CMMC Level 1 & Level 2 DIY Kit
CMMC Level 1 & Level 2 DIY Kit
Prepare Before CMMC Requirements Reach Your Contract
DoD is implementing CMMC requirements through a phased rollout. The CMMC level and assessment type that apply to your organization depend on the specific requirements included in an applicable solicitation, contract, task order, delivery order, subcontract, or flow-down requirement.
Organizations that process, store, or transmit Federal Contract Information or Controlled Unclassified Information should begin organizing their documentation, evidence, policies, procedures, System Security Plan, POA&M, and assessment records before those requirements are incorporated into applicable opportunities.
The Washington Process Group CMMC Level 1 & Level 2 DIY Kit provides practical templates, trackers, checklists, and guidance materials to help your team organize and manage readiness work internally.
What the Kit Helps You Do
- Organize CMMC Level 1 and Level 2 documentation
- Map policies, procedures, and evidence to applicable practices
- Build and maintain a System Security Plan
- Document open items using a POA&M
- Track implementation progress and readiness evidence
- Assign responsibilities and manage follow-up actions
- Prepare for the assessment type required by the applicable contract
- Support internal readiness reviews
What Is Included
The kit includes practical materials such as:
- CMMC Level 1 and Level 2 templates
- Practice-mapping tools
- System Security Plan templates
- POA&M templates
- Cybersecurity policies and procedures
- Evidence trackers
- Gap-assessment and readiness tools
- Roles and responsibilities materials
- Project and implementation trackers
- Internal review and assessment-preparation checklists
- Supporting guidance documents
Files are provided in editable formats, including DOCX, XLSX, and PDF, as applicable.
Who This Kit Is For
This kit is designed for:
- DoD prime contractors
- DoD subcontractors
- Organizations handling FCI or CUI
- Small and mid-sized defense suppliers
- Internal compliance, cybersecurity, quality, and operations teams
- Organizations that want to manage readiness work internally
- Organizations preparing for a Level 1 self-assessment
- Organizations preparing for a Level 2 self-assessment or C3PAO certification assessment, depending on the applicable contractual requirement
Prime contractors must flow applicable CMMC requirements to subcontractors when the subcontract requires the subcontractor to process, store, or transmit FCI or CUI and includes a required CMMC level.
Subcontractors should review the specific terms flowed down by the prime contractor to determine which systems, information, practices, and assessment requirements apply.
Assessment Path
The kit supports readiness work but does not determine which assessment type applies.
Level 1: Complete the required self-assessment, submit the assessment results in SPRS, and have the organization’s Affirming Official submit the required affirmation.
Level 2: Complete the assessment type required by the applicable solicitation or contract. Depending on the specific requirement, this may involve a Level 2 self-assessment or a C3PAO certification assessment.
Organizations should review the specific CMMC requirement included in the applicable solicitation, contract, subcontract, task order, or delivery order.
What You Receive After Purchase
This is a digital product.
After purchase, you will receive access to the downloadable files so your team can begin reviewing, customizing, and organizing the materials for its environment.
Important Notice
The toolkit provides a structured starting point for CMMC readiness work. It does not guarantee:
- CMMC certification
- Assessment success
- Contract eligibility
- Contract award
- Compliance with every contractual requirement
- Acceptance by a contracting officer, C3PAO, certification body, or government agency
Your organization is responsible for customizing the materials, implementing the applicable practices, maintaining evidence, and confirming the requirements that apply to its contracts, systems, and information.
Organizations should seek appropriate legal, contractual, cybersecurity, or assessment guidance when necessary.
Refund Policy
Digital product. Due to immediate electronic delivery, sales are final except for duplicate charges, delivery failures, defective or missing files, or where required by law.