Starter Compliance Kit

01 // What's In The Kit

Every document an
assessor expects to see

CMMC Level 2 covers 110 controls and 320 assessment objectives drawn from NIST SP 800-171. The Starter Kit produces the written record behind every one of them — authored, cross-referenced, and ready to submit.

System Security Plan

A thorough SSP that defines your CUI environment, system boundary, and a control-by-control statement of how each requirement is satisfied — the backbone document of any CMMC assessment.

Plan of Action & Milestones

A structured POA&M capturing any not-yet-met objectives, the planned fix, owner, and target date — formatted exactly as assessors and contracting officers expect to review it.

Policies & Procedures

The complete written library — access control, incident response, configuration management, and the rest — tailored to your organization rather than generic templates.

Organized Evidence Package

An indexed evidence binder mapping each artifact to the objective it supports, so your assessor can move through the assessment without chasing missing documents.

SPRS Score Package

Your NIST 800-171 self-assessment scored against the DoD methodology, with the supporting basis documented and ready to post in the Supplier Performance Risk System.

Assessor Handoff Guide

A short walkthrough of the package so you — or your assessor — can navigate every document, understand how it's structured, and present it with confidence on assessment day.

02 // Scope

Documentation in,
implementation out

The Starter Kit is deliberately focused. It produces the documentation that travels to your assessor — it does not stand up systems or remediate controls. Knowing exactly where that line sits keeps your engagement honest.

What the kit includes

A complete System Security Plan authored to your environment
A POA&M for any open assessment objectives
The full policy and procedure library
An organized, indexed body of evidence
Your scored SPRS self-assessment package
A guided handoff so you can hand it to your assessor

What it does not include

Hands-on remediation or technical control implementation
Standing up GCC High, enclaves, or other infrastructure
Procuring or configuring software licenses
The certification assessment itself (an independent assessor performs that)
Ongoing monitoring and maintenance

Need the controls actually built? That's the Full Compliance Build.

03 // How It Works

From intake
to a finished package

A focused engagement that turns what you already have into a clean, defensible set of documents.

Step 01

Scope & Intake

We define your CUI boundary and gather what already exists — your systems, current practices, and any prior documentation — so the package reflects your actual environment.

Step 02

Author & Assemble

We write the SSP, POA&M, policies, and procedures, score your self-assessment, and assemble the evidence index — every artifact mapped to the objectives it supports.

Step 03

Package & Hand Off

You receive a complete, organized documentation package plus a walkthrough — ready to post to SPRS and hand directly to an independent assessor for evaluation.

04 // Where This Fits

Three ways
Axyl can take it on

Start with documentation, hand us the whole build, or keep your program healthy year after year. Pick the level of support that matches where you are.

Tier 01 — DocumentationYou're here