Resources
Practical CMMC and NIST SP 800-171 guidance plus free working templates your team can actually use. Email is optional: you can ask us to send a resource and follow up, or skip the form and download it immediately.
Download the working documents
Branded by CMMCAssessment.ai, built for defense contractors, and designed to move from scoping to evidence instead of stopping at a generic checklist.
System Security Plan (SSP) Template
A branded, Word-compatible working template for documenting scope, environment, control implementation, evidence and revision history.
Prefer no form? Skip the form — download instantly.
POA&M Remediation Tracker
An Excel-compatible tracker for deficiencies, owners, milestones, due dates, evidence and closure validation.
Prefer no form? Skip the form — download instantly.
CMMC Readiness Checklist
A practical readiness review covering scope, governance, technical controls, documentation, evidence and assessment preparation.
Prefer no form? Skip the form — download instantly.
Evidence Package Checklist
A branded checklist for organizing screenshots, exports, tickets, logs, policies, records and other objective evidence.
Prefer no form? Skip the form — download instantly.
CUI Scoping Worksheet
A guided worksheet for tracing how CUI enters, moves through, rests in and leaves your environment.
Prefer no form? Skip the form — download instantly.
Control, Evidence & Ownership Mapping Workbook
An Excel-compatible matrix for mapping requirements to systems, owners, policy references, evidence and POA&M items.
Prefer no form? Skip the form — download instantly.
These resources are genuinely free. We would rather help a contractor use the document correctly than hide useful material behind a mandatory email wall. If you choose the email-and-download option, your request is routed to the CMMCAssessment.ai support team so we can answer questions and help with scoping, SPRS, documentation, remediation or readiness.
Three ways through this library
A clause appeared in a contract and you do not know what it means. Start with DFARS 252.204-7012, then check whether CMMC applies to you and confirm whether you handle FCI or CUI.
A prime has asked for your SPRS score. Read how the score is built, work through the fourteen families, and use the SPRS calculator. Treat the resulting number as a draft until you can support each implemented requirement with evidence.
You are building the program itself. Scope first with the CUI worksheet above, document the actual environment in the SSP, map requirements to owners and evidence, and use the POA&M tracker for genuine open deficiencies. If you want a second set of eyes, start a CMMC readiness assessment.
Professional resources should be useful before you hire us
We want contractors to come to CMMCAssessment.ai because the material is specific, current and practical. The templates are designed to expose the places where teams usually need help: drawing a defensible boundary, writing implementation statements that match reality, collecting objective evidence, prioritizing remediation and keeping documentation synchronized with the environment.
Where the regulatory position changes, use the program status page as the current reference. Never rely on a downloaded template as a substitute for checking the requirements that apply to your specific contract and environment.
Start here
If you are not yet certain what applies to you, these three answer it in order.
Controlled Unclassified Information
What CUI is, how it is categorised and marked, and how to find it in your own systems.
The standard
NIST SP 800-171 Revision 2 and the scoring methodology built on it.
All 14 control families
110 requirements, 313 points at risk, and where they concentrate.
Revision 2
Why a superseded revision is the one that counts.
SPRS scoring explained
The 110 start, the 313 deductions, and the −203 floor.
DFARS 252.204-7012
The clause everything traces back to, including the 72-hour rule.
CMMC
The programme, the levels, and where it currently stands.
Program status
The suspension, the class deviation, and what still applies.
CMMC 2.0 overview
Three levels, 32 CFR Part 170, and how the rules fit together.
Level 2 requirements
110 requirements, 320 objectives, conditional status at 88.
The process end to end
Six steps, in the order that avoids expensive rework.
CMMC assessment guide
How assessors read the 320 objectives, level by level.
Self-assessment
Scoring yourself, posting to SPRS, and the annual affirmation.
C3PAO assessment
How assessment works and why organisations fall short.
What it costs
Six line items, and why scope matters more than headcount.
By situation
Where the general guidance needs adjusting for how you actually work.
Flow-down requirements
What primes must impose and what subcontractors owe.
IT providers and MSPs
ESP classification and FedRAMP equivalency.
Architecture, engineering & construction
When your CUI lives in someone else’s platform.
CMMC vs HIPAA
Why a mature HIPAA programme transfers less than expected.
Choosing a partner
Software, consultant, and the claims that should slow you down.
Everything on this site is free to use on your own.
If you would rather have someone check your work or take it off your plate, that is what we do. Readiness only — we do not certify, and we will tell you plainly where you stand.