NIST 800-171 to Cloud Control Mapping: AWS, Azure, and GCP

How to Use This Reference

This document maps each NIST 800-171 Rev 2 control to the specific cloud configuration requirements that satisfy it across AWS, Azure, and GCP. Use it to:

• Understand exactly what each control requires in your cloud environment
• Identify which cloud services and configurations are in scope for each control family
• Prepare for your CMMC Level 2 C3PAO assessment
• Configure automated monitoring rules for continuous compliance

Control families covered: AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC, SI

Access Control (AC) — 22 Controls

AC.1.001 — Limit system access to authorized users

Requirement: Only authorized users, processes, and devices may access organizational systems.

Common findings: IAM users without role assignments, over-broad IAM policies, missing SCPs at account level

AC.1.002 — Limit system access to transactions and functions authorized users are permitted to execute

Requirement: Authorization for access is based on principle of least privilege.

Common findings: AdministratorAccess attached to non-admin users, wildcard actions in IAM policies, unused privileged roles not revoked

AC.2.005 — Provide privacy and security notices consistent with CUI rules

Requirement: Privacy and security notices displayed on system banners at login.

AC.2.006 — Limit use of portable storage devices on external systems

Requirement: Controls on use of portable storage with organizational systems.

Primarily an endpoint control; cloud implementation focuses on S3/Blob/GCS transfer policies and data loss prevention rules.

AC.2.007 — Employ the principle of least privilege, including for specific security functions and privileged accounts

Requirement: Privileged access is limited to only required permissions.

Common findings: Overly permissive IAM roles, persistent privileged access (should be just-in-time), service accounts with owner-level access

AC.2.008 — Use non-privileged accounts or roles when accessing non-security functions

Requirement: Privileged users use non-privileged accounts for non-administrative functions.

AC.2.009 — Limit unsuccessful logon attempts

Requirement: Limit consecutive failed authentication attempts.

AC.2.010 — Use session lock with pattern-hiding displays after period of inactivity

Requirement: Session lock after defined inactivity period.

Primarily enforced at the application and endpoint level. Cloud console sessions implement automatic timeout — AWS console: 1-hour inactivity timeout; Azure portal: configurable inactivity timeout.

AC.2.011 — Authorize wireless access prior to allowing such connections

Requirement: Wireless connections authorized before allowing network access.

Cloud implementation: wireless network security is not directly applicable to cloud environments. The corresponding cloud control is VPC/VNet access authorization and guest network isolation.

AC.2.012 — Control the flow of CUI in accordance with approved authorizations

Requirement: Information flow enforcement based on approved authorizations.

Common findings: Security groups with overly permissive inbound rules (0.0.0.0/0), S3 buckets without access restrictions, missing VPC endpoint policies

AC.2.013 — Monitor and control remote access sessions

Requirement: Remote access sessions are monitored and controlled.

AC.2.014 — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions

Requirement: TLS/cryptographic protection for all remote access.

AC.2.015 — Route remote access via managed access control points

Requirement: Remote access flows through managed, controlled access points.

AC.2.016 — Control the flow of CUI in accordance with approved authorizations

See AC.2.012 — data flow control. AC.2.016 specifically addresses CUI-tagged data flows.

AC.3.017 — Separate the duties of individuals to reduce the risk of malevolent activity

Requirement: Separation of duties controls prevent single individuals from having all permissions needed to execute unauthorized actions.

AC.3.018 — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs

Requirement: Privilege escalation controlled and logged.

AC.3.019 — Terminate sessions after defined conditions

Requirement: Automatic session termination after conditions are met.

AC.3.020 — Control connection of mobile devices

Requirement: Mobile device connections to organizational systems are controlled.

Cloud implementation: MDM integration for cloud console access, Conditional Access requiring compliant device status for cloud management plane access.

AC.3.021 — Authorize remote execution of privileged commands via remote access only for documented operational needs

Requirement: Remote execution of privileged commands limited to operational needs.

