Mockups/§3.7 Framework & assessment

a b c

Framework overview + SPRS calculator — Score header with sub-bars, family posture cards, a what-if SPRS calculator with POA&M eligibility per NOT MET item and the 180-day closeout clock, plus an ISO 27001 ↔ 800-171 evidence-reuse mapping tab.

CMMC Level 2

NIST SP 800-171 r2 · 110 requirements · 320 assessment objectives (800-171A)

C3PAO assessment · Mar 2027Scope: CUI enclave (14 assets) · Lead: MLMarcus Lee

SPRS score (current)

71/ 110No CMMC status

−203tick = Conditional ≥ 88 · max 110

Requirements MET89 of 110

Policies & plans

31/33

Records

44/52

Config exports

18/23

Test results

12/19

Objectives (800-171A)

Met268Not met29N/A9Not assessed14

Assessment timeline

Self-assessmentOct 2026
SPRS submissionDec 15
C3PAO assessmentMar 8–19, 2027
POA&M closeoutby Sep 15, 2027

What-if: SPRS calculator

Tick the NOT MET requirements you will remediate before the assessment.

Req.	Title · why NOT MET	Weight	POA&M	Owner
3.1.12	Monitor and control remote access sessions [d] session monitoring not evidenced	5 pt	Planned fix	TO
3.5.3	Multifactor authentication for local and network access [b] local privileged console has no MFA	5 pt	Planned fix	DW
3.14.1	Identify, report and correct system flaws Not assessed — counted as NOT MET	5 pt	Planned fix	TO
3.13.11	FIPS-validated cryptography to protect CUI Encryption used, module not FIPS-validated (partial credit)	5 3 pt	POA&M eligible	DW
3.11.1	Periodically assess risk to operations and assets Risk assessment last run Feb 2025	3 pt	Not eligible · weight > 1	ML
3.8.8	Prohibit portable storage without an identifiable owner USB policy not enforced on NX pool	3 pt	Not eligible · weight > 1	TO
3.1.20	Verify and control connections to external systems Vendor VPN not in connection inventory	1 pt	Never on POA&M (§170.21)	TO
3.10.4	Maintain audit logs of physical access Badge logs retained 30 days only	1 pt	Never on POA&M (§170.21)	PN
3.8.9	Protect confidentiality of backup CUI Offsite tapes unencrypted	1 pt	POA&M eligible	TO
3.1.8	Limit unsuccessful logon attempts Lockout threshold not set on 2 servers	1 pt	POA&M eligible	TO
3.1.10	Session lock with pattern-hiding displays Shop-floor HMIs exempted without rationale	1 pt	POA&M eligible	TO
3.1.11	Terminate user sessions after a defined condition Condition not defined in SSP	1 pt	POA&M eligible	ML
3.3.4	Alert in the event of an audit logging failure No alert rule in SIEM	1 pt	POA&M eligible	TO
3.3.8	Protect audit information and tools Log share writable by IT group	1 pt	POA&M eligible	TO
3.4.9	Control and monitor user-installed software Allow-listing in audit mode only	1 pt	POA&M eligible	TO
3.5.8	Prohibit password reuse for a specified number of generations History = 5, SSP says 24	1 pt	POA&M eligible	TO
3.5.9	Temporary passwords with immediate change Service desk script skips force-change	1 pt	POA&M eligible	TO
3.6.3	Test the incident response capability Last tabletop exercise > 12 months	1 pt	POA&M eligible	DW
3.13.9	Terminate network connections at end of session VPN idle timeout 24 h	1 pt	POA&M eligible	TO
3.13.10	Establish and manage cryptographic keys Key inventory incomplete	1 pt	POA&M eligible	DW
3.2.3	Insider-threat awareness training Module not assigned to contractors	1 pt	POA&M eligible	SA

Projected at assessment

86/ 110

No CMMC status

Score < 88 or a NOT MET item cannot go on a POA&M.

Score ≥ 88 (0.8 × 110)86
Every open item is POA&M-eligible4 blocking

Open after fixes

18 requirements

POA&M-eligible

14 of 21

POA&M rules (§170.21)

Only 1-point requirements, plus 3.13.11 at 3 points when encryption is used but not FIPS-validated.
Never on POA&M: 3.1.20 3.1.22 3.12.4 3.10.3–5
Closeout assessment within 180 days, or Conditional status lapses.

Posture by family

Vanta category cards ecd5d521

AC−9 pts

Access Control

17 of 22

AT−1 pts

Awareness and Training

2 of 3

AU−2 pts

Audit and Accountability

7 of 9

CM−1 pts

Configuration Management

8 of 9

IA−7 pts

Identification and Authentication

8 of 11

IR−1 pts

Incident Response

2 of 3

Maintenance

6 of 6

MP−4 pts

Media Protection

7 of 9

Personnel Security

2 of 2

PE−1 pts

Physical Protection

5 of 6

RA−3 pts

Risk Assessment

2 of 3

Security Assessment

4 of 4

SC−5 pts

System and Communications Protection

13 of 16

SI−5 pts

System and Information Integrity

6 of 7

Loading mockup…