4 Word Documents + SPRS Workbook. 110 Controls. Assessment-Ready.

CMMC Level 2 Compliance
Without the $50K Consultant

You need CMMC Level 2 to keep your DoD contracts. This kit gives you a System Security Plan with an implementation statement, the assessment objectives, and the evidence list for every one of the 110 controls (about 25,000 words), an SPRS scoring workbook that applies the 32 CFR 170.24 point values, a POA&M tracker, and assessment prep, built by an Information System Security Manager at a DoD contractor. Fill in the brackets, not a blank page.

Get the Builder - $397 See What's Inside

Version 3.0, updated 19 October 2026. Instant download by email after payment. Licensed to one organization, every employee included. Licence terms. 14-day refund, any reason. How refunds work. Download a sample (PDF), the opening pages of one document.

What's Happening Right Now

CMMC 2.0 is live. The compliance window is closing faster than most contractors realize.

2025–2028 Rollout

CMMC 2.0 Is Not Optional

The DoD is requiring CMMC Level 2 certification for all contracts involving CUI. The phased rollout is active - new RFPs are already including CMMC requirements. Without certification, you lose contract eligibility.

Active Requirement

SPRS Scores Under Scrutiny

The DoJ has pursued False Claims Act cases against contractors with inaccurate SPRS scores. Self-attestation without documented evidence is a legal liability, not just a compliance gap.

Limited C3PAO Capacity

Assessment Bottleneck

There aren't enough C3PAOs to assess every DIB contractor. Wait times are growing. The earlier you're assessment-ready, the earlier you get certified. Starting from scratch when your RFP drops is too late.

4 Word Documents and an SPRS Workbook. 110 Controls.

Built by an ISSM at a DoD contractor, with CISSP and CISM certifications. Not a generic template mill.

01

System Security Plan

The plan an assessor reads. System identification, boundary, architecture, interconnections, CUI types, and users, then every one of the 110 requirements with its SPRS value and POA&M eligibility, a worked implementation statement with bracketed placeholders, the assessment objectives paraphrased from NIST SP 800-171A, and the evidence to attach. A continuous monitoring schedule, POA&M summary, approval page, and Not Applicable appendix close it. About 25,000 words.

1 Word document
02

Control Implementation Guide

The quick reference: one short implementation statement per control with its SPRS weight and the evidence to collect, organized by family. Use it to brief staff and to answer an assessor's question in one paragraph; the SSP holds the full version.

1 Word document
03

POA&M Tracker

Plan of Action & Milestones table with 15 entry rows (control, gap, risk level, remediation plan, owner, and target date) and a status summary, plus the same tracker as a sheet in the scoring workbook with a formula that tells you whether each item may stay open at a Conditional assessment.

1 Word document
04

Assessment Prep

A 12-week preparation timeline, what the assessor will do, 18 common interview questions across four roles, an evidence folder structure by control family, and five common pitfalls.

1 Word document
05

SPRS Scoring Workbook

Mark each of the 110 requirements Implemented, Not implemented, Partially implemented, or Not applicable and the score calculates itself with the 32 CFR 170.24 point values, including the 3-point partials for 3.5.3 and 3.13.11. A summary shows whether you clear the 88-point threshold and how many open items block a Conditional status under 170.21. Sheets for the POA&M (with eligibility formulas) and an evidence index pre-filled from the SSP.

1 Excel workbook

Built for Defense Contractors Handling CUI

If you touch Controlled Unclassified Information under a DoD contract, you need CMMC Level 2.

Defense

DIB Subcontractors

Small manufacturers, machine shops, and service providers in the defense industrial base who handle CUI but can't afford a $50K–$150K consulting engagement.

IT & MSP

Defense IT Providers

MSPs and IT service companies supporting defense contractors. Need CMMC certification themselves and need to demonstrate compliance to their clients.

Engineering

Engineering Firms

Engineering and technical services firms with DoD subcontracts. Often handle CUI in design documents, specifications, and technical data packages.

Any DIB

Any CUI Handler

If you handle Controlled Unclassified Information under a DoD contract and need CMMC Level 2, this kit was built for you.

