Build your CMMC documentation

About 10 minutes. Your answers write your System Security Plan, calculate your estimated SPRS score, and fill in your POA&M. Preview it all free before paying.

What you need

Full CMMC Level 2 Documentation Kit, $249
System Security Plan, SPRS worksheet, POA&M filled in with your gaps, and the policy manual for all 14 control families System Security Plan and SPRS Worksheet, $99
The plan control 3.12.4 requires, plus your estimated score

Your company Company legal name Doing business as (leave blank if the same) Street address

City

State

ZIP

Phone

Email (receipt and download link go here)

Website (optional)

CAGE code (5 characters, optional)

UEI (12 characters, optional)

Number of employees

Who is accountable

Two named people appear throughout the documents and sign them. The senior official is the person who accepts the risk, usually an owner, president, or CEO.

Security lead name

Security lead title

Senior official name

Senior official title

The system and the CUI Name for the system being described What Controlled Unclassified Information do you handle? Primes or contracts driving this requirement (optional) Cloud services in scope Our cloud provider is FedRAMP authorized for this service An outside IT provider manages our systems IT provider name (if you ticked the box above)

Number of sites in scope

Effective date

People access CUI from outside the office People use personally owned devices for work

What is actually in place today

Answer honestly, and only tick what is genuinely done. Anything you leave unticked becomes an item in your POA&M with a suggested fix, which is exactly what an assessor expects to see. Ticking something you have not done produces a plan your senior official signs and cannot support. Partly done counts as not done, which is also how the DoD scoring works.

Accounts and access

Everyone has their own named account, no shared logins Admin rights are limited and separate from everyday accounts Multifactor authentication is on for all accounts and all remote access Screens lock automatically after inactivity

Encryption

Disks are encrypted on laptops, workstations, and servers CUI is encrypted in transit, including email and file transfer We have confirmed the encryption modules are FIPS validated (CMVP certificate) Removable media is encrypted, or banned and enforced

Logging and monitoring

Audit logging is on and actions can be traced to a person Someone reviews the logs on a schedule and records that review

Systems and patching

Endpoint protection is deployed and updates automatically Patches are applied on a defined schedule We scan for vulnerabilities and remediate findings Standard configurations are documented and enforced Changes are approved and recorded before they are made

Network

Traffic is controlled and monitored at the network boundary Public facing systems sit on a separate subnetwork from CUI

People

Security awareness training happens at hire and annually, with records Training includes insider threat awareness People are screened before getting CUI access, and access is removed when they leave

Incidents and backups

There is a written incident response plan with named responders The plan has been tested at least once Backups of CUI are kept in a protected, encrypted location Backup restores have been tested

Media and premises

Drives and media are sanitized or destroyed before disposal, with a record Documents and media holding CUI carry CUI markings Physical access to CUI systems is limited to authorized people Visitors are escorted and access logs are kept

Assessment habits

A risk assessment is performed and documented at least annually Controls are assessed periodically and the plan is kept current

Your goal What are you working towards?