// ToolkitCMMC.jsx — Verigo Global: CMMC 2.0 implementation toolkit page const { V: TV, MAXW: TMW, FONT: TFT } = window; /* ── BREADCRUMB ──────────────────────────────────────────── */ const CkCrumb = ({ onNav }) => (
/ / CMMC 2.0 Toolkit
); const ckCrumbBtn = { background: 'none', border: 'none', cursor: 'pointer', color: '#7A7A8A', fontSize: 13, fontWeight: 600, padding: 0, fontFamily: "'DM Sans', system-ui, sans-serif" }; /* ── HERO ────────────────────────────────────────────────── */ const CkHero = ({ onNav }) => (
US DoD Mandate CMMC 2.0 · NIST SP 800-171

The CMMC 2.0 toolkit, ready to deploy.

A complete, practitioner-maintained document set — 18 policies, 16 procedures, and all 110 NIST SP 800-171 practice templates, plus SSP and POA&M — tailored to your scope so you build a certifiable environment without starting from a blank page.

Level 2 third-party assessments are required from November 2026 — readiness now is a competitive edge.
onNav('evaluation')}>Start the readiness evaluation document.getElementById('downloads')?.scrollIntoView({ behavior: 'smooth', block: 'start' })}>See what's inside
Inside the toolkit
{[['doc', '18', 'Approval-ready policies'], ['file', '16', 'Operational procedures'], ['layers', '110', 'NIST 800-171 practice templates'], ['clipboard', '140+', 'Documents, SSP, POA&M & checklists']].map(([ic, n, l], i) => (
{n}
{l}
))}
); /* ── OVERVIEW ────────────────────────────────────────────── */ const CkOverview = () => (
Overview

Everything the assessor checks — pre-built and tailored.

The Verigo CMMC 2.0 toolkit is the document backbone of a certifiable environment for Federal Contract Information and Controlled Unclassified Information. It pairs the policies and procedures with implementation templates for every one of the 110 NIST SP 800-171 practices.

Each artefact is maintained by senior practitioners and tailored to your scope and level — then embedded into how you operate, the Compliance by Design way, so the evidence a C3PAO assessment needs is produced by the process itself.

{[ ['compass', 'Tailored to your scope', 'Every policy and practice is shaped to your CUI enclave, systems, and existing tooling — not a one-size-fits-all template dump.'], ['clipboard', 'SSP & POA&M ready', 'Ships with System Security Plan and Plan of Action & Milestones templates — the two artefacts every assessment turns on.'], ['network', 'Cross-framework ready', 'Practices are mapped so the same evidence supports ISO 27001, SOC 2, and the NIST CSF without duplication.'], ].map(([ic, t, d], i) => (

{t}

{d}

))}
); /* ── COVERAGE ────────────────────────────────────────────── */ const CkCoverage = () => (
Three certification levels
{window.TK_CMMC.LEVELS.map((lv, i) => { const pop = !!lv.popular; return (
{lv.name.split(' — ')[0]} {pop && Most common}
{lv.practices} practices
{lv.name.split(' — ')[1]}
{lv.scope}
{lv.assess}
); })}
14 NIST SP 800-171 domains · 110 practices (Level 2)
{window.TK_CMMC.DOMAINS.map((g, i) => (
{g.code}
{g.l2} practices
))}
); /* ── CONTENTS EXPLORER + GATED DOWNLOADS ─────────────────── */ const CkContents = ({ onDownload, unlocked }) => { const [tab, setTab] = React.useState('policies'); const A = window.TK_CMMC.ASSETS; const tabs = [['policies', 'Policies', A.policies.count], ['procedures', 'Procedures', A.procedures.count], ['controls', 'Practice Templates', A.controls.count]]; const meta = A[tab]; const renderList = () => { if (tab === 'controls') { return (
{window.TK_CMMC.DOMAINS.map((g, gi) => (
{g.code} · {g.domain} {g.items.length} practices
{g.items.map(([code, title], i) => (
{code} {title}
))}
))}
); } const list = tab === 'policies' ? window.TK_CMMC.POLICIES : window.TK_CMMC.PROCEDURES; return (
{list.map(([t, d], i) => (
{String(i + 1).padStart(2, '0')}
{t}
{d}
))}
); }; return (
{tabs.map(([id, label, count]) => ( ))}
{meta.label}
{meta.blurb}
onDownload(tab)} style={{ flexShrink: 0 }}> {unlocked ? `Download PDF · ${meta.count} ${meta.unit}` : `Download PDF (${meta.count} ${meta.unit})`}
{renderList()}
); }; /* ── SAMPLE DOCUMENTS VIEWER ─────────────────────────────── */ const CkSamples = ({ onDownloadSample }) => { const [s, setS] = React.useState('policy'); const tabs = [['policy', 'Policy', 'doc'], ['procedure', 'Procedure', 'file'], ['control', 'Practice template', 'layers'], ['checklist', 'Checklist', 'clipboard']]; return (
{tabs.map(([id, label, icon]) => ( ))}
Want the full sample?

Preview the complete package index as a branded PDF — we'll ask for a few details first.

Preview / download sample PDF

Samples are illustrative. Delivered documents are tailored to your organization and branding.

