bmad-plus 0.4.4 → 0.5.0

package/src/bmad-plus/packs/pack-shield/references/cis-controls/safeguards-detail.md

@@ -0,0 +1,252 @@
+# CIS Controls v8 — All 153 Safeguards Detail
+
+## How to Use This Reference
+
+Each safeguard entry shows:
+- **Safeguard ID:** CIS Control # . Safeguard #
+- **Title:** Official CIS safeguard name
+- **IG:** Minimum implementation group (1, 2, or 3)
+- **Asset Type:** Devices / Software / Data / Users / Network / Applications
+- **Security Function:** Govern / Identify / Protect / Detect / Respond / Recover
+- **Implementation Notes:** Practical guidance on what to do
+
+---
+
+## CIS Control 1: Inventory and Control of Enterprise Assets
+
+| Safeguard | Title | IG | Asset Type | Security Function |
+|-----------|-------|-----|-----------|------------------|
+| 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory | 1 | Devices | Identify |
+| 1.2 | Address Unauthorized Assets | 1 | Devices | Respond |
+| 1.3 | Utilize an Active Discovery Tool | 2 | Devices | Identify |
+| 1.4 | Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory | 1 | Devices | Identify |
+| 1.5 | Use a Passive Asset Discovery Tool | 3 | Devices | Identify |
+
+**Implementation Notes:**
+- **1.1:** Maintain inventory in a CMDB, spreadsheet, or MDM tool. Include: IP address, hostname, MAC address, owner, location, OS, asset type, acquisition date
+- **1.2:** Define a process for handling unauthorized devices found on network — quarantine, investigate, document
+- **1.3:** Run network scanners (Nmap, Nessus, Qualys, Tenable) on scheduled basis (weekly minimum)
+- **1.4:** Enable DHCP server logging; correlate logs with asset inventory; flag unknown MACs
+- **1.5:** Deploy passive network TAP or IDS/NDR sensors for continuous asset detection without active scanning
+
+**Recommended Tools:** Microsoft Intune, CrowdStrike Falcon, Tanium, Qualys VMDR, Nessus, Axonius, ServiceNow CMDB
+
+---
+
+## CIS Control 2: Inventory and Control of Software Assets
+
+| Safeguard | Title | IG | Asset Type | Security Function |
+|-----------|-------|-----|-----------|------------------|
+| 2.1 | Establish and Maintain a Software Inventory | 1 | Applications | Identify |
+| 2.2 | Ensure Authorized Software is Currently Supported | 1 | Applications | Protect |
+| 2.3 | Address Unauthorized Software | 1 | Applications | Respond |
+| 2.4 | Utilize Automated Software Inventory Tools | 2 | Applications | Identify |
+| 2.5 | Allowlist Authorized Software | 2 | Applications | Protect |
+| 2.6 | Allowlist Authorized Libraries | 2 | Applications | Protect |
+| 2.7 | Allowlist Authorized Scripts | 2 | Applications | Protect |
+
+**Implementation Notes:**
+- **2.1:** Track all installed software: name, version, vendor, license, install date, responsible owner
+- **2.2:** Identify software nearing end-of-support (EOS/EOL); plan upgrades before EOS date
+- **2.3:** Detect and remove unauthorized software; consider policy/consequence for installing unauthorized tools
+- **2.5:** Implement application allowlisting via Windows AppLocker, WDAC, or endpoint agents
+- **2.6:** Track approved DLL, library, and package versions; use software composition analysis (SCA) for development
+- **2.7:** Control scripting environments (PowerShell Constrained Language Mode, Python virtual environments)
+
+**Recommended Tools:** Microsoft Intune, SCCM, Tanium, Flexera, Snyk (SCA), Veracode, AppLocker
+
+---
+
+## CIS Control 3: Data Protection
+
+| Safeguard | Title | IG | Asset Type | Security Function |
