Menu

Not in the top 1,000 by GitHub stars

LV-262/cmmc-advisor

CMMC 2.0 compliance advisor as a Claude Code skill. All 3 levels, 14 domains, 110 practices; CUI scoping, SSP + POA&M; modern IT mapping for cloud, productivity, AI services, endpoints; contractor profiles and anti-patterns. Built from public DoD and NIST sources.

Claude CodeLegalProductivity

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

SKILL.md

Week of Oct 26, 2026 · +0 / −0 lines

Before Local scripts → After Local scripts

0828704c4d59 → 0828704c4d59

Compare on GitHub

View on GitHubAdd to my skills

Verified commit 0828704c4d591a3d41dbcf3f3b2a7c523e58f369

git clone --filter=blob:none --no-checkout https://github.com/LV-262/cmmc-advisor.git .hotskills/lv-262-cmmc-advisor && git -C .hotskills/lv-262-cmmc-advisor checkout --detach 0828704c4d591a3d41dbcf3f3b2a7c523e58f369 # Copy each selected skill directory from .hotskills/lv-262-cmmc-advisor into .claude/skills/<skill-name>/
24GitHub stars
0stars in 7 days
1skill in this repository
0commits in 30 days

Heat

0.4
  • Star growth, last 7 daysNot available
  • Star growth, last 24 hoursNot available
  • Rank movement, last 7 daysNot available
  • Commits, last 30 daysNot available
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Oct 25, 2026Oct 29, 202624

30-day change not yet available: not enough history.

Individual skills in this repository

How it works

cmmc-advisor

When your agent uses it

CMMC 2.0 compliance advisor for defense contractors. Provides practitioner-grade guidance on cybersecurity certification requirements, NIST SP 800-171 Rev 2 implementation, assessment preparation, CUI scoping, modern IT compliance mapping, and contractor-specific strategies. Built entirely from public DoD and NIST sources. Enabler posture: guides organizations toward compliant paths rather than blocking progress.

What it loads into context

Frontmatter

98 tokens

Always available to the agent

SKILL.md

1,821 tokens

When the skill is activated

Reference documents

243,278 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. Philosophy
  2. Knowledge Base Routing
  3. Audience Adaptation
  4. Response Standards
  5. Contractor-Aware Guidance
  6. Disclaimer
  7. What You Are Not

Scripts executed separately

  • evals/runner/__init__.py
  • evals/runner/precheck.py
  • evals/runner/runner.py
  • evals/runner/scoring.py

Files

  • .gitignoreasset183 bytes
  • CLAUDE.mddoc3,615 bytes
  • CONTRIBUTING.mddoc6,736 bytes
  • LICENSEasset1,068 bytes
  • README.mddoc5,103 bytes
  • SKILL.mdcore8,353 bytes
  • SKILL.mdcore8,353 bytes
  • SKILL.mdcore8,353 bytes
  • SOURCES.mddoc18,043 bytes
  • evals/rubrics/cmmc-answer-quality.mddoc4,776 bytes
  • evals/runner/__init__.pyruns0 bytes
  • evals/runner/precheck.pyruns3,100 bytes
  • evals/runner/requirements.txtdoc36 bytes
  • evals/runner/runner.pyruns5,195 bytes
  • evals/runner/scoring.pyruns4,993 bytes
  • evals/scenarios/anti-patterns-scope-theater.yamlasset3,489 bytes
  • evals/scenarios/level-2-scoping-basic.yamlasset1,930 bytes
  • evals/scenarios/modern-it-ai-dev-tools.yamlasset3,438 bytes
  • evals/scenarios/modern-it-m365-tenancy.yamlasset3,203 bytes
  • evals/scenarios/practice-implementation-ac-least-privilege.yamlasset3,322 bytes
  • references/anti-patterns.mddoc32,753 bytes
  • references/contractor-profiles.mddoc30,048 bytes
  • references/data/README.mddoc4,420 bytes
  • references/data/fedramp-snapshot.jsonasset8,923 bytes
  • references/domains/ac-access-control.mddoc24,281 bytes
  • references/domains/at-awareness-training.mddoc14,675 bytes
  • references/domains/au-audit.mddoc13,172 bytes
  • references/domains/ca-security-assessment.mddoc19,456 bytes
  • references/domains/cm-configuration-mgmt.mddoc12,999 bytes
  • references/domains/ia-identification-auth.mddoc14,410 bytes
  • references/domains/ir-incident-response.mddoc19,991 bytes
  • references/domains/ma-maintenance.mddoc17,125 bytes
  • references/domains/mp-media-protection.mddoc22,128 bytes
  • references/domains/pe-physical-protection.mddoc17,589 bytes
  • references/domains/ps-personnel-security.mddoc11,432 bytes
  • references/domains/ra-risk-assessment.mddoc14,737 bytes
  • references/domains/sc-system-comms.mddoc22,129 bytes
  • references/domains/si-system-information-integrity.mddoc25,005 bytes
  • references/evidence-collection.mddoc14,191 bytes
  • references/fedramp-gap.mddoc78,953 bytes
  • references/fedramp-marketplace-guide.mddoc29,589 bytes
  • references/levels-and-assessment.mddoc11,361 bytes
  • references/modern-it/ai-services/README.mddoc38,278 bytes
  • references/modern-it/ai-services/ai-dev-tools.mddoc31,656 bytes
  • references/modern-it/ai-services/fedramp-ai-services.mddoc31,106 bytes
  • references/modern-it/ai-services/self-hosted-ai.mddoc30,256 bytes
  • references/modern-it/cloud-platforms/aws-govcloud.mddoc34,987 bytes
  • references/modern-it/cloud-platforms/azure-government.mddoc42,978 bytes
  • references/modern-it/cloud-platforms/cloud-selection.mddoc30,892 bytes
  • references/modern-it/cloud-platforms/gcp-assured.mddoc41,964 bytes
  • references/modern-it/endpoints/README.mddoc20,390 bytes
  • references/modern-it/endpoints/macos-fleet.mddoc29,809 bytes
  • references/modern-it/endpoints/remote-work.mddoc30,725 bytes
  • references/modern-it/endpoints/windows-fleet.mddoc36,504 bytes
  • references/modern-it/productivity/README.mddoc33,038 bytes
  • references/modern-it/productivity/google-workspace.mddoc40,187 bytes
  • references/modern-it/productivity/legacy-dib-tools.mddoc32,010 bytes
  • references/modern-it/productivity/microsoft-365-gcc.mddoc43,724 bytes
  • references/poam-management.mddoc10,831 bytes
  • references/rev3-transition.mddoc6,713 bytes
  • references/scoping-and-cui.mddoc12,348 bytes
  • references/ssp-guidance.mddoc12,108 bytes
Read SKILL.md

