MesaFactor Technologies

CMMC Readiness Assessment — Engine v2

This diagnostic separately evaluates implementation readiness and evidence readiness, then estimates overall readiness, assessment risk, confidence, and remediation priority. Select Not Sure when appropriate rather than guessing.

Documentation

1. Do you maintain a current System Security Plan (SSP) that accurately describes the CMMC assessment scope, environment, and implementation of applicable security requirements?

System Security Plan (SSP) · Security Assessment · Reference: 3.12.4

Implementation

Supporting Evidence

2. Are cybersecurity policies and operating procedures documented, current, approved, and aligned with actual practices?

Cybersecurity Policies and Procedures · Cross-Family Governance · Reference: Diagnostic meta-control

Implementation

Supporting Evidence

3. Are access-control requirements, account-management procedures, privileged access rules, and authorization processes documented and maintained?

Access Control Documentation · Access Control · Reference: 3.1.1 / supporting documentation

Implementation

Supporting Evidence

4. Do you maintain and exercise a documented incident response capability with defined roles, reporting, escalation, handling, and recovery procedures?

Incident Response Plan · Incident Response · Reference: 3.6.1

Implementation

Supporting Evidence

5. Are identified cybersecurity deficiencies formally tracked through a POA&M or equivalent remediation process with owners, due dates, status, and closure evidence?

POA&M / Remediation Tracking · Security Assessment · Reference: 3.12.2

Implementation

Supporting Evidence

Evidence Readiness

6. Can you produce current, requirement-relevant evidence that demonstrates how implemented cybersecurity practices operate?

Control Evidence Availability · Cross-Family Evidence · Reference: Diagnostic meta-control

Implementation

Supporting Evidence

7. Are required audit logs generated, protected, retained, reviewable, and periodically analyzed?

Audit Logging · Audit and Accountability · Reference: 3.3.1 and related AU requirements

Implementation

Supporting Evidence

8. Are secure baseline configurations and system inventories established, maintained, and supported by evidence of enforcement and change control?

Baseline Configuration Management · Configuration Management · Reference: 3.4.1

Implementation

Supporting Evidence

9. Are required security-awareness and role-based training activities completed and supported by current training records?

Security Training Records · Awareness and Training · Reference: 3.2.1 / 3.2.2

Implementation

Supporting Evidence

10. Has your evidence been reviewed for currency, relevance, completeness, traceability, and consistency with documented implementation?

Assessor-Ready Evidence · Cross-Family Evidence · Reference: Diagnostic meta-control

Implementation

Supporting Evidence

Controls Implementation

11. Are access restrictions technically enforced so only authorized users, processes, and devices can access covered systems and CUI?

Technical Access Enforcement · Access Control · Reference: 3.1.1

Implementation

Supporting Evidence

12. Is MFA implemented for applicable privileged and network access paths in accordance with the CMMC Level 2 requirement?

Multi-Factor Authentication (MFA) · Identification and Authentication · Reference: 3.5.3

Implementation

Supporting Evidence

13. Are vulnerability scans performed at required intervals and when new vulnerabilities are identified, with findings analyzed and remediated?

Vulnerability Management · Risk Assessment · Reference: 3.11.2 / 3.11.3

Implementation

Supporting Evidence

Process Maturity

14. Are security controls monitored on an ongoing basis to ensure their continued effectiveness?

Continuous Security Monitoring · Security Assessment · Reference: 3.12.3

Implementation

Supporting Evidence

15. Is a formal remediation workflow used to prioritize, assign, track, validate, and close cybersecurity deficiencies?

Formal Remediation Process · Security Assessment · Reference: 3.12.2 / diagnostic process lens

Implementation

Supporting Evidence

Your Information

First Name

Last Name

Business Email

Company

Phone