<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-cmmc-assessment
description: >-
  Perform Cybersecurity Maturity Model Certification (CMMC) assessments
  to evaluate organizational compliance with DoD cybersecurity requirements
  across maturity levels, mapping controls to NIST SP 800-171 practices.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - cmmc
  - nist-800-171
  - dod-compliance
  - cui-protection
  - maturity-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078", "T1548"]
  frameworks: ["CMMC-2.0", "NIST-SP-800-171r2"]
  tools: ["nmap", "openscap", "ansible"]
---

## Overview

CMMC 2.0 is the Department of Defense framework requiring contractors handling
Controlled Unclassified Information (CUI) to demonstrate cybersecurity maturity.
It aligns with NIST SP 800-171 and defines three levels: Foundational (Level 1,
17 practices), Advanced (Level 2, 110 practices), and Expert (Level 3,
110+ practices with NIST SP 800-172 enhancements).

## Prerequisites

- Tools: `openscap`, `nmap`, `ansible`, `python3`
- NIST SP 800-171 Rev 2 control catalog
- CMMC Assessment Guide (publicly available from DoD)
- Asset inventory of CUI-processing systems
- Authorized assessment scope document

## Key Concepts

- **CUI Scope**: Systems that store, process, or transmit Controlled Unclassified Information
- **Security Assessment Boundary**: Defined perimeter of systems under evaluation
- **POA&M**: Plan of Action and Milestones for remediating findings
- **SSP**: System Security Plan documenting control implementations
- **SPRS Score**: Supplier Performance Risk System score (-203 to 110)

## Workflow

### Step 1: Define Assessment Boundary and CUI Scope

```bash
# Identify CUI data flows and system boundaries
# Document network segments handling CUI
nmap -sn 10.10.0.0/16 -oX network_discovery.xml

# Parse discovered hosts into assessment inventory
python3 -c "
import xml.etree.ElementTree as ET
tree = ET.parse('network_discovery.xml')
for host in tree.findall('.//host'):
    addr = host.find('address').get('addr')
    hostname = host.find('.//hostname')
    name = hostname.get('name') if hostname is not None else 'unknown'
    print(f'{addr},{name}')
" > cui_asset_inventory.csv
```

### Step 2: Map Controls to CMMC Domains

```bash
# CMMC Level 2 domains and practice counts
cat << 'EOF'
Domain                          | Practices
AC  - Access Control            | 22
AT  - Awareness & Training      | 3
AU  - Audit & Accountability    | 9
CM  - Configuration Management  | 9
IA  - Identification & Auth     | 11
IR  - Incident Response         | 3
MA  - Maintenance               | 6
MP  - Media Protection          | 9
PE  - Physical Protection       | 6
PS  - Personnel Security        | 2
RA  - Risk Assessment           | 3
CA  - Security Assessment       | 4
SC  - System & Comm Protection  | 16
SI  - System & Info Integrity   | 7
EOF
```

### Step 3: Assess Access Control Practices (AC Domain)

```bash
# AC.L2-3.1.1 — Limit system access to authorized users
# Check for account enumeration and unused accounts
grep -E 'nologin|false' /etc/passwd | wc -l
lastlog | awk '$NF == "**Never logged in**" {print $1}'

# AC.L2-3.1.5 — Least privilege
# Audit sudoers for overly broad permissions
grep -vE '^#|^$|Defaults' /etc/sudoers /etc/sudoers.d/*

# AC.L2-3.1.7 — Prevent non-privileged users from executing privileged functions
find / -perm -4000 -type f 2>/dev/null | head -20
```

### Step 4: Assess Audit & Accountability (AU Domain)

```bash
# AU.L2-3.3.1 — Create and retain system audit logs
# Verify auditd configuration
auditctl -l | head -20
systemctl is-active auditd

# AU.L2-3.3.2 — Ensure actions can be traced to individual users
grep -E 'session|login' /etc/audit/rules.d/audit.rules

# Check log retention policy
grep -E 'max_log_file|num_logs|space_left' /etc/audit/auditd.conf
```

### Step 5: Assess System & Communications Protection (SC Domain)

```bash
# SC.L2-3.13.1 — Monitor and protect communications at external boundaries
# Check firewall rules
iptables -L -n --line-numbers 2>/dev/null || nft list ruleset

# SC.L2-3.13.8 — Implement cryptographic mechanisms for CUI in transit
# Verify TLS configuration
nmap --script ssl-enum-ciphers -p 443 target.internal

# SC.L2-3.13.11 — Employ FIPS-validated cryptography
openssl version
grep -i fips /proc/sys/crypto/fips_enabled 2>/dev/null
```

### Step 6: Calculate SPRS Score

```bash
# SPRS scoring: start at 110, subtract for unmet practices
python3 -c "
practices_unmet = [
    ('AC.L2-3.1.5', 5, 'Least privilege not fully implemented'),
    ('AU.L2-3.3.2', 5, 'Audit logs missing user attribution'),
    ('SC.L2-3.13.11', 3, 'FIPS mode not enabled on 2 systems'),
]
score = 110
for practice, points, reason in practices_unmet:
    score -= points
    print(f'  {practice}: -{points} ({reason})')
print(f'\nSPRS Score: {score}/110')
print(f'POA&M items: {len(practices_unmet)}')
"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| CUI access without authorization | DLP/SIEM | Unauthorized access to CUI repositories |
| Audit log tampering | Audit daemon | Modification or deletion of audit logs |
| Privilege escalation attempts | Host logs | Users attempting unauthorized elevation |
| Unencrypted CUI transmission | Network monitor | CUI data sent over cleartext protocols |

```yaml
title: Unauthorized Access to CUI Repository
id: d4e5f6a7-b8c9-0123-def0-123456789abc
status: experimental
description: Detects access to CUI storage by unauthorized accounts
logsource:
  category: file_access
  product: linux
detection:
  selection:
    file.path|startswith: '/data/cui/'
  filter_authorized:
    user.name:
      - cui_admin
      - cui_service
  condition: selection and not filter_authorized
falsepositives:
  - Backup service accounts not listed in authorized users
level: high
tags:
  - attack.t1530
  - attack.collection
```

## Verification

- [ ] Assessment boundary and CUI scope documented
- [ ] All 110 Level 2 practices evaluated (if applicable)
- [ ] SPRS score calculated and documented
- [ ] POA&M created for unmet practices
- [ ] SSP reviewed and updated
- [ ] Evidence artifacts collected for each practice

## References

- [CMMC 2.0 Model Overview](https://dodcio.defense.gov/CMMC/)
- [NIST SP 800-171 Rev 2](https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final)
- [NIST SP 800-171A Assessment Procedures](https://csrc.nist.gov/publications/detail/sp/800-171a/final)
