cmmc-readiness

Topics in the source

• CMMC Readiness
• Workflow
• The gates block on (exit 4)
• Hard rules
• Scripts
• References and assets

Portability: 3 stdlib scripts, no network, no SPRS connection. Fill CSVs, run, keep the output with the SSP. Not an assessment and not legal advice. A C3PAO or DIBCAC assessor decides MET; the Affirming Official affirms in SPRS. Level 2 assessments fail in predictable ways: a 5-point gap someone planned to put on a POA&M, an SSP that misses half the assets, a cloud drive holding CUI without FedRAMP, and a Conditional status that quietly expires on day 181. Each script catches one of these before the assessor does. Step 1 sorts every asset into the 32 CFR 170.19 categories (CUI, Security Protection, Contractor Risk Managed, Specialized, Out-of-Scope) and blocks on in-scope assets missing from the inventory or SSP, and on any cloud provider holding CUI without FedRAMP Moderate or an equivalent body of evidence. Step 2 scores all 110 requirements (5, 3 or 1 point; partial credit only for MFA and FIPS encryption; the SSP unscored but mandatory). It lists what must be fixed before any assessment and what may go on a POA&M, and says how many points short of 88 you would still be after fixing the blockers. Step 3 checks the POA&M against the score: every deferred gap has an item, nothing

This is an excerpt. Refer to the complete source and its current requirements.