CMMC Level 2

Security > CMMC Level 2 tracks the 110 security requirements of NIST SP 800-171 Revision 2, the requirements CMMC Level 2 assesses. For each requirement you record its status, and Gardience shows the evidence it holds for the machines it manages. From the same data it calculates your SPRS score and produces the two documents an assessment needs: the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M).

CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that checks whether contractors protect controlled unclassified information (CUI). SPRS (Supplier Performance Risk System) is where contractors report their score.

Gardience helps you produce evidence and keep the assessment current. CMMC certification is granted by an authorized assessor and covers your whole environment, including people, policies, and facilities.

Turn it on#

CMMC Level 2 is an add-on to the Starter and Team plans. It is included in Government and enterprise, in trials and pilots until they end, and in paid licenses issued before October 27, 2026 (until they end). With a license that does not include it, admins see Security > CMMC Level 2 as a short page that says what it does, with a link to start a 90-day trial that includes it; nothing else about it shows or runs. A recorded assessment is kept if a license lapses. See Licensing.

With the add-on, CMMC Level 2 is still off on every new install. While it is off, nothing about it shows or runs: there is no menu item, no daily settings check, no Apply CMMC settings runbook, and nothing in evidence packs. Organizations that do not handle CUI never see it.

To turn it on, an admin opens Administration > Settings > CMMC Level 2, ticks On, and chooses Save. Security > CMMC Level 2 then appears in the menu. Turning it off again hides it and stops the checks; the recorded assessment is kept.

Where the rules come from#

• Requirement text and families: NIST SP 800-171 Rev. 2, from NIST's own spreadsheet.
• Scoring: 32 CFR 170.24 (the CMMC Level 2 scoring methodology, the same values as the DoD Assessment Methodology). Each requirement is worth 5, 3, or 1 points. The score starts at 110 and the value of every requirement not met is subtracted, so the lowest possible score is -203.
• POA&M rules: 32 CFR 170.21.

Microsoft 365#

Gardience can also read your Microsoft 365 sign-in and sharing settings, read only, and use six of them as evidence for 3.1.3, 3.1.5, 3.5.3, and 3.5.6: choose the Microsoft 365 tile under Start here. See Connect Microsoft 365 for CMMC. Until it is connected, nothing about it counts in the assessment.

Okta, your HR system, and other systems#

The Other systems tile connects Okta (multifactor enrollment, lockout, unused accounts, super administrators), a terminated-employees report from your HR or payroll system (anyone who left in the last 90 days with an account still enabled), and any system that publishes a CSV report, kept as the proof record you choose. The same window has Keep the score in sync with the evidence: requirements whose evidence is complete are recorded as met on their own, and set back to not met if that evidence fails; a status a person recorded is never changed. See Connect Okta, your HR system, and other systems.

Read the page#

The top of the page shows:

• SPRS score: 110 less the value of every requirement that is not met. A requirement nobody has assessed counts as not met, as it would in an assessment.
• Met: requirements met or not applicable.
• Not met yet: everything else, split into not assessed, not met, and partly met.
• Gardience evidence: how many requirements Gardience covers fully and partly on the machines it manages.

• Eligibility, one of:

  • Final Level 2: every requirement is met or not applicable.
  • Conditional Level 2: the score is at least 88 (80% of 110) and every open requirement may be on a POA&M. Open items must be closed and confirmed within 180 days.
  • Not yet eligible: the page names the reason, for example the score or the requirements that may not be on a POA&M.
  • Assessment cannot be completed: there is no System Security Plan (requirement 3.12.4).

Below that, three groups:

• Next step: Review and accept lists the requirements whose Gardience checks pass (see Accept Gardience's evidence). A red button appears when a requirement marked Met has a Gardience check that now fails.
• Machine settings: when the CMMC settings were last checked, Fix everything Gardience can, and Check now (see CMMC settings on every machine).
• Documents: the System Security Plan, the POA&M, and the two spreadsheets.

Then Start here (the system profile, policies, and the proof checklist) and Requirements by family: one tile per family with how many requirements are met, how many are still to assess, and how many points are open. Choose a tile to open its requirements in a window. Search all 110 requirements finds any requirement by number or words.

