CMMC 2.0 Compliance Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

What CMMC 2.0 asks an admin to plan

CMMC 2.0 is a framework other people may ask you about. This page is how an admin prepares evidence. It is not legal advice, not an audit opinion, and not a certification you award yourself. CMMC 2.0 is a US defence-industry requirement tied to the level a contract states. A self-checklist is not an assessment by a C3PAO and not permission to handle controlled information you were not authorised to hold. The text of the standard stays with the publisher. You do not paste it into a ticket or into a shell.

Three tools on this site draft a readiness assessment, a gap list, and a controls checklist. A draft is a set of questions. An answer is a link to evidence: a ticket, a config, a report, a training record. A tick with no link is a gap. The tools do not log into your systems and they do not submit anything to an auditor.

The governance guide is the risk register underneath this work. The policy guide is how a document gets an approver and a review date. Starting CMMC 2.0 by generating every policy on the same afternoon produces a library nobody has read.

Scope is the first sentence. If you cannot say which team, which system, and which data are in, you are not ready to mark a control. Out of scope is a written list, not a feeling. A vendor who holds the data is still in the sentence.

One scope, five gaps, no certificate

Write the scope in five lines: the legal entity if you know it, the systems, the data classes, the vendors, and who told you CMMC 2.0 applies. If nobody told you, the register may be enough and this framework waits. Do not start it because the selector listed it.

Answer five checklist questions by looking. Where you have evidence, paste the link. Where you do not, open a gap ticket with an owner and a date. Five honest gaps beat fifty green cells.

The readiness draft is marked draft. It is stored next to the register. It is not emailed to a customer as if it were an attestation. When a customer wants assurance, the path is the one CMMC 2.0 actually uses, which is not this website.

Write the level the contract named. If the contract is silent, stop and ask the person who owns it. Map five practices you can evidence inside the systems that would be in that scope. Leave the rest dated.

A change you can finish

The change in this window is the scope statement and the five gap tickets. Buying a tool or claiming you comply is not the change.

Rollback is the previous register and the previous draft, which you kept. You do not delete a gap to make the chart look finished.

Write why CMMC 2.0 is in scope, or stop.
Name the systems and the data in one paragraph.
Generate a draft and mark it draft.
Answer five items with links or gap tickets.
Map one item to a policy that is actually approved, or note that the policy is missing.
Tell the register owner. Do not tell a customer you are certified.
Schedule the next five items. Leave them out of this window.

Mistakes that outlive the command

CMMC 2.0 readiness fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Calling the checklist a certification or an attestation.
Pasting the publisher's control text into the ticket as if it were yours.
A scope of everything, with no named system.
Green cells with no evidence.
Starting CMMC 2.0 and three other frameworks in one week.
A gap with no owner.
Legal conclusions written by the admin who ran the generator.
Sending the draft to a customer or a regulator.
Deleting evidence that looked inconvenient.
Treating a generator score as an auditor's score.

Decisions to write down before the window

One decision for CMMC 2.0 readiness: Someone with authority said CMMC 2.0 applies, and that sentence is in the ticket. Scope names systems and data, including vendors who hold the data. The draft is labelled draft. Five items have evidence links or gap tickets. No control text from the publisher was pasted. No one is told they are certified. Counsel owns legal readings and any notice. The register and the policy guide are the companions, not a second copy of this page. The previous draft is kept. The next five items have a date. A second person read the scope aloud. And this page is not the submission path CMMC 2.0 uses.

The hour you stop

Write the hostname or the system name, the owner, and the clock time before you change anything for CMMC 2.0 readiness. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.

A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.

Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.

Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next system waits until someone else can repeat the proof from the notes. CMMC 2.0 readiness is done for this window when the proof is written, not when the tool printed a file.

This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.

CMMC 2.0 checks before anyone outside the team sees the draft

Confirm this before you call the change done: 0 checks before anyone outside the team sees the draft. The reason CMMC 2.0 applies is written. 0 checks before anyone outside the team sees the draft. Scope fits in one paragraph a second person can read. 0 checks before anyone outside the team sees the draft. The file says draft. 0 checks before anyone outside the team sees the draft. Five answers have links or tickets. 0 checks before anyone outside the team sees the draft. Empty answers were not marked done. 0 checks before anyone outside the team sees the draft. No certification sentence exists. 0 checks before anyone outside the team sees the draft. No standard text was pasted. 0 checks before anyone outside the team sees the draft. Counsel is named where the law is the question. 0 checks before anyone outside the team sees the draft. The hostname in the prompt matches the hostname in the ticket for CMMC 2.0 readiness. 0 checks before anyone outside the team sees the draft. The result line includes the time and the person, not only the command. 0 checks before anyone outside the team sees the draft. You can point at the rollback value without searching a chat history. And 0 checks before anyone outside the team sees the draft. Done is a sentence a second person can repeat: the proof for CMMC 2.0 readiness happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.