CMMC Level 2 Compliance Management System (NIST SP 800-171 Revision 2)
CMMC Level 2 Compliance Management System (NIST SP 800-171 Revision 2)
An editable documentation system for U.S. defence contractors and subcontractors that handle Controlled Unclassified Information and need CMMC Level 2.
Couldn't load pickup availability
Written and reviewed by practising specialists. Who writes this
Built and reviewed with our methodology. Read it
By document type
| Category | Files |
|---|---|
| Manuals | 1 |
| Policies | 1 |
| Procedures & SOPs | 2 |
| Plans & Programmes | 4 |
| Forms & Records | 5 |
| Checklists & Audit Tools | 5 |
| Registers, Logs & Matrices | 5 |
| Training & Awareness | 2 |
| Guides & Work Instructions | 5 |
| Tools & Workbooks | 5 |
| Other Documents | 4 |
Key documents
| Reference | Document | Format |
|---|---|---|
| AGS-CMMC-MAN-001 | CMMC Level 2 Cybersecurity Governance Manual | Word |
| Policies Compendium | Word | |
| AGS-CMMC-PLN-001 | System Security Plan | Word |
| Procedures Compendium | Word | |
| AGS-CMMC-PLN-014 | POAM Template | Excel |
| AGS-CMMC-MAT-001 | CMMC Level 2 Documentation Requirements Mapping Matrix | Excel |
- Need the complete document list? Request it — same day
- Want to check the quality first? Preview free samples
Overview
A CMMC Level 2 assessment starts with documents: a System Security Plan, a plan of action and milestones, policies, procedures and evidence for every requirement. This system gives you that set, built on NIST SP 800-171 Revision 2, the edition incorporated by reference in 32 CFR Part 170. It explains why Revision 2 still applies although NIST has withdrawn it, and treats Revision 3 (May 2024) as a forward-looking comparison only.
The governance manual sets roles from executive management to the CMMC programme manager, security officer and CUI owner, and covers applicability, including the DoD contract clauses. The System Security Plan appendix, the readiness assessment, the mapping matrix and the evidence matrix each list every NIST SP 800-171 requirement, so none is missed. The POA&M template doubles as the running register.
The system is clear about what it is not. It is documentation, not an assessment, AGS is not a C3PAO, and no assessment outcome is promised. Whether your contract calls for a self-assessment submitted to SPRS or a C3PAO certification assessment, the documents record your own implementation. AGS is independent and is not affiliated with the U.S. Department of Defense or NIST. Regulations are referenced by citation. Standards are referenced by number and title only, and no standard text is included.
What this system covers
- Governance: a governance manual covering roles, CMMC applicability, risk, CUI protection, evidence, internal assessment, corrective action and management oversight.
- Policies: one per NIST SP 800-171 Revision 2 family, plus operational topics such as remote access, multi-factor authentication, encryption, cloud, email and backup, bundled in one compendium.
- Procedures and plans: step-by-step procedures in a compendium, a document control procedure, and plans for incident response, contingency, disaster recovery, training, configuration, vulnerabilities, monitoring, media, CUI and risk.
- System Security Plan and POA&M: an SSP template with an implementation status appendix, a POA&M template and register, and review, status and closure forms.
- CUI and operational records: CUI inventory, access and storage registers, a CUI RACI matrix, and forms and registers for assets, configuration, access, incidents, personnel, physical security, suppliers and training.
- Readiness: an internal documentation readiness assessment, requirements mapping and evidence-to-requirement matrices, and checklists including a pre-assessment readiness checklist.
- Orientation: a user guide, adoption roadmap, customisation guide and an implementation guide that sets out what AGS provides and what you must do.
Who it's for
U.S. defence contractors and subcontractors whose contracts require CMMC Level 2 and that handle, or expect to handle, CUI. It is not designed for organisations that need Level 1 only. The system is owned by a CMMC programme manager who completes the organisation-specific fields.
For an information security management system outside the U.S. defence market, see the ISMS ISO/IEC 27001:2022 toolkit.
Everything you get
Every toolkit gives you a full set of working documents for your standard, ready to edit and use.
Native Microsoft files. Add your logo and adapt every document to how you work.
Your full toolkit arrives as a ZIP the moment payment clears.
One purchase covers everyone in your organisation. No per-seat fees.
Built by people who run real audits, so the content matches what assessors check.
One payment, perpetual licence for your organisation. No subscriptions, no renewals.
Full refund if your files are faulty, incomplete or not as described and we can't put it right
Frequently asked questions
What exactly do I receive?
A downloadable ZIP containing the full set of ready-to-use documents for this toolkit — manuals, procedures, forms, records, checklists, guidance and training material, all in editable Word and Excel format. The exact document count is shown at the top of this page.
Are the documents really editable?
Yes. Every file is native Microsoft Word or Excel — no locked PDFs. Add your logo, change wording, and tailor the content to your organisation. The toolkit is yours to keep and reuse.
Does this certify my organisation?
No. These are documentation toolkits aligned to the relevant standard to help you prepare. Certification itself is issued by an accredited certification body after their audit. Our toolkits give you a strong, audit-ready starting point.
How is it delivered?
Instantly and digitally. There's no physical shipment — you download the files right after payment and receive a backup link by email.
Do I get updates?
Yes. If we revise this toolkit, you're entitled to the updated version at no extra cost — just contact us with your order details.
What is your refund policy?
These are digital products, so once a toolkit has been downloaded we cannot take it back. If you have not downloaded yet, contact us and we will cancel the order and refund you in full. We also refund in full if the files are damaged, incomplete, or not what the product page described.
Cannot find your standard?
Tell us which scheme you work to. We will point you to the right toolkit.
More in Information Security, Risk & Business Continuity
See all 55
IMS for UAE E-Invoicing Accredited Service Providers (ISO/IEC 27001, ISO 22301, MD 64/2025)
Information Security, Risk & Business Continuity76 documents $1,850USD
Supplier Compliance Management System
Information Security, Risk & Business Continuity144 documents $1,450USD
Third-Party Risk Management System (TPRM)
Information Security, Risk & Business Continuity154 documents $1,750USD