# CMMC 2.0 Compliance Advisor

You are a compliance advisor helping defense contractors work through CMMC 2.0
certification. You provide clear, actionable guidance derived from publicly
available NIST and DoD documentation.

## Philosophy

You exist to help businesses succeed in delivering great services to the
U.S. Government in a compliant way. You are not a gatekeeper. You are a guide.

When a compliant path exists, map it clearly. When no compliant option exists
today, identify the gap honestly: describe who in the industry is working on
closing it, estimate when options may become available, and suggest interim
View the complete source on GitHub

Skills included

  • cmmc-advisor

Repository facts

License
MIT
Created
Apr 13, 2026
Last pushed
Apr 22, 2026
Forks
5
Open issues
0
Project activity
Slowing

Before you install

Local scripts

Automated signals, not a guarantee

Checked Nov 4, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 2 notes
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
Show all 193 signals by file

README.md

  • Network accessline 35
    git clone https://github.com/LV-262/cmmc-advisor.git

SOURCES.md

  • Network accessline 17
    - **Title:** Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
  • Network accessline 18
    - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final - **Used in:** Domain practice files, scoping guidance, SSP guidance
  • Network accessline 19
    - **URL:** https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
  • Network accessline 23
    - **Title:** Assessing Security Requirements for Controlled Unclassified Information - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/171/a/final
  • Network accessline 24
    - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/171/a/final - **Used in:** Assessment objectives, evidence collection guidance, anti-patterns
  • Network accessline 25
    - **URL:** https://csrc.nist.gov/pubs/sp/800/171/a/final
  • Network accessline 29
    - **Title:** Enhanced Security Requirements for Protecting Controlled Unclassified Information - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/172/final
  • Network accessline 30
    - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/172/final - **Used in:** Level 3 requirements
  • Network accessline 31
    - **URL:** https://csrc.nist.gov/pubs/sp/800/172/final
  • Network accessline 35
    - **Title:** Security and Privacy Controls for Information Systems and Organizations - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
  • Network accessline 36
    - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final - **Used in:** FedRAMP control baselines referenced in fedramp-marketplace-guide
  • Network accessline 37
    - **URL:** https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
  • Network accessline 41
    - **Title:** Computer Security Incident Handling Guide - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/61/r2/final
  • Network accessline 42
    - **Publisher:** National Institute of Standards and Technology - **URL:** https://csrc.nist.gov/pubs/sp/800/61/r2/final - **Used in:** Incident Response domain
  • Network accessline 43
    - **URL:** https://csrc.nist.gov/pubs/sp/800/61/r2/final
  • Network accessline 46
    ### NIST CMVP Validated Modules Registry - **URL:** https://csrc.nist.gov/projects/cryptographic-module-validation-program
  • Network accessline 47
    - **URL:** https://csrc.nist.gov/projects/cryptographic-module-validation-program
  • Network accessline 51
    - **Title:** Safeguarding Covered Defense Information and Cyber Incident Reporting - **Publisher:** Department of Defense (Defense Federal Acquisition Regulation Supplement) - **URL:** https://www.acquisition.gov/dfars/252.204-7012-safeguar
  • Network accessline 52
    - **Publisher:** Department of Defense (Defense Federal Acquisition Regulation Supplement) - **URL:** https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting - **Used in:** Incide
  • Network accessline 53
    - **URL:** https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
  • Network accessline 57
    - **Title:** Department of Defense Cloud Computing Security Requirements Guide - **Publisher:** DISA - **URL:** https://public.cyber.mil/dccs/dccs-documents/
  • Network accessline 58
    - **Publisher:** DISA - **URL:** https://public.cyber.mil/dccs/dccs-documents/ - **Used in:** DoD Impact Level framing (IL2/IL4/IL5/IL6), FedRAMP-to-IL reciprocity, cloud-platforms and productivity and AI-services files
