Workflow

Flow 39 — CMMC Level 2 internal readiness

Attach the code-owned 110-practice catalogue to one exact active approved compliance register, retain scoped evidence and findings, calculate the bounded readiness score, and govern only eligible POA&M through independent closeout.

Overview

Inventory meaning

Flow 39 is compliance evidence only. It never certifies an organization, acts as an assessor, submits to SPRS, sends externally, changes a source control or audit, or creates/changes item identity, receipt, quarantine, inspection, custody, current stock, stock ledger, workflow or notification delivery.

Responsible roles

Internal Auditor assessment author → different QA Head / Quality Management Representative reviewer → Compliance Manager eligible POA&M author → different QA Head / Quality Management Representative plan and closeout reviewer → Auditor read-only/export

Process

1
Pin governing register
Select one exact active approved register version with the same site and classification.
Read-only source pin
2
Scope CUI boundary
Version the enclave, SSP reference, assessment period and scoped asset categories.
Immutable scope evidence
3
Assess 110 practices
Record applicability, MET/NOT MET, implementation, methods, optional control map and CLEAN evidence for every exact practice.
Code-owned score
4
Independent review
A different QA/QMR user approves or rejects the complete internal readiness version.
No certification claim
5
Govern eligible POA&M
Only permitted approved NOT MET findings above the readiness threshold can receive a bounded plan and milestones.
180-day closeout
6
Verify and export
Independent closeout preserves the old score; a new assessment is required for a new score, and export remains bounded JSON.
Read-only evidence package
READ ONLY

Role handoff

Detailed reference chapters

CMMC Level 2 internal readiness Compliance-control register and risk-based audit coverage Quality audit programmes, findings and closure Controlled documents and evidence Tenant access, MFA, users and roles roles

Detailed steps

1
First approve the governing obligations and configured-control mapping in Flow 21. Open Governance/Quality → CMMC readiness and select its exact active approved register version; the site and classification must match.
2
Record the assessment scope, CUI boundary, SSP reference, assessment period and categorized asset boundary. Save the first immutable checkpoint with controlled evidence; use later checkpoints instead of editing history.
3
Assess every one of the 110 exact catalogue practices. MET and NOT MET findings require EXAMINE, INTERVIEW or TEST method evidence; partial scoring is accepted only for the two code-owned exceptions. Submit only when none remain NOT ASSESSED.
4
As a different QA Head or QMR, approve or reject the assessment. Confirm the surface and bounded export say internal readiness only and never represent certification, an assessor decision or an SPRS submission.
5
As Compliance Manager, create a POA&M only where the approved finding is eligible and the approved score meets the threshold. Submit milestones and a target no later than 180 days after assessment approval; obtain independent plan approval.
6
Submit objective closeout evidence and obtain a different QA/QMR verification. Confirm the approved assessment still shows its original score; create a fresh immutable assessment version if re-assessment establishes a new score.

Field-by-field practice data

Use a disposable training tenant

Create a CMMC Level 2 internal-readiness assessment against one approved training compliance register, approve a 108 score, close one eligible POA&M and preserve the original score. The page shows sample set A; the workbook includes independent A, B and C values.

Download all workflow samples (.xlsx)

Field names match the current application labels. Select existing approved records where shown, leave optional values blank unless they genuinely apply, and never copy fictitious TRAIN values into live work.

Internal Auditor

Create the immutable scope checkpoint

Open /quality/cmmc-readiness

Select the exact active approved training register, define the CUI boundary and one scoped asset, attach CLEAN evidence and save v1.

Exact field name	Requirement	Sample value A	How to use it
Exact active approved compliance register	Select existing	`TRAIN-A-CMMC-REGISTER v1`	Select an existing active approved Flow 21 register with the same site and classification.
Assessment title	Required	`Training A CMMC Level 2 internal readiness`	Use an internal-readiness title, never a certification claim.
Period start	Required	`2026-09-01`	Use the bounded evidence-review period.
Period end	Required	`2026-09-30`	The end cannot predate the start.
Assessment scope	Required	`Training A controlled enclave and supporting services that store, process or transmit programme CUI.`	Describe the organizational and system boundary.
CUI boundary	Required	`Named training A endpoints, identity services, security tooling and authorized network paths.`	Describe what is inside and outside the CUI boundary.
System security plan reference	Required	`TRAIN-A-SSP-CUI-2026`	Use the controlled SSP reference.
Asset identifier	Required	`TRAIN-A-CUI-ENCLAVE-01`	Use one fictitious scoped asset identity.
Asset category	Required	`CUI_ASSET`	Choose CUI, security protection, contractor-risk-managed, specialized or out-of-scope according to the documented boundary.
Asset description	Required	`Primary training A controlled enclave for regulated programme records.`	Describe function and scope, not credentials or secrets.
Owner reference	Required	`Information Security — training A`	Use the accountable internal function/reference.
Working controlled evidence	Select existing	`TRAIN-A-CMMC-SCOPE-001`	Select a same-site CLEAN controlled document version.

