The Cybersecurity Maturity Model Certificate (CMMC) is a comprehensive, mandatory security framework designed by the U.S. Department of Defense (DoD) to protect the sensitive data handled by organizations that work with the U.S. government.
All organizations that work with the DoD must achieve CMMC compliance, and the certificate is now a prerequisite for maintaining and bidding on any DoD contracts. To get CMMC certification, though, your organization will need to implement various comprehensive processes, measures, and practices prescribed by the program and document everything to prove compliance.
CMMC documentation can be time-consuming as you will need to collect, maintain, and update thorough evidence of all implemented processes and their effectiveness. Part of CMMC compliance includes passing regular assessments, and thorough documentation serves as demonstrable evidence of your cybersecurity maturity.
In this guide, we’ll outline the essential documentation you need to prepare and maintain to achieve CMMC compliance.
3 key documents for CMMC compliance
The CMMC compliance process will require your organization to collect, maintain, and update documentation at every step. However, three documents stand out as particularly important:
- System Security Plan (SSP)
- Customer Responsibility Matrix (CRM)
- Plan of Action and Milestones (POA&M)
{{cta_withimage27="/cta-blocks"}} | CMMC compliance checklist
1. System Security Plan (SSP)
A System Security Plan is a document that outlines the cybersecurity practices and processes your organization has in place to protect your information and IT infrastructure. It also shows how well they are aligned with CMMC requirements.
The primary purpose of an SSP is to provide a clear overview of your organization’s risk assessments, incident handling, and security posture. When undergoing a compliance assessment, auditors will rely on the SSP to understand and review whether your organization can detect, mitigate, and respond to cybersecurity risks effectively.
To provide a comprehensive overview of your organization’s entire security framework, an SSP often references other internal security documents, such as security policies, access control lists, and business continuity plans.
In general, your SSP needs to contain these essential elements:
- A description of the CMMC assessment scope
- A description of system boundaries and operational environments (e.g., physical location, remote work setup, or cloud provider details)
- The identified and approved security requirements
- Implementation methods for security requirements
- Relationships and connections to other systems and networks
- A defined update frequency—typically annually, at a minimum
In addition to these essential requirements, an SSP often also includes a general information system description, design philosophies, and a description of the roles and responsibilities of key stakeholders in your organization. These details give auditors a holistic view of your entire security infrastructure and enable greater assessment transparency.
2. Customer Responsibility Matrix (CRM)
The Customer Responsibility Matrix, sometimes referred to as a shared responsibility matrix, is a document that defines the specific responsibilities of cloud service providers (CSPs), external service providers (ESPs), and the services they provide, as outlined by the shared responsibility model. The document allows providers and users to understand their roles effectively, ensuring efficient ownership of security and risk management.
A CRM is necessary if your organization works with CSPs or ESPs. The providers are likely to handle sensitive data that CMMC covers, and a CRM clarifies their role in securing it and ensures that their measures align with CMMC compliance requirements.
The CRM outlines the exact NIST 800-171 controls that your organization needs to take care of versus those that are managed by your service providers. Here’s a comparison of the two:
If you don’t have a CRM, contact your CSP or ESP to obtain one, as it is a critical document for demonstrating compliance with CMMC requirements. It’s also important to ensure that your contract with the CSP or ESP clearly outlines shared responsibility for protecting this data, and consult an attorney to confirm that the appropriate language is included.
{{cta_withimage22="/cta-blocks"}} | The audit ready checklist
3. Plan of Action and Milestones (POA&M)
A Plan of Action and Milestones is a document that identifies security vulnerabilities and tracks remediation efforts for non-compliant requirements in an organization's security system.
It’s a necessary document for organizations that undergo a Level 2 or 3 CMMC certificate assessment and meet at least 80 percent of the required criteria but still have outstanding deficiencies that must be remediated.
When this happens, you can receive a conditional CMMC certificate, allowing you to submit a POA&M. This will provide you with a 180-day remediation window to address non-compliant requirements and achieve full certification without failing the assessment outright.
Ensure your POA&M includes the following information:
- Identified gaps and associated risks
- Planned remediation actions
- Timelines
- Milestones
- Responsible parties
- Required resources
Documenting your POA&M progress on an ongoing basis is equally essential. Doing this lets you demonstrate CMMC compliance efforts to assessors, which can be particularly important if you’re preparing for higher certification levels. It also allows your compliance team members to have a clear roadmap of workflows and deadlines and helps them allocate resources efficiently.