  • Network accessline 59
    - **URL:** https://public.cyber.mil/dccs/dccs-documents/
  • Network accessline 68
    - **Publisher:** Department of Defense - **Effective:** December 16, 2024 - **URL:** https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program
  • Network accessline 69
    - **Effective:** December 16, 2024 - **URL:** https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program - **Used in:** Levels and assessment, scoring, POA&M rules, scoping, contr
  • Network accessline 70
    - **URL:** https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program
  • Network accessline 75
    - **Publisher:** Department of Defense - **Effective:** November 10, 2025 - **URL:** https://www.federalregister.gov/d/2025-16120
  • Network accessline 76
    - **Effective:** November 10, 2025 - **URL:** https://www.federalregister.gov/d/2025-16120 - **Used in:** Phased rollout timeline, contract requirements, annual affirmations (48 CFR 252.204-7021) in anti-patterns
  • Network accessline 77
    - **URL:** https://www.federalregister.gov/d/2025-16120
  • Network accessline 81
    - **Title:** CMMC Program Cost-Benefit Analysis (preamble to 32 CFR Part 170 Final Rule) - **Publisher:** Department of Defense - **URL:** https://www.federalregister.gov/documents/2023/12/26/2023-27280/cybersecurity-maturity-model-certific
  • Network accessline 82
    - **Publisher:** Department of Defense - **URL:** https://www.federalregister.gov/documents/2023/12/26/2023-27280/cybersecurity-maturity-model-certification-cmmc-program - **Used in:** Cost projections in contractor-profiles, fedramp-market
  • Network accessline 83
    - **URL:** https://www.federalregister.gov/documents/2023/12/26/2023-27280/cybersecurity-maturity-model-certification-cmmc-program
  • Network accessline 87
    - **Title:** CMMC Assessment Guide Level 2 - **Publisher:** DoD CIO - **URL:** https://dodcio.defense.gov/Portals/0/Documents/CMMC/AssessmentGuideL2.pdf
  • Network accessline 88
    - **Publisher:** DoD CIO - **URL:** https://dodcio.defense.gov/Portals/0/Documents/CMMC/AssessmentGuideL2.pdf - **Used in:** Assessment process, practice-level guidance, scoping categories
  • Network accessline 89
    - **URL:** https://dodcio.defense.gov/Portals/0/Documents/CMMC/AssessmentGuideL2.pdf
  • Network accessline 93
    - **Title:** CMMC Model Overview Version 2.0 - **Publisher:** DoD CIO - **URL:** https://dodcio.defense.gov/CMMC/
  • Network accessline 94
    - **Publisher:** DoD CIO - **URL:** https://dodcio.defense.gov/CMMC/ - **Used in:** Domain structure, practice counts, level definitions
  • Network accessline 95
    - **URL:** https://dodcio.defense.gov/CMMC/
  • Network accessline 103
    - **Title:** Controlled Unclassified Information - **Publisher:** National Archives and Records Administration - **URL:** https://www.archives.gov/cui
  • Network accessline 104
    - **Publisher:** National Archives and Records Administration - **URL:** https://www.archives.gov/cui - **Used in:** CUI definition, marking requirements, dissemination-control taxonomy
  • Network accessline 105
    - **URL:** https://www.archives.gov/cui
  • Network accessline 127
    ### SBA Certify Portal - **URL:** https://certify.sba.gov
  • Network accessline 128
    - **URL:** https://certify.sba.gov
  • Network accessline 152
    - **Title:** Certification of Service-Disabled Veteran-Owned Small Businesses - **Publisher:** Federal Register - **URL:** https://www.federalregister.gov/documents/2024/02/23/2024-02797/federal-acquisition-regulation-certification-of-servi
  • Network accessline 153
    - **Publisher:** Federal Register - **URL:** https://www.federalregister.gov/documents/2024/02/23/2024-02797/federal-acquisition-regulation-certification-of-service-disabled-veteran-owned-small-businesses - **Used in:** contractor-profiles
  • Network accessline 154
    - **URL:** https://www.federalregister.gov/documents/2024/02/23/2024-02797/federal-acquisition-regulation-certification-of-service-disabled-veteran-owned-small-businesses
  • Network accessline 165
    ### FedRAMP Program - **URL:** https://www.fedramp.gov
  • Network accessline 166
    - **URL:** https://www.fedramp.gov
  • Network accessline 169
    ### FedRAMP Marketplace - **URL:** https://marketplace.fedramp.gov
  • Network accessline 170
    - **URL:** https://marketplace.fedramp.gov
  • Network accessline 173
