Deliverables & Automation
The artifacts clients actually see — dashboards, score calculations, data flow diagrams, and audit packages. Each lesson produces a submission-ready deliverable.
Assessment Dashboards
Generate client-facing compliance dashboards
Clients don't read 40-page assessment reports. They look at the dashboard first, then ask questions. A well-designed compliance dashboard communicates SPRS score, control family status, and open findings in a single view — and it's a deliverable that gets circulated to leadership.
Generate the HTML compliance dashboard
Feed in assessment results. Returns a self-contained HTML file with score widget, status donut chart, heat map, and filterable findings table — dark theme, client-facing, no external dependencies.
Generate a self-contained HTML file that serves as a CMMC L2 Assessment Dashboard. ASSESSMENT DATA: - Client: [org name or "Client"] - SPRS Score: [current score] - Assessment Date: [date] - Practices Met: [count] - Practices Not Met: [count] - Practices on POA&M: [count] CONTROL FAMILY SUMMARY: [paste family-by-family status: AC: 15/22 Met | IA: 8/11 Met | etc.] TOP FINDINGS: [paste top 5 Not Met practices with descriptions] Generate an HTML dashboard that includes: 1. Header: org name, assessment date, SPRS score (large, prominent) 2. Status widget: Met / Not Met / POA&M counts as colored tiles 3. Donut chart: practices by status (use vanilla JS canvas or SVG) 4. Control family heat map: 14 families, color-coded by compliance % (green/yellow/red) 5. Findings table: filterable by family and status, sortable by point value 6. Footer: disclaimer and assessor info Requirements: Inline CSS and vanilla JS only. Dark theme (#0a0f1a background). No external CDN dependencies. Professional client-facing design.
Automated gap summary narrative
The dashboard needs a written executive summary that translates the numbers into plain language. This generates the paragraph a CISO reads at the top of the dashboard before looking at the charts.
Write an executive summary for a CMMC L2 compliance assessment dashboard. ASSESSMENT RESULTS: - SPRS Score: [score out of 110] - Met: [count] | Not Met: [count] | POA&M: [count] - Highest-risk families: [list 2–3 families with lowest compliance] - Assessment date: [date] - Next assessment / target certification date: [date] Write an executive summary (4–5 sentences) that: - States the current compliance posture in plain language (no acronyms without explanation) - Names the highest-risk areas specifically - States the path to certification (timeline and key milestones) - Is written for a CISO or CFO — not a technical audience Then write a second version: "Board brief" (2 sentences max). This goes in email subject line previews and meeting intros. Tone: Direct. Not alarming but not sugar-coated. This is a professional risk communication.
When a client asks for Excel instead of HTML — which happens more than you'd expect — don't rebuild the dashboard from scratch. Ask the AI to generate a CSV export of the findings table, then import it into Excel and apply conditional formatting manually. The scoring and heat map logic in Excel is faster to customize than regenerating the HTML. Keep both formats in your deliverable template library.
SPRS Calculator
Score calculation and ROI-ranked roadmap
SPRS score calculation isn't complex, but the point values are specific and the math needs to be documented. This workflow calculates the score, shows every deduction, and then ranks the remediation roadmap by points-per-effort — so clients know exactly where to invest first.
Calculate the SPRS score with full deduction breakdown
Feed your Not Met practice list. Returns a scored calculation with each deduction shown — the document you keep in your workpapers and share when the client asks how you arrived at the number.
Calculate the SPRS score for a CMMC L2 assessment. NOT MET PRACTICES: [list each Not Met practice ID and name] PARTIALLY MET PRACTICES: [list each Partially Met practice ID and name] SPRS methodology: - Start: 110 - Each Not Met practice: subtract DoD-assigned point value - Each Partially Met practice: subtract half the point value (round down) - Floor: -203 Calculate: | Practice ID | Practice Name | DoD Point Value | Status | Deduction | Running Total | Final SPRS Score: [result] Then: - Practices worth the most points (top 5 — highest-impact remediations) - Practices worth the fewest points (deprioritize these) - Projected score if top 5 Not Met practices are remediated - What score improvement is needed to reach -109 (CMMC conditional threshold), if applicable Also use this tool: /learn/sprs for an interactive calculator.
