CMMC Level 2 Starter Bundle (Workbook, SSP, POA&M)

The three documents at the center of a defensible CMMC Level 2 self-assessment: the assessment workbook, the System Security Plan and the POA&M. Bought separately these cost $207; the bundle is $175, a saving of $32.

What you get

1. CMMC Level 2 / NIST 800-171 Assessment Workbook (Excel, $79 on its own): 110 requirements, 320 objectives, SPRS score calculator and Conditional status check.
2. NIST 800-171 System Security Plan Template (Word and Excel, $99 on its own): an 81-page SSP with verbatim requirement text and example statements, plus a 110-row implementation tracker.
3. CMMC POA&M Template & Tracker (Excel and Word, $29 on its own): a register with eligibility checks and 180-day deadlines, plus a guide to writing good items.
4. Bundle Start Here guide (PDF): how the files connect and a 4-week plan.

Your first 4 weeks

1. Week 1, scope and baseline: decide enclave or whole company, list the people, systems and locations that touch CUI, draw the diagrams, and set owners and dates in the SSP tracker.
2. Week 2, assess: work through the objectives family by family with the people who run each area and your MSP, recording evidence as you go. Anything without evidence is NOT MET.
3. Week 3, write the SSP: draft section 4 from what you learned, replacing every example with your own statement and ticking status honestly.
4. Week 4, plan, score and decide: put every NOT MET requirement on the POA&M, check eligibility, review the score and Conditional status, and have the senior official review everything before anything goes into SPRS.

Four weeks is realistic for a small company with an engaged owner and a responsive MSP. Fixing gaps usually takes longer than documenting them.

Who it is for

Defense suppliers of roughly 5 to 150 staff that handle CUI and need a defensible NIST SP 800-171 self-assessment and SPRS score, and the MSPs who support them. No security specialist needed.

Good to know

• Instant download. Editable Excel (.xlsx) and Word (.docx), plus PDF guides. Works in Excel 2016 or later, Microsoft 365 and LibreOffice; no macros.
• Licensed for use within one organization.
• NIST SP 800-171/171A and FAR requirement text is quoted verbatim (public domain). Check your contract and the current rules for what applies to you.
• These templates help you prepare and document an honest self-assessment. They do not guarantee a particular SPRS score, a passing assessment or contract eligibility.
• 5-day fit guarantee: if it does not fit your system, contact us within 5 days of purchase.