Mac-first · NIST SP 800-171 · CMMC Level 2
CMMC Level 2,
CMMC Level 2,
on Macs.
Practical, source-cited guidance for taking an Apple-first environment through NIST SP 800-171 and CMMC Level 2 - plus the documentation suite that takes your SSP, policies, and workbooks off the blank page.
Start the guideBrowse free tools
Written by a practitioner. Claims graded and sourced. No ads, ever.
110Level 2 requirements
320Assessment objectives
62Deliverables, Complete edition
7Workbooks that answer them
Where things stand · August 2026
CMMC Phase 2 was suspended on July 13, 2026 by implementing memo 26-P-1023. While the suspension holds, new solicitations may designate only Level 1 (Self) or Level 2 (Self), and waivers are paused.
What did not change: DFARS 252.204-7012, NIST SP 800-171 Rev 2, your SPRS self-assessment score, and the annual affirmation. The Reform Task Force RFI closed August 14, 2026; the task force report is expected around mid-September 2026.
Free tools
All free resources →Is This Mac in Your CMMC Scope?
Four questions. Find out if a Mac is a CUI asset, an SPA, or out of scope entirely, before you harden anything.
Open →No signupCMMC Documentation Cost Calculator
Estimate DIY hours against your own rate, and see where the Suite changes the math.
Open →No signupWhich Requirements Can Go on a POA&M?
Check which requirements can legally be deferred to a Plan of Action, and which cannot.
Open →No signupThe road to assessment-ready
Start here →
1
Orient
Decisions firstWhat is enforced today is NIST SP 800-171 Rev 2 self-assessment. Start from the current program state, not from guidance written before the July 2026 suspension.
2
Scope
Burden is set hereClassify every Mac before touching a control. Scope decides assessment burden, and ten minutes with the classifier beats a month of hardening machines that never needed it.
3
Implement
The 110Work the requirements with their SPRS weights in view, so effort lands on the 5-point items first instead of alphabetically.
4
Evidence
Prove itA control without evidence scores like a control you skipped. Produce artifacts as you implement, not in the month before the assessment.
5
Sustain
After the snapshotAn assessment asserts a point in time. Continuous monitoring is what keeps the assertion true in month seven.
Where the Suite fits: phases 3 and 4 are documentation-heavy. That is the part the templates compress. Phases 1 and 2 are free, and skipping them is how documentation ends up describing the wrong system.
Latest guidance
Browse all guides →Loading latest guidance…
Browse by topic
The full library →Scoping & CUI
macOS Controls & Baselines
MDM & the Management Plane
Documentation & Assessment
The Suite · v0.6.5
Off the blank page.
An SSP, 14 family policies, 15 procedures, 8 forms, and 7 workbooks, cross-referenced by artifact ID so a control, its policy, and its evidence request always point at each other. One-time purchase. No subscription.
See the SuiteCore · 50 deliverables$299
Complete · 62 deliverables$399
FOUNDING100 takes $100 off either edition. Release status →