CMMC policy templates

Fourteen plain-English security policies, one for each NIST SP 800-171 Rev 2 family, written for a 5 to 50 person shop. Enter your company, your people and a few settings once; every clause names the requirement it answers, and each policy can be edited, copied, printed or downloaded.

Policy generator

Fill in your shop once; every policy updates as you type. Pre-filled with an example shop.Example only

A policy is not a met requirement. An assessor checks that each requirement is implemented and examines the evidence: settings, logs, records. These policies say what you will do; the systems and records have to show it.

CMMC policy templates, cuideck.com

ACCESS CONTROL POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.1 Access control (22 requirements, CMMC AC.L2-3.1.1 to AC.L2-3.1.22)

1. Purpose
Who may use the systems that hold CUI, what each person may do there, and how CUI is kept on the paths we approved.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Who gets access
3.1 Only people Halvorsen Precision Machining LLC has authorized, the service accounts and processes they run, and company-issued or approved devices may use the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations). The Operations Manager keeps the list of authorized users and devices and reviews it every 12 months. [AC.L2-3.1.1]
3.2 Each person gets only the access and functions their job needs: the shop floor reads the drawings and travelers it works from, only the people who quote and program jobs add or change CUI files, and only named administrators change security settings. [AC.L2-3.1.2, AC.L2-3.1.5]
3.3 No one person both makes and approves a security change: changes made by Northgate IT are approved by the Operations Manager, and the two duties are listed in the system security plan. [AC.L2-3.1.4]
3.4 Administrators use a separate standard account for email, browsing and everyday work, and sign in as administrator only to administer. [AC.L2-3.1.6]
3.5 Standard users cannot run privileged functions such as installing software, creating accounts or changing security settings, and every use of a privileged function is written to the audit log. [AC.L2-3.1.7]

4. Signing in and leaving a session
4.1 An account locks after 5 failed sign-in attempts in a row and stays locked until Northgate IT unlocks it or the lockout period ends. [AC.L2-3.1.8]
4.2 Every system in scope shows a notice before sign-in: the system belongs to the company, holds controlled unclassified information, and use is monitored. [AC.L2-3.1.9]
4.3 Screens lock after 15 minutes without input, and the lock screen hides what was showing. [AC.L2-3.1.10]
4.4 Remote and web sessions end automatically after 8 hours, and sessions on shared shop-floor computers end at the end of each shift. [AC.L2-3.1.11]

5. Remote access
5.1 Remote access to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations) goes only through the company VPN or the cloud service's own sign-in, both of which encrypt the session. Northgate IT monitors and logs remote sessions. [AC.L2-3.1.12, AC.L2-3.1.13, AC.L2-3.1.14]
5.2 Privileged commands and security information are used remotely only by the administrators the Operations Manager has named in writing. [AC.L2-3.1.15]

6. Wireless and mobile devices
6.1 Northgate IT approves every wireless access point before it is connected. Wireless networks that reach CUI systems use encryption and individual sign-in; the guest network is kept apart. [AC.L2-3.1.16, AC.L2-3.1.17]
6.2 Phones and tablets may reach CUI only after Northgate IT enrols them in device management, and CUI on them is encrypted. [AC.L2-3.1.18, AC.L2-3.1.19]

7. CUI paths, outside systems and public posting
7.1 CUI moves only along the paths in the system security plan, between the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations) and the people authorized for it. It is never forwarded to personal email, consumer file sharing or chat apps. [AC.L2-3.1.3]
7.2 Personal computers, home networks and customers' or suppliers' systems are external systems. CUI is not processed on them unless the Operations Manager approves the connection in writing and it is listed in the system security plan. [AC.L2-3.1.20]
7.3 Portable storage holding CUI is not used on external systems. [AC.L2-3.1.21]
7.4 Only the people the Operations Manager names may post to the website, social media or customer portals, and they check first that nothing posted is CUI. [AC.L2-3.1.22]

8. Evidence we keep
- The list of active accounts with the person behind each, and records of recent leavers and transfers
- Configuration settings for lockout, session lock, remote access and wireless
- The approved list of external systems and mobile devices
- Audit log entries showing privileged functions being recorded

9. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

SECURITY AWARENESS AND TRAINING POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.2 Awareness and training (3 requirements, CMMC AT.L2-3.2.1 to AT.L2-3.2.3)

1. Purpose
What everyone with access learns about the risks of their work, and what people with security duties are trained to do.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Everyone
3.1 Everyone with access to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations) completes security awareness training before access is granted and every 12 months after. It covers the risks of their own work, these policies and how to report a problem. [AT.L2-3.2.1]
3.2 Training covers the signs of a possible insider threat, such as unusual requests for drawings, bulk copying of CUI or attempts to work around a control, and how to report them without confronting anyone. [AT.L2-3.2.3]

4. People with security duties
4.1 Administrators, Northgate IT staff who work on our systems and the Operations Manager are trained for the security duties they hold, and the Operations Manager keeps a record of who was trained, on what and when. [AT.L2-3.2.2]

5. Evidence we keep
- The training material and its curriculum
- Training records: who completed what, and when
- The list of security roles and the people who hold them

6. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

AUDIT AND ACCOUNTABILITY POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.3 Audit and accountability (9 requirements, CMMC AU.L2-3.3.1 to AU.L2-3.3.9)

1. Purpose
What our systems record, how long we keep it, who reviews it and how the records are protected.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. What is logged
3.1 the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations) record sign-ins and failed sign-ins, privileged actions, changes to accounts and security settings, and access to CUI folders, each with the time, user, device and outcome. Logs are kept for 365 days. [AU.L2-3.3.1]
3.2 Everyone uses their own account. Shared logins are not allowed, so every logged action traces to one person. [AU.L2-3.3.2]
3.3 All systems take their time from one authoritative time source, so timestamps line up across logs. [AU.L2-3.3.7]

4. Review and alerts
4.1 The Operations Manager and Northgate IT review the list of logged events every 12 months and after any incident, and update it. [AU.L2-3.3.3]
4.2 Northgate IT is alerted when logging stops, fails or runs out of storage. [AU.L2-3.3.4]
4.3 Logs from different systems are reviewed together at least weekly, so related events can be connected and investigated. [AU.L2-3.3.5]
4.4 The logging tool can search, filter and report on demand without altering the original records. [AU.L2-3.3.6]

5. Protecting the logs
5.1 Logs and logging tools are protected from unauthorized reading, change and deletion, and only the administrators named by the Operations Manager may manage logging. [AU.L2-3.3.8, AU.L2-3.3.9]

6. Evidence we keep
- The list of logged event types and the log retention setting
- Samples of audit records that trace actions to named users
- Records of log reviews and of logging-failure alerts

7. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

CONFIGURATION MANAGEMENT POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.4 Configuration management (9 requirements, CMMC CM.L2-3.4.1 to CM.L2-3.4.9)

1. Purpose
How we know what we run, how it is set up securely, and how changes are approved and recorded.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Inventory and baselines
3.1 Northgate IT keeps an inventory of every computer, server, network device, networked machine control, cloud service and piece of installed software in scope, and a baseline configuration for each kind of system. Both are updated whenever something is added, changed or retired. [CM.L2-3.4.1]
3.2 Security settings for each product follow a written baseline, such as a published hardening benchmark adjusted for our use, and Northgate IT enforces them through central management wherever the product allows. [CM.L2-3.4.2]

4. Changes
4.1 Every change to an in-scope system is requested, checked for its security impact before it is made, approved or refused by the Operations Manager, and logged with who made it, what changed and when. [CM.L2-3.4.3, CM.L2-3.4.4]
4.2 Only the administrators the Operations Manager names may change in-scope systems, and servers and network equipment sit in a locked room or cabinet. [CM.L2-3.4.5]

5. Least functionality and software
5.1 Systems run only the programs, functions, ports, protocols and services the business needs. Northgate IT keeps the list of what is essential and removes or disables the rest. [CM.L2-3.4.6, CM.L2-3.4.7]
5.2 Software runs under an allow-list: only programs on the approved list may run on in-scope computers. [CM.L2-3.4.8]
5.3 Users may not install software. Requests go to Northgate IT, who checks each one, installs it if approved and records it. [CM.L2-3.4.9]

