
          and functions that authorized users are permitted to execute. \n• FAR Clause
          52.204-21 b.1.ii\n• NIST SP 800-171 Rev 2 3.1.2"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2:question:1:
            type: unique_choice
            text: '[a] the types of transactions and functions that authorized users
              are permitted to execute are defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2:question:2:
            type: unique_choice
            text: '[b] system access is limited to the defined types of transactions
              and functions for authorized users.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.2:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.3
        name: Control CUI Flow
        description: "Control the flow of CUI in accordance with approved authorizations.
          \n• NIST SP 800-171 Rev 2 3.1.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:1:
            type: unique_choice
            text: '[a] information flow control policies are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:2:
            type: unique_choice
            text: '[b] methods and enforcement mechanisms for controlling the flow
              of CUI are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:3:
            type: unique_choice
            text: '[c] designated sources and destinations (e.g., networks, individuals,
              and devices) for CUI within the system and between interconnected systems
              are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:4:
            type: unique_choice
            text: '[d] authorizations for controlling the flow of CUI are defined;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:5:
            type: unique_choice
            text: '[e] approved authorizations for controlling the flow of CUI are
              enforced.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.3:question:5:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.4
        name: Separation of Duties
        description: "Separate the duties of individuals to reduce the risk of malevolent
          activity without collusion.\n• NIST SP 800-171 Rev 2 3.1.4\n"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:1:
            type: unique_choice
            text: '[a] the duties of individuals requiring separation are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:2:
            type: unique_choice
            text: '[b] responsibilities for duties that require separation are assigned
              to separate individuals; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:3:
            type: unique_choice
            text: '[c] access privileges that enable individuals to exercise the duties
              that require separation are granted to separate individuals.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.4:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.5
        name: Least Privilege
        description: "Employ the principle of least privilege, including for specific
          security functions and privileged accounts.\n• NIST SP 800-171 Rev 2 3.1.5"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:1:
            type: unique_choice
            text: '[a] privileged accounts are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:2:
            type: unique_choice
            text: '[b] access to privileged accounts is authorized in accordance with
              the principle of least privilege;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:3:
            type: unique_choice
            text: '[c] security functions are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:4:
            type: unique_choice
            text: '[d] access to security functions is authorized in accordance with
              the principle of least privilege.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.5:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.6
        name: Non-Privileged Account Use
        description: "Use non-privileged accounts or roles when accessing nonsecurity
          functions.\n• NIST SP 800-171 Rev 2 3.1.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6:question:1:
            type: unique_choice
            text: '[a] nonsecurity functions are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6:question:2:
            type: unique_choice
            text: '[b] users are required to use non-privileged accounts or roles
              when accessing nonsecurity functions.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.6:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.7
        name: Privileged Functions
        description: "Prevent non-privileged users from executing privileged functions
          and capture the execution of such functions in audit logs.\n• NIST SP 800-171
          Rev 2 3.1.7"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:1:
            type: unique_choice
            text: '[a] privileged functions are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:2:
            type: unique_choice
            text: '[b] non-privileged users are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:3:
            type: unique_choice
            text: '[c] non-privileged users are prevented from executing privileged
              functions; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:4:
            type: unique_choice
            text: '[d] the execution of privileged functions is captured in audit
              logs.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.7:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.8
        name: Unsuccessful Logon Attempts
        description: "Limit unsuccessful logon attempts. \n• NIST SP 800-171 Rev 2
          3.1.8 "
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8:question:1:
            type: unique_choice
            text: '[a] the means of limiting unsuccessful logon attempts is defined;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8:question:2:
            type: unique_choice
            text: '[b] the defined means of limiting unsuccessful logon attempts is
              implemented.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.8:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.9
        name: Privacy & Security Notices
        description: "Provide privacy and security notices consistent with applicable
          CUI rules.\n• NIST SP 800-171 Rev 2 3.1.9"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9:question:1:
            type: unique_choice
            text: '[a] privacy and security notices required by CUI-specified rules
              are identified, consistent, and associated with the specific CUI category;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9:question:2:
            type: unique_choice
            text: '[b] privacy and security notices are displayed.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.9:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.10
        name: Session Lock
        description: "Use session lock with pattern-hiding displays to prevent access
          and viewing of data after a period of inactivity. \n• NIST SP 800-171 Rev
          2 3.1.10"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:1:
            type: unique_choice
            text: '[a] the period of inactivity after which the system initiates a
              session lock is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:2:
            type: unique_choice
            text: '[b] access to the system and viewing of data is prevented by initiating
              a session lock after the defined period of inactivity; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:3:
            type: unique_choice
            text: '[c] previously visible information is concealed via a pattern-hiding
              display after the defined period of inactivity.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.10:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.11
        name: Session Termination
        description: "Terminate (automatically) a user session after a defined condition.\n
          • NIST SP 800-171 Rev 2 3.1.11"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11:question:1:
            type: unique_choice
            text: '[a] conditions requiring a user session to terminate are defined;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11:question:2:
            type: unique_choice
            text: '[b] a user session is automatically terminated after any of the
              defined conditions occur.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.11:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.12
        name: Control Remote Access
        description: "Monitor and control remote access sessions.\n• NIST SP 800-171
          Rev 2 3.1.12"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:1:
            type: unique_choice
            text: '[a] remote access sessions are permitted;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:2:
            type: unique_choice
            text: '[b] the types of permitted remote access are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:3:
            type: unique_choice
            text: '[c] remote access sessions are controlled; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:4:
            type: unique_choice
            text: '[d] remote access sessions are monitored.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.12:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.13
        name: Remote Access Confidentiality
        description: "Employ cryptographic mechanisms to protect the confidentiality
          of remote access sessions.\n• NIST SP 800-171 Rev 2 3.1.13"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13:question:1:
            type: unique_choice
            text: '[a] cryptographic mechanisms to protect the confidentiality of
              remote access sessions are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13:question:2:
            type: unique_choice
            text: '[b] cryptographic mechanisms to protect the confidentiality of
              remote access sessions are implemented.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.13:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.14
        name: Remote Access Routing
        description: "Route remote access via managed access control points. \n• NIST
          SP 800-171 Rev 2 3.1.14"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14:question:1:
            type: unique_choice
            text: '[a] managed access control points are identified and implemented;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14:question:2:
            type: unique_choice
            text: '[b] remote access is routed through managed network access control
              points.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.14:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.15
        name: Privileged Remote Access
        description: "Authorize remote execution of privileged commands and remote
          access to security-relevant information. \n• NIST SP 800-171 Rev 2 3.1.15"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:1:
            type: unique_choice
            text: '[a] privileged commands authorized for remote execution are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:2:
            type: unique_choice
            text: '[b] security-relevant information authorized to be accessed remotely
              is identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:3:
            type: unique_choice
            text: '[c] the execution of the identified privileged commands via remote
              access is authorized; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:4:
            type: unique_choice
            text: '[d] access to the identified security-relevant information via
              remote access is authorized.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.15:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.16
        name: Wireless Access Authorization
        description: "Authorize wireless access prior to allowing such connections.\n
          • NIST SP 800-171 Rev 2 3.1.16"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16:question:1:
            type: unique_choice
            text: '[a] wireless access points are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16:question:2:
            type: unique_choice
            text: '[b] wireless access is authorized prior to allowing such connections.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.16:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.17
        name: Wireless Access Protection
        description: "Protect wireless access using authentication and encryption.