AC.3.022 — Use encryption to protect CUI during transmission unless protected by alternative physical safeguards

Requirement: All CUI transmitted over open networks is encrypted.

Common findings: S3 bucket policies missing aws:SecureTransport condition, load balancers allowing HTTP, APIs without TLS enforcement

Audit and Accountability (AU) — 9 Controls

AU.2.041 — Ensure system activities can be associated with individual users

Requirement: Audit events are attributable to individual users.

Common findings: Shared IAM users (no individual attribution), missing CloudTrail in some regions, data plane events not logged

AU.2.042 — Create and retain system audit logs and records to the extent needed to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorized activity

Requirement: Audit logs retained for sufficient period (DoD requires 3 years).

Common findings (73% of environments): Log retention set to default (90 days or less), CloudTrail not enabled in all regions, log integrity validation disabled

AU.2.043 — Review and update logged events

Requirement: Regularly review logged events to ensure appropriate coverage.

Operational control — PolicyCortex automates continuous review of log coverage and alerts on logging gaps.

AU.3.045 — Review audit logs to identify and investigate anomalous activity

Requirement: Audit log analysis to detect anomalous activity.

AU.3.046 — Alert in the event of an audit logging process failure

Requirement: Alert when audit logging process fails or stops.

AU.3.048 — Collect audit information (e.g., logs) into one or more central repositories

Requirement: Centralized log management.

Common findings: Per-account logging without aggregation, no central SIEM, logs in multiple locations without correlation

AU.3.049 — Protect audit information and audit tools from unauthorized access, modification, and deletion

Requirement: Audit logs are protected from tampering.

AU.3.050 — Limit management of audit logging to a subset of privileged users

Requirement: Only authorized privileged users can modify audit log configurations.

AU.3.051 — Correlate audit record review, analysis, and reporting processes for investigation

Requirement: Audit records from multiple sources can be correlated.

Addressed by centralized logging and SIEM integration (AU.3.048). For CMMC assessment evidence, PolicyCortex provides correlated audit records across all control families.

Configuration Management (CM) — 9 Controls

CM.2.061 — Establish and maintain baseline configurations and inventories of organizational systems

Requirement: Documented baseline configurations for all in-scope systems.

Common findings: Resources created outside IaC pipelines (63% of environments), no automated baseline enforcement (71%), configuration drift from documented baseline

CM.2.062 — Establish and maintain security configuration settings

Requirement: Security configuration settings documented and enforced.

CM.2.063 — Address and document information security-relevant software and firmware updates

Requirement: Patching and updates managed systematically.

CM.2.064 — Establish and enforce security configuration settings for information technology products employed in organizational systems

Requirement: Vendor-recommended security configurations applied.

Assessed against CIS Benchmarks for AWS/Azure/GCP and platform-specific security baselines.

CM.2.065 — Track, review, approve, and log changes to systems

Requirement: Change management process for system modifications.

Common findings: Change management policy not applied to cloud configuration changes (58% of environments)

Identification and Authentication (IA) — 11 Controls

IA.1.076 — Identify organizational users, processes acting on behalf of users, and devices

Requirement: All system entities have unique identifiers.

IA.1.077 — Authenticate organizational users, processes acting on behalf of users, and devices before allowing access

Requirement: Authentication required for all access.

IA.2.078 — Enforce a minimum password complexity and change requirements

Requirement: Password policy enforces complexity requirements.

IA.2.079 — Prohibit password reuse for a specified number of generations

Requirement: Password history enforced to prevent reuse.

IA.2.080 — Allow temporary password use for system logons with immediate change requirement

Requirement: Temporary passwords expire and require change on first use.

Addressed by IdP configuration — IAM, Azure AD, and Google Identity all support forced password reset on first login.

IA.2.081 — Employ cryptographically-secured passwords

Requirement: Passwords stored using cryptographically secure hashing.

