bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/cmmc/cmmc-assessment.md

@@ -1,170 +1,170 @@
-# CMMC 2.0 — Assessment Guide: SPRS Scoring, C3PAO Process & POA&M Rules
-
-## SPRS Score Calculation
-
-### Scoring Methodology
-The SPRS score is calculated per the DoD Assessment Methodology for NIST SP 800-171:
-- **Starting score**: 110 points
-- **Each NOT MET practice**: Deduct the assigned point value
-- **Partial implementation**: Full deduction applies (no partial credit)
-- **Score range**: +110 (all practices met) to −203 (all not met)
-- **Submission**: Required for all Level 2 contracts; submit at sprs.csd.disa.mil
-
-### Point Values by Domain
-Point values are assigned based on the practice's security impact:
-
-| Domain | Practices | Total Points at Risk |
-|--------|-----------|---------------------|
-| AC (Access Control) | 22 | ~50 |
-| AU (Audit & Accountability) | 9 | ~17 |
-| CM (Configuration Management) | 9 | ~19 |
-| IA (Identification & Authentication) | 11 | ~22 |
-| IR (Incident Response) | 3 | ~5 |
-| MA (Maintenance) | 6 | ~11 |
-| MP (Media Protection) | 9 | ~8 |
-| PE (Physical Protection) | 6 | ~11 |
-| PS (Personnel Security) | 2 | ~4 |
-| RA (Risk Assessment) | 3 | ~9 |
-| CA (Security Assessment) | 4 | ~9 |
-| SC (System & Communications) | 16 | ~39 |
-| SI (System & Information Integrity) | 7 | ~14 |
-
-*Exact point values per practice are published in the DoD Assessment Methodology document (v2.2, Nov 2020).*
-
-### Highest-Impact Practices (Largest Point Deductions)
-Prioritize these when remediating — they carry the heaviest scoring weight:
-1. **AC.L2-3.1.3** — CUI flow control (5 pts)
-2. **SC.L2-3.13.8** — Encryption in transit / FIPS validated (5 pts)
-3. **SC.L2-3.13.11** — FIPS-validated cryptography (5 pts)
-4. **IA.L2-3.5.3** — Multifactor authentication (5 pts)
-5. **SI.L2-3.14.6** — Monitoring for attacks (5 pts)
-6. **AC.L2-3.1.5** — Least privilege (3 pts)
-7. **AU.L2-3.3.1** — Audit logging (3 pts)
-8. **CM.L2-3.4.1** — Baseline configuration (3 pts)
-
----
-
-## C3PAO Assessment Process
-
-### Pre-Assessment (Contractor Responsibilities)
-Before engaging a C3PAO, ensure:
-- [ ] System Security Plan (SSP) is complete and covers all 110 practices
-- [ ] System boundary is defined with network diagrams
-- [ ] CUI data flows are documented
-- [ ] POA&M lists all practices not yet met
-- [ ] SPRS score has been self-calculated
-- [ ] Personnel responsible for each practice are identified
-
-### Assessment Phases
-
-**Phase 1 — Documentation Review (Remote)**
-- C3PAO reviews SSP, network diagrams, policies, and POA&M
-- Requests artifact list: logs, screenshots, configuration exports, training records
-- Duration: 2–4 weeks
-
-**Phase 2 — Assessment Activities (On-site or Remote)**
-- Interviews with system administrators, security personnel, and executives
-- Technical testing: vulnerability scans, configuration reviews, access control verification
-- Observation of processes (incident response tabletop, maintenance procedures)
-- Duration: 1–3 weeks depending on scope
-
-**Phase 3 — Findings and Reporting**
-- C3PAO issues Findings Report: MET, NOT MET, or NOT APPLICABLE per practice
-- Contractor may provide additional evidence for disputed findings (limited window)
-- Final report submitted to CMMC-AB
-
-**Phase 4 — Certification Decision**
-- **All 110 practices MET**: Full certification issued; valid 3 years
-- **Limited unmet practices (non-critical)**: Conditional certification with POA&M; must remediate within 180 days
-- **Critical practices unmet**: No certification; remediate and reschedule
-
-### Critical Practices (Cannot Have POA&M at Certification)
-The following practices must be fully MET for any certification to be issued:
-- AC.L2-3.1.3 (CUI flow control)
-- IA.L2-3.5.3 (Multifactor authentication)
-- SC.L2-3.13.8 (Encryption in transit)
-- SC.L2-3.13.11 (FIPS-validated cryptography)
-- SI.L2-3.14.6 (Attack monitoring)
-- AU.L2-3.3.1 (Audit logging)
-- IR.L2-3.6.1 (Incident response capability)
-
----
-
-## POA&M Rules and Management
