CMMC v2 · Readiness & evidence
Start with the information. Define the boundary. Build the evidence.
Cybersecurity Maturity Model Certification (CMMC) verifies safeguards for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in contractor systems. Begin with the information you handle, the systems that support it, and the requirements in your solicitation or contract.
Requirements & evidence
Keep the requirement and the assessment basis together.
Level 1
FCI safeguards
Level 1 addresses 15 basic safeguarding requirements. Define the assessment scope and preserve evidence of implementation.
Level 2
NIST SP 800-171 Revision 2
Current CMMC Level 2 guidance uses 110 security requirements from Revision 2. NIST’s latest publication is Revision 3; confirm which revision your agreement requires.
Working evidence
Scope, implementation, verification
Connect each applicable requirement to a responsible owner, implementation details, dated evidence, gaps, and a verification result.
Use the official CMMC program guidance for current assessment and implementation requirements.
SPRS
Supplier Performance Risk System
DoDI 5000.79 identifies SPRS as the authoritative source for supplier and product performance assessments used by the DoD acquisition community to identify, assess, and monitor unclassified performance.
SPRS also holds NIST SP 800-171 assessment results and CMMC information. Supplier performance assessments, cybersecurity assessment scores, and CMMC status are distinct records.
Related references