CMMC agent skills
10 skills relate to CMMC. The tag says which framework a skill relates to; the skills contain no text from it.
CMMC, the Cybersecurity Maturity Model Certification, is the US Department of Defense programme that checks how contractors protect FCI and CUI. Level 2 builds on NIST SP 800-171 and is assessed by the contractor itself or by an accredited third party, as the contract says. These skills cover the plan, the open items and the evidence an assessment looks at.
10 skills tagged CMMC
- Access review campaign prepA ready-to-run access review: systems in scope, account lists reconciled against HR, pre-flagged leavers and admins, and review sheets for managers.
- Change management evidence samplingA change management test before the auditor runs one: the production change population, sampled approvals and segregation of duties gaps.
- Evidence freshness checkAn index of every evidence artefact with its date, owner and period covered, flagging stale, undated and missing items before the auditor does.
- First gap assessmentA first gap assessment against your chosen framework: what exists, rated by evidence, and a gap register with the long-lead items first.
- GRC setup reviewThe 10 grcskills that fit your setup, an audit of what is broken, duplicated or missing, and a 30-day plan, written to files.
- Incident response plan draftingAn incident response plan sized to your real team: roles and deputies, a severity scale, a contact tree and one-page playbooks for likely incidents.
- Internal audit checklist from scopeA working internal audit checklist for one area, built from your own documents: a question, a record to inspect, a sample and a pass criterion per test.
- Logging and monitoring evidence packA logging and monitoring evidence pack: log coverage and retention per system, the alert rules that matter, and proof an alert was handled.
- Plan of action and milestones draftA plan of action and milestones from your findings and scans: one row per weakness, dated milestones, owners, and every vague or overdue item flagged.
- SSP control implementation statementsSystem security plan statements drafted from your real evidence, per control id: who, what, how, where and how often, with every unproven claim flagged.