    ### AWS GovCloud User Guide - **URL:** https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/
  • Network accessline 174
    - **URL:** https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/
  • Network accessline 177
    ### AWS GovCloud Compliance Page - **URL:** https://aws.amazon.com/compliance/services-in-scope/FedRAMP/
  • Network accessline 178
    - **URL:** https://aws.amazon.com/compliance/services-in-scope/FedRAMP/
  • Network accessline 181
    ### AWS Bedrock in AWS GovCloud Documentation - **URL:** https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-bedrock.html
  • Network accessline 182
    - **URL:** https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-bedrock.html
  • Network accessline 185
    ### Microsoft Azure Government Documentation - **URL:** https://learn.microsoft.com/en-us/azure/azure-government/
  • Network accessline 186
    - **URL:** https://learn.microsoft.com/en-us/azure/azure-government/
  • Network accessline 189
    ### Azure OpenAI Service in Azure Government - **URL:** https://learn.microsoft.com/en-us/azure/ai-foundry/openai/azure-government
  • Network accessline 190
    - **URL:** https://learn.microsoft.com/en-us/azure/ai-foundry/openai/azure-government
  • Network accessline 193
    ### Azure Government OpenAI Announcement - **URL:** https://devblogs.microsoft.com/azuregov/azure-openai-fedramp-high-for-government/
  • Network accessline 194
    - **URL:** https://devblogs.microsoft.com/azuregov/azure-openai-fedramp-high-for-government/
  • Network accessline 197
    ### Google Cloud Assured Workloads Documentation - **URL:** https://cloud.google.com/assured-workloads
  • Network accessline 198
    - **URL:** https://cloud.google.com/assured-workloads
  • Network accessline 201
    ### Google Cloud Assured Workloads Release Notes - **URL:** https://docs.cloud.google.com/assured-workloads/docs/release-notes
  • Network accessline 202
    - **URL:** https://docs.cloud.google.com/assured-workloads/docs/release-notes
  • Network accessline 205
    ### Claude on Google Cloud Vertex AI Announcement - **URL:** https://claude.com/blog/claude-on-google-cloud-fedramp-high
  • Network accessline 206
    - **URL:** https://claude.com/blog/claude-on-google-cloud-fedramp-high
  • Network accessline 213
    ### Microsoft 365 Compliance Documentation - **URL:** https://learn.microsoft.com/en-us/compliance/
  • Network accessline 214
    - **URL:** https://learn.microsoft.com/en-us/compliance/
  • Network accessline 217
    ### Microsoft CMMC Page - **URL:** https://learn.microsoft.com/en-us/compliance/us-government/gov-cmmc
  • Network accessline 218
    - **URL:** https://learn.microsoft.com/en-us/compliance/us-government/gov-cmmc
  • Network accessline 221
    ### Google Workspace Security and Compliance - **URL:** https://workspace.google.com/security/
  • Network accessline 222
    - **URL:** https://workspace.google.com/security/
  • Network accessline 225
    ### Google Workspace CMMC Page - **URL:** https://cloud.google.com/security/compliance/cmmc
  • Network accessline 226
    - **URL:** https://cloud.google.com/security/compliance/cmmc
  • Network accessline 229
    ### Google Public Sector CMMC Certification Announcement - **URL:** https://cloud.google.com/blog/topics/public-sector/securing-the-mission-google-public-sectors-cmmc-level-2-certification-and-commitment-to-national-security
  • Network accessline 230
    - **URL:** https://cloud.google.com/blog/topics/public-sector/securing-the-mission-google-public-sectors-cmmc-level-2-certification-and-commitment-to-national-security
  • Network accessline 233
    ### Atlassian Trust Center (FedRAMP) - **URL:** https://www.atlassian.com/trust/compliance/resources/fedramp
  • Network accessline 234
    - **URL:** https://www.atlassian.com/trust/compliance/resources/fedramp
  • Network accessline 237
    ### Atlassian Government Cloud Announcement - **URL:** https://www.atlassian.com/blog/announcements/atlassiangovernmentcloud
  • Network accessline 238
    - **URL:** https://www.atlassian.com/blog/announcements/atlassiangovernmentcloud
  • Network accessline 241
    ### ServiceNow Trust and Compliance Page - **URL:** https://www.servicenow.com/company/trust/compliance.html
  • Network accessline 242
    - **URL:** https://www.servicenow.com/company/trust/compliance.html
  • Network accessline 245
    ### GitHub FedRAMP FAQ - **URL:** https://government.github.com/fedramp-faq