          \n• NIST SP 800-171 Rev 2 3.1.17"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17:question:1:
            type: unique_choice
            text: '[a] wireless access to the system is protected using authentication;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17:question:2:
            type: unique_choice
            text: '[b] wireless access to the system is protected using encryption.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.17:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.18
        name: Mobile Device Connection
        description: "Control connection of mobile devices.\n• NIST SP 800-171 Rev
          2 3.1.18"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:1:
            type: unique_choice
            text: '[a] mobile devices that process, store, or transmit CUI are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:2:
            type: unique_choice
            text: '[b] mobile device connections are authorized; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:3:
            type: unique_choice
            text: '[c] mobile device connections are monitored and logged.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.18:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.19
        name: Encrypt CUI on Mobile
        description: "Encrypt CUI on mobile devices and mobile computing platforms.
          \n• NIST SP 800-171 Rev 2 3.1.19"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19:question:1:
            type: unique_choice
            text: '[a] mobile devices and mobile computing platforms that process,
              store, or transmit CUI are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19:question:2:
            type: unique_choice
            text: '[b] encryption is employed to protect CUI on identified mobile
              devices and mobile computing platforms.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.19:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L1-3.1.20
        name: External Connections
        description: "Verify and control/limit connections to and use of external
          information systems. \n• FAR Clause 52.204-21 b.1.iii\n• NIST SP 800-171
          Rev 2 3.1.20"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:1:
            type: unique_choice
            text: '[a] connections to external systems are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:2:
            type: unique_choice
            text: '[b] the use of external systems is identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:3:
            type: unique_choice
            text: '[c] connections to external systems are verified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:4:
            type: unique_choice
            text: '[d] the use of external systems is verified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:5:
            type: unique_choice
            text: '[e] connections to external systems are controlled/limited; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:6:
            type: unique_choice
            text: '[f] the use of external systems is controlled/limited.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.20:question:6:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L2-3.1.21
        name: Portable Storage Use
        description: "Limit use of portable storage devices on external systems.\n
          • NIST SP 800-171 Rev 2 3.1.21"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:1:
            type: unique_choice
            text: '[a] the use of portable storage devices containing CUI on external
              systems is identified and documented;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:2:
            type: unique_choice
            text: '[b] limits on the use of portable storage devices containing CUI
              on external systems are defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:3:
            type: unique_choice
            text: '[c] the use of portable storage devices containing CUI on external
              systems is limited as defined.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l2-3.1.21:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ac
        ref_id: AC.L1-3.1.22
        name: Control Public Information
        description: "Control information posted or processed on publicly accessible
          information systems.\n• FAR Clause 52.204-21 b.1.iv\n• NIST SP 800-171 Rev
          2 3.1.22"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:1:
            type: unique_choice
            text: '[a] individuals authorized to post or process information on publicly
              accessible systems are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:2:
            type: unique_choice
            text: '[b] procedures to ensure FCI is not posted or processed on publicly
              accessible systems are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:3:
            type: unique_choice
            text: '[c] a review process is in place prior to posting of any content
              to publicly accessible systems;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:4:
            type: unique_choice
            text: '[d] content on publicly accessible systems is reviewed to ensure
              that it does not include FCI; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:5:
            type: unique_choice
            text: '[e] mechanisms are in place to remove and address improper posting
              of FCI.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ac.l1-3.1.22:question:5:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:at
        assessable: false
        depth: 1
        ref_id: AT
        name: AWARENESS AND TRAINING
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:at
        ref_id: AT.L2-3.2.1
        name: Role-Based Risk Awareness
        description: "Ensure that managers, systems administrators, and users of organizational
          systems are made aware of the security risks associated with their activities
          and of the applicable policies, standards, and procedures related to the
          security of those systems.\n• NIST SP 800-171 Rev 2 3.2.1\n"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:1:
            type: unique_choice
            text: '[a] security risks associated with organizational activities involving
              CUI are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:2:
            type: unique_choice
            text: '[b] policies, standards, and procedures related to the security
              of the system are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:3:
            type: unique_choice
            text: '[c] managers, systems administrators, and users of the system are
              made aware of the security risks associated with their activities; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:4:
            type: unique_choice
            text: '[d] managers, systems administrators, and users of the system are
              made aware of the applicable policies, standards, and procedures related
              to the security of the system.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.1:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:at
        ref_id: AT.L2-3.2.2
        name: Role-Based Training
        description: "Ensure that personnel are trained to carry out their assigned
          information security-related duties and responsibilities. \n• NIST SP 800-171
          Rev 2 3.2.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:1:
            type: unique_choice
            text: '[a] information security-related duties, roles, and responsibilities
              are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:2:
            type: unique_choice
            text: '[b] information security-related duties, roles, and responsibilities
              are assigned to designated personnel; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:3:
            type: unique_choice
            text: '[c] personnel are adequately trained to carry out their assigned
              information security-related duties, roles, and responsibilities.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.2:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:at
        ref_id: AT.L2-3.2.3
        name: Insider Threat Awareness
        description: "Provide security awareness training on recognizing and reporting
          potential indicators of insider threat.\n• NIST SP 800-171 Rev 2 3.2.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3:question:1:
            type: unique_choice
            text: '[a] potential indicators associated with insider threats are identified;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3:question:2:
            type: unique_choice
            text: '[b] security awareness training on recognizing and reporting potential
              indicators of insider threat is provided to managers and employees.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:at.l2-3.2.3:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        assessable: false
        depth: 1
        ref_id: AU
        name: AUDIT AND ACCOUNTABILITY
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.1
        name: System Auditing
        description: "Create and retain system audit logs and records to the extent
          needed to enable the monitoring, analysis, investigation, and reporting
          of unlawful or unauthorized system activity. \n• NIST SP 800-171 Rev 2 3.3.1"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:1:
            type: unique_choice
            text: '[a] audit logs needed (i.e., event types to be logged) to enable
              the monitoring, analysis, investigation, and reporting of unlawful or
              unauthorized system activity are specified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:2:
            type: unique_choice
            text: '[b] the content of audit records needed to support monitoring,
              analysis, investigation, and reporting of unlawful or unauthorized system
              activity is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:3:
            type: unique_choice
            text: '[c] audit records are created (generated);'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:4:
            type: unique_choice
            text: '[d] audit records, once created, contain the defined content;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:5:
            type: unique_choice
            text: '[e] retention requirements for audit records are defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:6:
            type: unique_choice
            text: '[f] audit records are retained as defined.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.1:question:6:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.2
        name: User Accountability
        description: "Ensure that the actions of individual system users can be uniquely
          traced to those users, so they can be held accountable for their actions.\n
          • NIST SP 800-171 Rev 2 3.3.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2:question:1:
            type: unique_choice
            text: '[a] the content of the audit records needed to support the ability
              to uniquely trace users to their actions is defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2:question:2:
            type: unique_choice
            text: '[b] audit records, once created, contain the defined content.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.2:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.3
        name: Event Review
        description: "Review and update logged events.\n• NIST SP 800-171 Rev 2 3.3.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:1:
            type: unique_choice
            text: '[a] a process for determining when to review logged events is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:2:
            type: unique_choice
            text: '[b] event types being logged are reviewed in accordance with the
              defined review process; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:3:
            type: unique_choice
            text: '[c] event types being logged are updated based on the review.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.3:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.4
        name: Audit Failure Alerting
        description: "Alert in the event of an audit logging process failure. \n•
          NIST SP 800-171 Rev 2 3.3.4"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:1:
            type: unique_choice
            text: '[a] personnel or roles to be alerted in the event of an audit logging
              process failure are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:2:
            type: unique_choice
            text: '[b] types of audit logging process failures for which alert will
              be generated are defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:3:
            type: unique_choice
