CMMC, without the spreadsheets.

AC.L2-3.1.1

Authorized Access Control

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

AC.L2-3.1.2

Transaction and Function Control

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

AC.L2-3.1.5

Least Privilege

Employ the principle of least privilege, including for specific security functions and privileged accounts.

AU.L2-3.3.1

System Auditing

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

CM.L2-3.4.1

Baseline Configuration

Establish and maintain baseline configurations and inventories of organizational systems.

IA.L2-3.5.3

Multi-Factor Authentication

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

IR.L2-3.6.1

Incident Handling

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

RA.L2-3.11.1

Risk Assessment

Periodically assess the risk to organizational operations, organizational assets, and individuals resulting from the operation of organizational systems.

SC.L2-3.13.3

Role Separation

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

SI.L2-3.14.1

Flaw Remediation

Identify, report, and correct information and information system flaws in a timely manner.

SI.L2-3.14.6

Security Alert Monitoring

Monitor organizational systems including inbound and outbound communications traffic to detect attacks and indicators of potential attacks.