A detailed walkthrough showing how technology-agnostic policies combine with Microsoft 365 GCC-High implementation for complete CMMC Level 2 compliance

CMMC compliance documentation and reference architecture are two distinct components of Level 2 compliance. Manual processes and technical configurations.

Most compliance solutions address one or the other. Documentation packages give you policies and procedures but leave technology implementation to you. Technical solutions configure systems but assume you’ll figure out the paperwork yourself.

The Kieri Compliance Documentation and Kieri Reference Architecture were designed as one package split into two pieces. They integrate at every requirement level.

This article walks through a single CMMC requirement to show exactly how that integration works.

The Split Between Manual and Technical Compliance

CMMC Level 2 has 320 assessment objectives across 110 security requirements. When you break down what those objectives actually require, a pattern emerges.

The majority are manual processes. How you authorize users. How you track changes. How you review access. How you train employees. How you document procedures.

The KCD addresses over 240 of those 320 assessment objectives. Policies, procedures, user agreements, databases, maintenance checklists. All the people-powered compliance work that applies regardless of what technology you use.

The remaining objectives are technology-specific. How your systems enforce password requirements. How your antivirus scans for threats. How your logging captures events. How your configurations restrict access.

The KRA addresses those technology objectives for a specific platform: Microsoft 365 GCC-High with Windows 10 or 11 computers.

Why Keep Them Separate

Not every organization needs the KRA.

Some companies already have established technology platforms. They’re using AWS. They have existing Azure configurations. They’ve invested in different security tools.

Those organizations still benefit from the KCD. The manual processes remain the same regardless of technology. Policies work universally. Procedures translate across platforms. The compliance workload is mostly people-powered anyway.

The KRA serves organizations wanting a proven architecture. Those who don’t want to figure out technology implementation themselves. Those who want explicit instructions based on a system that actually passed assessment.

By splitting the package, companies choose what they need. KCD for everyone. KRA for those wanting Microsoft 365 GCC-High implementation.

Mobile Code – One Requirement, Full Integration

To demonstrate how the KCD and KRA integrate, let’s walk through the mobile code requirement. It’s one of the most misunderstood CMMC requirements, making it a good example.

What Mobile Code Actually Means

Mobile code isn’t about cell phones. It’s computer code that executes inside a different application.

Office macros. Browser scripts. PowerShell scripts. PDF reader plugins. Any code that runs within the context of a trusted application.

CMMC requires you to control and monitor mobile code. That sounds simple until you try to implement it.

The KCD Approach – Manual Processes

The KCD System Security Plan starts with explanation. What mobile code means. Why it matters. How most companies approach it.

Then it provides recommended implementation language. Not blank templates. Actual statements describing how a compliant organization handles mobile code.

Software inventory tracking. The KCD says you’ll maintain a database listing what mobile code is authorized. Google Chrome authorized to run JavaScript and PDF mobile code. Microsoft Office authorized for specific macro scenarios. Everything documented.

Policy requirements. The KCD includes policies requiring identification of authorized mobile code, restrictions on unauthorized types, and antivirus configuration for mobile code control.

Database definitions. The KCD provides the structure for tracking authorized software, including mobile code authorizations. Real examples showing what documentation looks like.

This covers the manual compliance side. You know what mobile code is authorized. You have policies governing it. You maintain records proving authorization decisions.

The KRA Approach – Technical Implementation

The KRA picks up where the KCD leaves off. How do you actually configure systems to control and monitor mobile code?

Configuration instructions. The KRA includes about 350 tasks for building your Microsoft 365 tenant. Mobile code appears in antivirus policies and attack surface reduction rules.

Granular settings. The Microsoft secure configuration baselines document contains over 1,000 settings. Each setting includes the recommended configuration, the source of that recommendation (Microsoft, government guidelines, Kieri testing), and notes about functionality impact.

Specific policies created:

• Antivirus policy evaluating mobile code and blocking malicious execution
• Attack surface reduction blocking JavaScript and VBScript from launching executables
• Settings preventing Adobe Reader from creating child processes
• Browser script scanning configurations

Monitoring procedures. The KRA audit log procedure includes queries for mobile code monitoring. One query pulls all PowerShell scripts executed recently. Another shows processes started by web browsers. Copy-paste into Microsoft Defender for Endpoint and run.

