Docs
Open Moduvio
Tutorial

Tutorial: Build a bounded CMMC Level 2 readiness record

Pin an approved compliance register, assess the immutable 110-practice catalogue, calculate the internal readiness score and independently close only eligible POA&M.

Learning goal

Audience

Internal Auditors, Compliance Managers, QA Heads, Quality Management Representatives, Security & Compliance Officers and read-only Auditors.

Goal

Produce an attributable internal-readiness evidence chain while preserving external assessor, certification, SPRS and every source-domain authority.

Before you begin

  • Use an authorised disposable training tenant
  • An exact Flow 21 compliance register is active and approved
  • The CUI boundary and SSP reference are known
  • CLEAN controlled evidence is available in the same site and within classification
  • Different named assessment, review, POA&M and closeout users are available
Use safe learning data

Observation-first is the default. Do not create retained customer, procurement, receipt, inventory, Quality, Engineering or Manufacturing records merely to complete a tutorial.

Guided journey

  1. 1
    Governance / Quality

    Verify the governing register

    Open /quality/compliance-controls
    Acting role
    Internal Auditor
    What to do
    Confirm the obligations and configured controls are independently approved, then select that exact active register version in CMMC readiness.
    What you should observe
    The assessment freezes the framework/register identity, site and classification; later register amendments do not rewrite it.
    May change

    Nothing during verification; the later assessment stores only exact source references/snapshots.

    Must remain unchanged

    Configured controls, audit programmes, users, MFA, classification and operational records remain authoritative.

  2. 2
    Governance / Quality

    Save the scoped checkpoint

    Open /quality/cmmc-readiness
    Acting role
    Internal Auditor
    What to do
    Record title, scope, CUI boundary, SSP reference, period and scoped asset category/owner, attach CLEAN evidence and save immutable v1.
    What you should observe
    All 110 practices exist once as NOT ASSESSED and the draft score reflects their complete weighted deduction without claiming a final result.
    May change

    Assessment/version/asset/finding snapshots, controlled links, audit and outbox only.

    Must remain unchanged

    No certification, submission, workflow, source-control or operational transaction occurs.

  3. 3
    Governance / Quality

    Assess all 110 practices

    Open /quality/cmmc-readiness
    Acting role
    Internal Auditor
    What to do
    Create a new immutable checkpoint and record each exact finding, implementation state, methods, rationale, optional configured-control map, narrative and controlled evidence.
    What you should observe
    Only MFA and FIPS permit partial scoring; NOT ASSESSED blocks submission and the score is deterministic.
    May change

    A new immutable version and 110 evidence-backed finding snapshots.

    Must remain unchanged

    Earlier checkpoints and their scores remain immutable.

  4. 4
    Quality

    Review independently

    Open /quality/cmmc-readiness
    Acting role
    Different QA Head / QMR
    What to do
    Approve or reject the complete submitted version with controlled decision evidence.
    What you should observe
    The author/submitter cannot review; the approved record continues to say internal readiness only.
    May change

    Version decision, active approved pointer, audit and outbox facts.

    Must remain unchanged

    No assessor decision, certification or SPRS submission is represented.

  5. 5
    Governance

    Plan only eligible remediation

    Open /quality/cmmc-readiness
    Acting role
    Compliance Manager → different QA/QMR
    What to do
    Select an eligible approved NOT MET finding, enter root cause, plan, risk, target and ordered milestone evidence, submit and obtain independent approval.
    What you should observe
    The score must be at least 88, six prohibited practices fail closed and target closeout is limited to 180 days.
    May change

    Immutable POA&M plan/milestone/review evidence.

    Must remain unchanged

    The approved assessment score and source system do not change.

  6. 6
    Governance / Quality

    Close and re-assess

    Open /quality/cmmc-readiness
    Acting role
    Compliance Manager → different QA/QMR → Internal Auditor
    What to do
    Submit objective revalidation evidence, obtain independent closeout verification, then create a new assessment checkpoint if a new score is justified.
    What you should observe
    Closure changes POA&M status only; the old score remains, while bounded JSON export preserves the internal-only notice.
    May change

    Closeout/review evidence and, separately, a later new assessment version when authorised.

    Must remain unchanged

    No external delivery, source mutation, identity, receipt, custody, stock, ledger or notification occurs.

Continue learning

CMMC readiness guideReview exact fields, scoring, POA&M and authority boundaries.CMMC readiness workflowSee the official internal assessment role handoff.Compliance-control guideApprove the governing register before assessment.

Documentation version 2026.09

Last reviewed August 2026