For CMMC Level 2 you need a current system security plan, written policies and procedures for the 110 NIST SP 800-171 requirements, a scope and asset inventory, network and data flow diagrams, an incident response plan, training records and, if any items are not met, a plan of action and milestones. The system security plan is mandatory at assessment time.
What does the rule say about documentation?
The CMMC program rule is codified at 32 CFR part 170. It defines Level 1 (15 requirements from FAR 52.204-21), Level 2 (110 requirements from NIST SP 800-171 Revision 2) and Level 3 (24 further requirements selected from NIST SP 800-172). The rule requires organisations seeking assessment to have a system security plan in place at the time of assessment for each information system in scope, and an out of date plan results in a finding.
Assessments follow NIST SP 800-171A objectives. Assessors examine documents, interview people and test systems, so every requirement needs three layers: a written rule, a described method, and records that show it running.
Which documents make up the set?
Core plans
- System security plan (SSP). Describes each system in scope, its boundary, how each requirement is met and who owns it. Add name, date and version, because assessment submissions refer to them.
- Plan of action and milestones (POA&M). Tasks, resources, milestones and dates for any requirement not yet met. Level 1 permits no POA&Ms. Level 2 allows them within the limits set in the rule, and a conditional status must be closed out within 180 days.
- Scope and data documents. A statement of where Federal Contract Information and Controlled Unclassified Information are stored, processed and transmitted, and which assets fall inside the boundary.
Diagrams and inventories
- Network diagram with boundaries and connections.
- Data flow diagram showing how CUI enters, moves and leaves.
- Asset inventory: hardware, software, cloud services, people with access.
- External service provider list. The rule expects use of an external service provider to be documented in your SSP, along with that provider's service description and customer responsibility matrix.
Policies and procedures, by control family NIST SP 800-171 groups requirements into 14 families. One short policy per family is common, with procedures underneath:
- Access control, awareness and training, audit and accountability.
- Configuration management, identification and authentication, incident response.
- Maintenance, media protection, personnel security.
- Physical protection, risk assessment, security assessment.
- System and communications protection, system and information integrity.
Each policy states purpose, scope, roles, requirements and review cycle. Each procedure says who does what, when and where the record goes.
Plans
- Incident response plan with roles, categories, escalation and reporting contacts.
- Backup, maintenance and media sanitisation procedures.
- Configuration baselines and change control procedure.
- Supply chain risk plan. The rule text calls for updating supply chain risk plans at least annually.
Records
- Training completion records. The requirements call for awareness training at hire and at least annually, among other triggers.
- Access lists and access review records.
- Vulnerability scan results and remediation tickets.
- Audit log samples and review notes.
- Penetration test or equivalent assessment results at the cadence you set.
- Incident exercise notes.
- Annual affirmation records. An affirming official, a senior representative of the organisation, must affirm continuing compliance after every assessment and annually thereafter.
What mistakes do assessors see?
- SSP written once, never updated. It must match the live environment.
- Policies that say "should". Write what you do.
- No diagram of CUI flow. Scope disputes start here.
- Shared responsibility left vague. If a cloud provider handles part of a requirement, document which part and cite the matrix.
- Procedures with no records. An assessor asks for the last quarterly access review.
- POA&M used as a parking lot. It has deadlines and legal consequences.
Who owns what?
Executive sponsor: affirmation and resources. Compliance lead: SSP, POA&M, policy set. IT or security lead: diagrams, inventory, technical procedures. HR: personnel security, training. Contracts: external service provider terms and flow down.
What to do
- Determine which level your contracts require and what information you handle.
- Draw the boundary and the CUI data flow before writing anything else.
- Build the asset inventory and external service provider list.
- Write one policy per family and a procedure for each requirement that needs one.
- Draft the SSP against all 110 requirements, with a status for each.
- Capture gaps in a POA&M with owners and dates, and fix the heavy ones first.
- Start collecting records now, because assessors sample over time.
- Choose a date for annual review of every document, and put the affirmation on the calendar.
Quick check
Is a system security plan required for CMMC Level 2?
Yes. The rule requires an up to date system security plan describing each in scope system at the time of assessment, and its absence results in a finding.
How long do you have to close a POA&M after a conditional Level 2 status?
The rule gives 180 days from the CMMC status date. If it is not closed out in that time, the conditional status expires.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and monitoring runs between reviews. For the technical records above, such as vulnerability scans and remediation tickets, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. A C3PAO or DoD assessor, not Safeguard, decides assessment results.
Open the framework mapping demo or book a call.
Sources
Fetched 18 October 2026. Rules and phase in dates can change, so check the current text and your contract clauses.
Last reviewed: 18 October 2026.