  • Network accessline 246
    - **URL:** https://government.github.com/fedramp-faq
  • Network accessline 249
    ### GitHub Enterprise Cloud Trust Center - **URL:** https://ghec.github.trust.page/
  • Network accessline 250
    - **URL:** https://ghec.github.trust.page/
  • Network accessline 253
    ### Box Government Solutions Page - **URL:** https://www.box.com/industries/government
  • Network accessline 254
    - **URL:** https://www.box.com/industries/government
  • Network accessline 257
    ### Box Trust Center - **URL:** https://www.box.com/trust
  • Network accessline 258
    - **URL:** https://www.box.com/trust
  • Network accessline 265
    ### Anthropic Claude Code Documentation - **URL:** https://code.claude.com/docs
  • Network accessline 266
    - **URL:** https://code.claude.com/docs
  • Network accessline 269
    ### Claude Code on Amazon Bedrock - **URL:** https://code.claude.com/docs/en/amazon-bedrock
  • Network accessline 270
    - **URL:** https://code.claude.com/docs/en/amazon-bedrock
  • Network accessline 273
    ### GitHub Copilot Documentation - **URL:** https://docs.github.com/en/copilot
  • Network accessline 274
    - **URL:** https://docs.github.com/en/copilot
  • Network accessline 277
    ### Cursor Security Page - **URL:** https://cursor.com/security
  • Network accessline 278
    - **URL:** https://cursor.com/security
  • Network accessline 281
    ### Cursor Trust Center - **URL:** https://trust.cursor.com
  • Network accessline 282
    - **URL:** https://trust.cursor.com
  • Network accessline 285
    ### Codeium / Windsurf Documentation - **URL:** https://codeium.com
  • Network accessline 286
    - **URL:** https://codeium.com
  • Network accessline 289
    ### Continue Project Documentation - **URL:** https://continue.dev
  • Network accessline 290
    - **URL:** https://continue.dev
  • Network accessline 293
    ### BeyondTrust FedRAMP Identity Security Insights Announcement - **URL:** https://www.beyondtrust.com/press/fedramp-identity-security-insights
  • Network accessline 294
    - **URL:** https://www.beyondtrust.com/press/fedramp-identity-security-insights
  • Network accessline 297
    ### Splunk Cloud Platform FedRAMP High Announcement - **URL:** https://www.splunk.com/en_us/newsroom/press-releases/2024/splunk-cloud-platform-attains-fedramp-high-authorization.html
  • Network accessline 298
    - **URL:** https://www.splunk.com/en_us/newsroom/press-releases/2024/splunk-cloud-platform-attains-fedramp-high-authorization.html
  • Network accessline 301
    ### Anthropic Trust Center - **URL:** https://trust.anthropic.com
  • Network accessline 302
    - **URL:** https://trust.anthropic.com
  • Network accessline 309
    ### Meta Llama Model Cards and License - **URL:** https://llama.com
  • Network accessline 310
    - **URL:** https://llama.com
  • Network accessline 313
    ### Mistral AI Model Licenses - **URL:** https://mistral.ai
  • Network accessline 314
    - **URL:** https://mistral.ai
  • Network accessline 317
    ### Coder Documentation - **URL:** https://coder.com/docs
  • Network accessline 318
    - **URL:** https://coder.com/docs
  • Network accessline 325
    ### Summit 7 Blog - **Publisher:** Summit 7 - **URL:** https://www.summit7.us/blog
  • Network accessline 326
    - **Publisher:** Summit 7 - **URL:** https://www.summit7.us/blog - **Accessed:** April 2026
  • Network accessline 327
    - **URL:** https://www.summit7.us/blog
  • Network accessline 331
    #### Specific Articles Referenced: - "CMMC is Published: What Now?" https://www.summit7.us/blog/cmmc-is-published-what-now
  • Network accessline 332
    - "CMMC is Published: What Now?" https://www.summit7.us/blog/cmmc-is-published-what-now
  • Network accessline 333
    - "DoD Says CMMC Level 2 Self-Assessments Are the Exception, Not the Rule," https://www.summit7.us/blog/cmmc-l2-self-assessments
  • Network accessline 334
    - "3 Strategies for Successful CMMC Assessments, According to C3PAOs," https://www.summit7.us/blog/c3pao-advice-for-cmmc-assessment
  • Network accessline 337
    - **Title:** CMMC for Small Business: A Practical Guide to Compliance & Cost - **Publisher:** Secureframe - **URL:** https://secureframe.com/blog/cmmc-small-business
  • Network accessline 338
    - **Publisher:** Secureframe - **URL:** https://secureframe.com/blog/cmmc-small-business - **Accessed:** April 2026
  • Network accessline 339
    - **URL:** https://secureframe.com/blog/cmmc-small-business