6. Evidence we keep
- The system inventory and the records of its reviews
- Baseline configurations and the security settings applied
- Change records: request, impact check, approval, date
- The list of essential programs, ports and services, and the software allow-list

7. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

IDENTIFICATION AND AUTHENTICATION POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.5 Identification and authentication (11 requirements, CMMC IA.L2-3.5.1 to IA.L2-3.5.11)

1. Purpose
How every user and device is identified and proves who it is before it reaches CUI.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Identities
3.1 Every user, service account and device has a unique identifier and must authenticate before it gets access. [IA.L2-3.5.1, IA.L2-3.5.2]
3.2 A user ID is never reissued to a different person, and accounts unused for 45 days are disabled. [IA.L2-3.5.5, IA.L2-3.5.6]

4. Multifactor and sign-in
4.1 Multifactor authentication is required for every privileged sign-in, local or over the network, and for every network sign-in by a standard user, email and cloud file storage included. [IA.L2-3.5.3]
4.2 Network sign-ins use authentication that cannot be replayed if it is captured, for both privileged and standard accounts. [IA.L2-3.5.4]
4.3 Password entry is masked on screen. [IA.L2-3.5.11]

5. Passwords
5.1 Passwords are at least 14 characters and mix letters, numbers and symbols, and a new password must be more than a small change to the old one. [IA.L2-3.5.7]
5.2 The last 24 passwords cannot be reused. [IA.L2-3.5.8]
5.3 A temporary password works for one sign-in and must be changed to a permanent one straight away. [IA.L2-3.5.9]
5.4 Passwords are stored and sent only in cryptographically protected form. No passwords in spreadsheets, on notes or in plain-text email. [IA.L2-3.5.10]

6. Evidence we keep
- The list of system accounts and devices
- Multifactor and password settings in each system
- Audit records of sign-ins

7. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

INCIDENT RESPONSE POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.6 Incident response (3 requirements, CMMC IR.L2-3.6.1 to IR.L2-3.6.3)

1. Purpose
How we prepare for, spot, handle, report and learn from security incidents, including what DFARS 252.204-7012 asks of us.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Capability
3.1 Halvorsen Precision Machining LLC keeps an incident-handling capability that covers preparation, detection, analysis, containment, recovery and what users do. The Operations Manager leads it, with Northgate IT in support. [IR.L2-3.6.1]

4. Reporting
4.1 Anyone who sees something suspicious, such as a lost laptop, a clicked phishing link or odd account activity, reports it to the Operations Manager at once. Every incident is tracked and documented from report to close. [IR.L2-3.6.2]
4.2 When a cyber incident affects covered defense information or our covered systems, Halvorsen Precision Machining LLC reports it to DoD at https://dibnet.dod.mil within 72 hours of discovery, using the company's DoD-approved medium assurance certificate. [IR.L2-3.6.2]
4.3 We keep images of affected systems and the relevant monitoring and packet capture data for at least 90 days from the report, and send any malicious software we isolate to the DoD Cyber Crime Center (DC3), never to the contracting officer. [IR.L2-3.6.2]
4.4 Where Halvorsen Precision Machining LLC is a subcontractor, it gives the incident report number DoD assigns to the prime contractor or next higher tier as soon as practicable. [IR.L2-3.6.2]

5. Testing
5.1 The incident response capability is tested every 12 months, for example with a tabletop exercise on ransomware reaching the file server, and what we learn goes into this policy and the plan. [IR.L2-3.6.3]

6. Evidence we keep
- The incident response plan and the incident records
- The DoD-approved medium assurance certificate (or the request for one)
- Records of the last test or tabletop exercise and what changed after it

7. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

SYSTEM MAINTENANCE POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.7 Maintenance (6 requirements, CMMC MA.L2-3.7.1 to MA.L2-3.7.6)

1. Purpose
How in-scope systems are maintained, by whom and with what, so maintenance never becomes a way in.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Doing maintenance
3.1 Northgate IT maintains in-scope systems on a schedule and records each job: what was done, by whom, when. [MA.L2-3.7.1]
3.2 Only maintenance tools and technicians approved by the Operations Manager are used on in-scope systems. [MA.L2-3.7.2]
3.3 Diagnostic and test media are scanned for malicious code before they touch an in-scope system. [MA.L2-3.7.4]