-
-### What Can Be in a POA&M at Certification
-- Level 2: Up to a limited number of non-critical practices may remain in POA&M at time of certification
-- POA&M remediation deadline: **180 days** from certification date
-- Failure to remediate = certification revocation
-- Level 3: No POA&M at certification — all practices must be MET
-
-### POA&M Entry Format
-
-| Field | Description |
-|-------|-------------|
-| Practice ID | CMMC practice identifier (e.g., CM.L2-3.4.2) |
-| Weakness Description | What is not implemented and why |
-| Remediation Steps | Specific actions to achieve compliance |
-| Milestone 1–N | Intermediate checkpoints with dates |
-| Scheduled Completion | Target date for full implementation |
-| Resources Required | Personnel, tools, budget |
-| Status | Open / In Progress / Completed |
-| Evidence of Closure | What artifacts will demonstrate completion |
-
-### POA&M Best Practices
-- Never list a critical practice in a POA&M if seeking certification
-- Update monthly; stale POA&Ms raise auditor concerns
-- Link each POA&M item to the relevant SSP section
-- Document root cause, not just the symptom
-
----
-
-## Evidence Requirements by Practice Type
-
-### Documentary Evidence (policies, procedures, plans)
-- Acceptable formats: PDF, Word, screenshots with metadata
-- Must show: author, date, version, approval signature
-- Examples: SSP, access control policy, incident response plan, training records
-
-### Technical Evidence (system configuration, logs)
-- Configuration exports from firewalls, Active Directory, SIEM
-- Vulnerability scan reports (authenticated scans preferred)
-- MFA enrollment reports showing all privileged user enrollment
-- Patch management reports showing remediation timelines
-
-### Interview Evidence
-- Assessors will interview: ISSO/ISSM, system admins, end users, executives
-- Prepare personnel to describe their security responsibilities
-- Cannot substitute documentation for interview — both required
-
----
-
-## DIBNET Incident Reporting (DFARS 7012)
-
-DFARS 252.204-7012 mandates cyber incident reporting regardless of CMMC level:
-- **Report to**: DIBNET portal (dibnet.dod.mil)
-- **Deadline**: Within **72 hours** of discovering the incident
-- **What to report**: Systems affected, CUI categories involved, attack vectors, forensic indicators
-- **Preserve evidence**: Maintain disk images and forensic evidence for 90 days; DoD may request copies
-- **Notify prime**: If you are a subcontractor, notify the prime who notifies DoD
-
-### What Constitutes a Reportable Incident
-- Unauthorized access to systems containing CUI
-- Exfiltration of CUI (actual or suspected)
-- Malware detected on systems that process CUI
-- Compromise of credentials that could lead to CUI access
-
----
-
-## Common Assessment Findings
-
-| Practice | Common Finding | Typical Remediation |
-|----------|---------------|---------------------|
-| IA.L2-3.5.3 | MFA not enabled for all privileged accounts or remote access | Deploy MFA solution (Azure MFA, Duo, Okta); enforce via conditional access |
-| SC.L2-3.13.11 | TLS 1.0/1.1 still enabled; non-FIPS algorithms in use | Disable TLS 1.0/1.1; enable only FIPS-validated cipher suites |
-| AU.L2-3.3.1 | Logs not retained per policy; not all devices log to SIEM | Deploy/configure SIEM; set 3-year retention; cover all CUI-touching systems |
-| CM.L2-3.4.1 | No formal baseline configuration document | Create baseline config docs per OS/application; store in change management |
-| AC.L2-3.1.5 | Excessive admin rights; shared admin accounts | Implement PAM solution; audit/remove excess privileges quarterly |
-| RA.L2-3.11.2 | Vulnerability scans not authenticated; not covering all assets | Configure credentialed scans; scan all in-scope assets monthly |
-| CA.L2-3.12.4 | SSP outdated or incomplete | Update SSP; review and re-approve annually or after significant changes |
-| AC.L2-3.1.3 | CUI accessible to users without need-to-know | Implement data classification labels; enforce access controls at file/folder level |
