CMMC vs ISO 27001: what your certificate carries over
Published 2026-10-23
An ISO/IEC 27001 certificate says an auditor found your information security management system conforms to the standard: a system run on your own risk assessment, with controls tailored to your organization. CMMC Level 2 asks a narrower question with no tailoring in it: are the 110 requirements of NIST SP 800-171 Rev 2 met on every system that holds CUI? 170.14(c)(3)
So a certificate is a head start, not a pass. 32 CFR Part 170 accepts one other assessment in place of its own, a DCMA DIBCAC High Assessment 170.20, and never names ISO/IEC 27001 or SOC 2. What carries over is the evidence, and NIST has already drawn the map of where it fits. If you are not yet sure the data you hold is CUI, settle that first on FCI vs CUI.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
NIST SP 800-171 Rev 2 maps every requirement to ISO/IEC 27001 controls in its Appendix D. Joined requirement by requirement, the map splits like this:
- ISO control listed
- 61NIST lists at least one ISO/IEC 27001 control with no asterisk.192 points at stake, 29 worth 5
- Partial match
- 9Every ISO/IEC 27001 control NIST lists carries its asterisk: it does not fully satisfy the intent.25 points at stake, 3 worth 5
- No direct mapping
- 40NIST lists no ISO/IEC 27001 control at all.96 points at stake, 12 worth 5
The map is NIST's, and NIST calls it informal: it uses the 2013 edition's Annex A numbers and does not add requirements. Points are the 32 CFR 170.24 values each requirement costs when NOT MET.
What carries over, area by area
Twelve areas an ISO-certified shop asks about first. The group is our read of what to do with your existing evidence; the status word is NIST's own mapping, so you can check it in the reader below.
| Area | NIST's ISO map | What CMMC Level 2 adds | Points |
|---|---|---|---|
| Reuse: point the evidence at the CUI boundary | |||
| Accounts and access rights3.1.1, 3.1.2 | ISO control listed | Assessed on every asset that holds CUI; evidence in final form, never drafts or unapproved policies.170.19(c)(1); 170.24(b)(1) | 10 |
| Screening and leavers3.9.1, 3.9.2 | ISO control listed | The same duty, tied to systems containing CUI: screen before access, protect those systems through terminations and transfers.NIST SP 800-171 3.9 | 8 |
| Physical access3.10.1 to 3.10.6 | ISO control listed | Escorting visitors, physical access logs and managing physical access devices can never go on a POA&M.170.21(a)(2)(iii)(D)–(F) | 14 |
| Rework: the topic is there, the bar is different | |||
| System security plan3.12.4 | ISO control listed | An SSP for each system in the CMMC scope; without an up-to-date one the assessment cannot be completed.170.24(c)(2)(i)(B)(5) | 0 |
| Encryption3.13.11 | ISO control listed | FIPS-validated cryptography for CUI: encryption that is not validated still costs 3 points.170.24(c)(2)(i)(B)(4)(ii) | 5 |
| Marking media3.8.4 | ISO control listed | CUI markings set by rule: a banner reading CUI or CONTROLLED, not your own classification labels.32 CFR 2002.20(b) | 1 |
| Risk assessment and scanning3.11.1 to 3.11.3 | Partial match | Periodic risk assessment, vulnerability scans and remediation, scored like every other requirement.NIST SP 800-171 3.11 | 9 |
| Build: NIST lists no ISO control | |||
| Multifactor authentication3.5.3 | No direct mapping | MFA for privileged accounts and for network access to all accounts: 3 points off if only remote and privileged users have it, 5 if none do.170.24(c)(2)(i)(B)(4)(i) | 5 |
| Password rules3.5.7 to 3.5.10 | No direct mapping | Complexity, no reuse for a set number of generations, temporary passwords changed at once, only protected passwords stored.NIST SP 800-171 3.5.7–3.5.10 | 8 |
| Remote access sessions3.1.12 to 3.1.15 | No direct mapping | Monitored, encrypted sessions through managed access points, with remote privileged commands authorized.NIST SP 800-171 3.1.12–3.1.15 | 12 |
| Network defaults3.13.6, 3.13.7 | No direct mapping | Deny all traffic by default, permit by exception, and no split tunneling on remote devices.NIST SP 800-171 3.13.6–3.13.7 | 6 |
| Watching for attacks3.14.6, 3.14.7 | No direct mapping | Monitor inbound and outbound traffic for attacks and identify unauthorized use of your systems.NIST SP 800-171 3.14.6–3.14.7 | 8 |
The group is our read. The status word is NIST's own Appendix D mapping for the requirements in the row, and the points are what they cost under 32 CFR 170.24 when NOT MET (the SSP carries none: without it there is no score at all).
The pattern is plain once it is laid out. The governance side of CMMC, who gets access, who is screened, who walks into the shop, maps cleanly. The technical settings do not: MFA, remote sessions, deny-by-default networks and attack monitoring are written as specific configurations, and NIST found no ISO control to point them at.