  • Network accessline 344
    - **Title:** CMMC 2.0 Timeline: Key Dates & Deadlines Explained - **Publisher:** Secureframe - **URL:** https://secureframe.com/hub/cmmc/proposed-final-rule
  • Network accessline 345
    - **Publisher:** Secureframe - **URL:** https://secureframe.com/hub/cmmc/proposed-final-rule - **Accessed:** April 2026
  • Network accessline 346
    - **URL:** https://secureframe.com/hub/cmmc/proposed-final-rule
  • Network accessline 350
    ### cmmc.com — True Cost of CMMC 2.0 - **Title:** The True Cost of CMMC 2.0: Budget Breakdown by Level - **URL:** https://cmmc.com/newsroom/cost-of-cmmc
  • Network accessline 351
    - **Title:** The True Cost of CMMC 2.0: Budget Breakdown by Level - **URL:** https://cmmc.com/newsroom/cost-of-cmmc - **Accessed:** April 2026
  • Network accessline 352
    - **URL:** https://cmmc.com/newsroom/cost-of-cmmc
  • Network accessline 357
    - **Title:** CUI and FCI: Should We Keep Them Separate for CMMC Level 2 Compliance? - **Publisher:** Pivot Point Security - **URL:** https://www.pivotpointsecurity.com/cui-and-fci-should-you-keep-them-separate-for-cmmc-level-2-compliance/
  • Network accessline 358
    - **Publisher:** Pivot Point Security - **URL:** https://www.pivotpointsecurity.com/cui-and-fci-should-you-keep-them-separate-for-cmmc-level-2-compliance/ - **Accessed:** April 2026
  • Network accessline 359
    - **URL:** https://www.pivotpointsecurity.com/cui-and-fci-should-you-keep-them-separate-for-cmmc-level-2-compliance/
  • Network accessline 364
    - **Title:** CMMC POA&Ms Explained: What You Can and Cannot Defer - **Publisher:** ISI Defense - **URL:** https://isidefense.com/blog/cmmc-poams-explained-what-you-can-and-cannot-defer
  • Network accessline 365
    - **Publisher:** ISI Defense - **URL:** https://isidefense.com/blog/cmmc-poams-explained-what-you-can-and-cannot-defer - **Accessed:** April 2026
  • Network accessline 366
    - **URL:** https://isidefense.com/blog/cmmc-poams-explained-what-you-can-and-cannot-defer
  • Network accessline 370
    ### ISI Defense — Rev 2 vs Rev 3 - **Title:** NIST 800-171 Rev. 2 vs Rev. 3: What Defense Contractors Need to Know - **URL:** https://isidefense.com/blog/nist-800-171-rev-2-vs-rev-3-what-defense-contractors-need-to-know-now
  • Network accessline 371
    - **Title:** NIST 800-171 Rev. 2 vs Rev. 3: What Defense Contractors Need to Know - **URL:** https://isidefense.com/blog/nist-800-171-rev-2-vs-rev-3-what-defense-contractors-need-to-know-now - **Accessed:** April 2026
  • Network accessline 372
    - **URL:** https://isidefense.com/blog/nist-800-171-rev-2-vs-rev-3-what-defense-contractors-need-to-know-now
  • Network accessline 377
    - **Title:** The FedRAMP High Supply Crisis Is a Federal Security Problem - **Publisher:** MeriTalk - **URL:** https://www.meritalk.com/the-fedramp-high-supply-crisis-is-a-federal-security-problem-not-a-procurement-footnote/
  • Network accessline 378
    - **Publisher:** MeriTalk - **URL:** https://www.meritalk.com/the-fedramp-high-supply-crisis-is-a-federal-security-problem-not-a-procurement-footnote/ - **Accessed:** April 2026
  • Network accessline 379
    - **URL:** https://www.meritalk.com/the-fedramp-high-supply-crisis-is-a-federal-security-problem-not-a-procurement-footnote/
  • Network accessline 383
    ### InfraGap — CDE Compliance - **Title:** CDE Compliance: HITRUST, SOC 2, FedRAMP & CMMC - **URL:** https://infragap.com/compliance/
  • Network accessline 384
    - **Title:** CDE Compliance: HITRUST, SOC 2, FedRAMP & CMMC - **URL:** https://infragap.com/compliance/ - **Accessed:** April 2026
  • Network accessline 385
    - **URL:** https://infragap.com/compliance/
  • Network accessline 393
    ### GovRAMP (formerly StateRAMP) - **URL:** https://govramp.org (stateramp.org redirects)
  • Network accessline 394
    - **URL:** https://govramp.org (stateramp.org redirects)
  • Network accessline 401
    1. **NIST publications:** All NIST SPs are freely available at https://csrc.nist.gov
  • Network accessline 402
    2. **Federal Register:** Rules and regulations at https://www.federalregister.gov
  • Network accessline 403
    3. **CMMC program:** Official DoD page at https://dodcio.defense.gov/CMMC/
  • Network accessline 404
    4. **FedRAMP status:** Current authorizations at https://www.fedramp.gov/marketplace
  • Network accessline 405
    5. **CUI Registry:** Categories and markings at https://www.archives.gov/cui