+# CMMC 2.0 — Assessment Guide: SPRS Scoring, C3PAO Process & POA&M Rules
+
+## SPRS Score Calculation
+
+### Scoring Methodology
+The SPRS score is calculated per the DoD Assessment Methodology for NIST SP 800-171:
+- **Starting score**: 110 points
+- **Each NOT MET practice**: Deduct the assigned point value
+- **Partial implementation**: Full deduction applies (no partial credit)
+- **Score range**: +110 (all practices met) to −203 (all not met)
+- **Submission**: Required for all Level 2 contracts; submit at sprs.csd.disa.mil
+
+### Point Values by Domain
+Point values are assigned based on the practice's security impact:
+
+| Domain | Practices | Total Points at Risk |
+|--------|-----------|---------------------|
+| AC (Access Control) | 22 | ~50 |
+| AU (Audit & Accountability) | 9 | ~17 |
+| CM (Configuration Management) | 9 | ~19 |
+| IA (Identification & Authentication) | 11 | ~22 |
+| IR (Incident Response) | 3 | ~5 |
+| MA (Maintenance) | 6 | ~11 |
+| MP (Media Protection) | 9 | ~8 |
+| PE (Physical Protection) | 6 | ~11 |
+| PS (Personnel Security) | 2 | ~4 |
+| RA (Risk Assessment) | 3 | ~9 |
+| CA (Security Assessment) | 4 | ~9 |
+| SC (System & Communications) | 16 | ~39 |
+| SI (System & Information Integrity) | 7 | ~14 |
+
+*Exact point values per practice are published in the DoD Assessment Methodology document (v2.2, Nov 2020).*
+
+### Highest-Impact Practices (Largest Point Deductions)
+Prioritize these when remediating — they carry the heaviest scoring weight:
+1. **AC.L2-3.1.3** — CUI flow control (5 pts)
+2. **SC.L2-3.13.8** — Encryption in transit / FIPS validated (5 pts)
+3. **SC.L2-3.13.11** — FIPS-validated cryptography (5 pts)
+4. **IA.L2-3.5.3** — Multifactor authentication (5 pts)
+5. **SI.L2-3.14.6** — Monitoring for attacks (5 pts)
+6. **AC.L2-3.1.5** — Least privilege (3 pts)
+7. **AU.L2-3.3.1** — Audit logging (3 pts)
+8. **CM.L2-3.4.1** — Baseline configuration (3 pts)
+
+---
+
+## C3PAO Assessment Process
+
+### Pre-Assessment (Contractor Responsibilities)
+Before engaging a C3PAO, ensure:
+- [ ] System Security Plan (SSP) is complete and covers all 110 practices
+- [ ] System boundary is defined with network diagrams
+- [ ] CUI data flows are documented
+- [ ] POA&M lists all practices not yet met
+- [ ] SPRS score has been self-calculated
+- [ ] Personnel responsible for each practice are identified
+
+### Assessment Phases
+
+**Phase 1 — Documentation Review (Remote)**
+- C3PAO reviews SSP, network diagrams, policies, and POA&M
+- Requests artifact list: logs, screenshots, configuration exports, training records
+- Duration: 2–4 weeks
+
+**Phase 2 — Assessment Activities (On-site or Remote)**
+- Interviews with system administrators, security personnel, and executives
+- Technical testing: vulnerability scans, configuration reviews, access control verification
+- Observation of processes (incident response tabletop, maintenance procedures)
+- Duration: 1–3 weeks depending on scope
+
+**Phase 3 — Findings and Reporting**
+- C3PAO issues Findings Report: MET, NOT MET, or NOT APPLICABLE per practice
+- Contractor may provide additional evidence for disputed findings (limited window)
+- Final report submitted to CMMC-AB
+
+**Phase 4 — Certification Decision**
+- **All 110 practices MET**: Full certification issued; valid 3 years
+- **Limited unmet practices (non-critical)**: Conditional certification with POA&M; must remediate within 180 days
+- **Critical practices unmet**: No certification; remediate and reschedule
+
+### Critical Practices (Cannot Have POA&M at Certification)
+The following practices must be fully MET for any certification to be issued:
+- AC.L2-3.1.3 (CUI flow control)
+- IA.L2-3.5.3 (Multifactor authentication)
+- SC.L2-3.13.8 (Encryption in transit)
+- SC.L2-3.13.11 (FIPS-validated cryptography)
+- SI.L2-3.14.6 (Attack monitoring)
+- AU.L2-3.3.1 (Audit logging)
+- IR.L2-3.6.1 (Incident response capability)
+
+---
+
+## POA&M Rules and Management
+
+### What Can Be in a POA&M at Certification
