What the Kit Files Look Like
A Text Walkthrough With Sample Rows

Illustrative scenario only. Harborlight Machining LLC is a fictional company invented for teaching. This page is not a client story and not a testimonial. No real company, person, or result is described. The sample rows show the layout of the files and are not a finished assessment.

The situation

Harborlight Machining LLC is a fictional shop with 12 employees and one building. It cuts parts for a prime contractor that works for the Department of Defense. The subcontract involves Federal Contract Information (FCI), and the prime contractor has asked for the shop's Level 1 self-assessment result and the date of its most recent affirmation. The shop manager handles information technology alone and calls an outside provider when something breaks.

How the files are organized

Every file name starts with a number, so the files sort in reading order when saved to one folder. The files are editable Word and Excel documents, plus Portable Document Format (PDF) guides in each kit and a Source Library of official documents that arrives as one zip file. The first file, 01 Read Me First, explains the order of work and maps each requirement to the file that covers it. Values that are specific to your company, such as the company name, appear in square brackets with yellow highlight, so you can find them and replace them.

The requirement walkthrough

In the Level 1 Kit, the walkthrough (file 02) takes the 15 safeguarding requirements of Federal Acquisition Regulation (FAR) clause 52.204-21, paragraph (b)(1), one at a time. Each requirement has the same parts: the official text word for word, a plain-language meaning, each assessment objective with what to check, what good looks like for a small company, the evidence to keep, the common gaps, and the policy in file 03 that supports it. A sample entry looks like this:

The evidence tracker

The Evidence Tracker is a tab in the Level 1 self-assessment workbook (file 04). It lists suggested evidence items for each requirement, with a place to record where each item is kept, who owns it, the date collected, whether it is final and approved, its status, and the next refresh date. The same workbook supports the yearly affirmation. Sample rows for the fictional company:

The remediation plan

For any objective that is not yet met, the remediation plan template (file 05) and the Remediation Plan tab of the workbook record the gap, the fix to make, an owner, a target date, and a status. It is an internal fix list. Level 1 is scored met or not met for each requirement, and no Plan of Action and Milestones is permitted for Level 1, so the plan is how the shop gets every item to met before its senior official affirms. A sample row:

The policy set

The Level 1 policy and procedure set (file 03) is short, written for a company of a dozen people, and ready to edit. It has seven fill-in-the-blank policies that cover the 15 requirements, with logs and forms, and each policy names who does what. The text is yours to adopt as your own policy once you change it to match how your company really works.

The affirmation guide

This guide explains what the senior official is affirming, what to have ready before logging in, and how the result is entered in the Supplier Performance Risk System (SPRS). It states plainly that the affirmation belongs to the senior official and that a false or inaccurate affirmation can create liability under the False Claims Act.

What the Level 2 Kit adds

The Level 2 Kit covers all 110 requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2, which protects Controlled Unclassified Information (CUI), grouped by the 14 requirement families, with the 320 assessment objectives from NIST SP 800-171A. It adds a self-assessment and scoring workbook, a System Security Plan (SSP) template, a policy set, a Plan of Action and Milestones (POA&M) template, an SPRS entry and affirmation guide, and an evidence binder guide. A sample entry from the requirement walkthrough (file 05):

The workbook applies the point values in the CMMC scoring rule (Title 32 of the Code of Federal Regulations, section 170.24), which match the Department of Defense (DoD) Assessment Methodology, to the answers you enter, and shows the resulting score. The point value for each requirement is shown beside it in the SPRS Score tab. The accuracy of your answers, and therefore of your score, remains your company's responsibility.

What these files are not

The files help a company do its own self-assessment. They are not a certification and not legal advice, and we do not guarantee any score or outcome. A senior official of the company affirms the result. Please see the kit terms and the comparison page.