4. Off-site, remote and visiting technicians
4.1 Equipment going off-site for repair is cleared of CUI first, or its storage is removed and kept here. [MA.L2-3.7.3]
4.2 Remote maintenance over an outside network needs multifactor authentication, and the connection is closed as soon as the work is done. [MA.L2-3.7.5]
4.3 Technicians without access authorization, such as a machine-tool service engineer, are escorted and supervised while they work on in-scope equipment. [MA.L2-3.7.6]

5. Evidence we keep
- Maintenance records and the list of approved tools and technicians
- Sanitization records for equipment sent out for repair
- Remote maintenance session logs

6. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

SYSTEM MEDIA PROTECTION POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.8 Media protection (9 requirements, CMMC MP.L2-3.8.1 to MP.L2-3.8.9)

1. Purpose
How paper and digital media holding CUI are stored, marked, moved, and destroyed.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Storing and marking
3.1 Paper drawings, travelers and digital media holding CUI are kept in locked storage when not in use, and only authorized people may use them. [MP.L2-3.8.1, MP.L2-3.8.2]
3.2 Media holding CUI carries its CUI marking and any distribution statement the customer applied. [MP.L2-3.8.4]
3.3 Backups holding CUI are encrypted and kept where only authorized people can reach them. [MP.L2-3.8.9]

4. Moving media
4.1 Media leaving a controlled area stays with an authorized person or a tracked courier, and we record what left, who took it and when. [MP.L2-3.8.5]
4.2 Digital media carrying CUI outside a controlled area is encrypted, unless other physical safeguards protect it and the system security plan says which. [MP.L2-3.8.6]

5. Removable media and disposal
5.1 USB ports and removable media are blocked on in-scope systems except for devices Northgate IT has approved, and a drive with no identifiable owner is never plugged in. [MP.L2-3.8.7, MP.L2-3.8.8]
5.2 Media holding CUI is sanitized or destroyed before disposal or reuse: paper cross-cut shredded, drives wiped or physically destroyed, and the Operations Manager keeps the record. [MP.L2-3.8.3]

6. Evidence we keep
- Where CUI media is stored and who holds the keys
- Media transport and sanitization records
- Removable-media settings and the list of approved devices

7. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

PERSONNEL SECURITY POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.9 Personnel security (2 requirements, CMMC PS.L2-3.9.1 to PS.L2-3.9.2)

1. Purpose
How people are screened before they reach CUI, and how access follows them when they leave or change jobs.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Before access
3.1 People are screened before they get access to systems holding CUI, using the checks Halvorsen Precision Machining LLC applies to the role and that the law and our contracts allow. [PS.L2-3.9.1]

4. Leaving or changing jobs
4.1 When someone leaves, Northgate IT disables their accounts and the Operations Manager collects badges, keys, laptops and phones the same working day. When someone changes jobs, their access is changed to fit the new one. [PS.L2-3.9.2]

5. Evidence we keep
- Records of screened personnel
- Termination and transfer records showing access removed

6. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.10 Physical protection (6 requirements, CMMC PE.L2-3.10.1 to PE.L2-3.10.6)

1. Purpose
Who may enter the places where CUI lives, how visitors are handled, and how CUI is protected away from the shop.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Access to the site
3.1 Only authorized people may enter areas that hold CUI systems or paper, and the Operations Manager keeps the list. [PE.L2-3.10.1]
3.2 The building, the server room or network cabinet, and the power and network gear that support them are protected and monitored. [PE.L2-3.10.2]
3.3 Visitors sign in, wear a visitor badge and are escorted at all times in areas that hold CUI. [PE.L2-3.10.3]
3.4 The visitor log and badge-reader records are kept and reviewed. [PE.L2-3.10.4]
3.5 Keys, badges and door codes are issued, recorded and recovered, and codes change when someone with them leaves. [PE.L2-3.10.5]

4. Away from the shop
4.1 Anyone working with CUI from home or another site uses a company device, keeps the screen out of view, prints only with approval and stores any paper in a locked place. [PE.L2-3.10.6]

5. Evidence we keep
- The authorized access list and its reviews
- Visitor logs and badge or key records
- The rules given to staff who work from other sites

6. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

RISK ASSESSMENT POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.11 Risk assessment (3 requirements, CMMC RA.L2-3.11.1 to RA.L2-3.11.3)

1. Purpose
How often we look for risk and vulnerabilities, and how fast we fix what we find.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Assessing risk
3.1 The Operations Manager assesses the risk to Halvorsen Precision Machining LLC's operations, assets and people from the way we handle CUI every 12 months, and again after a major change. [RA.L2-3.11.1]

4. Vulnerabilities
4.1 Northgate IT scans in-scope systems and applications for vulnerabilities monthly, and again when a new vulnerability affecting them is announced. [RA.L2-3.11.2]
4.2 Vulnerabilities are fixed in order of risk, critical ones within 14 days, and anything that cannot be fixed in time goes on the plan of action with a reason. [RA.L2-3.11.3]

5. Evidence we keep
- The latest risk assessment and its review date
- Vulnerability scan reports
- Remediation records

6. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

SECURITY ASSESSMENT AND AUTHORIZATION POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.12 Security assessment (4 requirements, CMMC CA.L2-3.12.1 to CA.L2-3.12.4)

1. Purpose
How we check that our security works, plan the fixes and keep the system security plan current.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Checking
3.1 The Operations Manager assesses whether each security requirement is in place and working every 12 months. [CA.L2-3.12.1]
3.2 Between assessments, controls are monitored on an ongoing basis through log reviews, scan reports and access reviews. [CA.L2-3.12.3]

4. Plans
4.1 Every deficiency found goes on a plan of action with the fix, an owner and a date. [CA.L2-3.12.2]
4.2 Halvorsen Precision Machining LLC keeps a system security plan that describes the system boundary, the environment, how each requirement is met and the connections to other systems. It is updated every 12 months and whenever the system changes. [CA.L2-3.12.4]

5. Evidence we keep
- The last assessment and its results
- The plan of action
- The system security plan and its update history

6. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

SYSTEM AND COMMUNICATIONS PROTECTION POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.13 System and communications protection (16 requirements, CMMC SC.L2-3.13.1 to SC.L2-3.13.16)

1. Purpose
How the network boundary, the connections across it and the encryption that protects CUI are set up.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Boundaries
3.1 Northgate IT monitors, controls and protects traffic at the network's outer boundary and at the boundary around the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations). [SC.L2-3.13.1]
3.2 Network traffic is denied by default and allowed by exception, and the rules are reviewed when systems change. [SC.L2-3.13.6]
3.3 Anything reachable from the internet, such as a web server, sits on its own subnetwork separated from the internal network. [SC.L2-3.13.5]
3.4 Remote devices on the VPN cannot use a second connection to the internet at the same time (no split tunneling). [SC.L2-3.13.7]

4. Design and separation
4.1 New systems and changes are designed with security in mind: proven architectures, secure settings and the least access needed. [SC.L2-3.13.2]
4.2 Administration tools and interfaces are kept separate from everyday user functions. [SC.L2-3.13.3]
4.3 Shared system resources such as shared drives and memory do not pass information between users who should not see it. [SC.L2-3.13.4]

5. Encryption
5.1 CUI is encrypted in transit unless alternative physical safeguards protect it, and at rest wherever it is stored. [SC.L2-3.13.8, SC.L2-3.13.16]
5.2 Cryptography used to protect CUI is FIPS-validated. [SC.L2-3.13.11]
5.3 Northgate IT creates, stores, rotates and retires cryptographic keys under a written procedure. [SC.L2-3.13.10]
5.4 Communications sessions are protected against hijacking and forgery, for example by certificate-based encryption. [SC.L2-3.13.15]

6. Sessions and devices
6.1 Network connections end at the end of a session or after the inactivity period set in each system. [SC.L2-3.13.9]
6.2 Cameras and microphones in meeting rooms cannot be switched on remotely, and show when they are in use. [SC.L2-3.13.12]
6.3 Mobile code (scripts and macros from outside) is limited to what the business needs and is monitored. [SC.L2-3.13.13]
6.4 Internet phone systems (VoIP) are approved, configured securely and monitored. [SC.L2-3.13.14]

