CMMC Level 2 internal readiness
Assess the code-owned 110-practice CMMC Level 2 readiness catalogue, retain evidence and findings, and govern eligible POA&M remediation and closeout.
Screen orientation
CMMC readiness permissions, exact site and classification clearance apply. Assessment author/reviewer and POA&M author/closeout reviewer remain independent.
Select the exact active compliance register, define the assessment and asset boundary, complete every practice finding, then govern eligible POA&M milestones and closeout. The export is internal-only.
Field reference
The entries below describe the current screen controls and read-only values. They do not relax server-side validation, site scope, classification handling or required independence in a governed decision.
| Field or value | Control | Required or shown when | How to use or read it | Result |
|---|---|---|---|---|
| Exact active approved compliance register | Select | Required. | Choose the exact approved register version that anchors the assessment. | Pins the compliance framework and checksum. |
| Assessment title · Period start · Period end | Text and dates | Required. | Name and bound the internal readiness checkpoint. | Creates the assessment identity and period. |
| Assessment scope · CUI boundary · System security plan reference | Long text | Required. | Describe the assessed environment and authoritative SSP reference. | Freezes the declared boundary. |
| Asset identifier · Asset category · Asset description · Owner reference | Repeatable asset fields | At least one scoped asset is required. | List only assets inside the assessed boundary. | Creates the immutable asset snapshot. |
| Working controlled evidence | Controlled evidence | Required for authoring. | Select CLEAN evidence within scope. | Pins assessment evidence. |
| Finding · Implementation · Applicability rationale · Assessment narrative | Practice finding controls | All 110 practices require a complete finding. | Use the code-owned method and bounded partial-credit rules. | Calculates the immutable readiness score. |
| Submission note · Decision · Independent review rationale · Attributable action evidence | Transition controls | Required at submission/review. | Record an independent evidence-backed outcome. | Approves or rejects the exact scored version. |
| Root cause · Remediation plan · Residual risk · Target closeout (maximum 180 days) | POA&M controls | Required only for an eligible not-met finding. | Do not place prohibited practices on POA&M or exceed the bounded closeout window. | Creates the immutable remediation plan. |
| Milestone · Milestone date · Milestone completion criteria | Repeatable milestone fields | At least one complete milestone is required. | Define objective remediation checkpoints. | Freezes the planned remediation sequence. |
| Closure summary · Revalidation method | Closeout fields | Required for closeout submission. | Explain completed remediation and how the practice was revalidated. | Supports independent closeout review. |
Actions and effects
When to use: Against one exact approved compliance register.
What it does: Freezes catalogue, scope, assets, evidence and 110 findings.
When to use: After every practice is complete, by a different permitted reviewer.
What it does: Approves an internal readiness checkpoint; it is not certification or SPRS submission.
When to use: For an eligible not-met finding.
What it does: Records bounded remediation and milestones without changing the assessed source.
When to use: After remediation evidence, by an independent reviewer.
What it does: Approves or rejects closeout and retains revalidation evidence.
Lists and states
- Assessment and POA&M register: use status, exact version and accountable actors to distinguish current work from retained history.
- History and evidence: hashes and source/version references identify the immutable facts used by each decision.
Authority boundary
Moduvio provides internal readiness evidence only. It does not certify an organisation, act as a C3PAO, submit an SPRS score, change the generic compliance register or perform remediation automatically.