CMMC 2.0 Compliance Advisor

What it does

Makes Claude act as a CMMC 2.0 Registered Practitioner and NIST SP 800-171 implementation consultant for Defense Industrial Base contractors and subcontractors.

• Level determination workflow: check DFARS 252.204-7019/7020/7021 in the contract → classify FCI vs CUI → program criticality → confirm assessment track (self, C3PAO, DIBCAC)
• Gap assessment: outputs a table of Practice ID | Domain | Practice | Status (MET/PARTIAL/NOT MET/N/A) | Evidence Needed | Gap Notes, plus SPRS impact
• SSP drafting: per-practice implementation statements, system boundary, CUI data flows, documented N/A justifications, honest partial-implementation language
• SPRS scoring: 110-point baseline, weighted 5/3/1 deductions, no partial credit, annual senior-official affirmation and False Claims Act exposure
• POA&M rules: the two-part conditional-certification gate (score ≥88 AND all open items 1-point), the 180-day closeout clock, and the never-POA&M-eligible critical practices
• Scoping: CUI Assets, Security Protection Assets, CRMA, Specialized Assets, Out-of-Scope, plus enclave strategy and FedRAMP Moderate requirements for cloud CUI
• Flow-down: FCI-only subs (Level 1) vs CUI subs (Level 2) and a remediation menu when a sub turns out to be uncertified

Three bundled reference files (cmmc-practices.md, cmmc-levels.md, cmmc-assessment.md) are loaded on demand.

Who it's for

• Security and compliance leads at DoD prime contractors and subcontractors
• ISSOs/ISSMs and IT admins who actually have to write the SSP and POA&M
• MSPs and consultants preparing clients for assessment
• Not useful if you don't touch US defense contracts.

Example uses

1. "We're a tier-2 sub that receives CUI — what CMMC level do we need?" → contract-clause check, FCI/CUI classification, assessment track, and the current Phase 2 suspension caveat.
2. "Our C3PAO found 8 practices NOT MET" → applies the two gates (score ≥88 and all 1-point items) to tell you whether conditional certification with a 180-day clock is possible.
3. "Draft a gap table for the 22 Access Control practices" → structured table with required evidence and SPRS score impact.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/HEAD/plugins/cmmc/skills/cmmc/SKILL.md

What I want: (describe your task here)

Install the skill I found on Claude Skill Mart.
Copy the plugins/cmmc/skills/cmmc folder from the GitHub repo Sushegaad/Claude-Skills-Governance-Risk-and-Compliance into my ~/.claude/skills/cmmc/.
When it's done, tell me in one line what this skill can do.