CMMC isn’t just about firewalls — it’s also about knowing what’s documented and where. Here’s how to untangle the jargon.
Why These Terms Matter
Many small businesses get stuck not because of missing controls — but because of missing documentation. Let’s break down three of the most commonly misunderstood terms in the CMMC ecosystem:
Reference: NIST SP 800-171 Rev. 2, FAR 52.204-21, CMMC Model v2.0
1. System Security Plan (SSP)
The SSP is the core document that explains how your company is protecting its systems.
It should include:
How detailed should it be?
Source: NIST SP 800-171 Rev. 2, Section 3.12.4
2. Plan of Actions and Milestones (POA&M)
The POA&M is a living document that tracks your gaps and how you plan to fix them.
It should include:
POA&Ms are not allowed for some controls under CMMC Level 2, but fully allowed for Level 1 (self-assessed). That said, they cannot be indefinite.
Source: CMMC Assessment Process (CAP)
3. Federal Contract Information (FCI)
FCI is the type of data that triggers Level 1 CMMC applicability.
FCI includes:
FCI does not include:
You are expected to identify where FCI resides — systems, users, file shares — and protect access accordingly.
Definition Source: FAR 52.204-21(b)
Folder Structure Tips
Many SMBs store CMMC evidence haphazardly. Here’s a simple folder hierarchy to help:
Cloud solutions like SharePoint, Google Drive (with proper access controls), or an internal file server are acceptable — just ensure permissions are limited and auditable.
Final Thought
You can’t fake documentation. It’s the proof that your controls exist — and it’s what assessors will ask for. Build your paper trail intentionally, and it will become your strongest asset in demonstrating compliance.
