Tier 1: CMMC Documentation Templates (Level 2 / NIST 800-171)

The document your C3PAO assessor asks for first does not exist yet.

Most defense contractors preparing for CMMC Level 2 face the same problem: they know they need a System Security Plan, policies, and supporting documentation, but they do not know what format assessors expect, what level of detail is required, or how all the pieces connect. The result is 80 to 120 hours of trial and error building documentation from scratch, followed by revision cycles when the assessor rejects it.

**Tier 1** gives you every foundational document you need for CMMC Level 2 certification, pre-built in the format C3PAO assessors expect. Replace the bracketed placeholders with your organization’s details, get leadership signatures, and you have audit-ready documentation in days instead of months.

What’s Included in Tier 1 (30 Documents)

Assessment-Level Documents

• System Security Plan (SSP) Template: Covers all 110 NIST 800-171 Rev 2 controls across 14 families with implementation status tracking and evidence references
• Plan of Action & Milestones (POA&M): Both a narrative template (.docx) and an Excel tracking workbook with dashboard, SPRS score impact calculations, and the 22-item/180-day CMMC constraints built in
• CUI Boundary Definition Worksheet: 4 boundary architecture models, system inventory tables, data flow mapping, and a 27-item validation checklist

14 Domain Security Policies

One comprehensive policy per CMMC security domain: Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System & Communications Protection, and System & Information Integrity. Each policy includes purpose, scope, roles and responsibilities, enforcement, and maps directly to the CMMC practices it satisfies. Ready for executive signature.

Supporting Assessment Tools

• Control Implementation Matrix (Excel): Track implementation status for all 110 controls with conditional formatting and summary dashboard
• System Inventory Worksheet (Excel): 4-tab workbook for hardware, software, cloud services, and external connections
• Evidence Folder Structure Guide: Recommended folder hierarchy for all 14 families with evidence types and naming conventions
• Data Flow Diagram Template (PowerPoint): 3 complexity levels with shape library and CUI boundary examples
• Vendor Assessment Questionnaire: 50 questions with scoring rubric for third-party risk management
• Assessment Readiness Checklist: 45-item pre-assessment self-check across 6 categories
• FIPS Module Audit Spreadsheet (Excel): Cryptographic module inventory for control 3.13.11 with CMVP validation tracking

Comprehensive Usage Guide

Step-by-step instructions, recommended completion timeline, customization guide for all placeholders, cross-reference map showing how documents connect, and common mistakes to avoid.

Who This Is For

• Compliance leads at small-to-mid-size defense contractors (10-250 employees)
• IT directors building a compliance program from scratch
• Quality and security officers who need professional documentation without $5,000+ consultant fees
• GovCon consultants working with multiple small contractors

What You’ll Accomplish with Tier 1

1. Reduce documentation time from 80-120 hours to 20-30 hours
2. Meet assessor format expectations on first submission
3. Define your CUI boundary with a structured, defensible methodology
4. Track all 110 controls in a single implementation matrix
5. Build a professional evidence organization system assessors trust

Feature	Tier 1 ($79)	Tier 2 ($119)	Tier 3 ($149)
SSP, POA&M, CUI Boundary	Yes	Yes	Yes
14 Domain Policies	Yes	Yes	Yes
Supporting Tools (8 Excel/PPT/Word)	Yes	Yes	Yes
Usage Guide	Yes	Yes	Yes
42 Operating Procedures		Yes	Yes
111 Control Implementation Guides			Yes
Evidence Checklists per Control			Yes
C3PAO Assessment Objectives			Yes

Why Upgrade? Tier 1 Answers “What Do I Need?” The Next Question is “How?”

Tier 1 templates tell your assessor WHAT your organization requires. But during your assessment, the C3PAO will not stop at reading your policies. They will ask: “Show me your account management procedure.” “Walk me through your incident response process.” “How does your team handle media sanitization?” Without documented procedures, your policies are requirements with no operational proof.

**Tier 2: Templates + Procedures ($119)** adds 42 step-by-step operating procedures covering every domain, with technology-neutral placeholders for your actual tools. Your policies describe the rules; your procedures prove you follow them.

**Tier 3: Complete Pack – Templates, Procedures, and Control Guides ($149)** includes everything: Tier 1 templates, Tier 2 procedures, plus 111 control implementation guides with evidence checklists and C3PAO assessment objectives for every CMMC Level 2 practice. Each guide shows exactly what the assessor checks, what evidence they expect, and the pitfalls that fail other organizations. This is your full rehearsal for assessment day.

Visit https://agility-grp.com/shop to compare all tiers.