Free, source-cited guidance for small defense contractors
The documentation half
of CMMC Level 2.
Mac fleets included.
Guides, free tools and complete worked examples for writing your SSP, policies and evidence. Everything here cites a primary source. Nothing here asks for your email.
Where are you right now?
Free tool. Runs in your browser. Stores nothing.
Is this Mac in your CMMC scope?
Question 1 of 3
Will this Mac process, store or transmit CUI?
Likely asset category
A first pass, not a scoping decision. Categories from 32 CFR 170.19(c)(1), Table 3. Government-furnished Macs are Specialized Assets. Use the full scope classifier.
ProcedureA continuous monitoring procedureThe recurring checks that keep evidence current between assessments.
ReferenceWhat assessors ask forThe evidence requests to expect, so nothing is assembled at the last minute.
ReferenceFIPS 140-2 goes historicalWhat the Historical list means for encryption claims on Macs.
What changed on this site
Corrections and updates, dated, so you can tell what is current.
2026-10-06The Suite is now one edition at $97. Both template packs are $47.
2026-08-22macOS FIPS certificate table re-verified against CMVP. One entry corrected.
2026-08-21Suite v1.0 published with a SHA-256 fingerprint for every archive.
How this site is funded
The guides and tools are free and stay free. The site is paid for by one product: the CMMC Operator Suite, the full editable document set these guides are drawn from.
If the free material is enough for you, it was written to be.
CMMC Operator Suite
$97 once
62 editable deliverables: SSP, 14 policies, 15 procedures, 8 forms, 7 workbooks, a Mac overlay, 10 specialty documents and a training deck. 12 months of updates.
See what is inside Read a complete sample first