Each requirement shows its official text, its point value, and one of:

• Gardience evidence: Gardience's evidence covers the whole requirement for the machines it manages. Six do: 3.4.2 (security settings enforced), 3.4.3 (change control), 3.11.3 (remediating vulnerabilities), 3.12.2 (plans of action), 3.14.1 (flaw remediation), and 3.14.3 (security alerts). Change control (3.4.3) counts only when every change is approved: admins change machines directly, so turn on Administration > Settings > Change tickets: Required (every runbook, workflow, and fix then carries an approved ticket), keep at least two people who can approve, and give no API key the right to skip approval.
• Partial evidence: Gardience covers part of it on the machines it manages, for example the screen lock for 3.1.10 or disk encryption for 3.13.16. The rest (machines Gardience does not manage, wording, people) is for you to confirm.
• Your process: a policy, people, or facility requirement Gardience does not see, for example security awareness training (3.2.1) or visitor escorts (3.10.3). You still record its status, statement, and plan here.

Under each requirement, Gardience lists its live checks, for example "WIN-05 Account lockout after 3 or fewer bad logons: 1 of 2 machines pass (failing: win-01)". A check mark means the check passes on every managed machine.

Record an assessment#

Only admins record assessments. The CMMC page, its documents, policies, and proof files are shown to admins and approvers only: they describe where the company is weak, and proof files can hold personnel records.

1. Choose the requirement's family tile, then Assess under the requirement.
2. Set Status: Met, Not met, and where the rule allows it, Partly met (3.5.3 MFA for remote and privileged users only, and 3.13.11 encryption that is not FIPS-validated). Any requirement can be Not applicable when it truly does not apply (for example 3.1.16 when wireless access is not permitted); the implementation statement must say why, because an assessor checks the reason.
3. Write the Implementation statement: how the requirement is met. It goes into the System Security Plan.
4. For anything not met, write the Plan of action and a Milestone date within 180 days (a conditional status lasts 180 days, so a later date is refused). The window says when a requirement may not be on a POA&M.
5. Choose Save. The score, the tile, and the requirement update at once; the window stays open where you were.

Every change is recorded in the audit log with who made it.

Accept Gardience's evidence#

Review and accept lists two kinds of requirement:

• those Gardience's evidence covers fully, with every check passing;
• those Gardience covers partly, with every one of its checks passing, where you confirm that the rest is in place (for example that no machine outside Gardience holds CUI).

Each is ticked, with a drafted implementation statement that quotes the evidence and its date. Untick anything that is not really in place, edit any statement, and choose Accept: each requirement is recorded as Met by you, today. For partly covered requirements, the statement records that you confirmed the rest. Gardience never records a status on its own, because the score a company reports is its own affirmation.

If a Gardience check later fails on a requirement marked Met, the requirement is flagged (Met requirements need review) and an alert is sent. Gardience suggests 3.12.4 (a System Security Plan) once the system profile is complete and every other requirement has an implementation statement.

Fill in the system profile#

Choose the System profile tile and fill in the organization, system name, CAGE code, UEI, system description, boundary and environment, connections to other systems, the system owner and security contact (each with a name and an email address), assessment date, POA&M target date, and SSP version. The System Security Plan needs at least the system name, description, and boundary.

CMMC settings on every machine#

Some requirements live in each machine's own settings. Gardience checks them on every managed machine:

Switches, routers, and firewalls are checked from Network devices: 11 settings and the firmware, counted in the same requirements as the machine checks (read only; Gardience never changes a device).

FIPS mode, disk encryption, and malware protection products are never switched on by Apply CMMC settings: FIPS mode can stop applications, and the malware product is your choice. Disk encryption has its own page, Disk encryption, which turns BitLocker on only after each recovery key is kept outside the server. SSH changes are checked with sshd -t and undone if the SSH server would not accept them.