evals/runner/__init__.py

  • Executable scriptline 1
    Executable file

evals/runner/precheck.py

  • Executable scriptline 1
    Executable file

evals/runner/runner.py

  • Executable scriptline 1
    Executable file

evals/runner/scoring.py

  • Executable scriptline 1
    Executable file

references/domains/ir-incident-response.md

  • Network accessline 175
    obligations under the contract, report within 72 hours of discovery   via DIBNet (the DoD Defense Industrial Base Network cyber incident   reporting portal at https://dibnet.dod.mil, run by the DoD Cyber Crime Center
  • Network accessline 176
    via DIBNet (the DoD Defense Industrial Base Network cyber incident   reporting portal at https://dibnet.dod.mil, run by the DoD Cyber Crime Center   / DC3) per DFARS 252.204-7012 (the DFARS cyber incident reporting
  • Network accessline 177
    reporting portal at https://dibnet.dod.mil, run by the DoD Cyber Crime Center

references/domains/sc-system-comms.md

  • Network accessline 354
    TLS, VPN, email encryption, database encryption) - Verify each cryptographic module against the NIST CMVP list:   https://csrc.nist.gov/projects/cryptographic-module-validation-program
  • Network accessline 355
    - Verify each cryptographic module against the NIST CMVP list:   https://csrc.nist.gov/projects/cryptographic-module-validation-program - Common FIPS-validated modules: Windows BitLocker (with TPM), Apple
  • Network accessline 356
    https://csrc.nist.gov/projects/cryptographic-module-validation-program
  • Network accessline 380
    > Source: NIST CMVP, https://csrc.nist.gov/projects/cryptographic-module-validation-program

references/evidence-collection.md

  • Network accessline 226
    modules. "We use AES-256" is insufficient. The specific implementation must be validated. Check the NIST Cryptographic Module Validation Program (CMVP) list at https://csrc.nist.gov/projects/cryptographic-module-validation-program
  • Network accessline 228
    (CMVP) list at https://csrc.nist.gov/projects/cryptographic-module-validation-program

references/fedramp-gap.md

  • Network accessline 241
    > equivalent to those established by the Government for the Federal > Risk and Authorization Management Program (FedRAMP) Moderate baseline > (https://www.fedramp.gov/documents-templates/) and that the cloud
  • Network accessline 242
    > Risk and Authorization Management Program (FedRAMP) Moderate baseline > (https://www.fedramp.gov/documents-templates/) and that the cloud > service provider complies with requirements in paragraphs (c) through
  • Network accessline 243
    > (https://www.fedramp.gov/documents-templates/) and that the cloud

references/levels-and-assessment.md

  • Network accessline 19
    > Source: Summit 7 Blog, "CMMC is Published: What Now?" > https://www.summit7.us/blog/cmmc-is-published-what-now
  • Network accessline 20
    > https://www.summit7.us/blog/cmmc-is-published-what-now
  • Network accessline 75
    > Source: Summit 7 Blog, "DoD Says CMMC Level 2 Self-Assessments Are the > Exception, Not the Rule" > https://www.summit7.us/blog/cmmc-l2-self-assessments
  • Network accessline 77
    > https://www.summit7.us/blog/cmmc-l2-self-assessments
  • Network accessline 86
    > Source: Secureframe, "CMMC for Small Business: A Practical Guide to > Compliance & Cost," https://secureframe.com/blog/cmmc-small-business
  • Network accessline 87
    > Compliance & Cost," https://secureframe.com/blog/cmmc-small-business
  • Network accessline 185
    > Source: 32 CFR 170.21, POA&M Closeout; ISI Defense, "CMMC POA&Ms > Explained: What You Can and Cannot Defer" > https://isidefense.com/blog/cmmc-poams-explained-what-you-can-and-cannot-defer
  • Network accessline 187
    > https://isidefense.com/blog/cmmc-poams-explained-what-you-can-and-cannot-defer
  • Network accessline 251
    > Source: Secureframe, "CMMC 2.0 Timeline: Key Dates & Deadlines Explained" > https://secureframe.com/hub/cmmc/proposed-final-rule
  • Network accessline 252
    > https://secureframe.com/hub/cmmc/proposed-final-rule

references/rev3-transition.md

  • Network accessline 19
    > Source: ISI Defense, "NIST 800-171 Rev. 2 vs Rev. 3: What Defense > Contractors Need to Know" > https://isidefense.com/blog/nist-800-171-rev-2-vs-rev-3-what-defense-contractors-need-to-know-now
  • Network accessline 21
    > https://isidefense.com/blog/nist-800-171-rev-2-vs-rev-3-what-defense-contractors-need-to-know-now
  • Network accessline 151
    > Secureframe, "NIST 800-171 Rev 2 vs Rev 3: What Changed and What It > Means for CMMC" > https://secureframe.com/blog/nist-800-171-rev2-vs-rev3
  • Network accessline 153
    > https://secureframe.com/blog/nist-800-171-rev2-vs-rev3
  • Network accessline 172
    5. **Summit 7 analysis.** The Sum IT Up podcast and Summit 7 blog    consistently provide early and accurate analysis of CMMC rulemaking    developments: https://www.summit7.us/podcast
  • Network accessline 174
    developments: https://www.summit7.us/podcast

references/scoping-and-cui.md

  • Network accessline 178
    > Source: Pivot Point Security, "CUI and FCI: Should We Keep Them Separate > for CMMC Level 2 Compliance?" > https://www.pivotpointsecurity.com/cui-and-fci-should-you-keep-them-separate-for-cmmc-level-2-compliance/
  • Network accessline 180
    > https://www.pivotpointsecurity.com/cui-and-fci-should-you-keep-them-separate-for-cmmc-level-2-compliance/

references/ssp-guidance.md

  • Network accessline 40
    A CMMC-ready SSP should contain the following sections. This structure aligns with the NIST CUI SSP Template available at: https://csrc.nist.gov/files/pubs/sp/800/171/r2/upd1/final/docs/cui-ssp-template-final.docx
  • Network accessline 42
    https://csrc.nist.gov/files/pubs/sp/800/171/r2/upd1/final/docs/cui-ssp-template-final.docx

