CMMC Level 2, done in the open
In October 2026 Sanctir posted a NIST SP 800-171 self-assessment score of 110 out of 110 and affirmed a CMMC Level 2 (Self) status in the Department of Defense's Supplier Performance Risk System — from one Microsoft 365 tenant and two laptops, with no consultant and no managed-service provider. Everything we used is published, with our identifiers removed, so any small defense supplier can do the same.
collingeorge/cmmc-l2-reference
59 policy definitions · 17 alert rules · 19 remediations · 10 audit and administration scripts · 24 document skeletons · 6 explainers. MIT license for code, CC BY 4.0 for documents. Free; no sign-up.
Start with the right file
START-HERE.md — for owners who are not IT specialists: what the clauses require, how the score works, how to score yourself honestly, how to post it in SPRS (both records), which keys and certificates you need, and every command.
01 — Everything is owned by the tenant — the premise. A local machine never carries an individual setting; anything set by hand is drift, and drift is reversed and recorded.
02 — Build order — the sequence to deploy in, layer by layer. Each layer assumes the one before it; out of order is how you lock yourself out of your own tenant.
03 — Why this stack — Microsoft 365 E5 component by component, Sentinel and the locked archive, Cloudflare Zero Trust, FIPS security keys, the DoD ECA certificate, DISA SCAP and STIG tools, and what it costs.
04 — Working with an AI assistant — how Claude Code sped up implementation, testing and deployment on a standard subscription; the rules that kept it safe; and the four things it got wrong.
05 — Run your own audit — the eleven reads an assessor would do, in order, and what ours found before anyone else could.
06 — Tenant set-up and enrolment — the exact commands, from an empty tenant to enrolled, compliant devices. Every script prints its plan first and changes nothing without -Apply.
policies/ — Intune settings catalog, compliance, Conditional Access and authentication-method definitions, each with a deploy script that reads one configuration file. docs/templates/ — System Security Plan, Plan of Action, policies, procedures, plans, standards and runbooks: the structure of documents that passed, with the contents removed and guidance in their place.
How to use it, in five steps
1. Read START-HERE, then explainer 01
START-HERE explains what the clauses require, how the score works and how to post it in SPRS. Explainer 01 sets the premise: the tenant owns every setting and a local machine carries none. If you disagree with the premise, the rest will fight you.
2. Download the repository and set your configuration
Download the toolkit as a .zip (button above) or clone it. Copy config.example.json to config.json and fill in your tenant. Every deploy script reads that one file, so nothing tenant-specific lives in the scripts.
3. Deploy in the build order
Identity first, then the endpoint baseline, then logging and alerting, then the remediations that hold it all in place. Every script shows its plan before it changes anything and needs -Apply to act. The layer-by-layer sequence is in explainer 02; the exact commands are in explainer 06.
4. Take a baseline snapshot
From then on every change is a recorded change, and the drift check proves nothing else moved. Record changes in the configuration-management register (PLN-006).
5. Audit yourself as if you wanted to fail
Run the eleven reads an assessor would do, in the order in explainer 05. Fix what it finds, record what remains in the Plan of Action (POAM-002), and only then score and post.
Template library
Twenty-four document skeletons: the structure of documents that passed, with the contents removed and guidance in their place. Each opens on GitHub; the whole set is in the .zip.
Plans & assessment
- SSP-001 System Security Plan
- POAM-002 Plan of Action and Milestones
- PLN-006 Configuration Management Plan and change register
- PLN-007 Incident Response Plan and register
- PLN-010 Endpoint Baseline Architecture
- TCP-017 Technology Control Plan for ITAR technical data
- DOC-000 Document set completion checklist
Policies & procedures
- POL-003 Access Control and Identification Policy
- POL-004 Security Awareness and Training
- POL-008 Acceptable Use of Artificial Intelligence Services
- POL-009 Personnel Security and Physical Protection Policy
- PRO-005 Audit and Accountability Procedure
- PRO-008 Maintenance and Media Protection Procedure
- PRO-010 Risk and Security Assessment Procedure
Standards
Control map
Where to start for each of the fourteen NIST SP 800-171 control families: the document that governs it and the parts of the repository that implement it. This is a starting index, not a requirement-by-requirement mapping; that mapping belongs in your System Security Plan.
| Family | Document | Implemented by |
|---|---|---|
| Access Control (AC) | POL-003 | Conditional Access policies; local accounts and groups, screen lock, LAPS and logon banner (policies/) |
| Awareness & Training (AT) | POL-004, TRN-019 | Training modules and records |
| Audit & Accountability (AU) | PRO-005 | Audit policy, event-log size, time sync, process command-line auditing; audit-tamper and stream-lag alerts (alerting/) |
| Configuration Management (CM) | PLN-006, PLN-010, STD-011, STD-023 | Security baseline and Edge/Office configuration; service-baseline and drift-consistency remediations (remediations/) |
| Identification & Authentication (IA) | POL-003 | Authentication-methods policy, passwordless and security-key sign-in, MFA, password and lockout policy |
| Incident Response (IR) | PLN-007 | High-severity incident, malware, privilege-escalation and persistence alert rules |
| Maintenance (MA) | PRO-008, GDE-012, RUN-013 | Update rings and Office updates; documented rebuild test |
| Media Protection (MP) | PRO-008 | BitLocker, removable-media encryption, Defender device control |
| Personnel Security (PS) | POL-009 | Personnel procedures; break-glass account runbook (RUN-016) |
| Physical Protection (PE) | POL-009 | Physical-protection policy |
| Risk Assessment (RA) | PRO-010, LOG-020 | Security-advisory review register; audit and evaluation scripts |
| Security Assessment (CA) | SSP-001, POAM-002, PRO-010, DOC-000 | Self-audit method (explainer 05) |
| System & Communications Protection (SC) | STM-011, STD-021, TCP-017 | Firewall, egress leak-path and credential-network policies; session controls and token protection; Cloudflare Gateway rules |
| System & Information Integrity (SI) | STD-023 | Defender antivirus, attack-surface reduction, exploit protection, signature remediation, malware alerts |
See what “done” looks like
All 110 requirements as they stood when we posted 110 of 110: how each is met, where the evidence lives, and the eight decisions we had to justify in writing.
It is not a product and it does not produce a score. A NIST SP 800-171 score is your own assessment of your own system against your own evidence; the repository gives you controls that work, tooling that produces the evidence, and the method. Misrepresenting a CMMC status to the U.S. Government is a federal offense (18 U.S.C. §1001; False Claims Act). CMMC is a registered mark of the U.S. Department of Defense; this project is not affiliated with or endorsed by DoD, the Cyber AB, or Microsoft. The dated analysis behind the "self-assessed" status is in the research library: The Deadline Went Away. The Obligations Did Not.
Discuss an engagement
If you would rather have this implemented, audited or taught than do it yourself, an initial scoping conversation is provided at no charge. Describe the situation in general terms first; use an encrypted channel for anything specific.
Controlled Information & Cybersecurity advisory · Return to Sanctir