+|-----------|-------|-----|-----------|------------------|
+| 3.1 | Establish and Maintain a Data Management Process | 1 | Data | Govern |
+| 3.2 | Establish and Maintain a Data Inventory | 1 | Data | Identify |
+| 3.3 | Configure Data Access Control Lists | 1 | Data | Protect |
+| 3.4 | Enforce Data Retention | 1 | Data | Protect |
+| 3.5 | Securely Dispose of Data | 1 | Data | Protect |
+| 3.6 | Encrypt Data on End-User Devices | 2 | Data | Protect |
+| 3.7 | Establish and Maintain a Data Classification Scheme | 2 | Data | Protect |
+| 3.8 | Document Data Flows | 2 | Data | Identify |
+| 3.9 | Encrypt Data on Removable Media | 2 | Data | Protect |
+| 3.10 | Encrypt Sensitive Data in Transit | 2 | Data | Protect |
+| 3.11 | Encrypt Sensitive Data at Rest | 2 | Data | Protect |
+| 3.12 | Segment Data Processing and Storage Based on Sensitivity | 3 | Data | Protect |
+| 3.13 | Deploy a Data Loss Prevention Solution | 3 | Data | Protect |
+| 3.14 | Log Sensitive Data Access | 3 | Data | Detect |
+
+**Implementation Notes:**
+- **3.1:** Written policy covering classification, handling, retention, disposal — reviewed annually
+- **3.2:** Inventory must include: data type, sensitivity, location (on-prem/cloud), owner, retention period
+- **3.3:** Implement least-privilege on file shares, databases, cloud storage; review ACLs quarterly
+- **3.6:** Enable full-disk encryption (BitLocker for Windows, FileVault for macOS, LUKS for Linux)
+- **3.7:** Define classification labels: e.g., Public / Internal / Confidential / Restricted
+- **3.10:** Enforce TLS 1.2+ for all data in transit; disable older protocols (SSL, TLS 1.0/1.1)
+- **3.11:** Encrypt databases, backups, and file stores containing sensitive data
+- **3.13:** Deploy DLP on email, endpoints, and cloud services to prevent data exfiltration
+
+**Recommended Tools:** Microsoft Purview, Varonis, Symantec DLP, Zscaler, BitLocker, Vera (Digital Guardian)
+
+---
+
+## CIS Control 4: Secure Configuration
+
+| Safeguard | Title | IG | Asset Type | Security Function |
+|-----------|-------|-----|-----------|------------------|
+| 4.1 | Establish and Maintain a Secure Configuration Process | 1 | Devices | Protect |
+| 4.2 | Establish and Maintain a Secure Configuration Process for Network Infrastructure | 1 | Network | Protect |
+| 4.3 | Configure Automatic Session Locking on Enterprise Assets | 1 | Devices/Users | Protect |
+| 4.4 | Implement and Manage a Firewall on Servers | 1 | Devices | Protect |
+| 4.5 | Implement and Manage a Firewall on End-User Devices | 1 | Devices | Protect |
+| 4.6 | Securely Manage Enterprise Assets and Software | 2 | Devices | Protect |
+| 4.7 | Manage Default Accounts on Enterprise Assets and Software | 2 | Users | Protect |
+| 4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets | 2 | Devices | Protect |
+| 4.9 | Configure Trusted DNS Servers on Enterprise Assets | 2 | Devices/Network | Protect |
+| 4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | 2 | Devices | Protect |
+| 4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | 2 | Devices | Protect |
+| 4.12 | Separate Enterprise Workspaces on Mobile End-User Devices | 3 | Devices | Protect |
+
+**Implementation Notes:**
+- **4.1:** Use CIS Benchmarks as configuration baseline; automate hardening via Group Policy, Ansible, Chef, Puppet
+- **4.2:** Apply router/switch hardening; disable unused ports, protocols, and services on network devices
+- **4.3:** Set session timeout to 15 minutes or less; enforce screensaver lock via GPO/MDM