ROI-ranked remediation roadmap
Points recovered per remediation hour — this ranks every Not Met practice so the client spends money where it improves the score fastest, not just where it's easiest.
Build a remediation roadmap ranked by SPRS score recovery per effort invested. NOT MET PRACTICES WITH POINT VALUES: [paste the SPRS calculation table] For each Not Met practice, estimate: | Practice | SPRS Points | Remediation Category | Effort (hours) | Points per Hour | Rank | 30/60/90 Day | Owner | Remediation categories: - Policy (write/update a document): typically 2–8 hours - Configuration (tool setting change): typically 1–4 hours - Process (workflow/behavioral change): typically 8–40 hours - Training (workforce program): typically 16–80 hours - Infrastructure (architecture change): typically 40–200 hours Sort by: Points per Hour (highest first) — this is the ROI ranking. After the table: - "Quick win" cluster: practices remediable in < 4 hours with highest point yield - "Long tail" cluster: low point value, high effort — consider for Phase 2 - Total projected score if all 30-day items are completed
SPRS is a self-attestation submitted to the Supplier Performance Risk System — it's public and can be pulled by contracting officers. A score that doesn't reflect actual security posture, even if submitted in good faith with a calculation error, creates False Claims Act exposure. Document every deduction decision, store your workpapers, and have the SPRS number reviewed by a second assessor before submission. The math is simple; the liability is not.
CUI Flow Diagrams
Mermaid data flow diagrams for CUI boundary
CUI data flow diagrams are required evidence for CMMC scoping — and they're the document CCAs scrutinize most carefully because an incomplete boundary is the fastest way to expand an assessment's scope unexpectedly. Mermaid lets you generate them in text and render them anywhere.
Generate the Mermaid CUI flow diagram
Describe how CUI moves through the org. Returns a Mermaid flowchart that you can paste into any Mermaid renderer, copy to the client wiki, or convert to PNG for SSP submission.
Generate a Mermaid flowchart diagram of CUI data flows. ORG CUI ENVIRONMENT: [Describe how CUI enters, moves through, and exits the environment — e.g., "Receives CUI via encrypted email from DoD prime. Stores in SharePoint Online (GCC High). Processed on Azure VMs by engineering team. Outputs transmitted via encrypted email back to prime. No CUI on mobile devices."] SYSTEMS IN CUI BOUNDARY: [list each system: name, type, location (cloud/on-prem), owner] Generate a Mermaid flowchart (flowchart LR or TD) showing: 1. CUI entry points (external sources → organization boundary) 2. Internal CUI flows between systems 3. CUI exit points (if any authorized egress) For each flow/arrow, annotate: - Encryption in transit: TLS 1.2+ | TLS 1.3 | Not encrypted (FINDING) - Encryption at rest: AES-256 | Not encrypted (FINDING) - Access control type: MFA | Role-based | Unrestricted (FINDING) - CMMC-relevant practices that apply to this flow (e.g., SC.L2-3.13.8) Mark the CUI authorization boundary clearly. Flag any flow that represents a potential scope expansion or boundary gap.
CUI boundary description narrative
The diagram needs a written narrative for the SSP — the CUI boundary description that explains what's in scope, what's excluded, and why. This is the text that lives in the SSP alongside the diagram.
Write a CUI boundary description narrative for SSP submission. CUI ENVIRONMENT: [describe the CUI data flows and systems from the diagram] SYSTEMS IN SCOPE: [list] SYSTEMS EXPLICITLY EXCLUDED: [list any systems that touch CUI flow but are out of scope, and why] Write a narrative (400–600 words) that: 1. Defines the CUI authorization boundary — what's inside, what's outside 2. Describes how CUI enters the environment (all entry points) 3. Describes where CUI is stored (specific systems and locations) 4. Describes how CUI flows between systems internally 5. Describes any authorized CUI egress points 6. Explains what security controls protect CUI at each stage 7. States what systems are excluded from scope and the rationale Format: formal, third-person, present tense. This narrative will be reviewed by a CCA. Every claim must be testable against the diagram. After the narrative: list any systems where CUI scope is ambiguous and needs clarification before assessment.