Combined System Security Plan

When you merge the KCD and KRA content, your System Security Plan covers everything assessors need to see.

The non-technical portions from the KCD explain your policies, procedures, and authorization processes. You maintain a software inventory. You authorize mobile code technologies. You have policies governing mobile code use.

The technical portions from the KRA describe exact implementation. Mobile code is controlled with Defender and SmartScreen. Specific policies enforce restrictions. Browser scripts are scanned. Certain dangerous combinations are blocked. Monitoring uses Microsoft Defender for Endpoint with specific queries.

Assessors see both the manual compliance work and the technical implementation. Everything connects.

The Configuration Baselines Document

One of the most valuable components of the KRA is the Microsoft secure configuration baselines spreadsheet.

Over 1,000 settings across multiple tabs. Antivirus. Attack surface reduction. Device restrictions. Endpoint protection. Each setting documented with:

Recommended value. What the setting should be configured to.

Source. Where the recommendation comes from. Microsoft baseline. SCUBA secure technical guide. Kieri testing and least privilege analysis.

Notes. Explanation of why that value was chosen. If the recommended setting causes functionality problems, what alternative to use and why.

This document serves multiple purposes during assessment.

It proves you’re following secure configuration baselines. Assessors see you’re applying industry-standard or government-recommended settings.

It demonstrates least privilege review. Every setting was evaluated for whether it could be made more restrictive without breaking functionality.

It provides your baseline documentation. When assessors ask what your standard configuration looks like, you have 1,000+ settings documented.

Functionality Testing Built In

The KRA includes 30-40 functionality tests designed for acceptance testing.

Can you send email and have it arrive? Does FIPS mode show enabled in the registry? Do security policies apply correctly? Can users access what they need while being blocked from what they shouldn’t?

If you build the environment yourself, run every test before deploying to production. If Kieri builds it for you, they run these tests before handover.

This acceptance testing approach catches problems before they affect users. It also generates evidence showing your environment works as designed.

The Maintenance Reality

Kieri has operated on the KRA for over three years. Their maintenance reality:

One part-time system administrator. One extremely part-time virtual CISO (one meeting per month).

That’s the staffing required to keep the environment compliant and functional.

This matters because CMMC compliance isn’t a one-time achievement. You need to maintain it. If maintenance requires dedicated full-time staff, many small contractors can’t sustain it.

The KRA was designed for the staffing reality of small organizations.

Who Benefits from Each Product

KCD Only

Any company pursuing CMMC Level 2, regardless of technology platform.

Fortune 500 companies using the KCD appreciate the manual process documentation even when they have their own technology implementations. Small contractors with existing IT infrastructure use the KCD to build their compliance program around current systems.

The KCD works universally because manual compliance processes are technology-agnostic.

KCD Plus KRA

Organizations wanting complete implementation on Microsoft 365 GCC-High.

Those who don’t want to figure out technology configurations themselves. Those who want proven architecture based on a system that passed DIBCAC assessment. Those who prefer real laptops over virtual desktop solutions.

The combination provides everything needed for CMMC Level 2. Documentation plus technology. Manual processes plus technical controls. Policies plus configurations.

Getting Started

Evaluate which products fit your situation.

Already have technology platforms? Start with the KCD. Apply the manual compliance processes to your existing systems.

Need proven architecture? Consider the KCD plus KRA combination. Get both the documentation and the technical blueprint.

Want to see details? Download the KCD brochure at kieri.com/kcd and the KRA datasheet at kieri.com/kra.

Have questions? Schedule a consultation to discuss whether the KCD fits your compliance needs: kieri.com/schedule-consultation

The KCD and KRA exist because Kieri needed them first. They built the documentation. They designed the architecture. They passed assessment with both. Now they share the complete package with defense contractors facing the same compliance challenge.

Kieri Solutions is one of 54 authorized C3PAOs in the United States. Both the KCD and KRA are based on what we used to pass our own CMMC Level 2 assessment with DIBCAC. Over 100 companies use the KCD, including Fortune 100 and Fortune 500 organizations.

Ready for Assessment? Visit kieri.com/assess to learn about CMMC Level 2 certification services.