Additional CMMC documentation you’ll need
The specific documentation you’ll need to prepare mainly depends on your chosen level of CMMC certification and the corresponding practices you need to implement. Depending on the type of information your organization handles, you need to achieve one of the three CMMC certification levels:
- Level 1: Designed for organizations that handle Federal Contract Information (FCI) and requires implementing the 15 practices outlined by FAR clause 52.204-21
- Level 2: Intended for organizations that handle Controlled Unclassified Information (CUI) and requires the 110 controls from NIST SP 800-171 R2
- Level 3: Addresses highly sensitive CUI and requires the same controls as Level 2 and an additional 24 controls from NIST SP 800-172 that are outlined by 32 CFR 170.14
“
One of the key ways to demonstrate compliance with documented policies is by having the controls that map to the policies showcased on Vanta’s Trust Center. Having controls shown on your custom Trust Center shows real-time compliance and builds trust with your prospects and customers that your organization is following documented policies.”
Manually collecting all the necessary evidence and documentation requires your team members to sift through emails and disparate systems, which can significantly slow down your CMMC compliance efforts.
You can streamline these processes by leveraging an automation solution like Vanta that streamlines evidence collection, reduces human error, and ensures real-time compliance tracking.
Automate CMMC evidence collection with Vanta
Vanta is a trust management platform that streamlines CMMC compliance. It offers over 375 integrations with different platforms, enabling your organization to set up straightforward CMMC documentation and automate evidence collection processes. This reduces your team's manual workload and frees resources for priority security tasks.
Vanta offers a dedicated CMMC solution that comes with multiple features designed to automate up to 50% of CMMC compliance workflows, including:
- Out-of-the-box support for all certification levels
- Automated gap assessments (particularly useful for POA&M management)
- Centralized tracking of CMMC requirements
- A real-time dashboard for continuous monitoring
- Pre-mapped security controls aligned to NIST SP 800-171 and NIST SP 800-172
- Prescriptive guidance across controls, policies, and documents
If you’re pursuing a Level 2 or 3 certificate, you can utilize Vanta’s partner network to find a reputable C3PAO that can help guide your CMMC compliance efforts.
Schedule a custom demo and see how Vanta can help you save time and resources by streamlining CMMC compliance.
{{cta_simple33="/cta-blocks"}} | CMMC product page
A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance concerning relevant laws and regulations, you should consult a licensed attorney.
Key CMMC documentation you need to demonstrate compliance
Looking to streamline the work for CMMC?
The Cybersecurity Maturity Model Certificate (CMMC) is a comprehensive, mandatory security framework designed by the U.S. Department of Defense (DoD) to protect the sensitive data handled by organizations that work with the U.S. government.
All organizations that work with the DoD must achieve CMMC compliance, and the certificate is now a prerequisite for maintaining and bidding on any DoD contracts. To get CMMC certification, though, your organization will need to implement various comprehensive processes, measures, and practices prescribed by the program and document everything to prove compliance.
CMMC documentation can be time-consuming as you will need to collect, maintain, and update thorough evidence of all implemented processes and their effectiveness. Part of CMMC compliance includes passing regular assessments, and thorough documentation serves as demonstrable evidence of your cybersecurity maturity.
In this guide, we’ll outline the essential documentation you need to prepare and maintain to achieve CMMC compliance.
3 key documents for CMMC compliance
The CMMC compliance process will require your organization to collect, maintain, and update documentation at every step. However, three documents stand out as particularly important:
- System Security Plan (SSP)
- Customer Responsibility Matrix (CRM)
- Plan of Action and Milestones (POA&M)
{{cta_withimage27="/cta-blocks"}} | CMMC compliance checklist
1. System Security Plan (SSP)
A System Security Plan is a document that outlines the cybersecurity practices and processes your organization has in place to protect your information and IT infrastructure. It also shows how well they are aligned with CMMC requirements.
The primary purpose of an SSP is to provide a clear overview of your organization’s risk assessments, incident handling, and security posture. When undergoing a compliance assessment, auditors will rely on the SSP to understand and review whether your organization can detect, mitigate, and respond to cybersecurity risks effectively.
To provide a comprehensive overview of your organization’s entire security framework, an SSP often references other internal security documents, such as security policies, access control lists, and business continuity plans.
In general, your SSP needs to contain these essential elements:
- A description of the CMMC assessment scope
- A description of system boundaries and operational environments (e.g., physical location, remote work setup, or cloud provider details)
- The identified and approved security requirements
- Implementation methods for security requirements
- Relationships and connections to other systems and networks
- A defined update frequency—typically annually, at a minimum
In addition to these essential requirements, an SSP often also includes a general information system description, design philosophies, and a description of the roles and responsibilities of key stakeholders in your organization. These details give auditors a holistic view of your entire security infrastructure and enable greater assessment transparency.
2. Customer Responsibility Matrix (CRM)
The Customer Responsibility Matrix, sometimes referred to as a shared responsibility matrix, is a document that defines the specific responsibilities of cloud service providers (CSPs), external service providers (ESPs), and the services they provide, as outlined by the shared responsibility model. The document allows providers and users to understand their roles effectively, ensuring efficient ownership of security and risk management.