"What counts as CUI?" is a question with a specific answer — reference the DoD CUI Registry (cui.gov) before drawing any boundary. Common misclassification: clients assume all DoD-related work is CUI. It's not. CUI is specifically designated by an authorized government official and flows through specific program channels. If the client can't show you a CUI designation — a document header, contract clause, or explicit designation from the prime — challenge the scope. A boundary drawn around non-CUI data inflates the assessment scope unnecessarily.
Audit Packages
Pre-assessment readiness summary and checklist
Thirty days before a C3PAO assessment is when most clients realize they don't know what to hand the assessor. This workflow builds the readiness summary report and the 50-item pre-assessment checklist — the two documents that determine whether day one of fieldwork goes smoothly.
Generate the readiness summary report
Feed in current assessment state. Returns an executive readiness report the client can share with leadership and the C3PAO prior to the assessment kickoff call.
Generate an Audit Readiness Summary Report for a CMMC L2 assessment. CLIENT CONTEXT: - Org name: [name] - Assessment date: [date — or "in 30 days"] - Current SPRS score: [score] - C3PAO: [name or "TBD"] - Scope: [describe CUI boundary — systems, locations, users] - POA&M practices: [count] [list practice IDs] CURRENT STATUS: - Evidence: [% ready — e.g., "75% of required evidence collected"] - SSP: [complete / in-progress / not started] - Open findings: [list top 3–5 highest risk] - Interviews scheduled: [yes/no, with whom] Generate a report including: 1. Executive Summary (3 paragraphs: current state, what's ready, what's at risk) 2. Scope Statement (system boundary, locations, user count) 3. Assessment Method Summary (how the C3PAO will assess — examine/interview/test) 4. Top 5 Open Risks (ranked, with mitigation status) 5. Evidence Status (% ready by control family — table) 6. Key Contacts (roles, not names) 7. Pre-Assessment Checklist Summary (see next prompt) Format: professional document, suitable for distribution to C3PAO and client executive team.
50-item pre-assessment checklist
The day-of checklist. Every item a client needs to have ready when the CCA team arrives — grouped by category, with ownership assigned and a checkbox format ready for Notion or Google Docs.
Generate a 50-item pre-assessment checklist for a CMMC L2 C3PAO assessment. ASSESSMENT DETAILS: - Framework: CMMC L2 - Assessment type: C3PAO on-site / remote [specify] - Scope: [systems, number of users, number of sites] - Assessment start: [date] Generate 50 checklist items grouped by category: CATEGORY 1 — Documentation (10 items): SSP, policies, procedures, plans CATEGORY 2 — Evidence packages (10 items): Screenshots, exports, logs CATEGORY 3 — Access and accounts (8 items): Assessor accounts, VPN, system access CATEGORY 4 — Interviews (8 items): Schedules, interviewee availability, rooms CATEGORY 5 — Environment (7 items): Network diagrams, physical access, demos CATEGORY 6 — Administrative (7 items): NDA, logistics, communication protocols For each item: ☐ [Item description] — Owner: [role] — Due: [X days before assessment] — Status: [ ] After the list: "Day-of essentials" — the 10 most critical items to verify the morning of day 1.
Logistics on day one of a C3PAO assessment matter more than most practitioners think. If assessor access to systems isn't set up before they arrive — VPN credentials, guest accounts, jump server access — you lose hours of fieldwork time and create a bad first impression with the assessment team. Assign a technical point of contact specifically for assessor logistics, separate from the GRC lead. Their only job is keeping the assessment team unblocked.