CMMC Resource Library

The Complete CMMC 2.0 Guide

A practical, jargon-free walkthrough of CMMC from CUI to certification — written for operations and IT leaders.

25 minAll Levels Read

CMMC Level 1 vs. Level 2 vs. Level 3: What's the Difference?

Side-by-side comparison of the three CMMC levels — requirements, assessment types, and who needs which.

5 minOverview Read

What is CUI? A Contractor's Field Guide

How to identify Controlled Unclassified Information in your environment — categories, markings, and common examples for defense contractors.

7 minCUI Read

Readiness & Gap Analysis

Know Where You Stand

How to Conduct a Self-Assessment Against NIST 800-171

Step-by-step methodology for assessing your own compliance posture — how to structure interviews, gather evidence, and score each requirement.

15 minReadiness Read

TemplateAll Levels Download

Gap Register Template

A structured spreadsheet for tracking every open compliance gap — with fields for requirement ID, severity, owner, compensating controls, and target close date.

Pre-Assessment Decisions

Scoping, Level, and Assessor Selection

CUI Scoping Methodology

The inventory exercise that drives every downstream architecture and assessment decision — five questions, contract-driven discovery, and the shadow CUI patterns that catch most contractors.

14 minFoundational Read

Choosing Your CMMC Level

How to read your contracts to determine whether you need Level 1, Level 2 (Self), Level 2 (C3PAO), or Level 3 — with worked scenarios for mixed and ambiguous exposure.

9 minDecision Read

11 minVendor selection Read

Choosing a C3PAO

How to select a Certified Third-Party Assessment Organization — the questions to ask, the red flags to walk away from, and what an engagement actually looks like end-to-end.

Architecture & Scoping

Where CUI Lives & Who's on the Hook

Enclave Architecture for CUI

Most small DIB orgs scope CMMC down using a CUI enclave. A platform-agnostic comparison of M365 GCC High, PreVeil, Kiteworks, and VDI patterns — including the bridging failures that cost certifications.

16 minScoping Read

DFARS 252.204-7012(m) Flow-Down

What flows from primes to subcontractors handling CDI — the clause text, the 72-hour reporting chain, separate practical implementation steps for each side, and sample subcontract language.

14 minSubcontracts Read

FedRAMP Equivalence for CUI

Why commercial Microsoft 365, Google Workspace, and Dropbox cannot hold CUI — and what the DoD CIO's December 21, 2023 equivalency memo actually requires of "FedRAMP-equivalent" cloud services (3PAO assessment, 100% baseline, no open POA&Ms, no self-attestation).

5 minCloud Read

Control Family Guides

All 14 Families, Explained

14 min22 requirements Read

Access Control (3.1)

The most-cited CMMC deficiency family — 22 requirements covering account authorization, least privilege, remote access, wireless, and mobile device controls.

Awareness and Training (3.2)

Three requirements — two worth 5 points each — establishing that all personnel understand security risks and are trained for their specific responsibilities.

5 min3 requirements Read

Audit and Accountability (3.3)

What events must be logged, how long to retain them, how to protect logs from tampering, and how to correlate records across systems for investigations.

8 min9 requirements Read

Configuration Management (3.4)

Baseline configurations, security hardening, formal change control, pre-change security analysis, and software execution policy for all in-scope systems.

8 min9 requirements Read

9 min11 requirements Read

Identification and Authentication (3.5)

MFA requirements for privileged and remote access, password policy, account lifecycle management, and cryptographic protection of stored credentials.

Incident Response (3.6)

Building an operational IR capability, the 72-hour CUI incident reporting obligation via DIBNET, and requirements for testing your response plan.

5 min3 requirements Read

Maintenance (3.7)

Controlling maintenance activities, requiring MFA for remote vendor sessions, sanitizing equipment before it leaves the facility, and supervising uncleared personnel.

6 min6 requirements Read

Media Protection (3.8)

Protecting, marking, and controlling CUI on both physical and digital media — including sanitization before disposal and encryption requirements for media in transit.

8 min9 requirements Read

Personnel Security (3.9)

Pre-employment screening for CUI system access, and the 5-point requirement to protect CUI during and after personnel terminations and transfers.

4 min2 requirements Read

Physical Protection (3.10)

Physical access controls for facilities and systems, visitor management, physical access logging, and safeguarding CUI at alternate work sites including home offices.

6 min6 requirements Read

Risk Assessment (3.11)

Three 5-point requirements: conducting formal risk assessments, running authenticated vulnerability scans, and remediating findings on a risk-based schedule.

5 min3 requirements Read

Security Assessment (3.12)

Periodic control assessments, maintaining your POA&M, ongoing monitoring, and the System Security Plan — the cornerstone document of your CMMC compliance posture.

6 min4 requirements Read

12 min16 requirements Read

System and Communications Protection (3.13)

Network boundary monitoring, CUI encryption in transit and at rest, FIPS-validated cryptography, network segmentation, and session security — 16 requirements.