            text: '[c] identified personnel or roles are alerted in the event of an
              audit logging process failure.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.4:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.5
        name: Audit Correlation
        description: "Correlate audit record review, analysis, and reporting processes
          for investigation and response to indications of unlawful, unauthorized,
          suspicious, or unusual activity.\n• NIST SP 800-171 Rev 2 3.3.5"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5:question:1:
            type: unique_choice
            text: '[a] audit record review, analysis, and reporting processes for
              investigation and response to indications of unlawful, unauthorized,
              suspicious, or unusual activity are defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5:question:2:
            type: unique_choice
            text: '[b] defined audit record review, analysis, and reporting processes
              are correlated.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.5:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.6
        name: Reduction & Reporting
        description: "Provide audit record reduction and report generation to support
          on-demand analysis and reporting.\n• NIST SP 800-171 Rev 2 3.3.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6:question:1:
            type: unique_choice
            text: '[a] an audit record reduction capability that supports on-demand
              analysis is provided; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6:question:2:
            type: unique_choice
            text: '[b] a report generation capability that supports on-demand reporting
              is provided.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.6:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.7
        name: Authoritative Time Source
        description: "Provide a system capability that compares and synchronizes internal
          system clocks with an authoritative source to generate time stamps for audit
          records.\n• NIST SP 800-171 Rev 2 3.3.7"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:1:
            type: unique_choice
            text: '[a] internal system clocks are used to generate time stamps for
              audit records;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:2:
            type: unique_choice
            text: '[b] an authoritative source with which to compare and synchronize
              internal system clocks is specified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:3:
            type: unique_choice
            text: '[c] internal system clocks used to generate time stamps for audit
              records are compared to and synchronized with the specified authoritative
              time source.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.7:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.8
        name: Audit Protection
        description: "Protect audit information and audit logging tools from unauthorized
          access, modification, and deletion.\n• NIST SP 800-171 Rev 2 3.3.8"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:1:
            type: unique_choice
            text: '[a] audit information is protected from unauthorized access;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:2:
            type: unique_choice
            text: '[b] audit information is protected from unauthorized modification;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:3:
            type: unique_choice
            text: '[c] audit information is protected from unauthorized deletion;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:4:
            type: unique_choice
            text: '[d] audit logging tools are protected from unauthorized access;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:5:
            type: unique_choice
            text: '[e] audit logging tools are protected from unauthorized modification;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:6:
            type: unique_choice
            text: '[f] audit logging tools are protected from unauthorized deletion.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.8:question:6:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:au
        ref_id: AU.L2-3.3.9
        name: Audit Management
        description: "Limit management of audit logging functionality to a subset
          of privileged users. \n• NIST SP 800-171 Rev 2 3.3.9"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9:question:1:
            type: unique_choice
            text: '[a] a subset of privileged users granted access to manage audit
              logging functionality is defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9:question:2:
            type: unique_choice
            text: '[b] management of audit logging functionality is limited to the
              defined subset of privileged users.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:au.l2-3.3.9:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        assessable: false
        depth: 1
        ref_id: CM
        name: CONFIGURATION MANAGEMENT
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.1
        name: System Baselining
        description: "Establish and maintain baseline configurations and inventories
          of organizational systems (including hardware, software, firmware, and documentation)
          throughout the respective system development life cycles.\n• NIST SP 800-171
          Rev 2 3.4.1"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:1:
            type: unique_choice
            text: '[a] a baseline configuration is established;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:2:
            type: unique_choice
            text: '[b] the baseline configuration includes hardware, software, firmware,
              and documentation;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:3:
            type: unique_choice
            text: '[c] the baseline configuration is maintained (reviewed and updated)
              throughout the system development life cycle;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:4:
            type: unique_choice
            text: '[d] a system inventory is established;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:5:
            type: unique_choice
            text: '[e] the system inventory includes hardware, software, firmware,
              and documentation; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:6:
            type: unique_choice
            text: '[f] the inventory is maintained (reviewed and updated) throughout
              the system development life cycle.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.1:question:6:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.2
        name: Security Configuration Enforcement
        description: "Establish and enforce security configuration settings for information
          technology products employed in organizational systems.\n• NIST SP 800-171
          Rev 2 3.4.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2:question:1:
            type: unique_choice
            text: '[a] security configuration settings for information technology
              products employed in the system are established and included in the
              baseline configuration; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2:question:2:
            type: unique_choice
            text: '[b] security configuration settings for information technology
              products employed in the system are enforced.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.2:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.3
        name: System Change Management
        description: "Track, review, approve or disapprove, and log changes to organizational
          systems. \n• NIST SP 800-171 Rev 2 3.4.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:1:
            type: unique_choice
            text: '[a] changes to the system are tracked;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:2:
            type: unique_choice
            text: '[b] changes to the system are reviewed;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:3:
            type: unique_choice
            text: '[c] changes to the system are approved or disapproved; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:4:
            type: unique_choice
            text: '[d] changes to the system are logged.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.3:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.4
        name: Security Impact Analysis
        description: "Analyze the security impact of changes prior to implementation.
          \n• NIST SP 800-171 Rev 2 3.4.4"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.4:question:1:
            type: unique_choice
            text: '[a] the security impact of changes to the system is analyzed prior
              to implementation.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.4:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.5
        name: Access Restrictions for Change
        description: "Define, document, approve, and enforce physical and logical
          access restrictions associated with changes to organizational systems.\n
          • NIST SP 800-171 Rev 2 3.4.5"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:1:
            type: unique_choice
            text: '[a] physical access restrictions associated with changes to the
              system are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:2:
            type: unique_choice
            text: '[b] physical access restrictions associated with changes to the
              system are documented;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:3:
            type: unique_choice
            text: '[c] physical access restrictions associated with changes to the
              system are approved;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:4:
            type: unique_choice
            text: '[d] physical access restrictions associated with changes to the
              system are enforced;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:5:
            type: unique_choice
            text: '[e] logical access restrictions associated with changes to the
              system are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:6:
            type: unique_choice
            text: '[f] logical access restrictions associated with changes to the
              system are documented;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:6:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:7:
            type: unique_choice
            text: '[g] logical access restrictions associated with changes to the
              system are approved; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:7:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:7:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:7:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:8:
            type: unique_choice
            text: '[h] logical access restrictions associated with changes to the
              system are enforced.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:8:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:8:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.5:question:8:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.6
        name: Least Functionality
        description: "Employ the principle of least functionality by configuring organizational
          systems to provide only essential capabilities. \n• NIST SP 800-171 Rev
          2 3.4.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6:question:1:
            type: unique_choice
            text: '[a] essential system capabilities are defined based on the principle
              of least functionality; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6:question:2:
            type: unique_choice
            text: '[b] the system is configured to provide only the defined essential
              capabilities.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.6:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.7
        name: Nonessential Functionality
        description: "Restrict, disable, or prevent the use of nonessential programs,
          functions, ports, protocols, and services. \n• NIST SP 800-171 Rev 2 3.4.7"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:1:
            type: unique_choice
            text: '[a] essential programs are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:2:
            type: unique_choice
            text: '[b] the use of nonessential programs is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:3:
            type: unique_choice
            text: '[c] the use of nonessential programs is restricted, disabled, or
              prevented as defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:4:
            type: unique_choice
            text: '[d] essential functions are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:5:
            type: unique_choice