+- **4.4:** Enable Windows Firewall or host-based firewall on all servers; define least-privilege inbound/outbound rules
+- **4.7:** Rename or disable default admin accounts; change all default passwords immediately upon deployment
+- **4.8:** Disable/uninstall: Telnet, FTP, rsh, RPC where not needed; audit running services quarterly
+
+**CIS Benchmark Resources:** Free hardening guides available at cisecurity.org/benchmark for Windows, Linux, macOS, AWS, Azure, GCP, Kubernetes, Docker, browsers
+
+---
+
+## CIS Control 5: Account Management
+
+| Safeguard | Title | IG | Asset Type | Security Function |
+|-----------|-------|-----|-----------|------------------|
+| 5.1 | Establish and Maintain an Inventory of Accounts | 1 | Users | Identify |
+| 5.2 | Use Unique Passwords | 1 | Users | Protect |
+| 5.3 | Disable Dormant Accounts | 1 | Users | Protect |
+| 5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | 1 | Users | Protect |
+| 5.5 | Establish and Maintain an Inventory of Service Accounts | 2 | Users | Identify |
+| 5.6 | Centralize Account Management | 2 | Users | Protect |
+
+**Implementation Notes:**
+- **5.1:** Inventory: all user, admin, service, and guest accounts across all systems
+- **5.2:** Password policy: minimum 14 characters (or MFA required); check against breached password databases (HaveIBeenPwned); use password manager
+- **5.3:** Disable accounts unused for 90 days; automate detection via IdP reporting
+- **5.4:** Never use admin accounts for daily work; separate admin credentials; use PAM solutions for privileged access
+- **5.5:** Service accounts: document purpose, owner, permissions; rotate passwords regularly
+- **5.6:** Use Active Directory, Azure AD/Entra ID, Okta, or similar IdP as single source of truth
+
+---
+
+## CIS Control 6: Access Control Management
+
+| Safeguard | Title | IG | Asset Type | Security Function |
+|-----------|-------|-----|-----------|------------------|
+| 6.1 | Establish an Access Granting Process | 1 | Users | Protect |
+| 6.2 | Establish an Access Revoking Process | 1 | Users | Protect |
+| 6.3 | Require MFA for Externally-Exposed Applications | 2 | Users | Protect |
+| 6.4 | Require MFA for Remote Network Access | 2 | Users | Protect |
+| 6.5 | Require MFA for Administrative Access | 2 | Users | Protect |
+| 6.6 | Establish and Maintain an Inventory of Authentication/Authorization Systems | 2 | Users | Identify |
+| 6.7 | Centralize Access Control | 2 | Users | Protect |
+| 6.8 | Define and Maintain Role-Based Access Control | 2 | Users | Protect |
+
+**Implementation Notes:**
+- **6.1/6.2:** Formal access request and approval process; link to onboarding/offboarding procedures; review quarterly
+- **6.3:** MFA on all SaaS, web portals, VPN, RDP — phishing-resistant MFA (FIDO2/passkeys) preferred over SMS OTP
+- **6.5:** Require MFA for all admin console access (cloud management, AD, network devices)
+- **6.8:** Define roles in RBAC model; avoid overly broad permissions; apply least-privilege principle
+
+---
+
+## CIS Control 7: Continuous Vulnerability Management
+
+| Safeguard | Title | IG | Asset Type | Security Function |
+|-----------|-------|-----|-----------|------------------|
+| 7.1 | Establish and Maintain a Vulnerability Management Process | 1 | Devices/Apps | Protect |
+| 7.2 | Establish and Maintain a Remediation Process | 1 | Devices/Apps | Respond |
+| 7.3 | Perform Automated Operating System Patch Management | 1 | Devices | Protect |