Addressed by platform identity providers — AWS IAM, Azure AD, and Google Identity all use secure password hashing. Assessed for any custom authentication implementations.

IA.3.082 — Employ multifactor authentication for local and network access to privileged accounts

Requirement: MFA required for all privileged account access.

Common findings (61% of environments): IAM users with console access and no MFA enforcement, root account without MFA, MFA policy exists but not enforced via IAM condition

IA.3.083 — Employ multifactor authentication for local and network access to non-privileged accounts

Requirement: MFA required for all user accounts (not just privileged).

IA.3.085 — Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts

Requirement: Authentication mechanisms resist replay attacks.

Addressed by platform-level authentication — all major cloud providers use modern authentication protocols (OAuth 2.0, SAML 2.0) that include replay protection mechanisms.

IA.3.086 — Disable identifiers after a defined period of inactivity

Requirement: Unused accounts are disabled.

Common findings (52% of environments): Active IAM users with last activity > 90 days, unused service account keys not rotated or disabled

System and Communications Protection (SC) — 16 Controls

SC.1.175 — Monitor, control, and protect communications at external boundaries and key internal boundaries

Requirement: Network communications monitored and controlled at boundaries.

Common findings (52% of environments): VPC Flow Logs not enabled, no WAF on externally accessible applications (67%), overly permissive security groups (58%)

SC.1.176 — Implement subnetworks for publicly accessible system components

Requirement: Publicly accessible systems separated in dedicated subnets.

SC.3.177 — Employ FIPS-validated cryptography for CUI protection

Requirement: FIPS 140-2 validated cryptographic modules for CUI.

SC.3.178 — Prohibit remote activation of collaborative computing devices and provide indication of use

Requirement: Remote activation of cameras, mics prevented; presence indicators shown.

Primarily an endpoint control. Cloud assessment context: ensure no cloud-connected collaboration tools (video APIs, etc.) are configured to enable recording without participant indication.

SC.3.183 — Deny network communications traffic by default and allow by exception

Requirement: Default deny network policy.

Common findings: Security groups with 0.0.0.0/0 allow rules for broad port ranges, missing explicit deny rules

System and Information Integrity (SI) — 7 Controls

SI.1.210 — Identify, report, and correct information and information system flaws in a timely manner

Requirement: Vulnerability management and patching.

SI.1.211 — Provide protection from malicious code at appropriate locations

Requirement: Anti-malware controls deployed.

SI.2.214 — Monitor system security alerts and advisories and take action in response

Requirement: Security advisories monitored and acted upon.

SI.2.216 — Monitor organizational systems to detect attacks and indicators of compromise

Requirement: Continuous monitoring for attacks and IOCs.

Incident Response (IR) — 3 Controls

IR.2.092 — Establish an operational incident-handling capability

Requirement: Incident response capability exists and is operational.

Addressed through DFARS 72-hour reporting compliance and documented IR procedures. PolicyCortex supports incident detection, documentation, and timeline tracking.

IR.2.093 — Track, document, and report incidents to designated officials

Requirement: Incidents tracked and reported per requirements.

For DFARS-covered incidents: report to DoD via DIBNet Portal within 72 hours. PolicyCortex generates structured incident documentation for DIBNet submission.

IR.3.098 — Test the organizational incident response capability

Requirement: IR capability tested periodically.

Tabletop exercise and simulation requirement — PolicyCortex provides incident scenario simulation data and response timeline analytics.

Download the Complete Mapping

The downloadable version of this mapping includes:

• All 110 controls with detailed implementation guidance
• Specific configuration examples for each cloud provider
• PolicyCortex automation coverage indicators
• Assessment evidence requirements per control

Download Full NIST 800-171 Control Mapping (PDF)

Related Resources

• CMMC Level 2 Checklist: All 110 NIST 800-171 Controls
• NIST 800-171 Automation Solution
• State of Defense Contractor Cloud Compliance 2026
• The Complete Guide to CMMC 2.0 Compliance