            text: '[e] the use of nonessential functions is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:6:
            type: unique_choice
            text: '[f] the use of nonessential functions is restricted, disabled,
              or prevented as defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:6:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:7:
            type: unique_choice
            text: '[g] essential ports are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:7:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:7:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:7:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:8:
            type: unique_choice
            text: '[h] the use of nonessential ports is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:8:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:8:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:8:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:9:
            type: unique_choice
            text: '[i] the use of nonessential ports is restricted, disabled, or prevented
              as defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:9:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:9:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:9:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:10:
            type: unique_choice
            text: '[j] essential protocols are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:10:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:10:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:10:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:11:
            type: unique_choice
            text: '[k] the use of nonessential protocols is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:11:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:11:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:11:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:12:
            type: unique_choice
            text: '[l] the use of nonessential protocols is restricted, disabled,
              or prevented as defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:12:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:12:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:12:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:13:
            type: unique_choice
            text: '[m] essential services are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:13:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:13:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:13:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:14:
            type: unique_choice
            text: '[n] the use of nonessential services is defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:14:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:14:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:14:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:15:
            type: unique_choice
            text: '[o] the use of nonessential services is restricted, disabled, or
              prevented as defined.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:15:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:15:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.7:question:15:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.8
        name: Application Execution Policy
        description: "Apply deny-by-exception (blacklisting) policy to prevent the
          use of unauthorized software or deny-all, permit-by-exception (whitelisting)
          policy to allow the execution of authorized software. \n• NIST SP 800-171
          Rev 2 3.4.8"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:1:
            type: unique_choice
            text: '[a] a policy specifying whether whitelisting or blacklisting is
              to be implemented is specified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:2:
            type: unique_choice
            text: '[b] the software allowed to execute under whitelisting or denied
              use under blacklisting is specified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:3:
            type: unique_choice
            text: '[c] whitelisting to allow the execution of authorized software
              or blacklisting to prevent the use of unauthorized software is implemented
              as specified.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.8:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:cm
        ref_id: CM.L2-3.4.9
        name: User-Installed Software
        description: "Control and monitor user-installed software.\n• NIST SP 800-171
          Rev 2 3.4.9"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:1:
            type: unique_choice
            text: ''
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:2:
            type: unique_choice
            text: '[a] a policy for controlling the installation of software by users
              is established;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:3:
            type: unique_choice
            text: '[b] installation of software by users is controlled based on the
              established policy; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:4:
            type: unique_choice
            text: '[c] installation of software by users is monitored.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:cm.l2-3.4.9:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        assessable: false
        depth: 1
        ref_id: IA
        name: IDENTIFICATION AND AUTHENTICATION
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L1-3.5.1
        name: Identification
        description: "Identify information system users, processes acting on behalf
          of users, or devices.\n• FAR Clause 52.204-21 b.1.v\n• NIST SP 800-171 Rev
          2 3.5.1\n"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:1:
            type: unique_choice
            text: '[a] system users are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:2:
            type: unique_choice
            text: '[b] processes acting on behalf of users are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:3:
            type: unique_choice
            text: '[c] devices accessing the system are identified.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.1:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L1-3.5.2
        name: Authentication
        description: "Authenticate (or verify) the identities of those users, processes,
          or devices, as a prerequisite to allowing access to organizational information
          systems.\n• FAR Clause 52.204-21 b.1.vi\n• NIST SP 800-171 Rev 2 3.5.2"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:1:
            type: unique_choice
            text: '[a] the identity of each user is authenticated or verified as a
              prerequisite to system access;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:2:
            type: unique_choice
            text: '[b] the identity of each process acting on behalf of a user is
              authenticated or verified as a prerequisite to system access; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:3:
            type: unique_choice
            text: '[c] the identity of each device accessing or connecting to the
              system is authenticated or verified as a prerequisite to system access.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l1-3.5.2:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.3
        name: Multifactor Authentication
        description: "Use multifactor authentication for local and network access
          to privileged accounts and for network access to non-privileged accounts.
          \n• NIST SP 800-171 Rev 2 3.5.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:1:
            type: unique_choice
            text: '[a] privileged accounts are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:2:
            type: unique_choice
            text: '[b] multifactor authentication is implemented for local access
              to privileged accounts;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:3:
            type: unique_choice
            text: '[c] multifactor authentication is implemented for network access
              to privileged accounts; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:4:
            type: unique_choice
            text: '[d] multifactor authentication is implemented for network access
              to non-privileged accounts.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.3:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.4
        name: Replay-Resistant Authentication
        description: "Employ replay-resistant authentication mechanisms for network
          access to privileged and non-privileged accounts.\n• NIST SP 800-171 Rev
          2 3.5.4"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.4:question:1:
            type: unique_choice
            text: '[a] replay-resistant authentication mechanisms are implemented
              for network account access to privileged and non-privileged accounts.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.4:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.5
        name: Identifier Reuse
        description: "Prevent reuse of identifiers for a defined period. \n• NIST
          SP 800-171 Rev 2 3.5.5"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5:question:1:
            type: unique_choice
            text: '[a] a period within which identifiers cannot be reused is defined;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5:question:2:
            type: unique_choice
            text: '[b] reuse of identifiers is prevented within the defined period.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.5:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.6
        name: Identifier Handling
        description: "Disable identifiers after a defined period of inactivity. \n
          • NIST SP 800-171 Rev 2 3.5.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6:question:1:
            type: unique_choice
            text: '[a] a period of inactivity after which an identifier is disabled
              is defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6:question:2:
            type: unique_choice
            text: '[b] identifiers are disabled after the defined period of inactivity.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.6:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.7
        name: Password Complexity
        description: "Enforce a minimum password complexity and change of characters
          when new passwords are created.\n• NIST SP 800-171 Rev 2 3.5.7"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:1:
            type: unique_choice
            text: '[a] password complexity requirements are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:2:
            type: unique_choice
            text: '[b] password change of character requirements are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:3:
            type: unique_choice
            text: '[c] minimum password complexity requirements as defined are enforced
              when new passwords are created; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:4:
            type: unique_choice
            text: '[d] minimum password change of character requirements as defined
              are enforced when new passwords are created.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.7:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.8
        name: Password Reuse
        description: "Prohibit password reuse for a specified number of generations.\n
          • NIST SP 800-171 Rev 2 3.5.8\n"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8:question:1:
            type: unique_choice
            text: '[a] the number of generations during which a password cannot be
              reused is specified and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8:question:2:
            type: unique_choice
            text: '[b] reuse of passwords is prohibited during the specified number
              of generations.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.8:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.9
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.9
        name: Temporary Passwords
        description: "Allow temporary password use for system logons with an immediate
          change to a permanent password. \n• NIST SP 800-171 Rev 2 3.5.9"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.9:question:1:
            type: unique_choice
            text: '[a] an immediate change to a permanent password is required when
              a temporary password is used for system logon.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.9:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.9:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.9:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.10
        name: Cryptographically-Protected Passwords
        description: "Store and transmit only cryptographically-protected passwords.
