CMMC Level 2 Policy & Procedure Pack (14 Families)

Fourteen editable family policies that cover all 110 NIST SP 800-171 requirements, each statement mapped to its requirement ID. Short procedures and clear parameters, written so staff can actually follow them.

What you get

1. 14 family policies (Word, 62 pages in total): Access Control (22 requirements), Awareness and Training (3), Audit and Accountability (9), Configuration Management (9), Identification and Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System and Communications Protection (16), and System and Information Integrity (7).
2. The same structure in each: purpose, scope, definitions, roles, policy statements mapped to requirement IDs, short procedures, organization-defined parameters as [placeholders], records to keep and approval.
3. Policy-to-Requirement Matrix (Excel): all 110 requirements mapped to a policy statement, with a coverage check and adoption tracker.
4. Start Here guide (PDF): steps and common mistakes.

Also included in the CMMC Level 2 Compliance Toolkit.

How to use it

1. Decide your organization-defined parameters, such as lockout attempts, session lock and log retention, listed in section 7 of each policy (2 to 3 hours).
2. Adapt each policy: replace placeholders, change procedures to match how you work and delete guidance notes (1 to 2 hours per policy).
3. Have the owner and senior official approve, communicate to staff and collect acknowledgments where needed.
4. Mark each requirement adopted in the matrix and reference the statements in your SSP.
5. Review annually and after significant changes.

Who it is for

Defense suppliers and MSPs preparing for a NIST SP 800-171 or CMMC Level 2 self-assessment who need written policies behind every requirement. Policies alone do not meet requirements; assessors look for implementation and evidence, so pair them with an assessment and SSP.

Good to know

• Instant download. Editable Word (.docx) and Excel (.xlsx), plus a PDF guide. Works in Excel 2016 or later, Microsoft 365 and LibreOffice; no macros.
• Licensed for use within one organization.
• NIST SP 800-171/171A and FAR requirement text is quoted verbatim (public domain). Check your contract and the current rules for what applies to you.
• These templates help you prepare and document an honest self-assessment. They do not guarantee a particular SPRS score, a passing assessment or contract eligibility.
• 5-day fit guarantee: if it does not fit your system, contact us within 5 days of purchase.