Sign in Subscribe

CMMC Level 2 Documentation Templates for Mac

CMMC Level 2 documentation templates for Mac: SSP, policies, procedures, forms, Excel workbooks, evidence prompts, and implementation guidance.
Share

Home/The Suite

v1.0 · shipped Aug 21, 2026 · changelog

A Mac-first CMMC Level 2 documentation system: SSP, policies, procedures, forms, and workbooks, cross-referenced by artifact ID so a control, its policy, and its evidence request always point at each other. One-time purchase, from $299, including 12 months of versioned updates.

See editions & pricingWhat is in the box

The problem with every other template pack

Most CMMC Level 2 documentation is platform-neutral or Windows-default. If you run Macs, that means translating someone else's Active Directory assumptions into your actual environment, control by control. This suite is written the other way around: native Mac implementation examples, with Jamf Pro, FileVault, and Apple Business Manager as the reference architecture, and platform-neutral language where the requirement is genuinely platform-neutral.

What is actually in the box

Full manifest →
1System Security Plan template, structured for assessment
14Policies covering all 110 Level 2 requirements by family
15Procedures: the "do what you say" layer
8Forms and operational records
6Excel workbooks: self-assessment, POA&M, asset inventory, and more
5Mac implementation overlay documents
1Finishing guide
50Core edition total

Complete adds 12 deliverables

10Specialty documents, including the AI governance policy set
1Training deck (PPTX)
1Seventh workbook

Everything ships as editable DOCX and XLSX with structured placeholder fields, plus a read-only PDF render of every document alongside its editable source.

One connected system, not a folder of files

Every artifact carries an ID, and the cross-reference index ties them together: the SSP points at the policy that satisfies each control, the policy points at the procedure that implements it, and the workbooks point at the evidence an assessor will ask for. Change a scoping decision once and you can trace everything it touches.

How this suite is verified

How claims are graded →
Machine checksEvery release is checked against the canonical control sets: all 110 requirements and 320 assessment objectives, by ID.
Human reviewAll content is human-reviewed. Nothing ships on a model's say-so.
Primary sourcesSourced from the primary federal documents: the CFR, NIST publications, and the Federal Register, not from other people's templates.
IntegrityEvery release ships with its SHA-256 hash, so you can prove the archive you downloaded is byte for byte the archive that was published. Current fingerprints

Editions

Core

$299

One-time · 50 deliverables · 44 documents + 6 workbooks

  • SSP, 14 policies, 15 procedures, 8 forms
  • 6 workbooks, incl. self-assessment and POA&M
  • 5-document Mac implementation overlay + finishing guide
  • DOCX/XLSX + PDF renders · 12 months of versioned updates
Buy Core
Most complete Complete

$399

One-time · 62 deliverables · 54 documents + 7 workbooks + deck

  • Everything in Core
  • 10 specialty documents, incl. the AI governance policy set
  • Training deck (PPTX)
  • Seventh workbook
Buy Complete
FOUNDING100 takes $100 off either edition at checkout.

Not sure which edition fits? Run the fit check · Buying through a process? Procurement information

Preview the current templates

Self-assessment workbook screenshot
Self-assessment workbook: controls, SPRS weights, objective counts, status, owners, deductions.
POA&M workbook screenshot
POA&M workbook: control, weakness, milestone, owner, priority, status, target date.
Asset inventory workbook screenshot
Asset inventory workbook: CUI category, owner, location, processing, storage, transmission.

Who this is for

Small and mid-size defense contractors, roughly 5 to 200 endpoints, with a meaningful Mac fleet and CMMC Level 2 ahead of them. Built so the documentation work does not require a major consulting engagement. Curious how it is made? The build process is documented, down to the DFARS clauses behind the requirements.

Questions worth asking

Does this work if we use Intune, Iru (formerly Kandji), Addigy, or Mosyle instead of Jamf?
Yes. Jamf Pro is the reference architecture in the implementation examples, but every narrative states the requirement first and the mechanism second, with platform-neutral language wherever the requirement is genuinely platform-neutral. Swapping the MDM means swapping the tool name and the profile or payload reference, not rewriting the document.
We are a mixed Mac/Windows shop. Is this still useful?
Yes, if Macs are a meaningful part of your boundary. The SSP, policies, procedures, and forms cover the whole environment in platform-neutral terms; the Mac overlay adds the Apple-specific implementation language most packs lack. Windows-side specifics stay yours to describe, and the site's guidance on Windows and Active Directory SSP narratives follows the same structure, and the Mac SSP narrative template shows the Apple side.
What exactly happens after I buy?
An immediate download from Gumroad: a versioned archive with every document as editable DOCX or XLSX plus a read-only PDF render, the artifact cross-reference index, and the finishing guide that sequences the work. Updates for 12 months arrive as new versioned releases, each with a changelog entry and a published SHA-256 fingerprint.
Will this get us certified?
No, and no template can. Certification depends on your implementation, your evidence, and your assessment. What the Suite removes is the blank-page problem: the documentation structure, cross-referencing, and Mac-specific language that assessments expect, so your effort goes into implementing and evidencing instead of formatting.

Off the blank page.

One-time purchase, from $299, including 12 months of versioned updates. Every release ships with its SHA-256 hash, so you can prove the archive you downloaded is byte for byte the archive that was published.

Buy on Gumroad

Educational templates, not legal advice or a certification guarantee. How claims are graded · Need only part of it? Template packs