7. Evidence we keep
- Network diagrams with the external and internal boundaries
- Firewall rules and VPN settings
- FIPS validation certificates for the encryption used to protect CUI

8. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

SYSTEM AND INFORMATION INTEGRITY POLICY
Halvorsen Precision Machining LLC

Policy owner: Dana Ruiz, Operations Manager
Approved by: Mark Halvorsen, President
Effective date: 2026-11-02
Review: every 12 months
Requirements: NIST SP 800-171 Rev 2, family 3.14 System and information integrity (7 requirements, CMMC SI.L2-3.14.1 to SI.L2-3.14.7)

1. Purpose
How flaws get patched, malicious code is kept out and the systems are watched for attacks and misuse.

2. Scope
This policy applies to everyone who works for or on behalf of Halvorsen Precision Machining LLC and to the CUI enclave (cloud email and file storage, and the four CAD/CAM workstations), as described in the system security plan.

3. Flaws and alerts
3.1 Northgate IT identifies, reports and corrects system flaws on time: critical patches within 14 days, others in the next monthly cycle. [SI.L2-3.14.1]
3.2 Northgate IT follows security alerts and advisories from vendors and government sources and acts on the ones that affect us. [SI.L2-3.14.3]

4. Malicious code
4.1 Malicious code protection runs on every in-scope computer and server and at the email and web gateways. [SI.L2-3.14.2]
4.2 It updates automatically whenever a new release is available. [SI.L2-3.14.4]
4.3 It scans files in real time as they are downloaded, opened or run, and runs a full scan of each system weekly. [SI.L2-3.14.5]

5. Monitoring
5.1 Northgate IT monitors in-scope systems and inbound and outbound traffic for attacks and signs of attack. [SI.L2-3.14.6]
5.2 Authorized use is defined in the access control policy, and use outside it is identified and reported as an incident. [SI.L2-3.14.7]

6. Evidence we keep
- Patch records against the flaws found
- Malicious code protection settings and scan results
- Monitoring alerts and how they were handled

7. Exceptions and review
Any exception is approved in writing by the approving official, recorded with its reason and end date, and reflected in the system security plan. This policy is reviewed on the cycle above and whenever our systems, contracts or the rules change.

Approved: ______________________   Date: ____________

Status as of 2026-10-23

In force today: DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
Suspended: Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
Not yet known: The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23

What still applies while Phase 2 is suspended

Quick reference

Fourteen pockets, fourteen policies: one per family, each pointing at the requirements it answers.

110 requirements in 14 families, one policy each.

The 14 NIST SP 800-171 Rev 2 families, their policy and requirement count
3.1 AC	Access control	22
3.2 AT	Awareness and training	3
3.3 AU	Audit and accountability	9
3.4 CM	Configuration management	9
3.5 IA	Identification and authentication	11
3.6 IR	Incident response	3
3.7 MA	Maintenance	6
3.8 MP	Media protection	9
3.9 PS	Personnel security	2
3.10 PE	Physical protection	6
3.11 RA	Risk assessment	3
3.12 CA	Security assessment	4
3.13 SC	System and communications protection	16
3.14 SI	System and information integrity	7

What a CMMC policy is, and what it is not

A security policy is the written rule your shop follows for one family of NIST SP 800-171 requirements: who may sign in, how long logs are kept, what happens to a drive before it leaves the building. CMMC Level 2 is the 110 requirements of NIST SP 800-171 Rev 2, grouped in 14 families, so this generator writes 14 policies and tags every clause with the requirement it answers.

Rev 2 has no requirement that says “write a policy”. NIST tailored the policy-and-procedure controls (AC-1, AU-1 and the rest) out of the requirement set and marked them NFO, “expected to be routinely satisfied by nonfederal organizations without specification”. In practice the policy still carries weight: NIST SP 800-171A lists the family's policy first among the documents an assessor may examine, and many of its objectives ask that something be “defined”, such as how many failed logons lock an account. A policy is the natural place to define it. Rev 3 makes the duty explicit in requirement 03.15.01, but DoD binds Rev 2 today; how the two revisions and CMMC fit together is in CMMC vs NIST SP 800-171.