A CRM is necessary if your organization works with CSPs or ESPs. The providers are likely to handle sensitive data that CMMC covers, and a CRM clarifies their role in securing it and ensures that their measures align with CMMC compliance requirements.
The CRM outlines the exact NIST 800-171 controls that your organization needs to take care of versus those that are managed by your service providers. Here’s a comparison of the two:
If you don’t have a CRM, contact your CSP or ESP to obtain one, as it is a critical document for demonstrating compliance with CMMC requirements. It’s also important to ensure that your contract with the CSP or ESP clearly outlines shared responsibility for protecting this data, and consult an attorney to confirm that the appropriate language is included.
{{cta_withimage22="/cta-blocks"}} | The audit ready checklist
3. Plan of Action and Milestones (POA&M)
A Plan of Action and Milestones is a document that identifies security vulnerabilities and tracks remediation efforts for non-compliant requirements in an organization's security system.
It’s a necessary document for organizations that undergo a Level 2 or 3 CMMC certificate assessment and meet at least 80 percent of the required criteria but still have outstanding deficiencies that must be remediated.
When this happens, you can receive a conditional CMMC certificate, allowing you to submit a POA&M. This will provide you with a 180-day remediation window to address non-compliant requirements and achieve full certification without failing the assessment outright.
Ensure your POA&M includes the following information:
- Identified gaps and associated risks
- Planned remediation actions
- Timelines
- Milestones
- Responsible parties
- Required resources
Documenting your POA&M progress on an ongoing basis is equally essential. Doing this lets you demonstrate CMMC compliance efforts to assessors, which can be particularly important if you’re preparing for higher certification levels. It also allows your compliance team members to have a clear roadmap of workflows and deadlines and helps them allocate resources efficiently.
Additional CMMC documentation you’ll need
The specific documentation you’ll need to prepare mainly depends on your chosen level of CMMC certification and the corresponding practices you need to implement. Depending on the type of information your organization handles, you need to achieve one of the three CMMC certification levels:
- Level 1: Designed for organizations that handle Federal Contract Information (FCI) and requires implementing the 15 practices outlined by FAR clause 52.204-21
- Level 2: Intended for organizations that handle Controlled Unclassified Information (CUI) and requires the 110 controls from NIST SP 800-171 R2
- Level 3: Addresses highly sensitive CUI and requires the same controls as Level 2 and an additional 24 controls from NIST SP 800-172 that are outlined by 32 CFR 170.14
“
One of the key ways to demonstrate compliance with documented policies is by having the controls that map to the policies showcased on Vanta’s Trust Center. Having controls shown on your custom Trust Center shows real-time compliance and builds trust with your prospects and customers that your organization is following documented policies.”
Manually collecting all the necessary evidence and documentation requires your team members to sift through emails and disparate systems, which can significantly slow down your CMMC compliance efforts.
You can streamline these processes by leveraging an automation solution like Vanta that streamlines evidence collection, reduces human error, and ensures real-time compliance tracking.
Automate CMMC evidence collection with Vanta
Vanta is a trust management platform that streamlines CMMC compliance. It offers over 375 integrations with different platforms, enabling your organization to set up straightforward CMMC documentation and automate evidence collection processes. This reduces your team's manual workload and frees resources for priority security tasks.
Vanta offers a dedicated CMMC solution that comes with multiple features designed to automate up to 50% of CMMC compliance workflows, including:
- Out-of-the-box support for all certification levels
- Automated gap assessments (particularly useful for POA&M management)
- Centralized tracking of CMMC requirements
- A real-time dashboard for continuous monitoring
- Pre-mapped security controls aligned to NIST SP 800-171 and NIST SP 800-172
- Prescriptive guidance across controls, policies, and documents
If you’re pursuing a Level 2 or 3 certificate, you can utilize Vanta’s partner network to find a reputable C3PAO that can help guide your CMMC compliance efforts.
Schedule a custom demo and see how Vanta can help you save time and resources by streamlining CMMC compliance.
{{cta_simple33="/cta-blocks"}} | CMMC product page
A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance concerning relevant laws and regulations, you should consult a licensed attorney.
Explore more CMMC articles
Introduction to CMMC
CMMC requirements
CMMC certification process
CMMC levels
Get started with CMMC
Start your CMMC journey with these related resources.
What you need to know about CMMC—from our Director of Government Strategy & Affairs Morgan Kaplan
Vanta’s director of US government strategy and affairs shares how current and future contractors for the DoD can get CMMC certified.
CMMC Checklist
This checklist will guide you through the steps to take to get CMMC certified and how to successfully implement and maintain the certification.
The ultimate guide to NIST 800-171
Jumpstart your NIST 800-171 compliance with Vanta's complete guide to this legally required security standard.
.png)
.png)
.png)