+- Level 2: Up to a limited number of non-critical practices may remain in POA&M at time of certification
+- POA&M remediation deadline: **180 days** from certification date
+- Failure to remediate = certification revocation
+- Level 3: No POA&M at certification — all practices must be MET
+
+### POA&M Entry Format
+
+| Field | Description |
+|-------|-------------|
+| Practice ID | CMMC practice identifier (e.g., CM.L2-3.4.2) |
+| Weakness Description | What is not implemented and why |
+| Remediation Steps | Specific actions to achieve compliance |
+| Milestone 1–N | Intermediate checkpoints with dates |
+| Scheduled Completion | Target date for full implementation |
+| Resources Required | Personnel, tools, budget |
+| Status | Open / In Progress / Completed |
+| Evidence of Closure | What artifacts will demonstrate completion |
+
+### POA&M Best Practices
+- Never list a critical practice in a POA&M if seeking certification
+- Update monthly; stale POA&Ms raise auditor concerns
+- Link each POA&M item to the relevant SSP section
+- Document root cause, not just the symptom
+
+---
+
+## Evidence Requirements by Practice Type
+
+### Documentary Evidence (policies, procedures, plans)
+- Acceptable formats: PDF, Word, screenshots with metadata
+- Must show: author, date, version, approval signature
+- Examples: SSP, access control policy, incident response plan, training records
+
+### Technical Evidence (system configuration, logs)
+- Configuration exports from firewalls, Active Directory, SIEM
+- Vulnerability scan reports (authenticated scans preferred)
+- MFA enrollment reports showing all privileged user enrollment
+- Patch management reports showing remediation timelines
+
+### Interview Evidence
+- Assessors will interview: ISSO/ISSM, system admins, end users, executives
+- Prepare personnel to describe their security responsibilities
+- Cannot substitute documentation for interview — both required
+
+---
+
+## DIBNET Incident Reporting (DFARS 7012)
+
+DFARS 252.204-7012 mandates cyber incident reporting regardless of CMMC level:
+- **Report to**: DIBNET portal (dibnet.dod.mil)
+- **Deadline**: Within **72 hours** of discovering the incident
+- **What to report**: Systems affected, CUI categories involved, attack vectors, forensic indicators
+- **Preserve evidence**: Maintain disk images and forensic evidence for 90 days; DoD may request copies
+- **Notify prime**: If you are a subcontractor, notify the prime who notifies DoD
+
+### What Constitutes a Reportable Incident
+- Unauthorized access to systems containing CUI
+- Exfiltration of CUI (actual or suspected)
+- Malware detected on systems that process CUI
+- Compromise of credentials that could lead to CUI access
+
+---
+
+## Common Assessment Findings
+
+| Practice | Common Finding | Typical Remediation |
+|----------|---------------|---------------------|
+| IA.L2-3.5.3 | MFA not enabled for all privileged accounts or remote access | Deploy MFA solution (Azure MFA, Duo, Okta); enforce via conditional access |
+| SC.L2-3.13.11 | TLS 1.0/1.1 still enabled; non-FIPS algorithms in use | Disable TLS 1.0/1.1; enable only FIPS-validated cipher suites |
+| AU.L2-3.3.1 | Logs not retained per policy; not all devices log to SIEM | Deploy/configure SIEM; set 3-year retention; cover all CUI-touching systems |
+| CM.L2-3.4.1 | No formal baseline configuration document | Create baseline config docs per OS/application; store in change management |
+| AC.L2-3.1.5 | Excessive admin rights; shared admin accounts | Implement PAM solution; audit/remove excess privileges quarterly |
+| RA.L2-3.11.2 | Vulnerability scans not authenticated; not covering all assets | Configure credentialed scans; scan all in-scope assets monthly |
+| CA.L2-3.12.4 | SSP outdated or incomplete | Update SSP; review and re-approve annually or after significant changes |
+| AC.L2-3.1.3 | CUI accessible to users without need-to-know | Implement data classification labels; enforce access controls at file/folder level |

package/src/bmad-plus/packs/pack-shield/references/cmmc/cmmc-levels.md

@@ -1,113 +1,113 @@
