CMMC 2.0 Level 2 Compliance & SPRS Hardening Runbook
1. Regulatory Context & Scope of Applicability
Under DFARS 252.204-7012, 7019, and 7020, any contractor handling Controlled Unclassified Information (CUI) or Covered Defense Information (CDI) must achieve third-party certification by an authorized C3PAO (Certified Third-Party Assessment Organization) prior to contract award.
The objective of this runbook is to remediate the complete set of 110 controls defined in NIST SP 800-171 Rev 2, maximizing your Supplier Performance Risk System (SPRS) score to +110 and ensuring audit defensibility.
2. High-Impact Control Domains & Value Weighting
| Domain Code | Family Name | Control Count | Point Value Impact | Primary Failure Vector |
|---|---|---|---|---|
| AC | Access Control | 22 | Up to -5 pts each | Missing least privilege / split tunneling enabled |
| IA | Identification & Authentication | 11 | Up to -5 pts each | Lack of MFA for local console logins |
| SC | System & Communications Protection | 16 | Up to -5 pts each | Unapproved non-FIPS cryptographic ciphers |
| AU | Audit & Accountability | 9 | Up to -5 pts each | Inadequate log retention or lack of NTP sync |
| IR | Incident Response | 9 | Up to -5 pts each | Inability to report to DoD DIBNet within 72 hours |
| SI | System & Information Integrity | 7 | Up to -5 pts each | Flawed patch cadence or missing EDR sensor |
3. Critical Remediation Protocols
3.1 Control 3.5.3: Multifactor Authentication (MFA)
MFA is required for all local and network sessions accessing systems that process, store, or transmit CUI. SMS authentication is strictly unacceptable.
- Enforce FIDO2 WebAuthn hardware tokens (YubiKey 5 FIPS Series) or DoD CAC/PIV credentials.
- Disable legacy basic authentication across all mail endpoints (POP3, IMAP, SMTP).
3.2 Control 3.13.11: FIPS-Validated Cryptography
All encryption protecting CUI in transit and at rest must employ cryptographic modules validated by the NIST Cryptographic Module Validation Program (CMVP).
- Linux Hosts: Verify
/proc/sys/crypto/fips_enabledis set to1. - TLS Configuration: Enforce TLS 1.3 or TLS 1.2 with approved suites:
ECDHE-ECDSA-AES256-GCM-SHA384orECDHE-RSA-AES256-GCM-SHA384.
# Verify OpenSSL FIPS 140-3 provider status on RHEL 9
openssl fipsinstall -out /etc/pki/tls/fipsmodule.cnf -module /usr/lib64/ossl-modules/fips.so
fips-mode-setup --check
# Expected Output: FIPS mode is enabled.
4. Automated Audit Evidence Collection Script
Execute this bash auditing script to collect automated evidence of local password policies, audit daemon status, and cryptographic module state:
#!/usr/bin/env bash
set -euo pipefail
OUTPUT_DIR="/opt/cmmc-evidence-$(date +%Y%m%d)"
mkdir -p "${OUTPUT_DIR}"
echo "[*] Collecting CMMC 2.0 Evidence..."
# 1. Audit Daemon Configuration (Control 3.3.1)
auditctl -l > "${OUTPUT_DIR}/audit_rules.txt"
systemctl status auditd > "${OUTPUT_DIR}/auditd_status.txt"
# 2. FIPS Kernel State (Control 3.13.11)
cat /proc/sys/crypto/fips_enabled > "${OUTPUT_DIR}/fips_state.txt"
# 3. SSH Hardening (Control 3.1.12, 3.13.8)
sshd -T | grep -E "(ciphers|macs|kexalgorithms|permitrootlogin)" > "${OUTPUT_DIR}/sshd_hardening.txt"
# 4. User Accounts without Password Expiration (Control 3.5.10)
awk -F: '($2 == "" ) { print $1 " has no password!"}' /etc/shadow > "${OUTPUT_DIR}/empty_passwords.txt"
echo "[+] Evidence collection complete: ${OUTPUT_DIR}"
5. C3PAO Assessment Readiness Checklist
- System Security Plan (SSP): Documented system boundary, CUI flow diagrams, and operational environment descriptions signed by corporate CISO.
- DIBNet Reporting Readiness: Confirmed active DoD ECA Medium Assurance Certificate for submitting DIBNet incident reports within 72 hours.
- FIPS 140 Validation Numbers: Documented CMVP certificate numbers for every disk encryption software, VPN gateway, and cloud storage bucket.
- POA&M Resolution: All high-risk 5-point deficiencies closed; remaining 1-point items scheduled for resolution within 180 days.
