{"product_id":"cmmc-level-2-compliance-management-system-nist-sp-800-171-revision-2","title":"CMMC Level 2 Compliance Management System (NIST SP 800-171 Revision 2)","description":"\u003cp\u003e\u003cem\u003eAn editable documentation system for U.S. defence contractors and subcontractors that handle Controlled Unclassified Information and need CMMC Level 2.\u003c\/em\u003e\u003c\/p\u003e\n\u003ch2\u003eOverview\u003c\/h2\u003e\n\u003cp\u003eA CMMC Level 2 assessment starts with documents: a System Security Plan, a plan of action and milestones, policies, procedures and evidence for every requirement. This system gives you that set, built on NIST SP 800-171 Revision 2, the edition incorporated by reference in 32 CFR Part 170. It explains why Revision 2 still applies although NIST has withdrawn it, and treats Revision 3 (May 2024) as a forward-looking comparison only.\u003c\/p\u003e\n\u003cp\u003eThe governance manual sets roles from executive management to the CMMC programme manager, security officer and CUI owner, and covers applicability, including the DoD contract clauses. The System Security Plan appendix, the readiness assessment, the mapping matrix and the evidence matrix each list every NIST SP 800-171 requirement, so none is missed. The POA\u0026amp;M template doubles as the running register.\u003c\/p\u003e\n\u003cp\u003eThe system is clear about what it is not. It is documentation, not an assessment, AGS is not a C3PAO, and no assessment outcome is promised. Whether your contract calls for a self-assessment submitted to SPRS or a C3PAO certification assessment, the documents record your own implementation. AGS is independent and is not affiliated with the U.S. Department of Defense or NIST. Regulations are referenced by citation. Standards are referenced by number and title only, and no standard text is included.\u003c\/p\u003e\n\u003ch2\u003eWhat this system covers\u003c\/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eGovernance:\u003c\/strong\u003e a governance manual covering roles, CMMC applicability, risk, CUI protection, evidence, internal assessment, corrective action and management oversight.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePolicies:\u003c\/strong\u003e one per NIST SP 800-171 Revision 2 family, plus operational topics such as remote access, multi-factor authentication, encryption, cloud, email and backup, bundled in one compendium.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eProcedures and plans:\u003c\/strong\u003e step-by-step procedures in a compendium, a document control procedure, and plans for incident response, contingency, disaster recovery, training, configuration, vulnerabilities, monitoring, media, CUI and risk.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSystem Security Plan and POA\u0026amp;M:\u003c\/strong\u003e an SSP template with an implementation status appendix, a POA\u0026amp;M template and register, and review, status and closure forms.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCUI and operational records:\u003c\/strong\u003e CUI inventory, access and storage registers, a CUI RACI matrix, and forms and registers for assets, configuration, access, incidents, personnel, physical security, suppliers and training.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eReadiness:\u003c\/strong\u003e an internal documentation readiness assessment, requirements mapping and evidence-to-requirement matrices, and checklists including a pre-assessment readiness checklist.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOrientation:\u003c\/strong\u003e a user guide, adoption roadmap, customisation guide and an implementation guide that sets out what AGS provides and what you must do.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch2\u003eWho it's for\u003c\/h2\u003e\n\u003cp\u003eU.S. defence contractors and subcontractors whose contracts require CMMC Level 2 and that handle, or expect to handle, CUI. It is not designed for organisations that need Level 1 only. The system is owned by a CMMC programme manager who completes the organisation-specific fields.\u003c\/p\u003e\n\u003cp\u003eFor an information security management system outside the U.S. defence market, see the ISMS ISO\/IEC 27001:2022 toolkit.\u003c\/p\u003e","brand":"Apex Global Solutions AGS","offers":[{"title":"Default Title","offer_id":57395091898708,"sku":"AGS-06-031","price":1390.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1052\/4996\/4372\/files\/AGS-06-031.png?v=1790973309","url":"https:\/\/agskits.com\/products\/cmmc-level-2-compliance-management-system-nist-sp-800-171-revision-2","provider":"Apex Global Solutions","version":"1.0","type":"link"}