+| 7.4 | Perform Automated Application Patch Management | 1 | Applications | Protect |
+| 7.5 | Perform Automated Vulnerability Scans of Internal Enterprise Assets | 2 | Devices | Identify |
+| 7.6 | Perform Automated Vulnerability Scans of Externally Exposed Enterprise Assets | 2 | Devices/Network | Identify |
+| 7.7 | Remediate Detected Vulnerabilities | 2 | Devices/Apps | Respond |
+
+**Remediation SLAs (common industry standards):**
+| CVSS Severity | Recommended Remediation Time |
+|---------------|------------------------------|
+| Critical (9.0–10.0) | 15 days |
+| High (7.0–8.9) | 30 days |
+| Medium (4.0–6.9) | 90 days |
+| Low (0.1–3.9) | 180 days or risk accepted |
+
+**Recommended Tools:** Qualys VMDR, Tenable Nessus/io, Rapid7 InsightVM, Microsoft Defender Vulnerability Management, CrowdStrike Spotlight
+
+---
+
+## CIS Control 8: Audit Log Management
+
+| Safeguard | Title | IG | Asset Type | Security Function |
+|-----------|-------|-----|-----------|------------------|
+| 8.1 | Establish and Maintain an Audit Log Management Process | 1 | Network/Devices | Protect |
+| 8.2 | Collect Audit Logs | 1 | Network/Devices | Detect |
+| 8.3 | Ensure Adequate Audit Log Storage | 2 | Network/Devices | Protect |
+| 8.4 | Standardize Time Synchronization | 2 | Network/Devices | Protect |
+| 8.5 | Collect Detailed Audit Logs | 2 | Network/Devices | Detect |
+| 8.6 | Collect DNS Query Audit Logs | 2 | Network | Detect |
+| 8.7 | Collect URL Request Audit Logs | 2 | Network | Detect |
+| 8.8 | Collect Command-Line Audit Logs | 2 | Devices | Detect |
+| 8.9 | Centralize Audit Logs | 2 | Network/Devices | Detect |
+| 8.10 | Retain Audit Logs | 2 | Network/Devices | Protect |
+| 8.11 | Conduct Audit Log Reviews | 2 | Network/Devices | Detect |
+| 8.12 | Collect Service Provider Logs | 2 | Data/Network | Detect |
+
+**Minimum Log Retention:** 90 days hot (searchable), 1 year cold storage (regulatory minimum varies)
+**Recommended Tools:** Splunk, Microsoft Sentinel, Elastic SIEM, Sumo Logic, IBM QRadar
+
+---
+
+## CIS Controls 9–18 Summary (Selected Key Safeguards)
+
+### Control 9: Email and Web Browser Protections
+- 9.3 (IG1): Maintain/enforce email provider anti-spoofing (SPF, DKIM, DMARC)
+- 9.5 (IG2): Implement DMARC policy (p=quarantine or p=reject)
+
+### Control 10: Malware Defenses
+- 10.1 (IG1): Deploy/maintain anti-malware on all endpoints
+- 10.7 (IG2): Use behavior-based/next-gen anti-malware (EDR)
+
+### Control 11: Data Recovery
+- 11.2 (IG1): Automated backups on schedule; test restores quarterly
+- 11.4 (IG1): Store backup copy isolated/offline (3-2-1 rule)
+
+### Control 12: Network Infrastructure Management
+- 12.1 (IG1): Keep network devices firmware/OS current
+- 12.7 (IG2): Require VPN for remote access with AAA
+
+### Control 13: Network Monitoring and Defense
+- 13.1 (IG2): Centralize security event alerting (SIEM)
+- 13.3 (IG2): Deploy NIDS/NIPS or NDR solution
+- 13.7/13.8 (IG3): HIPS/NIPS for active blocking
+
+### Control 14: Security Awareness Training
+- 14.2 (IG1): Annual phishing awareness training; quarterly simulations (IG2+)
+- 14.6 (IG1): Train employees to recognize and report incidents
+
+### Control 15: Service Provider Management
+- 15.1 (IG1): Inventory of all service providers with data access
+- 15.4 (IG2): Contracts must include security requirements
+- 15.5 (IG2): Annual risk assessment of critical service providers
+
+### Control 16: Application Software Security
+- 16.9 (IG2): Developer security training (OWASP Top 10)
