CMMC Operator Suite Procurement Information

Procurement should be able to check this purchase without a sales call. This page records what ships in Core and Complete, what the current ZIPs were checked for, what the standard license allows, and what Gumroad handles.

This page summarizes the purchase. If it conflicts with the Terms of Use, Gumroad checkout terms, or the edition selected at checkout, those documents control.

What you are buying

Both editions map to all 110 NIST SP 800-171 Rev. 2 requirements and 320 CMMC Level 2 assessment objectives. Both include the five-document Mac overlay for the 46 requirements with a meaningful macOS implementation difference.

Core includes the SSP, policies, procedures, forms, Mac overlay, finishing guide, and six operational workbooks. Complete adds 10 specialty documents, the AI tool inventory and provider assessment workbook, and the training deck.

Review the edition comparison or inspect the file-level release manifest.

What arrives after checkout

• A ZIP archive delivered through Gumroad.
• Editable DOCX and XLSX files, plus PPTX in Complete.
• PDF companion copies for review and reference.
• Access to versioned release updates for 12 months.

Buy for the published formats: DOCX, XLSX, PDF, and PPTX in Complete. We have not published a compatibility matrix for Apple Pages, Numbers, Google Docs, Google Sheets, or individual Microsoft Office versions, so do not assume full formatting fidelity there.

What we checked inside the ZIPs

The Core and Complete ZIPs were inspected before publication, on August 13, 2026, against the release then current. Version 1.0 changed five markdown metadata files in each edition and nothing else: no entry was added or removed, and not one DOCX, XLSX, PPTX or PDF file differs by a single byte, verified by comparing the SHA-256 of every entry in both archives. The findings below therefore apply to v1.0 unchanged. The Office files are macro-free Office Open XML. The archives contain no executable or script files, no ActiveX content, no embedded executable objects, and no external Office relationship targets.

No template contains CUI, FCI, credentials, or real organization data. Once your team fills a file in, keep it inside your approved environment.

What the standard license allows

The standard license is for limited, non-exclusive, non-transferable internal business use by one organization. It does not permit resale, public redistribution, transfer to another organization, or use as paid third-party deliverables.

The standard license does not cover paid client deliverables. Consultants and service providers should confirm commercial-use licensing before buying for client work. The Terms of Use contain the controlling language.

What Gumroad handles

Gumroad is the merchant of record for the current self-service checkout. It handles payment, applicable sales tax, the receipt, and access to the download.

Purchases are generally non-refundable except where required by law or stated otherwise at checkout. The public checkout does not promise purchase orders, net terms, vendor-onboarding documents, or custom records. Ask before purchase if your process requires one.

What the Suite does not do

The Suite is an editable CMMC Level 2 documentation system. It does not tailor itself to your environment, implement controls, provide legal advice, certify an organization, or guarantee an assessment result.

Your team still has to tailor and approve the documents, operate the controls, and retain the evidence. Your contract, system boundary, operating practices, evidence, and assessor determine the outcome.

Check the purchase before approving it

• Completed Access Control policy specimen
• Contents and preview images
• Release manifest and archive fingerprints
• Terms of Use and Privacy Policy

Compare Core and Complete