CMMC Level 2 Compliance Assistant
Guides defense contractors through CMMC Level 2 readiness, SPRS scoring, and POA&M planning
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 4 files
What it does
When installed, the agent works through the steps a defense contractor needs to prepare for CMMC Level 2 certification, which applies to organizations handling Controlled Unclassified Information under DoD contracts. It helps decide which systems fall inside the CUI boundary, walks through the 110 NIST SP 800-171 requirements, computes a SPRS score using the DoD scoring weights, and structures a Plan of Action & Milestones for unmet items. It also includes a template and a Python script that calculates the score and readiness gaps from a JSON list of requirement statuses.
Great for
- Compliance or security leads at defense contractors and subcontractors preparing for a CMMC assessment
- IT teams building a System Security Plan or POA&M for NIST SP 800-171
- Consultants who want a structured starting point for SPRS score calculations
Skip it if
- Certifying compliance on its own: the skill is guidance, and formal assessment requires a C3PAO or DoD process, so an agent's output should be verified by qualified assessors and legal counsel
- Organizations whose requirements, weights, or POA&M rules have changed since the reference material was written, because the skill relies on static reference files and the agent may not check current DoD sources
Try asking
- “Help me scope which systems in our network fall inside the CUI boundary for CMMC Level 2.”
- “Calculate our SPRS score from this JSON list of 800-171 requirement statuses.”
- “Draft a POA&M for our unmet NIST 800-171 controls with owners and 180-day milestones.”
- “Explain the difference between Level 1 self-assessment and Level 2 C3PAO assessment for our contract.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
achieving-cmmc-level-2-compliance.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip achieving-cmmc-level-2-compliance.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip achieving-cmmc-level-2-compliance.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Supply official point weights from the DoD NIST SP 800-171 Assessment Methodology in your input file; the script does not invent them.
- Verify POA&M eligibility and Conditional/Final rules against 32 CFR Part 170 and current DoD guidance before relying on them.
- Review the generated SSP and POA&M with your assessor or compliance counsel, since CUI handling decisions carry contractual consequences.
What's inside
- assets/template.md
- references/standards.md
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.