Individual skill
cmmc-readiness
Use when a defense contractor or subcontractor is preparing for a CMMC 2.0 Level 2 self-assessment or C3PAO assessment, calculating or checking an SPRS score against NIST SP 800-171 Rev 2, deciding what can go on a POA&M, tracking POA&M closeout before Conditional status expires, or scoping assets, enclaves and cloud providers that handle CUI. Scores all 110 requirements with the 32 CFR 170.24 weights, blocks gaps that can never be deferred, and classifies the asset inventory into CMMC asset categories.
ra-qm-team/cmmc-readiness/skills/cmmc-readiness/SKILL.md
Source commit 8f082544116fc0d014188e521ca40304cdfc86b0
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 10, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 29,598
- Repository last updated
- Nov 5, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agentic-ai Repository topic
- anthropic-claude Repository topic
- claude-ai Repository topic
- claude-code Repository topic
- claude-skills Repository topic
- claude-code-skills Repository topic
- ai-coding-agent Repository topic
- claude-code-plugins Repository topic
- developer-tools Repository topic
- openai-codex Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 5,975 bytesSKILL.mdcore · 5,975 bytesassets/assessment.example.csvasset · 2,434 bytesassets/assessment_readiness_signoff.mddoc · 1,807 bytesassets/inventory.example.csvasset · 789 bytesassets/poam.example.csvasset · 285 bytesreferences/level2_scoring_and_status.mddoc · 6,012 bytesreferences/rev2_rev3_and_levels.mddoc · 3,113 bytesreferences/scoping_and_providers.mddoc · 4,873 bytesscripts/poam_closeout.pyruns · 13,012 bytesscripts/scope_classifier.pyruns · 11,551 bytesscripts/sprs_score.pyruns · 20,767 bytes
Read excerpt
# CMMC Readiness
> **Portability:** 3 stdlib scripts, no network, no SPRS connection. Fill CSVs, run, keep the output with the SSP.
> **Not an assessment and not legal advice.** A C3PAO or DIBCAC assessor decides MET; the Affirming Official affirms in SPRS.
Level 2 assessments fail in predictable ways: a 5-point gap someone planned to
put on a POA&M, an SSP that misses half the assets, a cloud drive holding CUI
without FedRAMP, and a Conditional status that quietly expires on day 181. Each
script catches one of these before the assessor does.
## Workflow
```bash
# 1 - Scope: what is in the assessment, and what must the SSP say about it?