Expected result: One immutable assessment version contains the exact catalogue/register fingerprint, scoped asset and all 110 NOT ASSESSED practice snapshots; it claims no certification or submission.

Internal Auditor

Assess all exact practices

Open /quality/cmmc-readiness

Create a new immutable checkpoint and complete every exact practice with finding, implementation, method, rationale, narrative and controlled evidence.

Exact field name	Requirement	Sample value A	How to use it
Finding	Required	`MET`	Use MET, NOT_MET or justified NOT_APPLICABLE; leave NOT_ASSESSED only before submission.
Implementation	Required	`FULL`	Use PARTIAL only where the code-owned practice explicitly permits it.
Applicability rationale	Required	`The training A CUI enclave requires an evidence-backed assessment of this exact practice.`	Give a practice-specific, scope-linked rationale.
Assessment narrative	Required	`Controlled policy, configuration and sampled test evidence demonstrate full implementation for training A.`	Record objective assessment conclusions.
Working controlled evidence	Select existing	`TRAIN-A-CMMC-EVIDENCE-001`	Apply an appropriate CLEAN evidence pack to assessed practices and refine per practice as needed.

Expected result: All 110 practices are assessed exactly once; two one-point NOT MET findings produce score 108 and submission becomes available.

Internal Auditor → different QA Head / QMR

Submit and independently review

Open /quality/cmmc-readiness

Submit the complete 110-practice checkpoint, then approve it as a different named reviewer with controlled decision evidence.

Exact field name	Requirement	Sample value A	How to use it
Submission note	Required	`All 110 training A practices have controlled evidence and are ready for independent review.`	Confirm completeness without claiming assessor authority.
Attributable action evidence	Select existing	`TRAIN-A-CMMC-SUBMIT-001`	Attach exact submission evidence.
Decision	Required	`APPROVE`	A different QA Head or QMR approves or rejects.
Independent review rationale	Required	`The scoped training A internal-readiness record is complete and independently reviewed without certification or SPRS claims.`	Explain the independent decision.

Expected result: The approved score and immutable findings remain attributable and the surface continues to state internal readiness only.

Compliance Manager → different QA Head / QMR

Create and approve eligible POA&M

Open /quality/cmmc-readiness

Choose one eligible approved NOT MET finding, record a bounded plan and milestone within 180 days, then obtain independent approval.

Exact field name	Requirement	Sample value A	How to use it
Root cause	Required	`Legacy training A security component does not yet implement the required safeguard.`	State the evidenced cause, not only the symptom.
Remediation plan	Required	`Replace the component, validate the safeguard and retain independently reviewable training A evidence.`	Describe bounded corrective work.
Residual risk	Required	`MEDIUM`	Select the risk retained while the approved plan remains open.
Target closeout (maximum 180 days)	Required	`2026-12-15`	Keep the target inside 180 days after assessment approval.
Milestone	Required	`Validated replacement installed — training A`	Use a measurable milestone title.
Milestone date	Required	`2026-12-01`	A milestone cannot fall after target closeout.
Milestone completion criteria	Required	`Approved configuration evidence and revalidation results are retained in the controlled document store.`	State objective completion evidence.
Controlled action evidence	Select existing	`TRAIN-A-POAM-PLAN-001`	Attach same-site CLEAN plan/review evidence.

Expected result: The plan opens without changing the original assessment score or source system.

Compliance Manager → different QA Head / QMR

Verify closeout without rewriting score

Open /quality/cmmc-readiness

Submit revalidation evidence and obtain independent closeout approval, then inspect the old assessment score and bounded export.

Exact field name	Requirement	Sample value A	How to use it
Closure summary	Required	`The training A replacement is installed and the original practice has been revalidated against controlled evidence.`	State completed remediation and result.
Revalidation method	Required	`Examine the approved configuration and test the safeguard using the retained training A validation procedure.`	Describe how closure was independently checked.
Controlled action evidence	Select existing	`TRAIN-A-POAM-CLOSE-001`	Attach exact CLEAN closeout and decision evidence.
Decision	Required	`APPROVE`	A different QA Head or QMR verifies or rejects closeout.
Independent review rationale	Required	`Independent training A revalidation supports closeout; a new assessment remains required for any score change.`	Preserve the score/reassessment boundary.

Expected result: The POA&M closes; the approved score remains 108 until a later immutable assessment version is assessed and approved.

End state

One attributable internal-readiness chain retains exact catalogue/register fingerprints, scoped assets, 110 findings, scoring, controlled evidence, eligible POA&M and independent closeout without claiming external authority or mutating operational source truth.