/practice-check

CMMC Practice Check

Validates implementation of specific CMMC v2.0 practices and provides evidence guidance.

Arguments

• $1 - Practice ID (required, e.g., AC.L2-3.1.1, IA.L2-3.5.7)
• $2 - Check type (optional: implementation, evidence, gaps)

Practice ID Format

Structure: [DOMAIN].[LEVEL]-[NIST-ID]

• Domain: Two-letter abbreviation (AC, IA, SI, etc.)
• Level: L1, L2, or L3
• NIST ID: Corresponding NIST 800-171 control number

Examples:

• AC.L1-3.1.1 - Access Control, Level 1, NIST 3.1.1
• IA.L2-3.5.7 - Identification & Authentication, Level 2, NIST 3.5.7 (MFA)
• AU.L2-3.3.1 - Audit & Accountability, Level 2, NIST 3.3.1 (Audit records)

Check Types

Implementation Check

Validates that the practice is properly implemented:

• Technical controls in place
• Processes documented
• Responsibilities assigned
• Operating effectiveness

Evidence Check

Reviews evidence artifacts for C3PAO assessment:

• Documentation completeness
• Evidence currency (recent)
• Artifact authenticity
• Coverage of practice requirements

Gap Analysis

Identifies deficiencies in current state:

• Missing controls
• Partial implementations
• Documentation gaps
• Remediation priorities

Common Practices

Access Control

• AC.L1-3.1.1: Limit system access to authorized users, processes, devices
• AC.L1-3.1.2: Limit system access to types of transactions/functions
• AC.L2-3.1.20: Verify and control external network connections

Identification & Authentication

• IA.L1-3.5.1: Identify information system users
• IA.L1-3.5.2: Authenticate (or verify) identities
• IA.L2-3.5.7: MFA for network access to privileged accounts
• IA.L2-3.5.8: MFA for network access to non-privileged accounts
• IA.L2-3.5.10: Store and transmit only cryptographically-protected passwords

Incident Response

• IR.L2-3.6.1: Establish incident handling capability
• IR.L2-3.6.2: Track, document, and report incidents

System Integrity

• SI.L1-3.14.1: Identify, report, and correct information system flaws
• SI.L1-3.14.2: Provide protection from malicious code
• SI.L2-3.14.4: Update malicious code protection mechanisms

Output

1. Practice Definition: What the practice requires
2. Implementation Guidance: How to satisfy the practice
3. Evidence Examples: What artifacts to provide
   • Policies and procedures
   • Screenshots/configurations
   • Logs and reports
   • Test results
4. Common Deficiencies: What C3PAOs flag
5. Pass/Fail Criteria: Assessment thresholds
6. Remediation Steps: If gaps identified

Examples

# Check MFA implementation for Level 2
/cmmc:practice-check IA.L2-3.5.7 implementation

# Review evidence for access control
/cmmc:practice-check AC.L1-3.1.1 evidence

# Gap analysis for incident response
/cmmc:practice-check IR.L2-3.6.1 gaps

# Verify audit logging implementation
/cmmc:practice-check AU.L2-3.3.1