-# CMMC 2.0 — Level Comparison, Assessment Types & Flow-Down Rules
-
-## Level Comparison Table
-
-| Attribute | Level 1 — Foundational | Level 2 — Advanced | Level 3 — Expert |
-|-----------|----------------------|-------------------|-----------------|
-| **Practices** | 17 (FAR 52.204-21) | 110 (NIST SP 800-171 Rev 2) | 110+ (SP 800-171 + SP 800-172 subset) |
-| **Focus** | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) | CUI on highest-priority DoD programs; APT resilience |
-| **Assessment type** | Annual self-assessment | Triennial C3PAO assessment (critical) OR self-assessment (non-critical) | DIBCAC-led government assessment (triennial) |
-| **SPRS submission** | Yes | Yes | Yes |
-| **Certification body** | Self | C3PAO (CMMC Third-Party Assessment Organization) | DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) |
-| **Conditional certification** | No | Yes (limited POA&M allowed) | No |
-| **Who needs it** | All DoD contractors receiving/generating FCI | Contractors handling CUI on DoD contracts | Contractors on highest-priority programs (e.g., nuclear C3, certain weapons systems) |
-
----
-
-## DFARS Clause Mapping
-
-| DFARS Clause | Requirement | Level Implied |
-|-------------|-------------|---------------|
-| FAR 52.204-21 | Basic Safeguarding of FCI — 15 requirements | Level 1 baseline |
-| DFARS 252.204-7012 | Safeguarding CUI; 72-hr DIBNET incident reporting; cloud = FedRAMP Moderate | Level 2 prerequisite |
-| DFARS 252.204-7019 | NIST SP 800-171 self-assessment; SPRS submission required | Level 2 self-assessment |
-| DFARS 252.204-7020 | DoD access to contractor assessment results in SPRS | Level 2 |
-| DFARS 252.204-7021 | CMMC certification requirement; flow-down to subcontractors | Level 2 or 3 |
-
-**Rule**: If your contract contains DFARS 252.204-7021, your CMMC level is specified in the contract. Check Section L or the Performance Work Statement.
-
----
-
-## Assessment Process by Level
-
-### Level 1 — Self-Assessment
-1. Assess all 17 practices against FAR 52.204-21
-2. Calculate and submit SPRS score (17 practices, max score = 17, each = 1 point)
-3. Submit to SPRS at https://www.sprs.csd.disa.mil/
-4. Senior official affirms accuracy
-5. Repeat annually
-
-### Level 2 — C3PAO Assessment (Critical Programs)
-1. **Pre-assessment preparation** (6–12 months): SSP, POA&M, gap remediation
-2. **Select a C3PAO**: Must be CMMC-AB authorized; find at cyberAB.us
-3. **Contract with C3PAO**: Negotiate scope, timeline, NDA
-4. **Assessment**: C3PAO reviews evidence, interviews, observes (typically 2–4 weeks on-site/remote)
-5. **Findings**: CMMC-AB receives results; conditional certification possible with limited POA&M
-6. **Certification**: Issued by CMMC-AB; valid for 3 years
-7. **Annual affirmation**: Affirm continued compliance each year
-
-### Level 2 — Self-Assessment (Non-Critical Programs)
-- Same 110 practices as C3PAO path
-- Self-assessed by contractor; senior official affirms in SPRS
-- DoD reserves right to audit; false statements = False Claims Act liability
-- Must still submit SPRS score
-
-### Level 3 — DIBCAC Assessment
-1. Contractor must hold a current Level 2 C3PAO certification first
-2. DIBCAC (government team) conducts assessment — not contractor-selected
-3. Assesses SP 800-171 practices PLUS select SP 800-172 enhanced requirements
-4. No conditional certification — all practices must be MET
-5. Government schedules the assessment; no commercial negotiation
-
----
-
-## Flow-Down Requirements
-
-DFARS 252.204-7021(c) requires prime contractors to:
-- Include CMMC requirements in **all subcontracts** where the subcontractor processes, stores, or transmits CUI
-- Specify the required CMMC level in the subcontract
-- Verify subcontractor certification before award (Level 2/3 must appear in SPRS/CMMC-AB registry)
-- Flow-down applies to **all tiers** — sub-subcontractors are not exempt
-
-**Practical implication**: If you're a prime, map your CUI to each subcontractor and determine which level applies to each. Document this in your supply chain security program.
