Most CMMC failures occur when an assessor asks who owns a practice. They also ask what proves it operates and where that proof is retained. A CMMC compliance kit must turn requirements into assessor-ready evidence. It cannot be just polished policies.
Your kit needs proof owners for 110 practices
A Level 2 kit should connect every practice to a responsible person. It should also list the in-scope system, retained evidence, review date, and SSP statement.
The matrix is the center of the kit
A traceability matrix should link each practice and assessment objective to an asset. It should list the evidence owner, location, review cadence, and SSP section.
| Kit component | Accountable owner | Review cadence | Expected proof |
|---|
| CUI asset and data-flow inventory | System owner | Quarterly and after major change | Data-flow diagram, asset register, approved boundary |
| SSP | Security lead | At least annually and after change | Version history, system-specific control statements |
| Access control evidence | IAM administrator | Monthly to quarterly | MFA settings, privileged-access reviews, termination tickets |
| POA&M register | Compliance lead | Monthly | Risk, due date, closure test, closure evidence |
Policies are only one evidence type
Policies state intent. Operational proof includes settings, access reviews, tickets, logs, interviews, and records that show controls work.
For each Level 2 practice, retain five links: the practice and assessment objective, the in-scope system, a named evidence owner, the evidence location, and the SSP sentence describing the control. If one link is missing, the package is harder to defend.
Use the traceability matrix as a working map. Do not treat it only as a document list. Group the 110 CMMC Level 2 controls under the 14 NIST SP 800-171 families. Then connect each applicable assessment objective to a CUI asset inventory entry, CUI data-flow map, SSP section, and named evidence owner.
For example, Access Control can link several records to relevant SSP control statements. These include access evidence, privileged-access reviews, MFA exports, and termination tickets.
This structure makes CMMC evidence collection repeatable. It establishes evidence ownership and shows an assessor where retained proof is located.
Scope CUI before writing policies
Define where CUI is received, stored, processed, transmitted, backed up, and administered. Do this before documenting controls.
Map the CUI path end to end
Follow a CUI artifact through email, collaboration tools, endpoints, and cloud storage. Include backups, administrator accounts, and managed support access.
Write down shared MSP duties
A shared-responsibility matrix must identify who configures controls and retains proof. It must also show who reviews access and logs, responds to incidents, and supports assessor interviews.
A practical kit workflow starts by identifying the contract and CUI types. It also identifies users, systems, and service providers inside the assessment boundary. Next, assess gaps against each applicable practice and assessment objective.
Record implemented controls, missing evidence, and remediation tasks in the POA&M register. Draft the SSP from actual configurations, not template language. Assign evidence owners and review dates.
Collect tickets, exports, logs, approvals, and interview contacts.
Before an assessment, test several controls from end to end. Confirm the documented process operates and that its proof is retrievable. Confirm that the SSP statement matches the scoped environment.
Choose the kit model that fits your evidence gap
Choose templates, platforms, or advisory support based on your CUI scope. Also consider control maturity and your ability to manage evidence owners.
Compare cost against internal effort
Cost depends on scope, remediation needs, evidence workflows, and internal time. That time is needed to produce system-specific documentation.
Ask five questions before buying
Confirm whether each artifact is required. Identify who owns it and how often it is reviewed. Confirm what proof supports it and where it maps into the SSP.
Keep SSP and POA&M claims testable
The SSP must describe actual configurations. The POA&M must track specific, time-bound corrections and closure evidence.
Write what the environment actually does
Name the platform, scope, setting, administrator role, and review process. Do not make vague claims about encryption or restricted access.
Close POA&Ms with validation
Close a POA&M only after deployment records and testing are complete. Updated SSP language and evidence must also show CUI boundary coverage.
This approach does not replace contract interpretation, legal advice, or a C3PAO's judgment. It does not apply as a standalone project without CUI. It also does not apply without a DoD contract or subcontract requirement. It may not apply if the documented scope contractually excludes the environment.
FAQs
Can you self-certify CMMC level 2?
Level 2 may need an independent C3PAO assessment when the contract requires it. The applicable model depends on solicitation and contract terms.
How many practices are in CMMC level 2?
Level 2 contains 110 practices aligned to NIST SP 800-171 Rev. 2. It also includes related assessment objectives.
What should a CMMC kit include?
It should include a CUI scope inventory, SSP, POA&M, and evidence matrix. Include policies, procedures, review records, owners, and review frequencies.
Can an MSP make a contractor CMMC compliant?
An MSP can operate safeguards. The contractor retains responsibility for CUI scope, evidence, and shared-control explanations.
Is a POA&M enough to pass a level 2 assessment?
No. A POA&M does not replace an implemented required control. It needs an owner, due date, validation, and closure evidence.
What is the difference between CUI and FCI?
CUI has federal safeguarding and dissemination controls. FCI is nonpublic contract information protected through basic FAR safeguards.
How long does CMMC level 2 preparation take?
A mature, defined environment may need 60 to 120 days. Major remediation can require 6 to 12 months.
Build the evidence package before assessment
Build the evidence matrix before scheduling an assessment. Policies cannot compensate for inaccurate scope, generic SSP claims, or unowned proof.
What matters most:- Map all 110 Level 2 practices to owners, evidence, review dates, and SSP statements.
- Define the CUI boundary before writing policies or buying software.
- Use an MSP responsibility matrix for every shared technical control.
- Close POA&Ms only after a fix is deployed, tested, documented, and retained as evidence.
- Confirm whether the contract calls for self-assessment or an independent C3PAO review.
Where does the NIST score fit into CMMC work?
Where applicable DFARS clauses require it, the NIST SP 800-171 score belongs in SPRS. Required affirmations also belong in SPRS.
An internal self-assessment is not the same as a CMMC certification. CMMC Level 1 uses an annual self-assessment model. It focuses on applicable safeguarding requirements and an annual senior-official affirmation.
For Level 2, the solicitation and contract set the required path. An organization may follow annual self-assessment requirements. Or it may need an independent assessment by an authorized C3PAO.
A successful C3PAO assessment can support Level 2 certification. An internal review prepares the organization but does not replace that third-party result.
In both models, the contractor must maintain current evidence. It must submit required affirmations through the applicable DoD process.
Related sources
These articles can help you explore the topic in more depth:
