Templates
NIST SP 800-171 Revision 2 & CMMC Related Templates
The following templates are provided free, pro bono, no guarantees, and with no support to the Defense Industrial Base (DIB) to support their NIST SP 800-171 implementation, documentation, and preparation activities for a Cybersecurity Maturity Model Certification (CMMC) Conformity Assessment event.
Video Support | System Security Plan (SSP)
When using the NIST SP 800-171 based free SSP templates below, we really recommend you watch the related As the CMMC Churns videos:
As the CMMC Churns | Your SSP Sucks, Seriously.: This Churns video explains how you use our SSP templates
As the CMMC Churns | The Three Types of Evidentiary Objects: This Churns video looks at the three main types of Examination Assess Objects enumerated in NIST SP 800-171A. This video also expounds on part of how to write an effective SSP.
As the CMMC Churns | Assessors and Toddlers: This explains the Document Traceability Matrix
As the CMMC Churns | Documenting Your Scope: How to create a scope diagram for your SSP
Policies and Plans
NIST SP 800-171/CMMC System Security Plan (SSP) Template
This free SSP Template is dependent upon using the Document Traceability Matrix (DTM) for mapping requirements to policies, plans, procedures, et al.
NIST SP 800-171/CMMC System Security Plan (SSP) without DTM Template
This SSP Template is not dependent upon using the Document Traceability Matrix (DTM) for mapping requirements to policies, plans, procedures, et al. It uses a table after each requirement to show traceability.
Document Traceability Matrix (DTM) Template
This is the Document Traceability Matrix (DTM) used for mapping requirements to policies, plans, procedures, et al in an external document.
Scope Diagram Template
This is the Scope Diagram template that is used in the free SSP templates. This is useful to illustrate your NIST SP 800-171 and CMMC Scoping boundaries internally or to an assessor.
System Design Parameters Plan for NIST SP 800-171 Rev 3 – 2026 template
The System Design Parameters Plan template provides organizations with a powerful, streamlined path to achieving and maintaining compliance with NIST SP 800‑171 Rev. 3. By defining every Organizationally Defined Parameter (ODP) in a single authoritative source, the template eliminates ambiguity, accelerates implementation, and ensures consistent security practices across the entire enterprise.
System Design Parameters Plan for NIST SP 800-171 Rev 2 – 2025 template
System Design Parameters Plan provides organizations with a clear, authoritative framework for implementing and sustaining every Organization‑Defined Parameter (ODP) required under NIST SP 800‑171 Rev. 2. By consolidating all explicit and implicit ODPs into a single, centralized and annually reviewed source, the plan eliminates ambiguity, strengthens compliance, and ensures consistent security practices across the enterprise.
Forms
Certificate of Storage Drive/Media Sanitization Form
This “Certificate of Storage Drive-Media Sanitization Form” is an Adobe Acrobat fillable form based on the NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization (https://csrc.nist.gov/pubs/sp/800/88/r1/final) sample “Certificate of Sanitization” from Appendix G.
Supporting Artifacts
CMMC Metrics for the C-Suite
These PowerPoint slides help you to communicate critical information which using the ProSci ADKAR model help to reinforce CMMC key areas to your C-suite while they help to transform your organization’s culture.
Customer Responsibility Matrix
This Customer Responsibility Matrix (CRM) is used to document the shared services responsibilities between an organization and their providers. Providers could be the parent company, cloud services, provider, MSPs, et al.
Other Artifacts
NIST SP 800-171 Rev2 DoD Assessment Methodology Scoring Template
This is an Excel template we use for all of our client to help complete their DoD Assessment Methodology (DoDAM) scoring of their NIST SP 800-171 Rev 2 implementation for entry into the Supplier Performance Risk Management System (SPRS).
DoDAM specific guidance is available at NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf (osd.mil).