Documentation That Passes CMMC Assessment

Yes. The KCD is designed for small and medium organizations regardless of your technology stack. The policies, procedures, and System Security Plan are written around NIST SP 800-171 requirements, not a specific platform. You’ll customize the technical implementation sections to match your environment. If you do use Microsoft 365 GCC High, we also offer the Kieri Reference Architecture as a companion solution.

Yes. We’re already incorporating NIST SP 800-171 Rev. 3 changes into the KCD. Your license includes 12 months of updates, so you’ll receive the Rev. 3 documentation as it becomes available. The KCD will support both Rev. 2 and Rev. 3.

No. We consider the sale of compliance documentation to be consulting, which means we cannot also serve as your C3PAO for a formal assessment. We maintain strict separation between these services. However, we can connect you with qualified C3PAOs that have strong track records. This is a standard ethical practice, not a limitation.

Most organizations can customize the KCD within a few weeks when working through it consistently. If you add our 25-hour customization package, a certified assessor walks through every document line-by-line with you, explaining the requirements and tailoring the language to your operations. By the end, you’ll have customized documentation and a clear picture of what’s left to implement.

We offer a customization engagement where a certified CMMC assessor works through each document with you. They’ll explain why each policy says what it does, review whether your current practices meet the requirement, and add any gaps to your Plan of Action. It’s like getting an informal gap analysis and documentation customization at the same time. Most clients complete this in 25 hours of sessions.