For CMMC 2.0 you can automate the recurring technical evidence that shows a control is operating, such as configuration states, access lists, scan results and logs. You cannot automate scoping decisions, the system security plan, or the senior official's affirmation. Plan the split before you pick tools.
What does the rule actually ask for?
The Department of Defense's CMMC program rule is codified at 32 CFR Part 170. Level 1 requires a self-assessment against the basic requirements, results posted in the Supplier Performance Risk System (SPRS), and no plan of action is allowed. Level 2 covers the 110 security requirements derived from NIST SP 800-171. Depending on the contract, Level 2 is a self-assessment every three years or a certification assessment by an authorized third-party assessor organization (C3PAO). Assessors work from the objectives in NIST SP 800-171A.
In every case an Affirming Official, a senior person in your organization, affirms continuing compliance after each assessment and annually after that. That is a human statement, and no tool makes it for you.
Which evidence is a good candidate for automation?
Assessment objectives ask you to examine documents, interview people and test mechanisms. Only some of that is machine friendly. Good candidates share one trait: the proof is a system state that can be read on a schedule.
- Account and group membership exports, with timestamps, for access control requirements.
- Configuration baselines for endpoints and servers, compared against a stored standard.
- Patch and vulnerability scan results, including the date of each run and what was fixed.
- Audit log settings and proof that logs are collected and retained.
- Encryption settings for storage and transport.
- Software inventory and dependency lists for the systems in scope.
Collect these on a schedule and store them with the date they were pulled. A single export proves a moment. A series proves the control keeps running, which is what an assessor wants to see.
What must stay manual?
Scope comes first. Deciding which systems handle controlled unclassified information, and drawing the boundary around them, is a judgment call that drives everything else.
The system security plan is next. The rule does not allow a plan of action for a missing system security plan, so it has to be real and owned by a person.
Policies and procedures need human authorship and approval. Training records, incident exercises and personnel screening involve people and need people to verify them. Interviews with staff are part of the assessment method itself.
What about gaps and the 180 day clock?
A Conditional Level 2 status is possible only when the score divided by the total number of requirements is at least 0.8, each open item is worth one point or less (with one narrow encryption exception), and none of the excluded requirements, including the system security plan, is on the list. Open items must be closed within 180 days of the conditional status date, or the status expires.
Automated collection helps here because you can show closure with dated evidence rather than a claim.
What to do
- Write the scope statement and data flow diagram first, with an owner.
- Map each of the 110 requirements to the assessment objectives and mark each as automatable, partly automatable or manual.
- For the automatable ones, schedule collection and keep dated, tamper-evident copies.
- Assign a named person to every manual item and set a review date.
- Run an internal assessment using the 800-171A objectives and score it the way the rule describes.
- Keep a plan of action only for items the rule allows, and track the 180 day deadline.
- Calendar the annual affirmation and who signs it.
Try the same idea in the framework mapping demo.
Quick check
Does a compliance tool make us CMMC certified?
No. Certification comes from an assessment under the program rules. Tools can collect and organize evidence, nothing more.
Is a screenshot enough evidence?
It can be, but a dated export from the system is stronger and easier to repeat. Ask your assessor what they accept.
Sources
- 32 CFR 170.15, Level 1 self-assessment, fetched 18 October 2026
- 32 CFR 170.16, Level 2 self-assessment, fetched 18 October 2026
- 32 CFR 170.17, Level 2 certification assessment, fetched 18 October 2026
- 32 CFR 170.21, Plan of action and milestones, fetched 18 October 2026
- 32 CFR 170.22, Affirmation, fetched 18 October 2026
- NIST SP 800-171A Rev. 3, fetched 18 October 2026
Last reviewed: 18 October 2026.
