<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-cmmc-maturity
description: >-
  Audit Cybersecurity Maturity Model Certification (CMMC 2.0) across three
  levels. Validate NIST 800-171 practice implementation for CUI protection,
  generate SSP/POA&M artifacts, and assess readiness for C3PAO assessment.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - cmmc
  - nist-800-171
  - cui
  - defense
  - dib
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing CMMC Maturity

## Overview

CMMC 2.0 requires Defense Industrial Base (DIB) contractors to demonstrate
cybersecurity maturity for handling Controlled Unclassified Information (CUI).
This skill automates assessment across three CMMC levels, mapping to NIST
SP 800-171 Rev 2 practices with automated validation via InSpec and OPA.

Mode: `[MODE: BLUE]` — CMMC practice validation and gap assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| InSpec (`gem install inspec`) | Required |
| OPA (`brew install opa`) | Required |
| NIST 800-171 assessment tools | Required |

## Key Concepts

### CMMC 2.0 Levels

```
CMMC 2.0 — Three Levels:
├── Level 1: Foundational (17 practices)
│   ├── Based on: FAR 52.204-21 (basic safeguarding)
│   ├── Assessment: Annual self-assessment
│   ├── Scope: FCI (Federal Contract Information)
│   └── Domains: Access Control, ID&Auth, Media Protection,
│       Physical Protection, System & Comm Protection, System & Info Integrity
├── Level 2: Advanced (110 practices)
│   ├── Based on: NIST SP 800-171 Rev 2 (all 110 requirements)
│   ├── Assessment: Triennial C3PAO assessment (prioritized) or self
│   ├── Scope: CUI (Controlled Unclassified Information)
│   └── 14 Domains: AC, AT, AU, CM, IA, IR, MA, MP, PE, PS, RA, CA, SC, SI
└── Level 3: Expert (110+ practices)
    ├── Based on: NIST SP 800-172 (enhanced requirements)
    ├── Assessment: Government-led assessment
    ├── Scope: CUI against APT
    └── Additional: Penetration-resistant architecture
```

### InSpec Profile — CMMC Level 2

```ruby
# controls/cmmc_level2.rb
control 'cmmc-ac-l2-3.1.1' do
  impact 1.0
  title 'AC.L2-3.1.1 — Authorized Access Control'
  desc 'Limit system access to authorized users, processes, and devices.'
  tag cmmc: 'AC.L2-3.1.1'
  tag nist_800_171: '3.1.1'
  tag cmmc_level: 2

  describe sshd_config do
    its('AllowUsers') { should_not be_nil }
  end

  describe passwd.where { shell != '/usr/sbin/nologin' } do
    its('users') { should_not include 'nobody' }
  end
end

control 'cmmc-au-l2-3.3.1' do
  impact 1.0
  title 'AU.L2-3.3.1 — System Auditing'
  desc 'Create and retain system audit logs to enable monitoring and investigation.'
  tag cmmc: 'AU.L2-3.3.1'
  tag nist_800_171: '3.3.1'

  describe service('auditd') do
    it { should be_enabled }
    it { should be_running }
  end

  describe file('/etc/audit/audit.rules') do
    it { should exist }
    its('size') { should be > 0 }
  end
end

control 'cmmc-ia-l2-3.5.3' do
  impact 1.0
  title 'IA.L2-3.5.3 — Multifactor Authentication'
  desc 'Use multifactor authentication for local and network access.'
  tag cmmc: 'IA.L2-3.5.3'
  tag nist_800_171: '3.5.3'

  describe sshd_config do
    its('AuthenticationMethods') { should include 'publickey' }
  end
end

control 'cmmc-sc-l2-3.13.8' do
  impact 1.0
  title 'SC.L2-3.13.8 — CUI Encryption in Transit'
  desc 'Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI.'
  tag cmmc: 'SC.L2-3.13.8'
  tag nist_800_171: '3.13.8'

  describe ssl(port: 443) do
    it { should be_enabled }
    its('protocols') { should include 'TLSv1.2' }
    its('protocols') { should_not include 'TLSv1.0' }
  end
end
```

## Workflow

### Step 1: Determine CMMC Level

```bash
node scripts/agent.js --action scope --level 2 \
  --output /tmp/cmmc-scope.json
```

### Step 2: Assess Practices

```bash
node scripts/agent.js --action assess --level 2 --profile ./controls/ \
  --output /tmp/cmmc-assessment.json
```

### Step 3: Generate SPRS Score

```bash
node scripts/agent.js --action score --input /tmp/cmmc-assessment.json \
  --output /tmp/cmmc-sprs.json
```

## Verification

- [ ] CMMC level determined based on contract CUI requirements
- [ ] CUI scope defined (systems, data flows, personnel)
- [ ] All 110 NIST 800-171 practices assessed for Level 2
- [ ] SPRS score calculated and submitted to SPRS portal
- [ ] SSP documents all practice implementations
- [ ] POA&M tracks unmet practices with remediation timeline
- [ ] C3PAO assessment readiness confirmed

## References

- [CMMC Program](https://dodcio.defense.gov/CMMC/)
- [NIST SP 800-171 Rev 2](https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final)
- [SPRS Portal](https://www.sprs.csd.disa.mil/)