-
----
-
-## Timeline and Key Dates
-
-| Milestone | Date |
-|-----------|------|
-| CMMC 2.0 Final Rule (32 CFR Part 170) effective | December 16, 2024 |
-| DFARS rule (48 CFR Parts 204, 212, 252) effective | December 16, 2024 |
-| CMMC requirements in new contracts | Phased: began Q1 2025, full rollout through 2026 |
-| Level 1 self-assessments required | All contracts with FAR 52.204-21, immediately |
-| Level 2 C3PAO assessments | Required when DFARS 7021 included in solicitation |
-
----
-
-## CUI Categories Most Common in Defense Contracts
-
-| CUI Category | Examples | Typical Contract Types |
-|-------------|----------|----------------------|
-| Export Controlled (CTI) | Technical data, software, drawings | Engineering, manufacturing |
-| Naval Nuclear Propulsion (NOFORN) | Propulsion design data | Shipbuilding, nuclear |
-| Controlled Technical Information (CTI) | ITAR/EAR-controlled technical data | Weapons systems, aerospace |
-| Privacy (PII) | Personnel records | HR, health, benefits |
-| Law Enforcement Sensitive | Investigation data | Base security contractors |
-| Procurement/Acquisition | Pre-award contract info | Proposal/BD teams |
-
----
-
-## Key Definitions
-
-| Term | Definition |
-|------|-----------|
-| **FCI** | Federal Contract Information — information provided by or generated for the Government under contract, not intended for public release |
-| **CUI** | Controlled Unclassified Information — information the Government creates or possesses that requires safeguarding per law/regulation/policy |
-| **SPRS** | Supplier Performance Risk System — DoD portal where self-assessment scores are submitted |
-| **C3PAO** | CMMC Third-Party Assessment Organization — authorized to conduct Level 2 assessments |
-| **DIBCAC** | Defense Industrial Base Cybersecurity Assessment Center — DCSA organization conducting Level 3 government assessments |
-| **CMMC-AB** | Cyber AB — accreditation body that certifies C3PAOs, assessors, and consultants |
-| **OSC** | Organization Seeking Certification — the defense contractor being assessed |
-| **POA&M** | Plan of Action & Milestones — documented remediation plan for unmet practices |
-| **SSP** | System Security Plan — describes the system boundary, CUI flows, and control implementations |
+# CMMC 2.0 — Level Comparison, Assessment Types & Flow-Down Rules
+
+## Level Comparison Table
+
+| Attribute | Level 1 — Foundational | Level 2 — Advanced | Level 3 — Expert |
+|-----------|----------------------|-------------------|-----------------|
+| **Practices** | 17 (FAR 52.204-21) | 110 (NIST SP 800-171 Rev 2) | 110+ (SP 800-171 + SP 800-172 subset) |
+| **Focus** | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) | CUI on highest-priority DoD programs; APT resilience |
+| **Assessment type** | Annual self-assessment | Triennial C3PAO assessment (critical) OR self-assessment (non-critical) | DIBCAC-led government assessment (triennial) |
+| **SPRS submission** | Yes | Yes | Yes |
+| **Certification body** | Self | C3PAO (CMMC Third-Party Assessment Organization) | DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) |
+| **Conditional certification** | No | Yes (limited POA&M allowed) | No |
+| **Who needs it** | All DoD contractors receiving/generating FCI | Contractors handling CUI on DoD contracts | Contractors on highest-priority programs (e.g., nuclear C3, certain weapons systems) |
+
+---
+
+## DFARS Clause Mapping
+
+| DFARS Clause | Requirement | Level Implied |
+|-------------|-------------|---------------|
+| FAR 52.204-21 | Basic Safeguarding of FCI — 15 requirements | Level 1 baseline |
+| DFARS 252.204-7012 | Safeguarding CUI; 72-hr DIBNET incident reporting; cloud = FedRAMP Moderate | Level 2 prerequisite |
+| DFARS 252.204-7019 | NIST SP 800-171 self-assessment; SPRS submission required | Level 2 self-assessment |
+| DFARS 252.204-7020 | DoD access to contractor assessment results in SPRS | Level 2 |
+| DFARS 252.204-7021 | CMMC certification requirement; flow-down to subcontractors | Level 2 or 3 |
+
+**Rule**: If your contract contains DFARS 252.204-7021, your CMMC level is specified in the contract. Check Section L or the Performance Work Statement.