+- 16.12 (IG3): SAST/DAST/IAST integrated in CI/CD pipeline
+
+### Control 17: Incident Response Management
+- 17.4 (IG1): Document incident response plan; test annually
+- 17.7 (IG2): Conduct tabletop exercises; include ransomware scenarios
+
+### Control 18: Penetration Testing
+- 18.2 (IG2): Annual external penetration test by qualified third party
+- 18.5 (IG3): Quarterly internal pen tests; red team exercises

package/src/bmad-plus/packs/pack-shield/references/cmmc/cmmc-assessment.md

@@ -0,0 +1,170 @@
+# CMMC 2.0 — Assessment Guide: SPRS Scoring, C3PAO Process & POA&M Rules
+
+## SPRS Score Calculation
+
+### Scoring Methodology
+The SPRS score is calculated per the DoD Assessment Methodology for NIST SP 800-171:
+- **Starting score**: 110 points
+- **Each NOT MET practice**: Deduct the assigned point value
+- **Partial implementation**: Full deduction applies (no partial credit)
+- **Score range**: +110 (all practices met) to −203 (all not met)
+- **Submission**: Required for all Level 2 contracts; submit at sprs.csd.disa.mil
+
+### Point Values by Domain
+Point values are assigned based on the practice's security impact:
+
+| Domain | Practices | Total Points at Risk |
+|--------|-----------|---------------------|
+| AC (Access Control) | 22 | ~50 |
+| AU (Audit & Accountability) | 9 | ~17 |
+| CM (Configuration Management) | 9 | ~19 |
+| IA (Identification & Authentication) | 11 | ~22 |
+| IR (Incident Response) | 3 | ~5 |
+| MA (Maintenance) | 6 | ~11 |
+| MP (Media Protection) | 9 | ~8 |
+| PE (Physical Protection) | 6 | ~11 |
+| PS (Personnel Security) | 2 | ~4 |
+| RA (Risk Assessment) | 3 | ~9 |
+| CA (Security Assessment) | 4 | ~9 |
+| SC (System & Communications) | 16 | ~39 |
+| SI (System & Information Integrity) | 7 | ~14 |
+
+*Exact point values per practice are published in the DoD Assessment Methodology document (v2.2, Nov 2020).*
+
+### Highest-Impact Practices (Largest Point Deductions)
+Prioritize these when remediating — they carry the heaviest scoring weight:
+1. **AC.L2-3.1.3** — CUI flow control (5 pts)
+2. **SC.L2-3.13.8** — Encryption in transit / FIPS validated (5 pts)
+3. **SC.L2-3.13.11** — FIPS-validated cryptography (5 pts)
+4. **IA.L2-3.5.3** — Multifactor authentication (5 pts)
+5. **SI.L2-3.14.6** — Monitoring for attacks (5 pts)
+6. **AC.L2-3.1.5** — Least privilege (3 pts)
+7. **AU.L2-3.3.1** — Audit logging (3 pts)
+8. **CM.L2-3.4.1** — Baseline configuration (3 pts)
+
+---
+
+## C3PAO Assessment Process
+
+### Pre-Assessment (Contractor Responsibilities)
+Before engaging a C3PAO, ensure:
+- [ ] System Security Plan (SSP) is complete and covers all 110 practices
+- [ ] System boundary is defined with network diagrams
+- [ ] CUI data flows are documented
+- [ ] POA&M lists all practices not yet met
+- [ ] SPRS score has been self-calculated
+- [ ] Personnel responsible for each practice are identified
+
+### Assessment Phases
+
+**Phase 1 — Documentation Review (Remote)**
+- C3PAO reviews SSP, network diagrams, policies, and POA&M
+- Requests artifact list: logs, screenshots, configuration exports, training records
+- Duration: 2–4 weeks
+
+**Phase 2 — Assessment Activities (On-site or Remote)**
+- Interviews with system administrators, security personnel, and executives
+- Technical testing: vulnerability scans, configuration reviews, access control verification
+- Observation of processes (incident response tabletop, maintenance procedures)
+- Duration: 1–3 weeks depending on scope
+
+**Phase 3 — Findings and Reporting**
