Step 1 of 3: Identity
CMMC 2.0
Phase 4 · Attestation & reportingBoard-ready defensible compliance reporting, audit trail aggregation, and analytics packs.
Basis: Defense Industrial Base (DIB) Submission Package
/cmmc/audit-reportingDoD Cybersecurity Maturity Model Certification (CMMC 2.0 / NIST SP 800-171)
3 steps, completed in order. Each step is validated against the schema before the next unlocks.
Step 1 of 3
Complete the Identity fields. Each value is validated against the schema before the next step unlocks.
Domain entity ID (required)
entityIdThe organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.
Step 2 of 3
Complete the Report fields. Each value is validated against the schema before the next step unlocks.
Report (required)
reportClassEnter report.
Written for (required)
audienceEnter written for.
Covering fromoptional
periodStartEnter covering from.
Covering tooptional
periodEndEnter covering to.
Step 3 of 3
Complete the Audience fields. Each value is validated against the schema before the next step unlocks.
Export formatoptional
exportFormatEnter export format.
Caveatsoptional
confidenceNotesWhat a reader should not conclude from this report.
Continue with the next guide in this framework's table of contents.
Automated NIST SSP compilation, 180-day POAM window enforcement, and SPRS score calculation.
Read guide Phase 4 · Attestation & reportingHuman-governed remediation planning, automated fix playbooks, and 180-day POAM resolution tracking.
Read guide Phase 4 · Attestation & reportingDefense subcontractor compliance verification, DFARS flowdown tracking, and vendor score validation.
Read guide