Step 1 of 3: Identity
CMMC 2.0
Phase 4 · Attestation & reportingDual-revision baseline engine managing NIST SP 800-171 Rev 2 to Rev 3 transitions and rulemaking tracking.
Basis: DFARS 252.204-7012 Safeguarding Covered Defense Information
/cmmc/regulatoryDoD Cybersecurity Maturity Model Certification (CMMC 2.0 / NIST SP 800-171)
3 steps, completed in order. Each step is validated against the schema before the next unlocks.
Step 1 of 3
Complete the Identity fields. Each value is validated against the schema before the next step unlocks.
Domain entity ID (required)
entityIdThe organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.
Step 2 of 3
Complete the Change fields. Each value is validated against the schema before the next step unlocks.
Change (required)
changeTitleEnter change.
Source (required)
sourceTypeEnter source.
Citationoptional
sourceReferenceThe rule, notice or guidance this came from.
Publishedoptional
publishedAtEnter published.
Effectiveoptional
effectiveAtBlank until the date is actually set — a guessed effective date reads as fact downstream.
Step 3 of 3
Complete the Impact fields. Each value is validated against the schema before the next step unlocks.
Enforceability (required)
enforceabilityEnter enforceability.
Impacted areasoptional
impactedDomainsEnter impacted areas.
Required actionoptional
transitionActionEnter required action.
Impact assessmentoptional
impactNotesEnter impact assessment.
Continue with the next guide in this framework's table of contents.
Automated NIST SSP compilation, 180-day POAM window enforcement, and SPRS score calculation.
Read guide Phase 4 · Attestation & reportingHuman-governed remediation planning, automated fix playbooks, and 180-day POAM resolution tracking.
Read guide Phase 4 · Attestation & reportingBoard-ready defensible compliance reporting, audit trail aggregation, and analytics packs.
Read guide