On Linux, the sign-in rules (lockout, password history, and complexity) are set only through the distribution's own tool: authselect on the Red Hat family (its with-faillock and with-pwhistory features) and pam-auth-update on Debian and Ubuntu (Gardience adds profiles named gardience-faillock, gardience-faillock-notify, and gardience-pwhistory in /usr/share/pam-configs, laid out as the CIS benchmarks for Ubuntu lay them out). PAM files are never edited by hand, because a mistaken edit can lock everyone out. If someone edited /etc/pam.d/common-* by hand, pam-auth-update leaves them alone, and Gardience reports that instead of forcing it. Before changing any of these rules, Gardience saves a copy of /etc/pam.d and /etc/security in /var/backups/gardience (the last 5 are kept). Sign-in with an SSH key still works while an account is locked (tested on Rocky Linux 9), and root is never locked out. A locked account unlocks after 15 minutes, or at once with faillock --user NAME --reset. Some cloud images (Rocky Linux's, for example) ship authselect without a profile selected, so nothing manages PAM: Gardience then leaves lockout and history to you and shows the one step that lets it set them (authselect select sssd --force --backup=before-authselect, or minimal on machines without SSSD, after checking /etc/pam.d for changes of your own).

• Check now checks every managed machine (it only reads). The check also runs every day.
• Fix everything Gardience can first shows Review changes: for each machine, the updates it would install, the security baseline checks it would fix, and the CMMC settings it would set, from the last scan, with totals at the top. Nothing runs until you choose Fix everything. It then installs pending updates, applies the security baseline, sets the CMMC settings that are safe to set, and checks every machine again. It runs on the server, so you can leave the page: the Machine settings card shows the current step whenever you come back, and what changed when it is done. One run at a time; a second click while it runs is refused. Each step is recorded in the audit log under the person who started it, and the updates and baseline jobs also show under Patching > Jobs. Change windows and locks apply; for roles other than admin, the baseline on several machines waits for a second person (see Patching).
• The Apply CMMC settings runbook (Automation > Runbooks) sets only the CMMC settings, on the node group you choose. A run of it is followed by a fresh check.

Each machine reports what it changed and what is left for you.

Antivirus from other companies#

Requirement 3.14.2 needs malware protection on every machine. Gardience recognizes the common products when their service is running: Microsoft Defender, CrowdStrike Falcon, SentinelOne, Sophos, Trellix (McAfee), Trend Micro, Cylance, Carbon Black, Elastic Defend, ESET, Kaspersky, Bitdefender, Malwarebytes, Huntress, and ClamAV. On Windows 10 and 11 Gardience also reads the products registered with Windows Security. With another product in charge, Windows puts Defender in passive mode: Gardience then counts that product and does not score Defender's own settings (definition age, removable drive scanning), which that product handles.

Only approved applications (allowlisting)#

Requirement 3.4.8 asks that only approved software can run. The Machine settings card shows how many machines let any application run, with Start allowlisting in audit mode:

• Windows: AppLocker with Microsoft's default rules: programs in Windows and Program Files run for everyone, and administrators run anything. Rules you already have are kept. If App Control for Business (WDAC) is already enforced, nothing changes.
• Linux, Red Hat family (RHEL, Rocky, Alma): fapolicyd (installed if missing), which trusts what the package manager installed. Gardience adds one rule so its own agent keeps working: the agent's folders (/var/cache/salt and /opt/saltstack, writable by root only). Gardience refuses to enforce if fapolicyd trusts fewer than 1,000 files.
• Debian and Ubuntu: checked, but Gardience does not install fapolicyd there: Debian 12's package starts blocking every program the moment it is installed, and Ubuntu's comes with no rules. Set it up by hand; Gardience recognizes it once it runs.

Nothing is blocked in audit mode; what would have been blocked is logged. After a week or two, choose Review what it would block: Gardience lists, for each machine, the programs that would have been blocked in the last 30 days. Allow what you need (an AppLocker rule, or a fapolicyd trust entry), then choose Enforce now for the machines you reviewed. Only machines that have been in audit mode can be enforced. Tested on real machines: under enforcement an untrusted program is blocked, and Gardience keeps working (its agent restarts, syncs, checks, and patches).

Antivirus on Linux (ClamAV)#

If your company already uses an antivirus, install it on your Linux machines and Gardience detects it.