NIST's own map, requirement by requirement
Appendix D of NIST SP 800-171 Rev 2 maps each requirement to its SP 800-53 controls, and each of those to the ISO/IEC 27001 controls NIST considers relevant. NIST marks with an asterisk any ISO control that does not fully satisfy the intent of its own, and says the tables add no requirements. Here is that map, joined row by row, with the points each requirement costs when NOT MET.
CMMC vs ISO 27001 requirement reader, cuideck.com
Pick a family and a match type. It opens on identification and authentication, where MFA sits.
Identification and authentication
5 with an ISO control listed, 0 partial, 6 with no direct mapping. The 6 without a full match carry 14 points.
IA.L2-3.5.1Identify system users, processes acting on behalf of users, and devices.
NIST lists A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.3; no ISO match for IA-3
ISO control listed5 pt
IA.L2-3.5.2Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
NIST lists A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.3; no ISO match for IA-3
ISO control listed5 pt
IA.L2-3.5.3Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
No ISO control. SP 800-53: IA-2(1), IA-2(2), IA-2(3)
No direct mapping5 pt
IA.L2-3.5.4Employ replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts.
No ISO control. SP 800-53: IA-2(8), IA-2(9)
No direct mapping1 pt
IA.L2-3.5.5Prevent reuse of identifiers for a defined period.
NIST lists A.9.2.1
ISO control listed1 pt
IA.L2-3.5.6Disable identifiers after a defined period of inactivity.
NIST lists A.9.2.1
ISO control listed1 pt
IA.L2-3.5.7Enforce a minimum password complexity and change of characters when new passwords are created.
No ISO control. SP 800-53: IA-5(1)
No direct mapping1 pt
IA.L2-3.5.8Prohibit password reuse for a specified number of generations.
No ISO control. SP 800-53: IA-5(1)
No direct mapping1 pt
IA.L2-3.5.9Allow temporary password use for system logons with an immediate change to a permanent password.
No ISO control. SP 800-53: IA-5(1)
No direct mapping1 pt
IA.L2-3.5.10Store and transmit only cryptographically-protected passwords.
No ISO control. SP 800-53: IA-5(1)
No direct mapping5 pt
IA.L2-3.5.11Obscure feedback of authentication information.
NIST lists A.9.4.2
ISO control listed1 pt
Read the 40 unmapped rows as your build list, and every listed row as a place where an assessor will still ask to see the evidence on the systems in your CUI scope. The requirements themselves, family by family, are in NIST 800-171 controls.
Six duties that come from your contract, not the standard
ISO/IEC 27001 is written for any organization, whatever its type, size or nature. The duties below are written for a defense contractor holding CUI, so no general standard can carry them. Each one sits in a clause or a rule you can quote back to an auditor.
A boundary drawn around CUI
Your ISMS scope is the one your organization set. The CMMC scope is set by asset category: every asset that processes, stores or transmits CUI is assessed against all Level 2 requirements, and the tools that protect them are in scope too.
A 72-hour report to DoD
“Rapidly report” means within 72 hours of discovery of any cyber incident. Reports go to dibnet.dod.mil with a DoD-approved medium assurance certificate, and images of affected systems are kept for at least 90 days.
A cloud at FedRAMP Moderate
A cloud provider that stores, processes or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline. A vendor's ISO certificate is not that.
FIPS-validated cryptography
3.13.11 asks for FIPS-validated cryptography, not just strong encryption. The evidence is the NIST validation certificate of each module that protects CUI, which an ISO audit file does not hold unless you put it there.
CUI markings set by rule
Every CUI document carries a banner reading CUI or CONTROLLED, plus category markings where they are mandatory. Your own classification labels can sit beside it; they cannot replace it.
A score and a signature
The result is a score out of 110 posted in SPRS, and an Affirming Official, a senior representative of the company, affirms in SPRS after every assessment and every year. An ISO certificate is not entered in SPRS.
Encryption is the one ISO shops trip on most, because the ISO control and the CMMC requirement sound alike. The rule prices the difference:
Who checks, and where the result lands
What decides a contract is less the controls than the paper trail: who checked, against what, and where the result is filed. Contracting officers check SPRS, so only one of these trails ends where they look.
ISO/IEC 27001 certificate
- Who checks
- A certification body you hire
- Against
- Clauses 4 to 10 of the standard, none of which may be excluded, and the controls your risk treatment chose
- Where it lands
- A certificate in your name
- CMMC credit
- None: Part 170 never names it
SOC 2 report
- Who checks
- A CPA firm
- Against
- The AICPA Trust Services Criteria for security, availability, processing integrity, confidentiality or privacy
- Where it lands
- An assurance report you share with customers
- CMMC credit
- None: Part 170 never names it
CMMC Level 2 (Self)
- Who checks
- You, with a senior Affirming Official signing
- Against
- All 110 requirements, against the NIST SP 800-171A assessment objectives
- Where it lands
- A score and an affirmation in SPRS
- CMMC credit
- The status a contract asks for
CMMC Level 2 (C3PAO)
- Who checks
- A C3PAO, accredited under ISO/IEC 17020:2012
- Against
- The same 110 requirements and objectives
- Where it lands
- CMMC eMASS, then SPRS, plus a Certificate of CMMC Status
- CMMC credit
- Also satisfies Level 2 (Self); see the status box for today
Part 170 does have one section for accepting someone else's assessment. It is short, and this is all of it that is in force:
The conditions that follow are a perfect score with no open POA&M from a DCMA DIBCAC High Assessment held before the rule took effect. There is no line for ISO/IEC 27001 or SOC 2. The ISO standards Part 170 does cite govern the assessors, not you: C3PAOs are accredited under ISO/IEC 17020 and the Accreditation Body works to ISO/IEC 17011. Who a C3PAO is, and where they stand today, is in what is a C3PAO.