Caution

A policy alone does not meet a requirement. An assessor checks each requirement's objectives against what is implemented, and examines the settings, logs and records that show it. A policy that says screens lock after 15 minutes is a finding if the screens do not. Write what you do, then do what you wrote, and keep the evidence the policy lists.

How to use the policy generator

Five steps

01Fill in your shop. Company, the person who owns the policies, the person who approves them, who runs your IT and where your CUI lives.
02Set the values. Open the settings and type what your systems actually enforce: lockout, screen lock, password rules, log retention, patch window.
03Pick the policies. All fourteen are ticked. Untick a family only if your system security plan already covers it in another document.
04Edit until it is true. Open each policy, change any sentence that does not describe your shop, and delete what you do not do. Copy or download each one.
05Approve, train, file. The approver signs and dates each policy, staff are told what changed, and the system security plan points to where the policies live.

The policies are one layer of the paperwork. The system security plan template describes how each requirement is implemented and should point to these policies; the NIST SP 800-171 checklist tells you which requirements are actually met; and anything not met yet belongs in the POA&M builder, within the limits the rule sets.

The numbers NIST leaves to you

NIST never says how many failed logons should lock an account or how long to keep logs. NIST SP 800-171A asks only that the value be defined, and in the next objective it usually checks that the defined value is implemented. That is why the generator asks for numbers: each one below is an objective an assessor will look for in writing, and then in your settings.

14 values to define

NIST SP 800-171A objectives that ask for a defined value
Objective	What 800-171A asks (its words)	Example shop	Set in
3.1.8[a]	The means of limiting unsuccessful logon attempts is defined.	5 failed tries	Form
3.1.10[a]	The period of inactivity after which the system initiates a session lock is defined.	15 minutes	Form
3.1.11[a]	Conditions requiring a user session to terminate are defined.	8 hours; end of shift	Policy text
3.3.1[e]	Retention requirements for audit records are defined.	365 days	Form
3.5.6[a]	A period of inactivity after which an identifier is disabled is defined.	45 days	Form
3.5.7[a]	Password complexity requirements are defined.	14 characters, mixed	Form
3.5.8[a]	The number of generations during which a password cannot be reused is specified.	24 passwords	Form
3.11.1[a]	The frequency to assess risk to organizational operations, organizational assets, and individuals is defined.	Every 12 months	Form
3.11.2[a]	The frequency to scan for vulnerabilities in organizational systems and applications is defined.	monthly	Form
3.12.1[a]	The frequency of security control assessments is defined.	Every 12 months	Form
3.12.4[g]	The frequency to update the system security plan is defined.	Every 12 months	Form
3.13.9[a]	A period of inactivity to terminate network connections associated with communications sessions is defined.	Set per system	Policy text
3.14.1[e]	The time within which to correct system flaws is specified.	14 days (critical)	Form
3.14.5[a]	The frequency for malicious code scans is defined.	Weekly full scan	Policy text

Pick numbers your systems can enforce today, not the strictest you have read about. If the policy says 14 days to patch a critical flaw and the patch report shows 40, the policy has created a finding instead of preventing one.

Worked example: a 22-person CNC shop

The tool opens on a fictional job shop, Halvorsen Precision Machining LLC: 22 people, drawings marked as CUI arriving from a prime, an outside IT provider, and CUI kept in a small enclave of cloud email, cloud storage and four CAD/CAM workstations. The operations manager owns the policies and the president approves them.

Weak and strong

AC.L2-3.1.8

Weak

Access to systems is restricted appropriately and accounts are protected against password guessing.

Strong

An account locks after 5 failed sign-in attempts in a row and stays locked until Northgate IT unlocks it or the lockout period ends.

The weak line defines nothing, so objective [a] has no answer and an assessor has no number to test the setting against.

IR.L2-3.6.2

Weak

Incidents will be reported to the appropriate authorities in a timely manner.

Strong

Cyber incidents affecting covered defense information are reported to DoD at https://dibnet.dod.mil within 72 hours of discovery, and the report number goes to the prime.

DFARS 252.204-7012 already sets the clock and the place. A policy that does not say them leaves staff to guess on the worst day of the year.

Then follow one sentence all the way through. The policy defines the number, the system enforces it, and a record proves it. Miss either of the last two and the requirement is not met, however good the wording.