 ); }; const CkDocHeader = ({ docId, title, ver = '2.1', owner }) => (
{docId}

{title}

{[['Classification', 'CUI'], ['Version', ver], ['Owner', owner], ['Framework', 'CMMC 2.0 · 800-171']].map(([k, v], i) => (
{k}
{v}
))}
); const CkDocSection = ({ n, h, children }) => (
{n}{h}
{children}
); const CkSamplePaper = ({ kind }) => { if (kind === 'policy') return (
This policy establishes the requirements for limiting access to systems that store, process, or transmit FCI and CUI, on a least-privilege basis, in support of NIST SP 800-171 practices 3.1.1–3.1.5. Applies to all users, processes, and devices that access in-scope systems within the assessment boundary and CUI enclave.
  • Access is provisioned through a formal request and approval workflow tied to documented roles.
  • Least privilege and separation of duties are enforced; privileged accounts are restricted and logged.
  • Multifactor authentication is enforced for remote and privileged access (3.5.3).
  • Connections to external systems and CUI on public systems are controlled (3.1.20–3.1.22).
 System owners approve access; IT operations provisions it; the CISO owns this policy and its annual review. Reviewed annually or upon significant change. Next review: 12 months from approval.
); if (kind === 'procedure') return (
Define the repeatable steps to build and maintain the SSP documenting how each of the 110 practices is implemented across the assessment boundary (3.12.4).
2.0Process steps
{[['1', 'Define boundary', 'Identify systems handling FCI/CUI and the assessment scope.'], ['2', 'Map practices', 'Document how each 800-171 practice is met across the boundary.'], ['3', 'Record status', 'Mark each practice met / not met and link supporting evidence.'], ['4', 'Open POA&M', 'Log gaps to the Plan of Action & Milestones with target dates.'], ['5', 'Review & sign', 'Senior owner reviews and approves; SSP versioned and retained.']].map(([n, t, d], i) => (
{n}
{t}
{d}
))}
The SSP, POA&M, and supporting evidence are versioned and retained through the assessment cycle.
); if (kind === 'control') return (
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
{[['Domain', 'IA · Identification & Authentication'], ['Status', 'Met'], ['Control owner', 'Head of IT Security'], ['Assessment', 'Level 2 · C3PAO']].map(([k, v], i) => (
{k}
{v}
))}
MFA is enforced through the identity provider for all remote, privileged, and network access; authenticator types and enrolment are documented in the SSP. IdP MFA policy export, enrolment report, screenshots of enforced prompts, and a sample of authentication logs.
); return (
{[['done', 'Assessment boundary and CUI enclave defined', 'Scope'], ['done', 'System Security Plan (SSP) complete and signed', '3.12.4'], ['done', 'All 110 practices assessed and status recorded', '800-171'], ['progress', 'POA&M open for any not-met practices with dates', '3.12.2'], ['progress', 'MFA enforced for remote & privileged access', '3.5.3'], ['todo', 'FIPS-validated cryptography confirmed for CUI', '3.13.11'], ['todo', 'Incident response plan tested and documented', '3.6.3']].map(([st, t, ref], i) => { const map = { done: [TV.purple, 'check', 'Complete'], progress: [TV.orange, 'refresh', 'In progress'], todo: [TV.g300, 'clipboard', 'Outstanding'] }; const [c, ic, lab] = map[st]; return (
{t}
{ref} {lab}
); })}
); }; /* ── PRICING ──────────────────────────────────────────────── */ const CkPricing = ({ onNav }) => { const TIERS = window.TK_CMMC.TIERS; const baseFmt = window.TK_CMMC.fmtPrice(window.TK_CMMC.QUOTE_BASE.price); return (
{TIERS.map((t,i)=>{ const pop=!!t.popular; return (
{pop&&
Most popular
}
{t.name}

{t.tagline}

{(t.features||[]).slice(0,4).map((f,fi)=>(
{f}
))}
); })}
onNav('checkout')}>Build custom package Starts from {baseFmt} · add only what you need · live pricing
); }; /* ── ONLINE EVALUATION PROMO ─────────────────────────────── */ const CkEvalBand = ({ onNav }) => { const steps = [ ['target', 'Pick your level & scope', 'Choose Level 1, 2, or 3 — your choice tailors the questions to exactly the practices that apply.'], ['gauge', 'Get your readiness score', 'An instant maturity score with a gap heat-map across the in-scope 800-171 domains.'], ['flag', 'See your next steps', 'A prioritized action plan showing which toolkit documents and practices close each gap.'], ]; return (
Online evaluation · level-aware

Know where you stand before the assessor does.

Our online CMMC readiness evaluation scores your current state against the 800-171 practices for your chosen level — and maps every gap straight to the toolkit documents that close it.

onNav('evaluation')}>Start the evaluation onNav('evaluation')}>See how it works
{steps.map(([ic, t, d], i) => (
{String(i + 1).padStart(2, '0')}

{t}

{d}

))}
); }; /* ── PAGE ────────────────────────────────────────────────── */ const ToolkitCMMCPage = ({ onNav }) => { const [modalAsset, setModalAsset] = React.useState(null); const [unlocked, setUnlocked] = React.useState(false); const sessionOk = () => { try { return !!sessionStorage.getItem('verigo_dl_ok'); } catch (e) { return false; } }; React.useEffect(() => { if (sessionOk()) setUnlocked(true); }, []); const onDownload = (asset) => { if (sessionOk()) { window.TK_CMMC.generatePDF(asset, window.TK_CMMC.getUser() || {}); } else { setModalAsset(asset); } }; const onModalSubmit = (form) => { window.TK_CMMC.storeLead(form); try { sessionStorage.setItem('verigo_dl_ok', '1'); } catch (e) {} setUnlocked(true); const asset = modalAsset; setModalAsset(null); setTimeout(() => window.TK_CMMC.generatePDF(asset, form), 60); }; const A = modalAsset ? window.TK_CMMC.ASSETS[modalAsset] : null; return (
onDownload('standard')} /> {A && ( setModalAsset(null)} onSubmit={onModalSubmit} /> )}
); }; Object.assign(window, { ToolkitCMMCPage });