This document outlines the essential documentation and artifacts required for your upcoming CMMC 2.0 audit. Having these items organized and readily available will streamline the audit process and demonstrate your organization’s commitment to cybersecurity compliance.

Kovr is here to help. In a separate article, we’ll summarize how Kovr can help you quickly identify which artifacts you’re missing and how to easily remediate those gaps.

Required Documentation and Artifacts

Policies and Procedures

1. Access Control Policy and Procedures: These documents should outline how your organization manages and restricts system access, including user account management, least privilege implementation, and access enforcement mechanisms.

2. Audit and Accountability Policy and Procedures: These establish requirements for creating, protecting, and retaining system audit logs and records to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

3. Configuration Management Policy and Procedures: These documents detail how your organization establishes and maintains baseline configurations and inventories of organizational systems, including hardware, software, firmware, and documentation.

4. Incident Response Policy, Plan, and Procedures: These outline the structured approach to handling security incidents, including roles and responsibilities, reporting procedures, and recovery actions.

5. Password Policy: This document defines password complexity requirements, expiration periods, reuse restrictions, and other authentication mechanisms implemented in your systems.

6. Personnel Security Policy and Procedures: These detail the processes for screening individuals prior to authorizing access to information systems and ensuring that conditions for maintaining access remain appropriate.

7. Physical and Environmental Protection Policy and Procedures: These documents outline physical access controls, visitor management, and protections against environmental threats to information systems.

8. Risk Assessment Policy and Procedures: These establish the methodology for identifying, evaluating, and documenting potential risks to organizational operations, assets, and individuals.

9. Security Assessment and Authorization Policy and Procedures: These documents outline how your organization assesses the effectiveness of security controls, authorizes system operation, and manages ongoing system security.

10. System and Communications Protection Policy and Procedures:  These detail boundary protection mechanisms, encryption requirements, and other safeguards that protect system communications.

11. System and Information Integrity Policy and Procedures: These documents establish requirements for identifying, reporting, and correcting system flaws, including malicious code protection and system monitoring.

12. System Maintenance Policy and Procedures: These outline controlled maintenance of information systems, including maintenance tools, remote maintenance, and timely repairs.

13. System Media Protection Policy and Procedures: These establish requirements for protecting system media, both digital and non-digital, including access restrictions and sanitization procedures.

Plans and Strategies

14. System Security Plan (SSP): This comprehensive document details how your organization manages and protects Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), including an inventory of all systems that process, store, or transmit this information.

15. Continuous Monitoring Strategy: This outlines your approach to ongoing awareness of vulnerabilities, threats, and security control effectiveness through systematic monitoring and assessment activities.

16. Security Planning Policy: This document establishes requirements for developing, documenting, and updating security plans that describe system boundaries and implemented security controls.

Technical Documentation

17. System-level, Network, and Data Flow Diagrams: These visual representations should clearly illustrate your IT infrastructure, showing system boundaries, network topology, and how data flows through your environment.

18. System Audit Logs and Records: These records demonstrate that your systems are configured to capture and maintain security-relevant events according to your audit policies.

19. System Monitoring Records: These documents provide evidence of ongoing system monitoring activities, including alerts, reviews, and responses to suspicious activities.

20. Screenshots of Security Settings: These provide visual evidence of properly configured security settings, such as firewall rules, endpoint protection configurations, and access control implementations.

21. Implementation Reports: These reports document the deployment and configuration of specific security controls, such as encryption tools, vulnerability scanners, and authentication mechanisms.

22. Evidence of Multi-factor Authentication (MFA) Implementation: This demonstrates that MFA is properly implemented for privileged accounts and for access to CUI.

Training and Personnel Records

23. Cybersecurity Training Materials: These include training content, presentations, and materials that educate personnel on security awareness and role-based security responsibilities.

24. Training Records: These document completion of required security awareness and specialized training for all users who access your systems.

Assessment and Compliance Records

25. Results of Internal Gap Assessments: These reports identify gaps between your current security posture and CMMC 2.0 Level 2 requirements, providing a roadmap for remediation.

26. Plans of Action and Milestones (POAMs): These documents track identified security weaknesses, planned remedial actions, milestones, and completion dates.

27. Audit Trails: These provide evidence of periodic reviews and policy updates, demonstrating ongoing commitment to maintaining your security program.

28. User Access Reviews: These document regular validation that user access privileges remain appropriate based on job responsibilities and need-to-know.

CUI-Specific Documentation

29. Identification of CUI: This documentation clearly identifies what CUI is specific to your contracts, including categories and handling requirements.

30. CUI Protection Processes: These documents outline the processes for identifying, marking, handling, storing, and destroying CUI throughout its lifecycle.

31. Data Encryption Evidence: This provides verification that CUI is properly encrypted both at rest and in transit, meeting FIPS 140-2 (or newer) standards.

Preparation Tips

1. Organization is Key: Create a structured repository or file system that maps directly to CMMC 2.0 Level 2 requirements for easy reference during the audit.

2. Evidence Mapping: For each required control, maintain a clear mapping between the policy, implementation evidence, and any supporting documentation.

3. Currency: Ensure all documentation is current and reflects your actual practices; outdated or inaccurate documentation can raise concerns during the audit.

4. Stakeholder Preparation: Brief key personnel who may be interviewed during the audit to ensure they understand the security policies and their responsibilities.

5. Self-Assessment: Conduct a mock audit before the official assessment to identify and address any gaps or inconsistencies in your documentation.