For Linux machines with none, the Machine settings card shows how many there are, with Install ClamAV. ClamAV is free, open source antivirus maintained by Cisco Talos. It is never installed by Fix everything, only when an admin chooses it, and only on machines in the assessment that run no other antivirus. On each machine, Gardience checks again first, then:

• Refuses servers with less than 4 GB of memory. ClamAV holds about 1.5 GB of virus definitions in memory while it scans, which can starve the applications on a small server. Use a lighter product there.
• Refuses servers in FIPS mode when only ClamAV older than 1.5 is available. Those versions cannot verify their virus definition downloads in FIPS mode, so they would never update (RHEL 9 with EPEL offers 1.4.6 today). Use an antivirus that supports FIPS mode there; Gardience detects the common ones.
• Installs ClamAV from the machine's own repositories (on the Red Hat family it comes from EPEL, which must be enabled first), turns on daily definition updates (clamav-freshclam), and schedules a scan of the whole machine once a night at a random time, at the lowest CPU and disk priority (gardience-clamscan.timer; results in /var/log/gardience-clamscan.log).
• Reports per machine what it did, and checks every machine again.

The machines need to reach database.clamav.net for definitions, or a mirror set in /etc/freshclam.conf. The Install ClamAV runbook (Automation > Runbooks) does the same on a node group you choose. Each install is recorded in the audit log under the person who started it; change tickets and locks apply.

Policies#

Most of the 110 requirements are about people and process (training, screening, physical access, and incident response), and an assessor checks them against written policies. The Policies tile has one policy template for each of the 14 requirement families, covering every requirement:

• Each template is filled in from the system profile (organization and system names) and turns every requirement into a policy statement. Where Gardience supports a requirement on the machines it manages, the statement says how, for you to confirm.
• What we keep as evidence lists the records an assessor usually asks for in that family.
• View or print opens the policy; print it or save it as a PDF, then edit it to match what you really do. An assessor checks that practice matches the written policy, so adopt a policy only once it is true.
• An admin records adoption with the policy owner and a version. The adoption (who, when, and version) appears in the System Security Plan, the policy goes into the evidence pack, and Gardience reminds you a year later to review it.

Policy signatures#

CMMC expects everyone who works with controlled unclassified information to know the security rules. In the Policies window, under Signatures, paste the people (one per line: Name <email>, Name, email, or just the email) and choose Ask them to read and sign. Each person gets one email with one link to a page that shows each of your adopted policies. They read it, tick "I have read this policy and I will follow it", and type their name to sign. No Gardience account is needed.

Gardience keeps each signature: the person's name and email, the policy, its version and adoption date, the typed name, and the time. The Signatures section shows how many each person has signed, and Download the record saves them all as a CSV for your assessor. Unsigned links are reminded every 3 days, up to 3 times. The links work like proof upload links (below): 30 days, cancellable, and they can only sign their own policies. When you change a policy and record a new version, ask people to sign it again.

Proof checklist#

Some proof only people have: training records, background checks, the visitor log, access reviews, the incident response test. The Proof checklist tile lists the 17 records an assessor usually asks for that machines cannot produce. For each one it shows:

• what to provide, in plain words, and the requirements it supports;
• who usually has it (HR, facilities, IT, the security lead, or leadership), or the person you made its owner;
• how often it is due (every month, quarter, or year, or once), and its state: Missing, Current (with the date it runs out), Due soon, or Overdue;
• a Template, already filled in with your organization's name, for records you don't keep yet: a visitor log, training sign-in sheet, access review, maintenance log, media destruction record, incident response test record, and more. Print it, or open the spreadsheet version.

Upload adds files to a record yourself. Ask someone is for records that live with someone else: enter their name and email, and Gardience emails them a link. The link opens a page that names the one record you asked for and offers its template; they upload files there with no Gardience account. Their files land on that record, encrypted like every proof file, and the security contact in your system profile gets an email when they arrive. Gardience reminds them every 3 days, up to 3 times. Leave They own this record ticked and Gardience asks them again on its own before the record runs out, so yearly training and quarterly access reviews don't lapse quietly.