+- C3PAO issues Findings Report: MET, NOT MET, or NOT APPLICABLE per practice
+- Contractor may provide additional evidence for disputed findings (limited window)
+- Final report submitted to CMMC-AB
+
+**Phase 4 — Certification Decision**
+- **All 110 practices MET**: Full certification issued; valid 3 years
+- **Limited unmet practices (non-critical)**: Conditional certification with POA&M; must remediate within 180 days
+- **Critical practices unmet**: No certification; remediate and reschedule
+
+### Critical Practices (Cannot Have POA&M at Certification)
+The following practices must be fully MET for any certification to be issued:
+- AC.L2-3.1.3 (CUI flow control)
+- IA.L2-3.5.3 (Multifactor authentication)
+- SC.L2-3.13.8 (Encryption in transit)
+- SC.L2-3.13.11 (FIPS-validated cryptography)
+- SI.L2-3.14.6 (Attack monitoring)
+- AU.L2-3.3.1 (Audit logging)
+- IR.L2-3.6.1 (Incident response capability)
+
+---
+
+## POA&M Rules and Management
+
+### What Can Be in a POA&M at Certification
+- Level 2: Up to a limited number of non-critical practices may remain in POA&M at time of certification
+- POA&M remediation deadline: **180 days** from certification date
+- Failure to remediate = certification revocation
+- Level 3: No POA&M at certification — all practices must be MET
+
+### POA&M Entry Format
+
+| Field | Description |
+|-------|-------------|
+| Practice ID | CMMC practice identifier (e.g., CM.L2-3.4.2) |
+| Weakness Description | What is not implemented and why |
+| Remediation Steps | Specific actions to achieve compliance |
+| Milestone 1–N | Intermediate checkpoints with dates |
+| Scheduled Completion | Target date for full implementation |
+| Resources Required | Personnel, tools, budget |
+| Status | Open / In Progress / Completed |
+| Evidence of Closure | What artifacts will demonstrate completion |
+
+### POA&M Best Practices
+- Never list a critical practice in a POA&M if seeking certification
+- Update monthly; stale POA&Ms raise auditor concerns
+- Link each POA&M item to the relevant SSP section
+- Document root cause, not just the symptom
+
+---
+
+## Evidence Requirements by Practice Type
+
+### Documentary Evidence (policies, procedures, plans)
+- Acceptable formats: PDF, Word, screenshots with metadata
+- Must show: author, date, version, approval signature
+- Examples: SSP, access control policy, incident response plan, training records
+
+### Technical Evidence (system configuration, logs)
+- Configuration exports from firewalls, Active Directory, SIEM
+- Vulnerability scan reports (authenticated scans preferred)
+- MFA enrollment reports showing all privileged user enrollment
+- Patch management reports showing remediation timelines
+
+### Interview Evidence
+- Assessors will interview: ISSO/ISSM, system admins, end users, executives
+- Prepare personnel to describe their security responsibilities
+- Cannot substitute documentation for interview — both required
+
+---
+
+## DIBNET Incident Reporting (DFARS 7012)
+
+DFARS 252.204-7012 mandates cyber incident reporting regardless of CMMC level:
+- **Report to**: DIBNET portal (dibnet.dod.mil)
+- **Deadline**: Within **72 hours** of discovering the incident
+- **What to report**: Systems affected, CUI categories involved, attack vectors, forensic indicators
+- **Preserve evidence**: Maintain disk images and forensic evidence for 90 days; DoD may request copies
+- **Notify prime**: If you are a subcontractor, notify the prime who notifies DoD
+
+### What Constitutes a Reportable Incident