Real Compliance Expertise

This kit was built by someone who lives this work every day.

ISSM at a DoD Contractor

Currently serving as Information System Security Manager for a US Department of Defense contractor. This isn't theoretical - it's the same framework used in practice.

CISSP & CISM Certified

Industry-recognized certifications in information security management. The same credentials C3PAO assessors hold.

110 Controls Mapped

Every NIST SP 800-171 Rev 2 control covered: an implementation statement, its SPRS weight, and the evidence to collect.

Strengthen Your Security Program

Already bought another Solas AI product? Use code SOLAS20 for 20% off.

AI Compliance Toolkit - $247

Using AI tools in your defense work? Cover HIPAA, EU AI Act, FTC, and ethics compliance alongside your CMMC program.

Security Questionnaire Response Kit - $297

Win more contracts by responding to customer security questionnaires faster with pre-drafted answers and evidence mapping.
One-Time Purchase
$397

4 Word documents and an Excel scoring workbook. 110 controls. Core documentation for CMMC Level 2.

  • System Security Plan with all 110 requirements written out: implementation statement, assessment objectives, evidence (about 25,000 words)
  • SPRS Scoring Workbook with the 32 CFR 170.24 point values and the 170.21 Conditional-status checks
  • Control Implementation Guide: the one-paragraph version of each control
  • POA&M tracker with status summary
  • Evidence to collect for each of the 110 controls
  • SPRS weight for every control and a score summary
  • Assessment prep guide with a 12-week timeline and interview questions
  • Single-organization commercial licence, every employee included
Buy Now - $397

Instant download. Four Word documents (.docx) and one Excel workbook (.xlsx). Version 3.0, 19 October 2026.

Questions

Is this enough for CMMC Level 2 certification?

This kit provides the core documentation a C3PAO assessment looks at: an SSP template, implementation statements for all 110 controls, a POA&M tracker, and evidence guidance. It does not include written policy documents; you write those separately. You still need to implement the controls in your environment, collect real evidence, and pass the assessment. The kit reduces the documentation work so you can focus on implementation.

What format are the documents?

Four Word documents (.docx) and one Excel workbook (.xlsx). Open in Microsoft Word and Excel, Google Docs and Sheets, or LibreOffice. Easy to customize with your organization's details.

Do I need all 110 controls?

CMMC Level 2 requires all 110 NIST SP 800-171 Rev 2 controls. Some may be marked Not Applicable if your system boundary excludes certain scenarios, but you must document the justification. The SSP template has Implemented and In POA&M columns for each of the 14 control families, and the POA&M tracker logs each open gap.

How is this different from buying NIST SP 800-171?

The NIST standard tells you what to do. This kit gives you the templates to prove you did it. Pre-written implementation statements, evidence collection guidance, and the exact document structure that assessors expect.

Can I use this for CMMC Level 1?

Level 1 requires 15 of the 110 controls and allows self-assessment. This kit covers all 110, so it's more than you need for Level 1 - but it gives you a head start if you later need Level 2.

What about AI tools used in defense work?

Using AI tools that process CUI triggers additional CMMC considerations - specifically around data handling, vendor risk management, and the chain of custody for information processed by third-party AI systems. This kit has no AI-specific guidance. Record any AI tool that touches CUI as a component or external connection in the SSP template's system boundary and interconnection sections.

We use cloud services for some CUI processing. How does this handle that?

CMMC Level 2 has specific requirements for cloud service providers handling CUI - they need to be FedRAMP authorized or equivalent. The SSP template has a field for your cloud provider and region and asks you to list the cloud services inside your system boundary. The implementation statements for facility protection, key management, and FIPS-validated cryptography include cloud-hosted wording. The kit does not include a FedRAMP checklist or provider-specific guidance.

David A. Moline, CISSP | CISM

Your AI automation, built by someone who secures DoD systems.

AI certifications Johns Hopkins IBM Google

Get Assessment-Ready Before the Deadline

CMMC requirements are already appearing in DoD RFPs. Every month you wait is a month closer to losing contract eligibility.

Get the Builder - $397 Book a Compliance Call