          \n• NIST SP 800-171 Rev 2 3.5.10"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10:question:1:
            type: unique_choice
            text: '[a] passwords are cryptographically protected in storage; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10:question:2:
            type: unique_choice
            text: '[b] passwords are cryptographically protected in transit.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.10:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.11
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ia
        ref_id: IA.L2-3.5.11
        name: Obscure Feedback
        description: "Obscure feedback of authentication information. \n• NIST SP
          800-171 Rev 2 3.5.11"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.11:question:1:
            type: unique_choice
            text: '[a] authentication information is obscured during the authentication
              process.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.11:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.11:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ia.l2-3.5.11:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir
        assessable: false
        depth: 1
        ref_id: IR
        name: INCIDENT RESPONSE
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ir
        ref_id: IR.L2-3.6.1
        name: Incident Handling
        description: "Establish an operational incident-handling capability for organizational
          systems that includes preparation, detection, analysis, containment, recovery,
          and user response activities.\n• NIST SP 800-171 Rev 2 3.6.1"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:1:
            type: unique_choice
            text: '[a] an operational incident-handling capability is established;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:2:
            type: unique_choice
            text: '[b] the operational incident-handling capability includes preparation;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:3:
            type: unique_choice
            text: '[c] the operational incident-handling capability includes detection;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:4:
            type: unique_choice
            text: '[d] the operational incident-handling capability includes analysis;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:5:
            type: unique_choice
            text: '[e] the operational incident-handling capability includes containment;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:6:
            type: unique_choice
            text: '[f] the operational incident-handling capability includes recovery;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:6:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:7:
            type: unique_choice
            text: '[g] the operational incident-handling capability includes user
              response activities.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:7:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:7:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.1:question:7:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ir
        ref_id: IR.L2-3.6.2
        name: Incident Reporting
        description: "Track, document, and report incidents to designated officials
          and/or authorities both internal and external to the organization.\n• NIST
          SP 800-171 Rev 2 3.6.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:1:
            type: unique_choice
            text: '[a] incidents are tracked;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:2:
            type: unique_choice
            text: '[b] incidents are documented;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:3:
            type: unique_choice
            text: '[c] authorities to whom incidents are to be reported are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:4:
            type: unique_choice
            text: '[d] organizational officials to whom incidents are to be reported
              are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:5:
            type: unique_choice
            text: '[e] identified authorities are notified of incidents; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:6:
            type: unique_choice
            text: '[f] identified organizational officials are notified of incidents.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.2:question:6:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ir
        ref_id: IR.L2-3.6.3
        name: Incident Response Testing
        description: "Test the organizational incident response capability.\n• NIST
          SP 800-171 Rev 2 3.6.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.3:question:1:
            type: unique_choice
            text: '[a] the incident response capability is tested.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ir.l2-3.6.3:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma
        assessable: false
        depth: 1
        ref_id: MA
        name: MAINTENANCE
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ma
        ref_id: MA.L2-3.7.1
        name: Perform Maintenance
        description: "Perform maintenance on organizational systems.\n• NIST SP 800-171
          Rev 2 3.7.1"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.1:question:1:
            type: unique_choice
            text: '[a] system maintenance is performed.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.1:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ma
        ref_id: MA.L2-3.7.2
        name: System Maintenance Control
        description: "Provide controls on the tools, techniques, mechanisms, and personnel
          used to conduct system maintenance.\n• NIST SP 800-171 Rev 2 3.7.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:1:
            type: unique_choice
            text: '[a] tools used to conduct system maintenance are controlled;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:2:
            type: unique_choice
            text: '[b] techniques used to conduct system maintenance are controlled;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:3:
            type: unique_choice
            text: '[c] mechanisms used to conduct system maintenance are controlled;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:4:
            type: unique_choice
            text: '[d] personnel used to conduct system maintenance are controlled.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.2:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ma
        ref_id: MA.L2-3.7.3
        name: Equipment Sanitization
        description: "Ensure equipment removed for off-site maintenance is sanitized
          of any CUI. \n• NIST SP 800-171 Rev 2 3.7.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.3:question:1:
            type: unique_choice
            text: '[a] equipment to be removed from organizational spaces for off-site
              maintenance is sanitized of any CUI.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.3:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ma
        ref_id: MA.L2-3.7.4
        name: Media Inspection
        description: "Check media containing diagnostic and test programs for malicious
          code before the media are used in organizational systems. \n• NIST SP 800-171
          Rev 2 3.7.4"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.4:question:1:
            type: unique_choice
            text: '[a] media containing diagnostic and test programs are checked for
              malicious code before being used in organizational systems that process,
              store, or transmit CUI.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.4:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ma
        ref_id: MA.L2-3.7.5
        name: Nonlocal Maintenance
        description: "Require multifactor authentication to establish nonlocal maintenance
          sessions via external network connections and terminate such connections
          when nonlocal maintenance is complete.\n• NIST SP 800-171 Rev 2 3.7.5"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5:question:1:
            type: unique_choice
            text: '[a] multifactor authentication is used to establish nonlocal maintenance
              sessions via external network connections; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5:question:2:
            type: unique_choice
            text: '[b] nonlocal maintenance sessions established via external network
              connections are terminated when nonlocal maintenance is complete.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.5:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ma
        ref_id: MA.L2-3.7.6
        name: Maintenance Personnel
        description: "Supervise the maintenance activities of maintenance personnel
          without required access authorization. \n• NIST SP 800-171 Rev 2 3.7.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.6:question:1:
            type: unique_choice
            text: '[a] maintenance personnel without required access authorization
              are supervised during maintenance activities.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ma.l2-3.7.6:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        assessable: false
        depth: 1
        ref_id: MP
        name: MEDIA PROTECTION
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L2-3.8.1
        name: Media Protection
        description: "Protect (i.e., physically control and securely store) system
          media containing CUI, both paper and digital. \n• NIST SP 800-171 Rev 2
          3.8.1"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:1:
            type: unique_choice
            text: '[a] paper media containing CUI is physically controlled;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:2:
            type: unique_choice
            text: '[b] digital media containing CUI is physically controlled;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:3:
            type: unique_choice
            text: '[c] paper media containing CUI is securely stored; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:4:
            type: unique_choice
            text: '[d] digital media containing CUI is securely stored.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.1:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L2-3.8.2
        name: Media Access
        description: "Limit access to CUI on system media to authorized users.\n•
          NIST SP 800-171 Rev 2 3.8.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.2:question:1:
            type: unique_choice
            text: '[a] access to CUI on system media is limited to authorized users.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.2:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L1-3.8.3
        name: Media Disposal
        description: "Sanitize or destroy information system media containing Federal
          Contract Information before disposal or release for reuse.\n• FAR Clause
          52.204-21 b.1.vii\n• NIST SP 800-171 Rev 2 3.8.3"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3:question:1:
            type: unique_choice
            text: '[a]system media containing FCI is sanitized or destroyed before
              disposal; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3:question:2:
            type: unique_choice
            text: '[b]system media containing FCI is sanitized before it is released
              for reuse.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l1-3.8.3:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L2-3.8.4
        name: Media Markings
        description: "Mark media with necessary CUI markings and distribution limitations.\n
          • NIST SP 800-171 Rev 2 3.8.4"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4:question:1:
            type: unique_choice
            text: '[a] media containing CUI is marked with applicable CUI markings;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4:question:2:
            type: unique_choice
            text: '[b] media containing CUI is marked with distribution limitations.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.4:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L2-3.8.5
        name: Media Accountability
        description: "Control access to media containing CUI and maintain accountability
          for media during transport outside of controlled areas. \n• NIST SP 800-171
          Rev 2 3.8.5"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5:question:1:
            type: unique_choice
            text: '[a] access to media containing CUI is controlled; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5:question:2:
            type: unique_choice
            text: '[b] accountability for media containing CUI is maintained during
              transport outside of controlled areas.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.5:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L2-3.8.6
        name: Portable Storage Encryption
        description: "Implement cryptographic mechanisms to protect the confidentiality
          of CUI stored on digital media during transport unless otherwise protected
          by alternative physical safeguards. \n• NIST SP 800-171 Rev 2 3.8.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.6:question:1:
            type: unique_choice
            text: '[a] the confidentiality of CUI stored on digital media is protected
              during transport using cryptographic mechanisms or alternative physical
              safeguards.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.6:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.7
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L2-3.8.7
        name: Removable Media
        description: "Control the use of removable media on system components.\n•
          NIST SP 800-171 Rev 2 3.8.7"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.7:question:1:
            type: unique_choice
            text: '[a] the use of removable media on system components is controlled.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.7:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.7:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.7:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.8
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L2-3.8.8
        name: Shared Media
        description: "Prohibit the use of portable storage devices when such devices
          have no identifiable owner.\n• NIST SP 800-171 Rev 2 3.8.8"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.8:question:1:
            type: unique_choice
            text: '[a] the use of portable storage devices is prohibited when such
              devices have no identifiable owner.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.8:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.8:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.8:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.9
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:mp
        ref_id: MP.L2-3.8.9
        name: Protect Backups
        description: "Protect the confidentiality of backup CUI at storage locations.