What the link can and cannot do:

• It works for 30 days, and only for that one record. It can add files (up to 20, 10 MB each) and cannot show or download anything else. Cancel under the record ends it at once.
• The person needs to reach your console's address: from your network or VPN for an install on your own servers, or from anywhere for Gardience hosted.
• The link's secret is in the part of the address after #, which browsers never send to the server, so it does not appear in web server logs. Gardience keeps only a hash of it to look it up, plus a copy sealed with the vault key so a reminder can resend the same link.
• Each upload, request, reminder, and cancellation is written to the audit log, with the person's name and email and who asked them.

Without email set up (Administration > Settings > Alerts), Ask someone shows the link for you to send yourself.

Other proof keeps anything else you want in the evidence pack: attach a file (PDF, image, text, CSV, Word, Excel, or PowerPoint, up to 10 MB; 2 GB in all) to one or more requirements. Every proof file is encrypted at rest with the Gardience vault key, because it can hold personnel records, is listed under its requirements and in the System Security Plan, and is carried in the signed evidence pack with its SHA-256 hash, so an assessor can confirm it was not changed.

Alerts#

Once a day, after the CMMC settings check, Gardience sends an alert (to the Slack or Teams webhook, email, and PagerDuty set under Administration > Settings) when:

• a managed machine fails a CMMC setting that Gardience can set (choose Fix everything Gardience can to fix it; settings that are yours to set are not alerted on daily);
• a requirement marked Met has a Gardience check that now fails;
• the SPRS score went down;
• a POA&M milestone date has passed (a conditional Level 2 status needs every POA&M item closed within 180 days);
• an adopted policy is due for its yearly review within 30 days;
• the yearly affirmation in SPRS is due within 30 days, or overdue;
• the DoD Medium Assurance certificate expires within 30 days;
• an incident that affects CUI has not been reported to DoD and its 72-hour deadline is less than a day away (every 6 hours until it is reported).

Each alert repeats at most once a week while the condition lasts, except the incident deadline.

DoD requirements#

Besides the 110 requirements, DoD requires these, kept in the DoD requirements window and carried into the System Security Plan:

• Annual affirmation. After the assessment, and every year after, a senior official affirms in SPRS that the company still meets the requirements (32 CFR 170.22). Record each one: who, when, and the score. Gardience reminds you 30 days before the next one is due.
• Asset categories. The CMMC scoping guide sorts every asset into CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, or out of scope. Give each node group in the assessment (and each custom group) a category, and list what Gardience does not manage, such as firewalls, printers, phones, and test equipment.
• Cloud and service providers. A cloud service that holds CUI must be FedRAMP Moderate authorized or equivalent (DFARS 252.204-7012). List each provider, whether it holds CUI, its FedRAMP status and package, and the shared responsibility: what the provider does and what you do. A provider holding CUI without FedRAMP Moderate is flagged.
• Incident reporting to DoD. A cyber incident that affects CUI must be reported at dibnet.dod.mil within 72 hours of discovery, with a DoD Medium Assurance certificate, and images of the affected systems kept for 90 days. Record an incident when it is found: Gardience counts down the 72 hours, alerts you, and keeps the report number and how long the images are kept. Times are entered in your local time and kept in UTC.
• Your defined values. Many requirements leave a value to you ("periodically", "a defined period"). Define each: the suggestions match what Gardience's checks enforce.
• FIPS-validated modules. The cryptographic modules that protect CUI and their CMVP certificate numbers (3.13.11).

Incidents count as evidence for 3.6.1 and 3.6.2, and the FIPS modules for 3.13.11.

Documents and exports#

• System Security Plan: the system profile, the assessment summary, the policies with their adoption, every requirement with its status, implementation statement, policy, and proof files, and the DoD requirements: asset categories, external service providers, defined values, FIPS modules, incident reporting, and the last affirmation. Use the browser's print to save it as a PDF.
• Plan of action (POA&M): every open requirement with its value, whether it may be on a POA&M, the planned remediation, the milestone, and the responsible person.
• POA&M (CSV) and Assessment (CSV): the same data for a spreadsheet or your GRC tool.
• Evidence pack (Security > Reports and evidence): for an admin or approver, also carries the System Security Plan and POA&M documents, the policies, the assessment, and the proof files, each hashed into the signed manifest.

Related#

• Security baseline controls
• STIG compliance
• Vulnerabilities (CVE lookup)