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Signal confidence: 193 facts
  • Network access in code of documentationREADME.md:35Low confidence
  • Network access in prose of documentationSOURCES.md:17Low confidence
  • Network access in prose of documentationSOURCES.md:18Low confidence
  • Network access in prose of documentationSOURCES.md:19Low confidence
  • Network access in prose of documentationSOURCES.md:23Low confidence
  • Network access in prose of documentationSOURCES.md:24Low confidence
  • Network access in prose of documentationSOURCES.md:25Low confidence
  • Network access in prose of documentationSOURCES.md:29Low confidence
  • Network access in prose of documentationSOURCES.md:30Low confidence
  • Network access in prose of documentationSOURCES.md:31Low confidence
  • Network access in prose of documentationSOURCES.md:35Low confidence
  • Network access in prose of documentationSOURCES.md:36Low confidence
  • Network access in prose of documentationSOURCES.md:37Low confidence
  • Network access in prose of documentationSOURCES.md:41Low confidence
  • Network access in prose of documentationSOURCES.md:42Low confidence
  • Network access in prose of documentationSOURCES.md:43Low confidence
  • Network access in prose of documentationSOURCES.md:46Low confidence
  • Network access in prose of documentationSOURCES.md:47Low confidence
  • Network access in prose of documentationSOURCES.md:51Low confidence
  • Network access in prose of documentationSOURCES.md:52Low confidence
  • Network access in prose of documentationSOURCES.md:53Low confidence
  • Network access in prose of documentationSOURCES.md:57Low confidence
  • Network access in prose of documentationSOURCES.md:58Low confidence
  • Network access in prose of documentationSOURCES.md:59Low confidence
  • Network access in prose of documentationSOURCES.md:68Low confidence
  • Network access in prose of documentationSOURCES.md:69Low confidence
  • Network access in prose of documentationSOURCES.md:70Low confidence
  • Network access in prose of documentationSOURCES.md:75Low confidence
  • Network access in prose of documentationSOURCES.md:76Low confidence
  • Network access in prose of documentationSOURCES.md:77Low confidence
  • Network access in prose of documentationSOURCES.md:81Low confidence
  • Network access in prose of documentationSOURCES.md:82Low confidence
  • Network access in prose of documentationSOURCES.md:83Low confidence
  • Network access in prose of documentationSOURCES.md:87Low confidence
  • Network access in prose of documentationSOURCES.md:88Low confidence
  • Network access in prose of documentationSOURCES.md:89Low confidence
  • Network access in prose of documentationSOURCES.md:93Low confidence
  • Network access in prose of documentationSOURCES.md:94Low confidence
  • Network access in prose of documentationSOURCES.md:95Low confidence
  • Network access in prose of documentationSOURCES.md:103Low confidence
  • Network access in prose of documentationSOURCES.md:104Low confidence
  • Network access in prose of documentationSOURCES.md:105Low confidence
  • Network access in prose of documentationSOURCES.md:127Low confidence
  • Network access in prose of documentationSOURCES.md:128Low confidence
  • Network access in prose of documentationSOURCES.md:152Low confidence
  • Network access in prose of documentationSOURCES.md:153Low confidence
  • Network access in prose of documentationSOURCES.md:154Low confidence
  • Network access in prose of documentationSOURCES.md:165Low confidence
  • Network access in prose of documentationSOURCES.md:166Low confidence
  • Network access in prose of documentationSOURCES.md:169Low confidence

and 143 more

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeNativePath CLAUDE.md.claude/skills/<skill-name>/
CodexCompatibleStandard SKILL.md SKILL.md.agents/skills/<skill-name>/
CursorCompatibleStandard SKILL.md SKILL.md.cursor/skills/<skill-name>/
Gemini CLICompatibleStandard SKILL.md SKILL.md.gemini/skills/<skill-name>/
GitHub CopilotCompatibleStandard SKILL.md SKILL.md.github/skills/<skill-name>/
OpenCodeCompatibleStandard SKILL.md SKILL.md.opencode/skills/<skill-name>/
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

You might also use

ibnsawad/Saudi-Regulatory-Compliance-Claude-Skill

Expert-level Claude Skill for Saudi regulatory compliance — NCA ECC, SAMA-CSF, PDPL, CST and more.

10GitHub stars

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Claude Skills for Governance, Risk, & Compliance (GRC): Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, EU AI Act, ISO 42001, ISO 2…

1kGitHub stars

mhfed/vn-law-check

Audit pháp lý website theo luật Việt Nam (BVDLCN 91/2025, TMĐT 122/2025, ANM 116/2025, AI 134/2025) cho Claude Code, Cursor, Copilot, Windsurf, Cline

463GitHub stars

grcorsair/corsair

Compliance trust shouldn't require emailing PDFs and hoping nobody tampered with them. Corsair signs compliance findings as verifiable digital certificates that anyone can check w…

16GitHub stars

Ansvar-Systems/incident-reporting-navigator-skill

Agent skill: one security incident mapped across EU reporting regimes (NIS2, GDPR, DORA, CRA) — duties, authorities, deadlines, cited live via the Ansvar Gateway MCP connector

1GitHub stars

Ansvar-Systems/regulatory-threat-model-skill

Agent skill: server-enforced STRIDE + LINDDUN threat modeling with cited EU security-obligations mapping via the Ansvar Gateway MCP connector

1GitHub stars