+
+---
+
+## Assessment Process by Level
+
+### Level 1 — Self-Assessment
+1. Assess all 17 practices against FAR 52.204-21
+2. Calculate and submit SPRS score (17 practices, max score = 17, each = 1 point)
+3. Submit to SPRS at https://www.sprs.csd.disa.mil/
+4. Senior official affirms accuracy
+5. Repeat annually
+
+### Level 2 — C3PAO Assessment (Critical Programs)
+1. **Pre-assessment preparation** (6–12 months): SSP, POA&M, gap remediation
+2. **Select a C3PAO**: Must be CMMC-AB authorized; find at cyberAB.us
+3. **Contract with C3PAO**: Negotiate scope, timeline, NDA
+4. **Assessment**: C3PAO reviews evidence, interviews, observes (typically 2–4 weeks on-site/remote)
+5. **Findings**: CMMC-AB receives results; conditional certification possible with limited POA&M
+6. **Certification**: Issued by CMMC-AB; valid for 3 years
+7. **Annual affirmation**: Affirm continued compliance each year
+
+### Level 2 — Self-Assessment (Non-Critical Programs)
+- Same 110 practices as C3PAO path
+- Self-assessed by contractor; senior official affirms in SPRS
+- DoD reserves right to audit; false statements = False Claims Act liability
+- Must still submit SPRS score
+
+### Level 3 — DIBCAC Assessment
+1. Contractor must hold a current Level 2 C3PAO certification first
+2. DIBCAC (government team) conducts assessment — not contractor-selected
+3. Assesses SP 800-171 practices PLUS select SP 800-172 enhanced requirements
+4. No conditional certification — all practices must be MET
+5. Government schedules the assessment; no commercial negotiation
+
+---
+
+## Flow-Down Requirements
+
+DFARS 252.204-7021(c) requires prime contractors to:
+- Include CMMC requirements in **all subcontracts** where the subcontractor processes, stores, or transmits CUI
+- Specify the required CMMC level in the subcontract
+- Verify subcontractor certification before award (Level 2/3 must appear in SPRS/CMMC-AB registry)
+- Flow-down applies to **all tiers** — sub-subcontractors are not exempt
+
+**Practical implication**: If you're a prime, map your CUI to each subcontractor and determine which level applies to each. Document this in your supply chain security program.
+
+---
+
+## Timeline and Key Dates
+
+| Milestone | Date |
+|-----------|------|
+| CMMC 2.0 Final Rule (32 CFR Part 170) effective | December 16, 2024 |
+| DFARS rule (48 CFR Parts 204, 212, 252) effective | December 16, 2024 |
+| CMMC requirements in new contracts | Phased: began Q1 2025, full rollout through 2026 |
+| Level 1 self-assessments required | All contracts with FAR 52.204-21, immediately |
+| Level 2 C3PAO assessments | Required when DFARS 7021 included in solicitation |
+
+---
+
+## CUI Categories Most Common in Defense Contracts
+
+| CUI Category | Examples | Typical Contract Types |
+|-------------|----------|----------------------|
+| Export Controlled (CTI) | Technical data, software, drawings | Engineering, manufacturing |
+| Naval Nuclear Propulsion (NOFORN) | Propulsion design data | Shipbuilding, nuclear |
+| Controlled Technical Information (CTI) | ITAR/EAR-controlled technical data | Weapons systems, aerospace |
+| Privacy (PII) | Personnel records | HR, health, benefits |
+| Law Enforcement Sensitive | Investigation data | Base security contractors |
+| Procurement/Acquisition | Pre-award contract info | Proposal/BD teams |
+
+---
+
+## Key Definitions
+
+| Term | Definition |
+|------|-----------|
+| **FCI** | Federal Contract Information — information provided by or generated for the Government under contract, not intended for public release |
+| **CUI** | Controlled Unclassified Information — information the Government creates or possesses that requires safeguarding per law/regulation/policy |
+| **SPRS** | Supplier Performance Risk System — DoD portal where self-assessment scores are submitted |
+| **C3PAO** | CMMC Third-Party Assessment Organization — authorized to conduct Level 2 assessments |
+| **DIBCAC** | Defense Industrial Base Cybersecurity Assessment Center — DCSA organization conducting Level 3 government assessments |
+| **CMMC-AB** | Cyber AB — accreditation body that certifies C3PAOs, assessors, and consultants |
+| **OSC** | Organization Seeking Certification — the defense contractor being assessed |
+| **POA&M** | Plan of Action & Milestones — documented remediation plan for unmet practices |
+| **SSP** | System Security Plan — describes the system boundary, CUI flows, and control implementations |