Tip!
Once you title the SRM, select the Generic SRM Template to begin completing the SRM or upload a copy of the SRM provided by your service provider.

Next, click on the newly created SRM to view and edit its information.

Live Document
 	Tool/Service and Provider:	 	Last Reviewed By and Date:	 	 	 
NIST SP 800-171 Requirement ID	CMMC ID	Requirement	Responsibility Inheritance from Provider
(Full, Partial, None, N/A)	Provider Responsibilities	OSC Responsibilities	MSP/MSSP Responsibilities
3.1.1* 	AC.L1-3.1.1	Limit system access to authorized users, processes acting on behalf of authorized users, and devices
(including other systems). 	 	 	 	 
3.1.2* 	AC.L1-3.1.2	Limit system access to the types of transactions and functions that authorized users are permitted to execute. 	 	 	 	 
3.1.3 	AC.L2-3.1.3	Control the flow of CUI in accordance with approved authorizations. 	 	 	 	 
3.1.4 	AC.L2-3.1.4	Separate the duties of individuals to reduce the risk of malevolent activity without collusion. 	 	 	 	 
3.1.5 	AC.L2-3.1.5	Employ the principle of least privilege, including for specific security functions and privileged accounts. 	 	 	 	 
3.1.6 	AC.L2-3.1.6	Use non-privileged accounts or roles when accessing non-security functions. 	 	 	 	 
3.1.7 	AC.L2-3.1.7	Prevent non-privileged users from executing privileged functions and capture the execution of such functions
in audit logs. 	 	 	 	 
3.1.8 	AC.L2-3.1.8	Limit unsuccessful logon attempts. 	 	 	 	 
3.1.9 	AC.L2-3.1.9	Provide privacy and security notices consistent with applicable CUI rules. 	 	 	 	 
3.1.10 	AC.L2-3.1.10	Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. 	 	 	 	 
3.1.11 	AC.L2-3.1.11	Terminate (automatically) a user session after a defined condition. 	 	 	 	 
3.1.12 	AC.L2-3.1.12	Monitor and control remote access sessions. 	 	 	 	 
3.1.13 	AC.L2-3.1.13	Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. 	 	 	 	 
3.1.14 	AC.L2-3.1.14	Route remote access via managed access control points. 	 	 	 	 
3.1.15 	AC.L2-3.1.15	Authorize remote execution of privileged commands and remote access to security-relevant information. 	 	 	 	 
3.1.16 	AC.L2-3.1.16	Authorize wireless access pri

Once it is made, click "Tools and Services" under Technology Overview.

Tip!
You can also click on Technology Overview for a view of all of the created Tools/Services.

Select the relevant tool or service the SRM applies to. 

Select the SRM to apply to the Tool/Service.

Use the Tagging feature to apply the Tool/Service to controls throughout the Assessment.

Tip!
The SRM will appear as an option to apply to a control's objective/s for all controls that the Inventory Item is tagged to that the SRM is selected for.

Click "Assess" and go to the control that the inventory item, with the correct SRM, has been tagged. 

When on the control, for any of the objectives, click on Inheritance.

Indicate the Inheritance (Not Inherited, Partially, or Fully Inherited) for the objective. Once done, you will be able to add an SRM.

Creating SRMs and Applying to Controls