System and Information Integrity (3.14)

Patch management, layered malware protection, monitoring for attacks and indicators of compromise, and the ability to detect unauthorized system use.

7 min7 requirements Read

Documentation

SSP, POA&M & Templates

Writing Your SSP: Section by Section

What belongs in each section of your System Security Plan, what assessors look for, and common mistakes that lead to findings on assessment day.

14 minSSP Read

SSP Section Outline & Writing Guide

A structured Word document outline for your System Security Plan with section-by-section writing prompts and example implementation statement language.

TemplateLevel 2 Download

POA&M Starter Template

A pre-formatted POA&M ready for all 110 requirements — with columns for status, owner, compensating controls, milestones, and target dates.

TemplateLevel 2 Download

Policy Library Guide

The 14 family policies your SSP will reference, what each must contain, and how policies relate to procedures, standards, and the SSP itself.

13 minDocumentation Read

Evidence Library Guide

What evidence assessors look for by control family — configuration screenshots, system reports, activity records — with freshness expectations and organization patterns.

12 minDocumentation Read

The Assessment

What Actually Happens On Assessment Day

Assessment Day Playbook

Hour-by-hour walkthrough of a Level 2 C3PAO assessment — pre-assessment phase, opening conference, daily rhythm, interviews by family, technical observations, findings, and closing.

17 minOperational Read

Assessor Interview Questions by Family

Sample questions assessors actually ask in AC, IA, AU, and SC interviews — plus how to prepare an SME so they can describe and demonstrate, not just read the SSP.

5 minInterview prep Read

How Findings Emerge — and How to Handle Them

Findings rarely arrive as surprises in the closing conference. How they emerge through the daily rhythm, when to remediate, when to acknowledge, and what does not work.

4 minIn-the-moment Read

Specialized Topics

Edge Cases & Adjacent Compliance

11 minCompliance overlay Read

ITAR, EAR, and US-Person Controls

How export control regimes layer on top of CMMC — the US-person rule, cloud constraints, MSP constraints, and the registration obligations that affect anyone manufacturing ITAR-controlled defense articles.

13 minThird-party mgmt Read

MSP, Vendor & CSP Oversight

When vendors fall in scope, what contractual terms to require, what evidence to collect, and the External Service Provider rules that may require MSPs themselves to be CMMC certified.

Vendor Contract Security Clause

A plain-language sample contract clause for CUI-handling vendors — covers NIST 800-171, FedRAMP, US-person personnel, incident reporting, and audit rights.

TemplateContract Read

After Certification

The Three-Year Operational Picture

Maintaining Your Certification

The operational compliance picture for the three-year certification period — annual affirmation, POA&M lifecycle, change management, continuous monitoring, and re-assessment triggers.

12 minLifecycle Read

POA&M Lifecycle Management

How to actually maintain a POA&M throughout the certification period — the rules around 5-point requirements, the 180-day conditional certification clock, and ongoing review cadence.

3 minOperational Read

Recertification Planning

The six-month runway before your certification expires — engaging the C3PAO, internal readiness review, document submission, and scheduling fieldwork before the lapse.

4 minPlanning Read

SPRS Scoring

Understand Your Score

How SPRS Scoring Works — And Why It Matters

Your SPRS score is submitted to the DoD and reviewed during source selection. Here's exactly how it's calculated and which gaps cost you the most points.

6 minSPRS Read

SPRS Point Values by Requirement

A complete reference table showing the weighted point value (1, 3, or 5) for every NIST 800-171 requirement — sorted by family and by point value.

ReferenceAll 110 View

Submitting Your SPRS Score: Step-by-Step

How to register in SPRS, what the senior official attestation means legally, and what to do if your current score is very low.

5 minSPRS Read

Reference & Tracking

Glossary, Timeline & Standards Watch

CMMC Glossary & Acronym Index

An A–Z reference of the acronyms and terms used across CMMC, NIST 800-171, DFARS, FAR, ITAR, EAR, and the broader DIB compliance ecosystem.

ReferenceA–Z View

CMMC Final Rule Phase Tracker

Where the CMMC Final Rule rollout stands today — Phase 1, 2, 3, and 4 enforcement milestones, what's currently in effect, and how to read your contracts to know which phase applies.

ReferenceUpdated View

9 minForward-looking Read

NIST 800-171 Rev 2 → Rev 3 Transition

What changed between Rev 2 and Rev 3, what it means for current CMMC compliance, and how to begin preparing for the eventual transition without prematurely abandoning Rev 2.

Automation & Open Standards

OSCAL & Machine-Readable Compliance

NIST OSCAL Project Home

The Open Security Controls Assessment Language (OSCAL) is NIST's set of XML, JSON, and YAML formats for representing security control catalogs, profiles, SSPs, and assessment results in machine-readable form.

ExternalNIST Visit

OSCAL Content for NIST SP 800-171

NIST's official GitHub repository of OSCAL-formatted control catalogs and profiles — including SP 800-53 Rev 5 and SP 800-171 Rev 2 — ready to use as the starting point for an OSCAL-based SSP.

ExternalGitHub Visit