BUILT & BUILDING / 04

CMMC Controls Generator

Before a small defense contractor pays for a five-figure CMMC assessment, they should know what the assessor is going to ask for. This turns each Level 2 control into the policy, the procedure, the evidence to collect and the questions to expect, written for the systems the company already uses.

STATUS
Working build
DATA
Illustrative
FOR
Defense contractors
BUILT AS
Standalone app
The control workspace: control records on the left, the views assembled from them on the right, and the company's implementation profile

WHY IT MATTERS

HOW THE DOCUMENTS ARE MADE

No AI writes these documents. Each control is a structured record: what it requires, who owns it, what proves it. The company's setup is a set of mappings: which product handles identity, which logs show sign-ins, who approves access. Fixed rules combine the two into the policy, procedure, evidence plan and assessor prep, so the same inputs always produce the same document. Change a mapping, and every document that depends on it changes with it.

The walkthrough

ILLUSTRATIVE DATA The company is invented. Captured from the working software on a test machine. Nothing on these screens is written by AI.

Start with the business
01Start with the businessCompany size, whether you handle controlled unclassified information, whether you've been assessed before. Skip anything you don't know yet.
It sketches your environment
02It sketches your environmentFrom the email, cloud and identity answers, it proposes the rest of the stack (file storage, device management) for you to confirm or correct.
Each control, in plain English
03Each control, in plain EnglishWhat the control means, why it matters, a worked example, who owns it, and which controls it connects to.
The policy statement
04The policy statementThe commitment, its purpose and its scope, assembled from the control record rather than copied from a generic template.
The procedure, step by step
05The procedure, step by stepWho does what, in which system, with the approvals and triggers. It names the tools from onboarding, not placeholders.
What to collect, and how often
06What to collect, and how oftenEach piece of evidence with how it's gathered, where it comes from, how often, and who owns it.
What the assessor will do
07What the assessor will doThe interview questions, what they'll examine, and what they'll want to watch happen. No surprises on the day.
Change one setting, rewrite the policy
08Change one setting, rewrite the policyThe same control with Microsoft Entra ID on the left and Okta on the right. The commitments stay the same; the systems named change with the setting.
Documents to start from
09Documents to start fromExport-ready outlines of the policy manual, built from the same records, for the framework, domain and identity provider you pick.

HOW THIS COULD EVOLVE

From getting ready for one assessment to knowing, any day of the year, whether each control still holds.

  1. BUILTControl requirementEach control as a structured record: what it requires, who owns it, what proves it.
  2. BUILTCompany configurationOnboarding, an inferred environment, and system mappings for the company's own tools.
  3. BUILTImplementation guidancePolicy, procedure, technical steps and assessor prep, written for that configuration.
  4. PARTLY BUILTEvidence collectionWhat to collect, from where, how often and by whom is defined. Collecting it automatically from live systems is planned.
  5. PLANNEDVerificationThe checks are written down. Running them against collected evidence is planned.
  6. PLANNEDReadiness statusA current answer to "could we prove this control today?", based on verified evidence rather than self-assessment.

WHAT THIS PROVES

Control-driven compliance documents: one structured control record, combined with the company's own system mappings, produces the policy, procedure, evidence plan and assessment prep.

Built

  • Three controls modelled end to end. For each, the working build produces a system-specific policy, implementation procedure, evidence requirements and assessment preparation.
  • Onboarding that infers the company's environment, and an identity-provider switch (Entra or Okta) that rewrites every dependent document. The app's architecture tests pass.

Not yet

  • The three controls are two in Access Control and one in Audit and Accountability. The broader catalog of 110 controls is under development.
  • Evidence connectors are simulated; nothing is pulled from live systems yet.
  • Not a certification, and not a substitute for an assessment by an authorized assessor.

Facing a CMMC assessment? Find out where you stand first.

ASK FOR A WALKTHROUGH

Thirty minutes, on a screen share or at your office in Dallas.
Or write to bluedottechnology [at] outlook [dot] com