Process-Maturity-Index-Template

In order to save time, frustration, and the potential for missing evidence during your CMMC Gap Analysis, we
recommend that you create an index of each documented policy, procedure, control, template, checklist,
agreement, training, etc in use for your CMMC Level 3 Information System.
This index will be used extensively through your Gap Analysis, for each of the 34 CMMC Level 2 Process Maturity
requirements.
Specifically XX.2.998 has the following objectives.

Determine if:
[a] the procedures to implement the practices are documented and followed to implement the policy for the
<Domain> domain;
[b] the procedures specify the activities required to carry out the <Domain> policy; and
[c] procedures are reviewed and updated periodically to ensure they meet <Domain> policy
In simple terms, this means that for each of the 130 practice requirements, we need to check that you have
"procedures to implement the practice" documented and that the "procedures specify the activities required". This
takes a long time without an index that correlates the practice to each text item.
Q: Can we just list the applicable documents in our System Security Plan?
A: Yes, if you really want to, but we've found that it is easy to miss some practices when this is done (not a desirable
thing to happen during an assessment). Also that still leaves us with trying to decide which sentences or paragraphs
relate to which practice. If you have time, we recommend indexing to ensure you are fully ready for the process
maturity portion of the assessment.
Provided by Kieri Solutions LLC (a CMMC C3PAO in Maryland, USA). Copyrighted by Kieri Solutions LLC. Not for resale. May b
shared as long as you don't remove attribution statement.
© Kieri Solutions 2021

Text in document
Configure the system to use FIPS-validated cryptography for applications that may be used to transmit or store CUI
The Access Request Form requires the requester and IT department to identify/review granular security roles for access to
systems.
5.Review major changes that have completed since last meeting.
<table of ports, protocols, programs, services, functions allowed in and out of your boundary>
Visitor Log template which we print out each week (Date, visitor name, visitor organization, sponsor name, time in, time ou
badge #)
Additional incident response procedures (in the incident response procedure document) to describe how to actually perform
an incident. Too long to quote here.
[daily] Check alerts dashboard on Antivirus server
[daily] Check alerts dashboard on SIEM
[daily] Check alerts dashboard on Antivirus server
[daily] Check alerts dashboard on SIEM
These are examples of ways that documentation can support different practices. This is a tiny fragment of what the complete
index might look like for a CMMC ML3 organization. Most organizations will have between 500 - 1000 rows in their index.
Domain Topic Practice Which Doc Now?
Configuration Management
SC Encryption for CUI SC.3.177 Policy
AC Access Control Process AC.1.002 Access Request Form
CM Change Management CM.2.065 CAB Meeting Template
Network and Data Map

SC Firewall rules SC.1.175 Diagrams
Facilities Security - LogBook

PE Facilities Forensics PE.1.132 Template
Incident Response
IR Incident Control IR.2.092 Procedure
AU Audit Log Review AU.2.044 Daily tasks checklist
SI Audit Log Review SI.2.217 Daily tasks checklist

In this example, the Configuration Management policy addresses 20+
practices. Each paragraph is separated in this index and identified for
what it supports.
If the supporting text is very lengthy and specific to one topic (a common
example is the Change Management Policy), just reference the document.
In this example, the CAB Meeting template addresses 6+ practices. Each

paragraph is separated in this index and identified for what it supports.
Note that the same text supports multiple practices © Kieri Solutions 2021
Note that the same text supports multiple practices

Text in document *Required Field*
Create an index of your CMMC supporting documentation on this worksheet

Domain Topic Practice *Required Field*
Which Document? *Required Field*

Practice ID CMMC Domain 800-171 requirement
AC.1.001 AC - Access Control 3.01.01
AM.3.036 AM - Asset Management N/A
AT.2.056 AT - Awareness & Training 3.02.01
AU.2.041 AU - Audit & Accountability 3.03.02
AU.2.044 AU - Audit & Accountability N/A
AU.3.048 AU - Audit & Accountability N/A
CA.2.157 CA - Security Assessment 3.12.04
CA.3.162 CA - Security Assessment N/A
CM.2.061 CM - Configuration Management 3.04.01
IA.1.076 IA - ID & Authentication 3.05.01
IR.2.092 IR - Incident Response 3.06.01
IR.2.093 IR - Incident Response N/A
MA.2.111 MA - Maintenance 3.07.01
MP.1.118 MP - Media Protection 3.08.03
PE.1.131 PE - Physical Protection 3.10.01
PS.2.127 PS - Personnel Security 3.09.01
PS.2.128 PS - Personnel Security 3.09.02
RE.2.137 RE - Recovery N/A
RE.2.138 RE - Recovery 3.08.09
RE.3.139 RE - Recovery N/A
RM.2.141 RM - Risk Management 3.11.01
RM.3.144 RM - Risk Management N/A
SA.3.169 SA - Situational Awareness N/A
SC.1.175 SC - Systems & Comms Protection 3.13.01
SC.2.179 SC - Systems & Comms Protection N/A
SI.1.210 SI - System & Information Integrity 3.14.01
SI.3.218 SI - System & Information Integrity N/A

Process-Maturity-Index-Template

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Process-Maturity-Index-Template

Uploaded by

Copyright:

Available Formats

In order to save time, frustration, and the potential for missing evidence during your CMMC Gap Analysis, we

Specifically XX.2.998 has the following objectives.

© Kieri Solutions 2021

5.Review major changes that have completed since last meeting.

AC Access Control Process AC.1.002 Access Request Form

CM Change Management CM.2.065 CAB Meeting Template

Network and Data Map

Facilities Security - LogBook

AU Audit Log Review AU.2.044 Daily tasks checklist

SI Audit Log Review SI.2.217 Daily tasks checklist

In this example, the CAB Meeting template addresses 6+ practices. Each

Note that the same text supports multiple practices

Create an index of your CMMC supporting documentation on this worksheet

© Kieri Solutions 2021

You might also like