ComplAIRequest a working session

CMMC LEVEL 2

Keep CMMC evidence connected to the CUI boundary.

Give teams a maintained view of where CUI lives, what protects it, who can reach it, and which evidence supports each NIST SP 800-171 requirement.

CMMC 2.0 · NIST SP 800-171 · CUI boundary
Scope a CMMC working session

THE ASSESSMENT BOUNDARY

Define the boundary before measuring readiness.

A credible CMMC program connects its 110 security requirements to the systems, users, and data flows that handle CUI. ComplAI brings those relationships into the same operating picture.

  1. 01

    Discover and classify CUI across governed repositories.

  2. 02

    Identify assets, identities, vendors, and access paths touching the boundary.

  3. 03

    Connect each security requirement to implementation, evidence, and accountable owners.

  4. 04

    Maintain SSP, POA&M, and assessment evidence as the environment changes.

ONE ASSESSMENT RECORD

See data, assets, access, and evidence together.

Evidence and control status stay grounded in the environment the assessor will examine instead of living in a separate compliance record.

DATA

Know where CUI lives

Classify regulated data, map its movement, and connect handling rules to real repositories.

ASSETS

Know what supports it

Maintain an authoritative inventory of endpoints, workloads, services, and boundary components.

USERS

Know who can reach it

Trace identities, privileges, vendors, and review obligations across the in-scope environment.

ASSESSMENT WORKSPACE VIEWRELATIONSHIP VIEW · EXAMPLE RECORD

See whether the requirement, boundary, and evidence still agree.

reviewablesignal → context → owner
REVIEW STATEExample record
  • Source linked56%
  • Review due28%
  • Owner needed16%
Latest linked changeRepository scope confirmedTrace affected context
RELATIONSHIP SIGNALSFive checkpoints

Five checkpoints compare linked context with review attention. Hover, tap, or use the arrow keys to inspect each checkpoint.

84%linked context
+42 pts
HUMAN REVIEW PATHAccountability retained
  • Requirement ownerassigned
  • Evidence reviewerreview due
  • Remediation ownerowner needed
CHANGE TIMELINENeeds attention
  1. Repository scope confirmedBoundary linked
    EV
  2. Narrative change detectedReview due
    RO
  3. Remediation owner missingAction required
    ?

Illustrative values and event history · not a customer result, authorization decision, assessment result, or readiness score.

NEXT DECISION

Start with the boundary you have today.

We will identify what is known, what is assumed, and what must be verified before the assessment plan hardens.

Scope a CMMC working session