          \n• NIST SP 800-171 Rev 2 3.8.9"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.9:question:1:
            type: unique_choice
            text: '[a] the confidentiality of backup CUI is protected at storage locations.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.9:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.9:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:mp.l2-3.8.9:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps
        assessable: false
        depth: 1
        ref_id: PS
        name: PERSONNEL SECURITY
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ps
        ref_id: PS.L2-3.9.1
        name: Screen Individuals
        description: "Screen individuals prior to authorizing access to organizational
          systems containing CUI.\n• NIST SP 800-171 Rev 2 3.9.1"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.1:question:1:
            type: unique_choice
            text: '[a] individuals are screened prior to authorizing access to organizational
              systems containing CUI.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.1:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ps
        ref_id: PS.L2-3.9.2
        name: Personnel Actions
        description: "Ensure that organizational systems containing CUI are protected
          during and after personnel actions such as terminations and transfers.\n
          • NIST SP 800-171 Rev 2 3.9.2\n"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:1:
            type: unique_choice
            text: '[a] a policy and/or process for terminating system access and any
              credentials coincident with personnel actions is established;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:2:
            type: unique_choice
            text: '[b] system access and credentials are terminated consistent with
              personnel actions such as termination or transfer; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:3:
            type: unique_choice
            text: '[c] the system is protected during and after personnel transfer
              actions.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ps.l2-3.9.2:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe
        assessable: false
        depth: 1
        ref_id: PE
        name: PHYSICAL PROTECTION
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:pe
        ref_id: PE.L1-3.10.1
        name: Limit Physical Access
        description: "Limit physical access to organizational information systems,
          equipment, and the respective operating environments to authorized individuals.
          \n• FAR Clause 52.204-21 b.1.viii\n• NIST SP 800-171 Rev 2 3.10.1"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:1:
            type: unique_choice
            text: '[a] authorized individuals allowed physical access are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:2:
            type: unique_choice
            text: '[b] physical access to organizational systems is limited to authorized
              individuals;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:3:
            type: unique_choice
            text: '[c] physical access to equipment is limited to authorized individuals;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:4:
            type: unique_choice
            text: '[d] physical access to operating environments is limited to authorized
              individuals.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.1:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:pe
        ref_id: PE.L2-3.10.2
        name: Monitor Facility
        description: "Protect and monitor the physical facility and support infrastructure
          for organizational systems.\n• NIST SP 800-171 Rev 2 3.10.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:1:
            type: unique_choice
            text: '[a] the physical facility where organizational systems reside is
              protected;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:2:
            type: unique_choice
            text: '[b] the support infrastructure for organizational systems is protected;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:3:
            type: unique_choice
            text: '[c] the physical facility where organizational systems reside is
              monitored; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:4:
            type: unique_choice
            text: '[d] the support infrastructure for organizational systems is monitored.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.2:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:pe
        ref_id: PE.L1-3.10.3
        name: Escort Visitors
        description: "Escort visitors and monitor visitor activity. \n• FAR Clause
          52.204-21 Partial b.1.ix \n• NIST SP 800-171 Rev 2 3.10.3"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3:question:1:
            type: unique_choice
            text: '[a] visitors are escorted; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3:question:2:
            type: unique_choice
            text: '[b] visitor activity is monitored.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.3:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:pe
        ref_id: PE.L1-3.10.4
        name: Physical Access Logs
        description: "Maintain audit logs of physical access.\n• FAR Clause 52.204-21
          Partial b.1.ix \n• NIST SP 800-171 Rev 2 3.10.4"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.4:question:1:
            type: unique_choice
            text: '[a] audit logs of physical access are maintained.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.4:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:pe
        ref_id: PE.L1-3.10.5
        name: Manage Physical Access
        description: "Control and manage physical access devices.\n• FAR Clause 52.204-21
          Partial b.1.ix \n• NIST SP 800-171 Rev 2 3.10.5"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:1:
            type: unique_choice
            text: '[a] physical access devices are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:2:
            type: unique_choice
            text: '[b] physical access devices are controlled; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:3:
            type: unique_choice
            text: '[c] physical access devices are managed.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l1-3.10.5:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:pe
        ref_id: PE.L2-3.10.6
        name: Alternative Work Sites
        description: "Enforce safeguarding measures for CUI at alternate work sites.\n
          • NIST SP 800-171 Rev 2 3.10.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6:question:1:
            type: unique_choice
            text: '[a] safeguarding measures for CUI are defined for alternate work
              sites; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6:question:2:
            type: unique_choice
            text: '[b] safeguarding measures for CUI are enforced for alternate work
              sites.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:pe.l2-3.10.6:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra
        assessable: false
        depth: 1
        ref_id: RA
        name: RISK ASSESSMENT
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ra
        ref_id: RA.L2-3.11.1
        name: Risk Assessments
        description: "Periodically assess the risk to organizational operations (including
          mission, functions, image, or reputation), organizational assets, and individuals,
          resulting from the operation of organizational systems and the associated
          processing, storage, or transmission of CUI.\n• NIST SP 800-171 Rev 2 3.11.1"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1:question:1:
            type: unique_choice
            text: '[a] the frequency to assess risk to organizational operations,
              organizational assets, and individuals is defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1:question:2:
            type: unique_choice
            text: '[b] risk to organizational operations, organizational assets, and
              individuals resulting from the operation of an organizational system
              that processes, stores, or transmits CUI is assessed with the defined
              frequency.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.1:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ra
        ref_id: RA.L2-3.11.2
        name: Vulnerability Scan
        description: "Scan for vulnerabilities in organizational systems and applications
          periodically and when new vulnerabilities affecting those systems and applications
          are identified. \n• NIST SP 800-171 Rev 2 3.11.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:1:
            type: unique_choice
            text: '[a] the frequency to scan for vulnerabilities in organizational
              systems and applications is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:2:
            type: unique_choice
            text: '[b] vulnerability scans are performed on organizational systems
              with the defined frequency;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:3:
            type: unique_choice
            text: '[c] vulnerability scans are performed on applications with the
              defined frequency;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:4:
            type: unique_choice
            text: '[d] vulnerability scans are performed on organizational systems
              when new vulnerabilities are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:5:
            type: unique_choice
            text: '[e] vulnerability scans are performed on applications when new
              vulnerabilities are identified.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.2:question:5:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ra
        ref_id: RA.L2-3.11.3
        name: Vulnerability Remediation
        description: "Remediate vulnerabilities in accordance with risk assessments.\n
          • NIST SP 800-171 Rev 2 3.11.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3:question:1:
            type: unique_choice
            text: '[a] vulnerabilities are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3:question:2:
            type: unique_choice
            text: '[b] vulnerabilities are remediated in accordance with risk assessments.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ra.l2-3.11.3:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca
        assessable: false
        depth: 1
        ref_id: CA
        name: SECURITY ASSESSMENT
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ca
        ref_id: CA.L2-3.12.1
        name: Security Control Assessment
        description: "Periodically assess the security controls in organizational
          systems to determine if the controls are effective in their application. \n
          • NIST SP 800-171 Rev 2 3.12.1"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1:question:1:
            type: unique_choice
            text: '[a] the frequency of security control assessments is defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1:question:2:
            type: unique_choice
            text: '[b] security controls are assessed with the defined frequency to
              determine if the controls are effective in their application.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.1:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ca
        ref_id: CA.L2-3.12.2
        name: Plan of Action
        description: "Develop and implement plans of action designed to correct deficiencies
          and reduce or eliminate vulnerabilities in organizational systems.\n• NIST
          SP 800-171 Rev 2 3.12.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:1:
            type: unique_choice
            text: '[a] deficiencies and vulnerabilities to be addressed by the plan
              of action are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:2:
            type: unique_choice
            text: '[b] a plan of action is developed to correct identified deficiencies
              and reduce or eliminate identified vulnerabilities; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:3:
