<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# CMMC Maturity Auditing — API Reference

## InSpec CMMC Resources

```bash
# Run CMMC Level 2 profile
inspec exec cmmc-l2-profile -t ssh://user@target --reporter json

# Filter by domain
inspec exec cmmc-profile --controls /cmmc-ac/ /cmmc-au/

# AWS cloud target
inspec exec cmmc-profile -t aws:// --reporter json
```

## SPRS Scoring

```
SPRS Score Calculation:
├── Maximum score: 110 (all 110 practices met)
├── Each unmet practice: subtract weighted value (1, 3, or 5 points)
├── Minimum score: -203 (all practices unmet)
└── Score submitted to SPRS portal at https://www.sprs.csd.disa.mil/

Weight Categories:
├── 5 points: Critical practices (AC.L2-3.1.1, IA.L2-3.5.3, etc.)
├── 3 points: Important practices (most practices)
└── 1 point: Supporting practices
```

## NIST 800-171 to CMMC Mapping

| NIST 800-171 Family | CMMC Domain | Level 2 Practices |
|---------------------|-------------|-------------------|
| 3.1 Access Control | AC | 22 |
| 3.2 Awareness/Training | AT | 3 |
| 3.3 Audit/Accountability | AU | 9 |
| 3.4 Config Management | CM | 9 |
| 3.5 ID & Authentication | IA | 11 |
| 3.6 Incident Response | IR | 3 |
| 3.7 Maintenance | MA | 6 |
| 3.8 Media Protection | MP | 9 |
| 3.9 Personnel Security | PS | 2 |
| 3.10 Physical Protection | PE | 6 |
| 3.11 Risk Assessment | RA | 3 |
| 3.12 Security Assessment | CA | 4 |
| 3.13 System/Comm Protection | SC | 16 |
| 3.14 System/Info Integrity | SI | 7 |

## Assessment Artifacts

```
CMMC Assessment Package:
├── System Security Plan (SSP)
├── Plan of Action & Milestones (POA&M)
├── Network diagram with CUI boundaries
├── Data flow diagrams for CUI
├── Hardware/software inventory
├── Account management procedures
└── Incident response plan
```