+- Unauthorized access to systems containing CUI
+- Exfiltration of CUI (actual or suspected)
+- Malware detected on systems that process CUI
+- Compromise of credentials that could lead to CUI access
+
+---
+
+## Common Assessment Findings
+
+| Practice | Common Finding | Typical Remediation |
+|----------|---------------|---------------------|
+| IA.L2-3.5.3 | MFA not enabled for all privileged accounts or remote access | Deploy MFA solution (Azure MFA, Duo, Okta); enforce via conditional access |
+| SC.L2-3.13.11 | TLS 1.0/1.1 still enabled; non-FIPS algorithms in use | Disable TLS 1.0/1.1; enable only FIPS-validated cipher suites |
+| AU.L2-3.3.1 | Logs not retained per policy; not all devices log to SIEM | Deploy/configure SIEM; set 3-year retention; cover all CUI-touching systems |
+| CM.L2-3.4.1 | No formal baseline configuration document | Create baseline config docs per OS/application; store in change management |
+| AC.L2-3.1.5 | Excessive admin rights; shared admin accounts | Implement PAM solution; audit/remove excess privileges quarterly |
+| RA.L2-3.11.2 | Vulnerability scans not authenticated; not covering all assets | Configure credentialed scans; scan all in-scope assets monthly |
+| CA.L2-3.12.4 | SSP outdated or incomplete | Update SSP; review and re-approve annually or after significant changes |
+| AC.L2-3.1.3 | CUI accessible to users without need-to-know | Implement data classification labels; enforce access controls at file/folder level |

package/src/bmad-plus/packs/pack-shield/references/cmmc/cmmc-levels.md

@@ -0,0 +1,113 @@
+# CMMC 2.0 — Level Comparison, Assessment Types & Flow-Down Rules
+
+## Level Comparison Table
+
+| Attribute | Level 1 — Foundational | Level 2 — Advanced | Level 3 — Expert |
+|-----------|----------------------|-------------------|-----------------|
+| **Practices** | 17 (FAR 52.204-21) | 110 (NIST SP 800-171 Rev 2) | 110+ (SP 800-171 + SP 800-172 subset) |
+| **Focus** | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) | CUI on highest-priority DoD programs; APT resilience |
+| **Assessment type** | Annual self-assessment | Triennial C3PAO assessment (critical) OR self-assessment (non-critical) | DIBCAC-led government assessment (triennial) |
+| **SPRS submission** | Yes | Yes | Yes |
+| **Certification body** | Self | C3PAO (CMMC Third-Party Assessment Organization) | DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) |
+| **Conditional certification** | No | Yes (limited POA&M allowed) | No |
+| **Who needs it** | All DoD contractors receiving/generating FCI | Contractors handling CUI on DoD contracts | Contractors on highest-priority programs (e.g., nuclear C3, certain weapons systems) |
+
+---
+
+## DFARS Clause Mapping
+
+| DFARS Clause | Requirement | Level Implied |
+|-------------|-------------|---------------|
+| FAR 52.204-21 | Basic Safeguarding of FCI — 15 requirements | Level 1 baseline |
+| DFARS 252.204-7012 | Safeguarding CUI; 72-hr DIBNET incident reporting; cloud = FedRAMP Moderate | Level 2 prerequisite |
+| DFARS 252.204-7019 | NIST SP 800-171 self-assessment; SPRS submission required | Level 2 self-assessment |
+| DFARS 252.204-7020 | DoD access to contractor assessment results in SPRS | Level 2 |
+| DFARS 252.204-7021 | CMMC certification requirement; flow-down to subcontractors | Level 2 or 3 |
+
+**Rule**: If your contract contains DFARS 252.204-7021, your CMMC level is specified in the contract. Check Section L or the Performance Work Statement.
