Implementation examples
8 examples referencing CMDB
- MP.L2-3.8.8[a]
No identifiable owner, no port: found drives go in the amnesty bin
AO coverage. Addresses the Shared Media objective: use of portable storage devices is prohibited when the device has no identifiable owner. What identifiable owner means here. A portable storage…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.5[a] [b]
Chain-of-custody form rides along with every drive that leaves the building
AO coverage. Addresses both Media Accountability objectives: controlling access to media containing CUI, and maintaining accountability for that media during transport outside controlled areas.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MA.L2-3.7.2[a] [b] [c] [d]
Approved tool register, no personal laptops on the plant floor, escorted OEM techs
AO coverage. Addresses all System Maintenance Control objectives — controls over the tools, techniques, mechanisms, and personnel used to conduct maintenance. Tools. A register lists the maintenance…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MA.L2-3.7.1[a]
Maintenance calendar driven by the asset inventory, not by what breaks
AO coverage. Addresses the Perform Maintenance objective: system maintenance is performed on organizational systems. Driven by inventory. Every asset in the inventory carries a maintenance profile:…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SI.L2-3.14.3[a] [b] [c]
One advisory intake queue with a written response-action catalog and a named owner
AO coverage. Addresses all three Security Alerts & Advisories objectives: response actions are identified, advisories are monitored, and actions are taken. Response-action catalog [a]. Six outcomes…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.9[a] [b] [c]
Self-service catalog for approved software; everything else shows up in the weekly diff
AO coverage. Addresses all three User-installed Software objectives: an installation policy is established [a], installation is controlled per that policy [b], and installation is monitored [c].…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.1[a] [b] [c]
One naming standard for people, svc- identities, and device records
AO coverage. Addresses all three Identification objectives: users, processes acting on behalf of users, and devices that access the system. Users. Person accounts follow with a numeric suffix on…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal88% · 2 - AC.L2-3.1.20[a] [b] [c] [d] [e]
External system connections via CASB allow-list and reviewed integrations
AO coverage. Claims objectives [a]–[e] for verifying and limiting connections to external systems that handle CUI. Objective [f] (limit use of portable storage on external systems) is covered under…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet