Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

CMMC 2.0 Compliance Expert

A CMMC 2.0 / NIST SP 800-171 advisory skill for US defense contractors that produces level determinations, gap tables, SSP sections, POA&Ms, and SPRS score walkthroughs.

Security & ReviewAdvanced★ 851⑂ 174AI score 8/10Last updated: Aug 16, 2026

What it does

  • Level determination workflow: uses the contract's DFARS 252.204-7019/7020/7021 clauses and FCI vs. CUI data classification to pick Level 1/2/3 and the assessment track (self, C3PAO, DIBCAC).
  • Gap assessment tables: Practice ID | Domain | Practice | Status (MET / PARTIAL / NOT MET / N/A) | Evidence Needed | Gap Notes.
  • SSP drafting/review: per-practice implementation statements, system boundary, CUI data flows, documented N/A justifications.
  • SPRS scoring: 110-point baseline, weighted 5/3/1 deductions, no partial credit, senior-official affirmation requirements.
  • POA&M rules: the two-part conditional-certification gate (score ≥88 AND all open items 1-point), 180-day closeout clock, and the never-POA&M-eligible critical practices (MFA, FIPS crypto, flow control, etc.).
  • Scoping and flow-down: five asset categories (CUI / SPA / CRMA / Specialized / Out-of-Scope), enclave strategy, and a remediation menu for uncertified subcontractors.

Who it's for

  • Security and compliance leads at DoD prime contractors and subcontractors
  • ISSOs/ISSMs, sysadmins, and audit-prep teams in CUI environments
  • MSPs and consultants serving the Defense Industrial Base
  • Not useful if you don't touch US defense contracts.

Examples

  1. "We're a subcontractor that receives CUI — what level do we need?" → returns the five-step determination table plus the FCI/CUI decision matrix and assessment cadence.
  2. "Our C3PAO found 8 practices NOT MET." → recomputes the score (102) and checks whether all eight are 1-point items to decide if conditional certification with a 180-day clock is available.
  3. "Draft an SSP for our Level 2 self-assessment." → produces structured SSP sections covering boundary, CUI flows, per-practice implementation, responsible roles, and evidence artifacts.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/HEAD/plugins/cmmc/skills/cmmc/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the plugins/cmmc/skills/cmmc folder from the GitHub repo Sushegaad/Claude-Skills-Governance-Risk-and-Compliance into my ~/.claude/skills/cmmc/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git && mkdir -p ~/.claude/skills && cp -r Claude-Skills-Governance-Risk-and-Compliance/plugins/cmmc/skills/cmmc ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal (Terminal on macOS/Linux, Git Bash on Windows).
  2. Confirm Git is installed with git --version; install from git-scm.com if needed.
  3. Clone the repo: git clone https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git
  4. Create the skills directory: mkdir -p ~/.claude/skills
  5. Copy the skill in: cp -r Claude-Skills-Governance-Risk-and-Compliance/plugins/cmmc/skills/cmmc ~/.claude/skills/
  6. Verify with ls ~/.claude/skills/cmmc — you should see SKILL.md and a references/ folder.
  7. Restart Claude Code and try a prompt like "Help me run a CMMC Level 2 gap assessment."
  8. Always re-verify regulatory status (especially the Phase 2 suspension notes) against official DoD sources before acting.
View source on GitHub ↗License: MIT