+
+---
+
+## Assessment Process by Level
+
+### Level 1 — Self-Assessment
+1. Assess all 17 practices against FAR 52.204-21
+2. Calculate and submit SPRS score (17 practices, max score = 17, each = 1 point)
+3. Submit to SPRS at https://www.sprs.csd.disa.mil/
+4. Senior official affirms accuracy
+5. Repeat annually
+
+### Level 2 — C3PAO Assessment (Critical Programs)
+1. **Pre-assessment preparation** (6–12 months): SSP, POA&M, gap remediation
+2. **Select a C3PAO**: Must be CMMC-AB authorized; find at cyberAB.us
+3. **Contract with C3PAO**: Negotiate scope, timeline, NDA
+4. **Assessment**: C3PAO reviews evidence, interviews, observes (typically 2–4 weeks on-site/remote)
+5. **Findings**: CMMC-AB receives results; conditional certification possible with limited POA&M
+6. **Certification**: Issued by CMMC-AB; valid for 3 years
+7. **Annual affirmation**: Affirm continued compliance each year
+
+### Level 2 — Self-Assessment (Non-Critical Programs)
+- Same 110 practices as C3PAO path
+- Self-assessed by contractor; senior official affirms in SPRS
+- DoD reserves right to audit; false statements = False Claims Act liability
+- Must still submit SPRS score
+
+### Level 3 — DIBCAC Assessment
+1. Contractor must hold a current Level 2 C3PAO certification first
+2. DIBCAC (government team) conducts assessment — not contractor-selected
+3. Assesses SP 800-171 practices PLUS select SP 800-172 enhanced requirements
+4. No conditional certification — all practices must be MET
+5. Government schedules the assessment; no commercial negotiation
+
+---
+
+## Flow-Down Requirements
+
+DFARS 252.204-7021(c) requires prime contractors to:
+- Include CMMC requirements in **all subcontracts** where the subcontractor processes, stores, or transmits CUI
+- Specify the required CMMC level in the subcontract
+- Verify subcontractor certification before award (Level 2/3 must appear in SPRS/CMMC-AB registry)
+- Flow-down applies to **all tiers** — sub-subcontractors are not exempt
+
+**Practical implication**: If you're a prime, map your CUI to each subcontractor and determine which level applies to each. Document this in your supply chain security program.
+
+---
+
+## Timeline and Key Dates
+
+| Milestone | Date |
+|-----------|------|
+| CMMC 2.0 Final Rule (32 CFR Part 170) effective | December 16, 2024 |
+| DFARS rule (48 CFR Parts 204, 212, 252) effective | December 16, 2024 |
+| CMMC requirements in new contracts | Phased: began Q1 2025, full rollout through 2026 |
+| Level 1 self-assessments required | All contracts with FAR 52.204-21, immediately |
+| Level 2 C3PAO assessments | Required when DFARS 7021 included in solicitation |
+
+---
+
+## CUI Categories Most Common in Defense Contracts
+
+| CUI Category | Examples | Typical Contract Types |
+|-------------|----------|----------------------|
+| Export Controlled (CTI) | Technical data, software, drawings | Engineering, manufacturing |
+| Naval Nuclear Propulsion (NOFORN) | Propulsion design data | Shipbuilding, nuclear |
+| Controlled Technical Information (CTI) | ITAR/EAR-controlled technical data | Weapons systems, aerospace |
+| Privacy (PII) | Personnel records | HR, health, benefits |
+| Law Enforcement Sensitive | Investigation data | Base security contractors |
+| Procurement/Acquisition | Pre-award contract info | Proposal/BD teams |
+
+---
+
+## Key Definitions
+
+| Term | Definition |
+|------|-----------|
+| **FCI** | Federal Contract Information — information provided by or generated for the Government under contract, not intended for public release |
+| **CUI** | Controlled Unclassified Information — information the Government creates or possesses that requires safeguarding per law/regulation/policy |
+| **SPRS** | Supplier Performance Risk System — DoD portal where self-assessment scores are submitted |
+| **C3PAO** | CMMC Third-Party Assessment Organization — authorized to conduct Level 2 assessments |
+| **DIBCAC** | Defense Industrial Base Cybersecurity Assessment Center — DCSA organization conducting Level 3 government assessments |
+| **CMMC-AB** | Cyber AB — accreditation body that certifies C3PAOs, assessors, and consultants |
+| **OSC** | Organization Seeking Certification — the defense contractor being assessed |
+| **POA&M** | Plan of Action & Milestones — documented remediation plan for unmet practices |
+| **SSP** | System Security Plan — describes the system boundary, CUI flows, and control implementations |