A6 Windows CMMC Configuration Baseline
Version 1.0.0 | 2026-09-21

PURPOSE
This Windows PowerShell 5.1 script audits, plans, applies, or rolls back a
bounded Windows endpoint security baseline. It addresses selected technical
configuration areas relevant to CMMC Level 2 and NIST SP 800-171 Revision 2:
Windows Firewall, selected registry policies, Microsoft Defender Antivirus,
Attack Surface Reduction (ASR), and advanced audit policy.

IMPORTANT LIMITS
- This is not a CMMC certification and cannot make an organization compliant.
- It does not replace scoping, an SSP, assessment objectives, policies,
  procedures, training, physical controls, identity governance, incident
  response, evidence review, or an authorized assessment.
- GPO, MDM, endpoint-management, and security-platform policy may override
  local settings.
- Audit and Plan are non-changing. Apply requires elevation and creates a
  rollback state first.
- ASR defaults to Audit. Block only after telemetry review, application-owner
  approval, exclusions, a staged pilot, and recovery testing.
- The script does not enable BitLocker, select a recovery-key escrow location,
  turn on automatic cloud sample submission, or deploy a generic WDAC/AppLocker
  blocking policy.

RECOMMENDED WORKFLOW
1. Verify the SHA-256 file against the downloaded PowerShell file.
2. Read the complete source.
3. Run Audit as a standard change-free discovery pass:
     .\A6-Windows-CMMC-Baseline.ps1
4. Review findings.csv, findings.json, and summary.json with the system owner.
5. Run Plan:
     .\A6-Windows-CMMC-Baseline.ps1 -Mode Plan -AsrMode Audit
6. Test Apply in a disposable or representative pilot endpoint:
     .\A6-Windows-CMMC-Baseline.ps1 -Mode Apply -AsrMode Audit -OutputDirectory C:\A6-Baseline
7. Reboot if UAC policy changed; refresh GPO/MDM; rerun Audit; review telemetry.
8. Roll back with the exact prior Apply run directory when necessary:
     .\A6-Windows-CMMC-Baseline.ps1 -Mode Rollback -BackupDirectory C:\A6-Baseline\YYYYMMDD-HHMMSS

ARTIFACTS
Each run writes CSV/JSON findings and an action log beneath OutputDirectory.
Apply also writes rollback-state.json, audit-policy.csv, and
firewall-policy.wfw before changes. -IncludeSensitiveArtifacts additionally
collects gpresult, systeminfo, and the current audit policy. Treat all output as
sensitive assessment evidence because it may expose hostnames, policy paths,
and security configuration.

REFERENCES
- 32 CFR Part 170: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170
- DoD CMMC: https://dodcio.defense.gov/CMMC/
- NIST SP 800-171 Rev. 2: https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
- NIST SP 800-171A: https://csrc.nist.gov/pubs/sp/800/171/a/final
- Microsoft ASR reference: https://learn.microsoft.com/defender-endpoint/attack-surface-reduction-rules-reference

NO AFFILIATION OR CERTIFICATION
A6 is not claiming that this script is approved, endorsed, or certified by the
Department of Defense, CISA, NIST, MITRE, or any assessment organization.
References identify public standards and resources only.
