SSP Evidence Drill Tracker (Complete 110-Control Coverage)

Can your team prove what your SSP claims?

Most defense contractors can pass a paper review of their System Security Plan. But when a C3PAO assessor says “show me the evidence for this control right now,” the real test begins. Controls where evidence takes hours to locate, requires reconstruction, or does not exist signal weak implementation and result in assessment findings.

The SSP Evidence Drill Tracker gives your compliance team a structured, repeatable method to test evidence production capability for every NIST SP 800-171 control before your CMMC Level 2 assessment.

How It Works

This product includes 3 drill cycle workbooks. Each cycle pre-selects 5 NIST 800-171 controls per week for a 10-week schedule. Your team attempts to locate and produce the required evidence for each control within 30 minutes. You record whether evidence was found, how long it took, and where it was located. Controls with missing or slow evidence get logged as gaps with assigned owners and target resolution dates.

Cycle A (50 controls) and Cycle B (50 controls) have zero overlap, covering 100 unique controls across all 14 families. Cycle C tests the remaining 10 controls plus 40 re-drills weighted toward commonly weak families. Together, all 3 cycles test every one of the 110 NIST 800-171 controls.

What’s Included

• 3 Drill Cycle Workbooks (.xlsx, no macros required)
• Each workbook is a self-contained 4-tab Excel file:
• Control Randomizer: Pre-randomized 10-week drill schedule
• Evidence Production Log: 50-row tracking sheet with pre-populated control descriptions and evidence type guidance
• Gap Summary Dashboard: Auto-calculated readiness metrics by control family with Green/Yellow/Red status indicators
• Remediation Tracker: Consolidated gap management with priority, owner, status, and verification tracking
• Evidence Drill Guide (PDF): Step-by-step instructions, 3-cycle system overview, scoring methodology, remediation planning framework, and accelerated schedule options
• Example Completed Drill Cycle (PDF): Sample 4-week drill output for a mid-size contractor showing realistic results, common patterns, and key takeaways
• README (TXT): Quick-start instructions and package orientation

Who This Is For

• Compliance leads and security officers at small-to-mid-size defense contractors preparing for CMMC Level 2 assessment
• IT managers responsible for evidence repositories and assessor evidence requests
• GovCon consultants conducting pre-assessment readiness checks
• Organizations that have an SSP but have never tested their ability to produce evidence on demand

What You’ll Accomplish

After completing all 3 drill cycles, you will have:

1. Tested evidence production for all 110 NIST 800-171 controls with zero gaps in coverage
2. Established baseline evidence retrieval times per control family
3. Identified specific gaps with documented remediation plans and assigned owners
4. Re-tested commonly weak control families through Cycle C’s reinforcement drills
5. Built organizational confidence for assessment-day evidence requests

System Requirements

• Microsoft Excel 2016 or later (Windows or Mac)
• No macros, no software installation
• PDF reader for companion materials