One setting, end to end

Policy: AC 4.1: "An account locks after 5 failed sign-in attempts…"
Setting: The account lockout threshold in the identity system, set to 5.
Evidence: A dated screenshot or export of that setting, filed with the SSP.
Objectives: 3.1.8[a] defined (the policy), 3.1.8[b] implemented (the setting).

The incident clause matters even with CMMC's third-party phase on hold: DFARS 252.204-7012 still binds, and its 72-hour reporting rule belongs in the policy your staff will open on the day something goes wrong.

Where the rule leans on your policies: the shop floor

For two kinds of asset, the CMMC rule itself points at your policies rather than at the 110 requirements. Both are common in a machine shop: the CNC controls, coordinate measuring machine and test rigs that may run a program built from a CUI drawing, and the office laptops that could hold CUI but are not meant to.

Rule text

Specialized Assets
Assets that can process, store, or transmit CUI but are unable to be fully secured, including: Internet of Things (IoT) devices, Industrial Internet of Things (IIoT) devices, Operational Technology (OT), Government Furnished Equipment (GFE), Restricted Information Systems, and Test Equipment.
Show these assets are managed using the contractor's risk-based security policies, procedures, and practices.

Contractor Risk Managed Assets
Assets that can, but are not intended to, process, store, or transmit CUI because of security policy, procedures, and practices in place.
If OSA's risk-based security policies, procedures, and practices documentation or other findings raise questions about these assets, the assessor can conduct a limited check to identify deficiencies.

32 CFR 170.19(c)(1), table 3

So the policies are not only paperwork for the 110 requirements. For specialized assets they are the thing the assessor reviews, and for contractor risk managed assets they are what keeps CUI off a machine in the first place. Name those machines in the policies: the configuration management policy can say how a networked controller is isolated and who may load programs onto it, and the media protection policy can say how a USB stick moves a program to an old control that has no network at all. Decide which machines fall where with the CMMC scoping worksheet first.

Takeaway

Add one sentence per machine type to the policy that governs it, then make the asset inventory, the system security plan and the policy name the same machines. Two more places worth a careful sentence: how drives are wiped before a machine or PC is sold (see NIST 800-88 media sanitization), and what the yearly training actually covers (see CUI training).

Questions about CMMC policies

Questions

Do I need 14 separate policy documents?

No format is required. NIST's own discussion in Rev 3 says policies “can be included as part of the organizational security policy or be represented by separate policies that address each family”. One document with 14 sections works as well as 14 files, as long as every family is covered and the system security plan says where to find it. The generator gives you both: copy one policy, or copy or download all of them as one file.

Will these policies make my shop CMMC compliant?

No. A policy states what you will do. Each requirement is met only when it is implemented and you can show the evidence, and a Level 2 self-assessment is scored on the requirements, not on the paperwork. Check where you stand with the NIST SP 800-171 checklist and the SPRS score calculator.

Do I need policies for CMMC Level 1?

Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21, and it is MET or NOT MET in its entirety. None of the 15 is a policy requirement, but writing down who may use which systems and how media is destroyed makes the yearly self-assessment and affirmation easier to stand behind. The CMMC Level 1 checklist covers what each one asks.

How often do policies have to be reviewed?

Rev 2 sets no cycle for policies; the policy controls were left to organizations. Rev 3's 03.15.01 asks you to review and update them at a frequency you define. The generator uses your review cycle for the policies, the risk assessment, the control assessment and the SSP update, because Rev 2 asks you to define a frequency for each of the last three. Twelve months is the example, not a rule.

Who should approve and sign them?

Someone with the authority to make the shop follow them, usually the owner or president. That is often the same person who acts as the Affirming Official, the senior representative who affirms the assessment in SPRS, but signing a policy and affirming in SPRS are separate acts.

Is anything I type saved or sent anywhere?

No. The policies are built in your browser; nothing is stored or sent, and closing the page clears it. Download or copy your text before you leave.

CMMC policy templates

Step 1Your shop

Step 2Pick the policies

Step 3Your policies

Access control policy

1. Purpose

2. Scope

3. Who gets access

4. Signing in and leaving a session

5. Remote access

6. Wireless and mobile devices

7. CUI paths, outside systems and public posting

8. Evidence we keep

9. Exceptions and review