            type: unique_choice
            text: '[c] the plan of action is implemented to correct identified deficiencies
              and reduce or eliminate identified vulnerabilities.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.2:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ca
        ref_id: CA.L2-3.12.3
        name: Security Control Monitoring
        description: "Monitor security controls on an ongoing basis to ensure the
          continued effectiveness of the controls. \n• NIST SP 800-171 Rev 2 3.12.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.3:question:1:
            type: unique_choice
            text: '[a] security controls are monitored on an ongoing basis to ensure
              the continued effectiveness of those controls.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.3:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:ca
        ref_id: CA.L2-3.12.4
        name: System Security Plan
        description: "Develop, document, and periodically update system security plans
          that describe system boundaries, system environments of operation, how security
          requirements are implemented, and the relationships with or connections
          to other systems. \n• NIST SP 800-171 Rev 2 3.12.4"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:1:
            type: unique_choice
            text: '[a] a system security plan is developed;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:2:
            type: unique_choice
            text: '[b] the system boundary is described and documented in the system
              security plan;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:3:
            type: unique_choice
            text: '[c] the system environment of operation is described and documented
              in the system security plan;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:4:
            type: unique_choice
            text: '[d] the security requirements identified and approved by the designated
              authority as non-applicable are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:5:
            type: unique_choice
            text: '[e] the method of security requirement implementation is described
              and documented in the system security plan;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:6:
            type: unique_choice
            text: '[f] the relationship with or connection to other systems is described
              and documented in the system security plan;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:6:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:7:
            type: unique_choice
            text: '[g] the frequency to update the system security plan is defined;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:7:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:7:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:7:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:8:
            type: unique_choice
            text: '[h] system security plan is updated with the defined frequency.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:8:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:8:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:ca.l2-3.12.4:question:8:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        assessable: false
        depth: 1
        ref_id: SC
        name: SYSTEM AND COMMUNICATIONS PROTECTION
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L1-3.13.1
        name: Boundary Protection
        description: "Monitor, control, and protect organizational communications
          (i.e., information transmitted or received by organizational information
          systems) at the external boundaries and key internal boundaries of the information
          systems.\n• FAR Clause 52.204-21 b.1.x\n• NIST SP 800-171 Rev 2 3.13.1"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:1:
            type: unique_choice
            text: '[a] the external system boundary is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:2:
            type: unique_choice
            text: '[b] key internal system boundaries are defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:3:
            type: unique_choice
            text: '[c] communications are monitored at the external system boundary;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:4:
            type: unique_choice
            text: '[d] communications are monitored at key internal boundaries;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:5:
            type: unique_choice
            text: '[e] communications are controlled at the external system boundary;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:6:
            type: unique_choice
            text: '[f] communications are controlled at key internal boundaries;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:6:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:7:
            type: unique_choice
            text: '[g] communications are protected at the external system boundary;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:7:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:7:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:7:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:8:
            type: unique_choice
            text: '[h] communications are protected at key internal boundaries.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:8:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:8:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.1:question:8:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.2
        name: Security Engineering
        description: "Employ architectural designs, software development techniques,
          and systems engineering principles that promote effective information security
          within organizational systems.\n• NIST SP 800-171 Rev 2 3.13.2"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:1:
            type: unique_choice
            text: '[a] architectural designs that promote effective information security
              are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:2:
            type: unique_choice
            text: '[b] software development techniques that promote effective information
              security are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:3:
            type: unique_choice
            text: '[c] systems engineering principles that promote effective information
              security are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:4:
            type: unique_choice
            text: '[d] identified architectural designs that promote effective information
              security are employed;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:5:
            type: unique_choice
            text: '[e] identified software development techniques that promote effective
              information security are employed; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:6:
            type: unique_choice
            text: '[f] identified systems engineering principles that promote effective
              information security are employed.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.2:question:6:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.3
        name: Role Separation
        description: "Separate user functionality from system management functionality.
          \n• NIST SP 800-171 Rev 2 3.13.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:1:
            type: unique_choice
            text: '[a] user functionality is identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:2:
            type: unique_choice
            text: '[b] system management functionality is identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:3:
            type: unique_choice
            text: '[c] user functionality is separated from system management functionality.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.3:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.4
        name: Shared Resource Control
        description: "Prevent unauthorized and unintended information transfer via
          shared system resources. \n• NIST SP 800-171 Rev 2 3.13.4"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.4:question:1:
            type: unique_choice
            text: '[a] unauthorized and unintended information transfer via shared
              system resources is prevented.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.4:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L1-3.13.5
        name: Public-Access System Separation
        description: "Implement subnetworks for publicly accessible system components
          that are physically or logically separated from internal networks.\n• FAR
          Clause 52.204-21 b.1.xi\n• NIST SP 800-171 Rev 2 3.13.5"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5:question:1:
            type: unique_choice
            text: '[a] publicly accessible system components are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5:question:2:
            type: unique_choice
            text: '[b] subnetworks for publicly accessible system components are physically
              or logically separated from internal networks.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l1-3.13.5:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.6
        name: Network Communication by Exception
        description: "Deny network communications traffic by default and allow network
          communications traffic by exception (i.e., deny all, permit by exception).\n
          • NIST SP 800-171 Rev 2 3.13.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6:question:1:
            type: unique_choice
            text: '[a] network communications traffic is denied by default; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6:question:2:
            type: unique_choice
            text: '[b] network communications traffic is allowed by exception.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.6:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.7
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.7
        name: Split Tunneling
        description: "Prevent remote devices from simultaneously establishing non-remote
          connections with organizational systems and communicating via some other
          connection to resources in external networks (i.e., split tunneling). \n
          • NIST SP 800-171 Rev 2 3.13.7"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.7:question:1:
            type: unique_choice
            text: '[a] remote devices are prevented from simultaneously establishing
              non-remote connections with the system and communicating via some other
              connection to resources in external networks (i.e., split tunneling).'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.7:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.7:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.7:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.8
        name: Data in Transit
        description: "Implement cryptographic mechanisms to prevent unauthorized disclosure
          of CUI during transmission unless otherwise protected by alternative physical
          safeguards.\n• NIST SP 800-171 Rev 2 3.13.8"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:1:
            type: unique_choice
            text: '[a] cryptographic mechanisms intended to prevent unauthorized disclosure
              of CUI are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:2:
            type: unique_choice
            text: '[b] alternative physical safeguards intended to prevent unauthorized
              disclosure of CUI are identified; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:3:
            type: unique_choice
            text: '[c] either cryptographic mechanisms or alternative physical safeguards
              are implemented to prevent unauthorized disclosure of CUI during transmission.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.8:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.9
        name: Connections Termination
        description: "Terminate network connections associated with communications
          sessions at the end of the sessions or after a defined period of inactivity.
