43. CMMC Level 2 internal readiness
Use one code-owned 110-practice CMMC Level 2 catalogue to collect bounded internal-readiness evidence against an exact approved compliance register, calculate the evidence score and independently govern eligible POA&M.
Purpose
Use one code-owned 110-practice CMMC Level 2 catalogue to collect bounded internal-readiness evidence against an exact approved compliance register, calculate the evidence score and independently govern eligible POA&M.
Internal Auditor, different QA Head or Quality Management Representative, Compliance Manager and read-only/export Auditor
CMMC-… draft checkpoint v1 → all-practices v2 score 108 → independent approval → eligible POAM-… plan → independent closeout; original score remains 108 until a new assessment version is approved.
Before you begin
- The governing Flow 21 compliance register is active and its exact version is approved
- The user's assigned site and clearance cover the register and evidence
- The CUI boundary and system security plan reference are known
- Controlled evidence documents are active and CLEAN
- Different named users are available for assessment, assessment review, POA&M ownership and independent plan/closeout review
Readiness, scoring and authority boundaries
The package pins version 2.13/32 CFR 2025 metadata, all 110 NIST SP 800-171 Rev. 2 practices, point values and a SHA-256 fingerprint. Tenants cannot add, edit or delete practices.
Every assessment retains one active approved generic compliance-register version in the same site and classification. Later register changes never rewrite the assessment.
Scope, CUI boundary, SSP reference, assets, findings, methods, mappings and evidence are copied into a new version. A checkpoint never edits an earlier version.
All 110 exact practice keys appear once. MET/NOT MET findings require at least one assessment method and CLEAN controlled evidence; NOT ASSESSED is allowed only before submission.
The display begins at 110 and subtracts code-owned 1/3/5 weights. Partial deduction is bounded to MFA and FIPS exceptions. The pack avoids publishing a disputed minimum range.
The approved score must be at least 88. Only permitted one-point findings and the bounded partial FIPS exception are eligible; the six prohibited practices fail closed and target closeout must be within 180 days.
A different reviewer verifies or rejects the evidence. Verified closure closes the plan but does not alter the approved assessment score; only a new assessment version can establish a new score.
Permission-controlled JSON contains only the scoped immutable readiness package and an explicit internal-only notice. It does not call an assessor, SPRS, customer endpoint, callback or external delivery service.
There is no certification claim, assessor authority, SPRS submission, arbitrary URL, executable content, command, tenant JavaScript, SQL, generic workflow/template or source-domain mutation.
Procedure
- 1
Open Compliance controls and verify the governing framework and exact register version are active/approved, site matched and classified within your clearance.
- 2
As Internal Auditor, create assessment v1, record the scope/CUI boundary/SSP/asset boundary and attach CLEAN evidence. Save immutable checkpoints while practices remain NOT ASSESSED.
- 3
Complete every practice with the exact finding, implementation state, applicability rationale, assessment methods, optional configured-control mapping, narrative and controlled evidence. Submit only after all 110 are assessed.
- 4
As a different QA Head or QMR, reject or approve the immutable assessment. Rejection requires a new checkpoint; approval never represents certification or external submission.
- 5
As Compliance Manager, open an eligible NOT MET finding, create the root cause, remediation plan, residual risk, target and ordered milestones with evidence, then obtain independent plan approval.
- 6
Submit closeout evidence and obtain independent verification. Export the bounded JSON only with cmmc:export permission and reconcile original score, audit/outbox history, zero delivery and unchanged operational source tables.
Expected result
- Exactly 110 immutable code-owned practice snapshots appear in every assessment version
- Only active approved same-site/classification register versions can be selected
- Site scope and clearance filter every read and transition; classified reads are audited
- Assessment author/submitter cannot approve the same version
- NOT ASSESSED practices block submission
- Only the two declared practices accept partial scoring
- POA&M threshold, prohibited-practice and 180-day rules fail closed
- POA&M author cannot approve their own plan or closeout
- Closeout never rewrites the approved score
- Export remains internal-only and creates no delivery
- Current stock, stock ledger, custody, identity, audit sources and configured controls remain authoritative and unchanged