If your badge is SOC 2
A SOC 2 report is not a certification. The AICPA describes SOC as a suite of service offerings CPAs may provide, and its output as assurance reports: a SOC 2 examination reports on controls relevant to security, availability, processing integrity, confidentiality or privacy, judged against the AICPA's Trust Services Criteria. The AICPA's own description of those criteria shows where the two part ways:
The objectives management has established: that is the gap in a phrase. SOC 2 tests the objectives you set; CMMC sets them for you, all 110. NIST's Appendix D maps to SP 800-53 and ISO/IEC 27001 only, and the AICPA's own criteria mappings are for its members, so there is no public map to lean on. Run the full list in the NIST 800-171 checklist and reuse each SOC 2 control description where it already says the same thing.
If the SOC 2 report belongs to your cloud vendor rather than to you, it does not settle the cloud question either. Equivalency under the DoD memo means 100 percent of the latest FedRAMP Moderate baseline, assessed by a FedRAMP-recognized 3PAO, as CMMC vs FedRAMP sets out. If you keep SOC 2 or ISO evidence in a compliance platform, Vanta vs Drata for CMMC shows how two of them count a CMMC score.
The order to work in
An ISO shop has a real advantage: the habits of a management system, documented evidence and continual improvement are already in place. The work is aiming them at a fixed list instead of your own risk register.
- 01
Draw the CUI boundary first
Do not assume your ISMS scope is the CMMC scope. Sort every asset into its CMMC category in the scoping worksheet; evidence only counts for the assets inside the line.
- 02
Re-point the evidence you already hold
Set the reader above to "ISO control listed": those 61 requirements are where your policies, records and audit trail can be reused, once they name the in-scope systems.
- 03
Build the unmapped rows, five-pointers first
40 requirements have no ISO counterpart in NIST's table, and 12 of them cost 5 points each when NOT MET. Copy the gap list from the reader and work it from the top.
- 04
Write the SSP and score yourself
Your ISO documents feed the system security plan, but the SSP is its own document and the score is its own sum. Run it in the SPRS score calculator before anyone signs.
- 05
Post the score and affirm it
A senior official affirms the result in SPRS, then again every year. How to submit an SPRS score walks through the entry.
How we read the rules
Questions ISO shops ask
Does ISO 27001 certification count toward CMMC?
Not as a status. The one standards-acceptance section of 32 CFR Part 170, 170.20, converts a DCMA DIBCAC High Assessment and nothing else, and the rule never mentions ISO/IEC 27001. What counts is the evidence behind your certificate, requirement by requirement, in your own assessment.
How much of NIST SP 800-171 does ISO 27001 cover?
By NIST's own table, 61 of the 110 requirements have at least one ISO/IEC 27001 control listed without an asterisk, 9 have only partial matches and 40 have none. NIST calls the mapping informal, and a listed control is a pointer to where your evidence may sit, not proof the requirement is met.
We are certified to the 2022 edition. Does NIST's mapping still apply?
As a guide, with care. Appendix D cites ISO/IEC 27001:2013 and its Annex A numbers; the current edition was published in October 2022 and amended in 2024. Check each A-number against your own Statement of Applicability rather than assuming the numbers line up. NIST SP 800-171 Rev 3 carries no ISO table at all, and DoD still binds Rev 2.
Can our ISO certification body do our CMMC assessment?
Only if it is also a C3PAO: Part 170 has C3PAOs authorized and accredited by the Cyber AB under ISO/IEC 17020, a scheme of its own. For Level 2 (Self) no outside assessor is involved at all. The third-party route's status today is in the box at the top of this page.
Is CMMC stricter than ISO 27001?
It is narrower and less flexible. ISO/IEC 27001's risk requirements are tailored to the needs of your organization, in the standard's own abstract; CMMC Level 2 applies all 110 requirements to every asset that holds CUI and scores each one. A shop can hold a clean ISO certificate and still post a low SPRS score; the CMMC vs NIST SP 800-171 page explains how that score is counted.
Do we need ISO 27001 to win defense work?
Not for CMMC: Part 170 does not ask for it. A customer or a contract can ask for ISO/IEC 27001 on its own terms, so read your contract. For CUI, what DoD reads is your SPRS entry.