Scoping
CUI identification worksheet, system boundary template, and asset inventory. Define exactly what's in scope before you document a single control.
3 files 44 Documents. 110 Controls. Assessment-Ready. CMMC Level 2 Compliance
CMMC Level 2 Compliance
Without the $50K Consultant
You need CMMC Level 2 to keep your DoD contracts. This kit gives you every template - SSP, POA&M, policies, evidence maps, and assessment prep - built by an active DoD Information System Security Manager. Fill in the blanks, not a blank page.
What's Happening Right Now
CMMC 2.0 is live. The compliance window is closing faster than most contractors realize.
2025â2028 Rollout
CMMC 2.0 Is Not Optional
The DoD is requiring CMMC Level 2 certification for all contracts involving CUI. The phased rollout is active - new RFPs are already including CMMC requirements. Without certification, you lose contract eligibility.
Active Requirement
SPRS Scores Under Scrutiny
The DoJ has pursued False Claims Act cases against contractors with inaccurate SPRS scores. Self-attestation without documented evidence is a legal liability, not just a compliance gap.
Limited C3PAO Capacity
Assessment Bottleneck
There aren't enough C3PAOs to assess every DIB contractor. Wait times are growing. The earlier you're assessment-ready, the earlier you get certified. Starting from scratch when your RFP drops is too late.
6 Sections. 44 Documents.
Built by an active DoD ISSM with CISSP and CISM certifications. Not a generic template mill.
01
02
System Security Plan
Full SSP template aligned to NIST SP 800-171 Rev 2, plus implementation statements for all 110 controls organized by family. The flagship of the kit.
16 files 03
POA&M
Plan of Action & Milestones template, POA&M tracker spreadsheet, and risk assessment with scoring matrix. Track every gap from finding to closure.
3 files 04
Policies
One policy template per control family - 14 total. Each includes purpose, scope, policy statements, roles, enforcement, and review cycle. Drop in your org name and go.
14 files 05
Evidence Mapping
Control-to-evidence map for all 110 controls, evidence collection guide, and screenshot standards. Know exactly what to collect and how.
3 files 06
Assessment Prep
Self-assessment checklist with SPRS scoring, C3PAO readiness guide, and the top 20 most common assessment findings with fixes.
3 filesBuilt for Defense Contractors Handling CUI
If you touch Controlled Unclassified Information under a DoD contract, you need CMMC Level 2.
Defense
DIB Subcontractors
Small manufacturers, machine shops, and service providers in the defense industrial base who handle CUI but can't afford a $50Kâ$150K consulting engagement.
IT & MSP
Defense IT Providers
MSPs and IT service companies supporting defense contractors. Need CMMC certification themselves and need to demonstrate compliance to their clients.
Engineering
Engineering Firms
Engineering and technical services firms with DoD subcontracts. Often handle CUI in design documents, specifications, and technical data packages.
Any DIB
Any CUI Handler
If you handle Controlled Unclassified Information under a DoD contract and need CMMC Level 2, this kit was built for you.
Real Compliance Expertise
This kit was built by someone who lives this work every day.
Active DoD ISSM
Currently serving as Information System Security Manager for a US Department of Defense contractor. This isn't theoretical - it's the same framework used in practice.
CISSP & CISM Certified
Industry-recognized certifications in information security management. The same credentials C3PAO assessors hold.
110 Controls Mapped
Every NIST SP 800-171 Rev 2 control covered: implementation statements, evidence mapping, policy templates, and self-assessment checklist.
Strengthen Your Security Program
Already bought another Solas AI product? Use code SOLAS20 for 20% off.
AI Compliance Toolkit - $247
Using AI tools in your defense work? Cover HIPAA, EU AI Act, FTC, and ethics compliance alongside your CMMC program.
Security Questionnaire Response Kit - $297
Win more contracts by responding to customer security questionnaires faster with pre-drafted answers and evidence mapping.
One-Time Purchase
$297
44 documents. 110 controls. Everything for CMMC Level 2.
- Full System Security Plan template (NIST 800-171r2)
- Implementation statements for all 110 controls
- 14 policy templates (one per control family)
- POA&M template and tracker spreadsheet
- Control-to-evidence map for all 110 controls
- Self-assessment checklist with SPRS scoring
- C3PAO readiness guide
- Asset inventory and CUI scoping tools
- Single-user commercial license
Instant download. Professional Word documents (.docx) + CSV formats for easy customization.
Questions
Is this enough for CMMC Level 2 certification?
This kit provides the complete documentation framework - SSP, policies, POA&M, evidence mapping - that a C3PAO assessment requires. You still need to implement the controls in your environment, collect real evidence, and pass the assessment. The kit eliminates the documentation burden so you can focus on implementation.
What format are the documents?
Professional Word documents (.docx) and CSV files. Open in Microsoft Word, Google Docs, or LibreOffice. Import CSVs into Excel or Sheets. Easy to customize with your organization's details.
Do I need all 110 controls?
CMMC Level 2 requires all 110 NIST SP 800-171 Rev 2 controls. Some may be marked Not Applicable if your system boundary excludes certain scenarios, but you must document the justification. The kit includes status fields for every control.
How is this different from buying NIST SP 800-171?
The NIST standard tells you what to do. This kit gives you the templates to prove you did it. Pre-written implementation statements, evidence collection guidance, and the exact document structure that assessors expect.
Can I use this for CMMC Level 1?
Level 1 requires 15 of the 110 controls and allows self-assessment. This kit covers all 110, so it's more than you need for Level 1 - but it gives you a head start if you later need Level 2.
What about AI tools used in defense work?
Using AI tools that process CUI triggers additional CMMC considerations - specifically around data handling, vendor risk management, and the chain of custody for information processed by third-party AI systems. The vendor management policy template and the scoping worksheet both include guidance for organizations using AI tools in CUI-adjacent workflows.
We use cloud services for some CUI processing. How does this handle that?
CMMC Level 2 has specific requirements for cloud service providers handling CUI - they need to be FedRAMP authorized or equivalent. The scoping worksheet and SSP template include cloud service inventory sections and guidance for documenting your cloud CUI handling arrangements in a way that satisfies assessors. Azure Government, AWS GovCloud, and similar FedRAMP-authorized services are covered.
David A. Moline, CISSP | CISM
Your AI automation, built by someone who secures DoD systems.
Johns Hopkins IBM Google
Get Assessment-Ready Before the Deadline
CMMC requirements are already appearing in DoD RFPs. Every month you wait is a month closer to losing contract eligibility.