          \n• NIST SP 800-171 Rev 2 3.13.9"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:1:
            type: unique_choice
            text: '[a] a period of inactivity to terminate network connections associated
              with communications sessions is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:2:
            type: unique_choice
            text: '[b] network connections associated with communications sessions
              are terminated at the end of the sessions; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:3:
            type: unique_choice
            text: '[c] network connections associated with communications sessions
              are terminated after the defined period of inactivity.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.9:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.10
        name: Key Management
        description: "Establish and manage cryptographic keys for cryptography employed
          in organizational systems. \n• NIST SP 800-171 Rev 2 3.13.10"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10:question:1:
            type: unique_choice
            text: '[a] cryptographic keys are established whenever cryptography is
              employed; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10:question:2:
            type: unique_choice
            text: '[b] cryptographic keys are managed whenever cryptography is employed.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.10:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.11
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.11
        name: CUI Encryption
        description: "Employ FIPS-validated cryptography when used to protect the
          confidentiality of CUI. \n• NIST SP 800-171 Rev 2 3.13.11"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.11:question:1:
            type: unique_choice
            text: '[a] FIPS-validated cryptography is employed to protect the confidentiality
              of CUI.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.11:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.11:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.11:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.12
        name: Collaborative Device Control
        description: "Prohibit remote activation of collaborative computing devices
          and provide indication of devices in use to users present at the device.
          \n• NIST SP 800-171 Rev 2 3.13.12"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:1:
            type: unique_choice
            text: '[a] collaborative computing devices are identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:2:
            type: unique_choice
            text: '[b] collaborative computing devices provide indication to users
              of devices in use; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:3:
            type: unique_choice
            text: '[c] remote activation of collaborative computing devices is prohibited.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.12:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.13
        name: Mobile Code
        description: "Control and monitor the use of mobile code. \n• NIST SP 800-171
          Rev 2 3.13.13"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13:question:1:
            type: unique_choice
            text: '[a] use of mobile code is controlled; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13:question:2:
            type: unique_choice
            text: '[b] use of mobile code is monitored.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.13:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.14
        name: Voice over Internet Protocol
        description: "Control and monitor the use of Voice over Internet Protocol
          (VoIP) technologies.\n• NIST SP 800-171 Rev 2 3.13.14"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14:question:1:
            type: unique_choice
            text: '[a] use of Voice over Internet Protocol (VoIP) technologies is
              controlled; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14:question:2:
            type: unique_choice
            text: '[b] use of Voice over Internet Protocol (VoIP) technologies is
              monitored.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.14:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.15
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.15
        name: Communications Authenticity
        description: "Protect the authenticity of communications sessions.\n• NIST
          SP 800-171 Rev 2 3.13.15"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.15:question:1:
            type: unique_choice
            text: '[a] the authenticity of communications sessions is protected.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.15:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.15:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.15:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.16
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:sc
        ref_id: SC.L2-3.13.16
        name: Data at Rest
        description: "Protect the confidentiality of CUI at rest.\n• NIST SP 800-171
          Rev 2 3.13.16"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.16:question:1:
            type: unique_choice
            text: '[a] the confidentiality of CUI at rest is protected.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.16:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.16:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:sc.l2-3.13.16:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:si
        assessable: false
        depth: 1
        ref_id: SI
        name: SYSTEM AND INFORMATION INTEGRITY
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:si
        ref_id: SI.L1-3.14.1
        name: Flaw Remediation
        description: "Identify, report, and correct information and information system
          flaws in a timely manner.\n• FAR Clause 52.204-21 b.1.xii\n• NIST SP 800-171
          Rev 2 3.14.1"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:1:
            type: unique_choice
            text: '[a] the time within which to identify system flaws is specified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:2:
            type: unique_choice
            text: '[b] system flaws are identified within the specified time frame;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:3:
            type: unique_choice
            text: '[c] the time within which to report system flaws is specified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:4:
            type: unique_choice
            text: '[d] system flaws are reported within the specified time frame;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:4:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:5:
            type: unique_choice
            text: '[e] the time within which to correct system flaws is specified;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:5:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:5:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:5:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:6:
            type: unique_choice
            text: '[f] system flaws are corrected within the specified time frame.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:6:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:6:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.1:question:6:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:si
        ref_id: SI.L1-3.14.2
        name: Malicious Code Protection
        description: "Provide protection from malicious code at appropriate locations
          within organizational information systems.\n• FAR Clause 52.204-21 b.1.xiii\n
          • NIST SP 800-171 Rev 2 3.14.2"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2:question:1:
            type: unique_choice
            text: '[a] designated locations for malicious code protection are identified;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2:question:2:
            type: unique_choice
            text: '[b] protection from malicious code at designated locations is provided.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.2:question:2:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:si
        ref_id: SI.L2-3.14.3
        name: Security Alerts & Advisories
        description: "Monitor system security alerts and advisories and take action
          in response.\n• NIST SP 800-171 Rev 2 3.14.3"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:1:
            type: unique_choice
            text: '[a] response actions to system security alerts and advisories are
              identified;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:2:
            type: unique_choice
            text: '[b] system security alerts and advisories are monitored; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:3:
            type: unique_choice
            text: '[c] actions in response to system security alerts and advisories
              are taken.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.3:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.4
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:si
        ref_id: SI.L1-3.14.4
        name: Update Malicious Code Protection
        description: "Update malicious code protection mechanisms when new releases
          are available.\n• FAR Clause 52.204-21 b.1.xiv\n• NIST SP 800-171 Rev 2
          3.14.4"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.4:question:1:
            type: unique_choice
            text: '[a] malicious code protection mechanisms are updated when new releases
              are available.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.4:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.4:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.4:question:1:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:si
        ref_id: SI.L1-3.14.5
        name: System & File Scanning
        description: "Perform periodic scans of the information system and real-time
          scans of files from external sources as files are downloaded, opened, or
          executed.\n• FAR Clause 52.204-21 b.1.xv\n• NIST SP 800-171 Rev 2 3.14.5"
        implementation_groups:
          - L1
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:1:
            type: unique_choice
            text: '[a] the frequency for malicious code scans is defined;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:2:
            type: unique_choice
            text: '[b] malicious code scans are performed with the defined frequency;
              and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:3:
            type: unique_choice
            text: '[c] real-time malicious code scans of files from external sources
              as files are downloaded, opened, or executed are performed.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l1-3.14.5:question:3:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:si
        ref_id: SI.L2-3.14.6
        name: Monitor Communications for Attacks
        description: "Monitor organizational systems, including inbound and outbound
          communications traffic, to detect attacks and indicators of potential attacks.\n
          • NIST SP 800-171 Rev 2 3.14.6"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:1:
            type: unique_choice
            text: ''
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:2:
            type: unique_choice
            text: '[a] the system is monitored to detect attacks and indicators of
              potential attacks;'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:2:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:3:
            type: unique_choice
            text: '[b] inbound communications traffic is monitored to detect attacks
              and indicators of potential attacks; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:3:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:3:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:3:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:4:
            type: unique_choice
            text: '[c] outbound communications traffic is monitored to detect attacks
              and indicators of potential attacks.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:4:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:4:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.6:question:4:choice:3
                value: N/A
      - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7
        assessable: true
        depth: 2
        parent_urn: urn:intuitem:risk:req_node:cmmc-2.0:si
        ref_id: SI.L2-3.14.7
        name: Identify Unauthorized Use
        description: "Identify unauthorized use of organizational systems. \n• NIST
          SP 800-171 Rev 2 3.14.7"
        implementation_groups:
          - L2
        questions:
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7:question:1:
            type: unique_choice
            text: '[a] authorized use of the system is defined; and'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7:question:1:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7:question:1:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7:question:1:choice:3
                value: N/A
          urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7:question:2:
            type: unique_choice
            text: '[b] unauthorized use of the system is identified.'
            choices:
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7:question:2:choice:1
                value: 'Yes'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7:question:2:choice:2
                value: 'No'
              - urn: urn:intuitem:risk:req_node:cmmc-2.0:si.l2-3.14.7:question:2:choice:3
                value: N/A
