NIST CSF 2.0 outcomes and CMMC Level 2 requirements
NIST's Cybersecurity Framework describes the outcomes a security program should reach; NIST SP 800-171 sets the requirements a defense contractor must meet to protect controlled unclassified information. Ciyora runs many of the identity, monitoring and response controls behind both and keeps the evidence.
About the frameworks
The NIST Cybersecurity Framework (CSF) 2.0, published in February 2024, organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is voluntary for most organizations and widely used to structure a program and report on it.
The Cybersecurity Maturity Model Certification (CMMC) program verifies that defense contractors protect federal contract information and controlled unclassified information (CUI). CMMC Level 2 corresponds to the 110 security requirements of NIST SP 800-171 Revision 2, assessed by a certified third-party assessment organization (C3PAO) or by self-assessment, depending on the contract.
Hosting location
Customer data is hosted in India. Self-hosted deployment is also available. Under DFARS 252.204-7012, cloud services that store, process or transmit covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline, and Ciyora's hosted service is not FedRAMP authorized. For systems that handle CUI, run Ciyora Fabric self-hosted inside your own assessment boundary.
How Ciyora maps to the requirement areas
Each row names a control area, what Ciyora does for it, and the evidence it can produce. Your own policies, people and processes still matter: the platform helps you operate and evidence the controls.
| Requirement area | How Ciyora helps | Evidence you can produce | Modules |
|---|---|---|---|
| Govern (GV.RM, GV.OV, GV.SC) | Risk register linked to controls; compliance posture per framework with history; third-party identities with sponsors and expiry, and a catalogue of SaaS suppliers with who has access. | Risk register, posture snapshots and third-party access reports. | Comply, Fortress, Discover |
| Identify (ID.AM, ID.RA) | Inventory of endpoints, servers, certificates, cloud resources and SaaS applications with owners; vulnerabilities ranked by CVSS, EPSS and CISA KEV; attack-surface discovery. | Asset and SaaS inventories and vulnerability status over time. | Discover, Armor |
| Protect: identity, authentication and access (PR.AA) | Lifecycle from HR, access requests and reviews, separation of duties, just-in-time privilege, credential vault and recorded privileged sessions; zero-trust network access by identity and device posture. | Access review evidence packs, privileged access reports and versioned access policy. | Fortress, VPN |
| Protect: data and platform security (PR.DS, PR.PS) | Cloud checks for encryption and public exposure; secure configuration against CIS benchmarks; endpoint data-protection policies for file transfers, USB devices and AI tools. | Posture findings and data-protection events. | Armor, Monitor |
| Detect (DE.CM, DE.AE) | Continuous log collection, Sigma rules mapped to MITRE ATT&CK, behaviour baselines, endpoint detection and identity threat detection, correlated across modules. | Detection coverage, alert history and correlated incidents. | Detect, Fortress, Neural Mesh |
| Respond (RS.MA, RS.AN, RS.MI) | Incident queue with owner and severity, investigation timelines, response actions and playbooks under your approval. | Incident records with timelines, actions and closure notes. | Detect, Neural Mesh |
| Recover (RC.RP) | Incident timelines record containment and restoration steps and who confirmed them. Backups and system restoration stay with your own recovery tools. | Incident records showing recovery actions and closure. | Detect |
NIST SP 800-171 families where Ciyora helps
Ciyora Comply includes the NIST Cybersecurity Framework; the 800-171 requirements can be added as custom controls and linked to the same evidence. Ciyora Armor maps cloud findings to NIST SP 800-53, the catalog 800-171 is derived from.
| Family | Requirements | How Ciyora helps | Modules |
|---|---|---|---|
| 3.1 Access Control | 3.1.1, 3.1.2, 3.1.5, 3.1.7, 3.1.12, 3.1.13 | Access limited to authorized users and approved transactions; least privilege with just-in-time elevation; privileged functions logged; remote access sessions controlled by identity and device posture over an encrypted tunnel. | Fortress, VPN |
| 3.3 Audit and Accountability | 3.3.1, 3.3.2, 3.3.5, 3.3.8 | Central log collection and search; actions traced to individual identities; correlation across endpoint, network and identity; a hash-chained audit log for administrative actions. | Detect, Comply |
| 3.4 Configuration Management | 3.4.1, 3.4.2 | Inventory of endpoints, servers and cloud resources; cloud configuration checks against CIS benchmarks with drift detection. | Discover, Armor |
| 3.5 Identification and Authentication | 3.5.1, 3.5.2, 3.5.3 | One identity record per user, device and service account; MFA status per identity; MFA can be required to activate privilege. | Fortress |
| 3.6 Incident Response | 3.6.1, 3.6.2 | Incident queue with owner, severity and timelines of signals, notes and response actions, so incidents are tracked and documented for reporting. | Detect, Neural Mesh |
| 3.9 Personnel Security | 3.9.2 | Leaver and mover events from the HR system remove or change access across connected systems. | Fortress |
| 3.11 Risk Assessment | 3.11.2, 3.11.3 | Vulnerability scanning, including credentialed scans, ranked by CVSS, EPSS and CISA KEV, with remediation tracked to closure. | Discover |
| 3.12 Security Assessment | 3.12.1, 3.12.3 | Control status and posture tracked over time, with snapshots; an agent flags controls with stale or missing evidence. | Comply, Neural Mesh |
| 3.13 System and Communications Protection | 3.13.1, 3.13.6 | Communications at the boundary controlled by deny-by-default policy, with no inbound ports for remote access. | VPN |
| 3.14 System and Information Integrity | 3.14.1, 3.14.2, 3.14.6, 3.14.7 | Flaws identified and tracked; endpoint detection for malicious code; monitoring for attacks and unauthorized use, including data movement to USB devices and AI tools. | Detect, Discover, Monitor |
Outside Ciyora's scope. Requirement 3.13.11 calls for FIPS-validated cryptography to protect the confidentiality of CUI; confirm with your assessor which cryptographic modules are in your boundary. Your system security plan, plans of action, physical protection, media protection and training remain your own. DFARS 252.204-7012 also requires cyber incidents to be reported to the Department of Defense within 72 hours of discovery (DIBNet); Ciyora's incident records help you establish the facts but do not file the report.
Please note. Ciyora is not a certification and does not make an organization compliant on its own. This page describes how Ciyora capabilities map to requirement areas and help you produce evidence. Always read the current text of the regulation or standard and take advice from your compliance team, auditors or legal counsel.
Walk through your control set with us
Bring your latest audit observations or gap assessment, and we will show where Ciyora fits and where it does not.