POA&M template builder
Build a CMMC POA&M row by row, checked against 32 CFR 170.21: the 88-point minimum, 1-point gaps only, 180-day closeout.
SSP, POA&M & policies
3 tools, 3 guides, 2 comparisons
An assessor reads paper before looking at a screen. The system security plan describes the boundary and how each requirement is met, the plan of action lists what is not met yet, and the policies say who does what.
The templates here are starting points to fill in with your own shop's facts, and the guides say what each document has to hold.
Tools
System security plan (SSP) template
Fill in the SSP that NIST 800-171 3.12.4 asks for, checked against its eight assessment objectives.
CMMC policy templates
Fourteen NIST SP 800-171 policies built from your shop's details, every clause tagged with the requirement it covers.
Comparisons
- Best CMMC compliance software for small contractorsSix tools read against the rule: 800-171 coverage, SPRS scoring, SSP and POA&M, and FedRAMP status.6 vendors compared
- Vanta vs Drata (and Secureframe) for CMMCTwo SOC 2-first platforms and Secureframe read against CMMC Level 2: SPRS score, SSP, POA&M and FedRAMP listing.3 vendors compared
Guides
- What is a POA&M?What a plan of action and milestones holds, what 32 CFR 170.21 lets you leave open and for how long, and what a good row looks like.12 min read
- What is a system security plan?What NIST 3.12.4 asks the SSP to describe, what goes in each part, what an assessor reads in it, and why no current SSP means no score.13 min read
- NIST SP 800-88 media sanitization for a machine shopClear, purge or destroy under NIST SP 800-88 Rev 2, the decision flow, 800-171 3.8.3, and a printable certificate.17 min read
Other topics
- Scoping & CUIFind where CUI lives in a small shop, draw the boundary around it, and sort every laptop, share and machine into or out of scope.4 tools, 7 guides, 3 comparisons
- Assessment & SPRSSelf-assessments, the SPRS score and getting ready for an assessor, worked through in plain English.4 tools, 12 guides, 4 comparisons
- Vendors & cloudCloud suites, email and file sharing, enclaves and service providers, compared on what the rule asks of them.2 guides, 8 comparisons