Everything you get with a KCD license and how each component helps you pass your CMMC assessment

---

Defense contractors preparing for CMMC often face the same overwhelming question. Where do I even start with all this documentation?

You know you need policies. You know you need a System Security Plan. You know you need to prove you’re actually doing what you say you’re doing. But staring at blank templates or trying to interpret vague government guidance can paralyze even the most capable IT teams.

The Kieri Compliance Documentation was built to solve exactly this problem. Rather than giving you empty forms and hoping you figure it out, the KCD provides fully written templates based on what actually passes CMMC assessments.

Watch the Full KCD Demo

<iframe width=”560″ height=”315″ src=”https://www.youtube.com/embed/YOUR_VIDEO_ID” title=”Kieri Compliance Documentation Demo” frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture” allowfullscreen></iframe>

In this walkthrough, Amira Armond and Jill Wright take you through every major component of the KCD, showing real examples and explaining why each piece matters for your assessment.

---

How the KCD Works Differently From Other Documentation Packages

Most compliance documentation packages hand you blank templates and wish you luck. You get empty tables, vague section headers, and maybe a few bullet points about what should go where.

The KCD takes a completely different approach built on three principles.

Behavior Stacking links compliance tasks to scheduled activities. Your IT department only needs to remember to start a weekly maintenance task, and the rest follows with just-in-time procedures and reminders. You build compliance into your existing routines rather than creating an entirely separate workload.

No Blanks means every template comes fully written with reasonable best practices. You’re not staring at empty forms trying to figure out what a compliant response looks like. You have working examples you can customize rather than creating from scratch.

Battle Tested means these documents are based on what Kieri Solutions actually used to pass their own CMMC Level 2 assessment by DIBCAC. This isn’t theoretical guidance. It’s proven documentation that has survived real government scrutiny.

When you purchase a license, you get a 12-month subscription to download the most current versions. If CMMC requirements change or a new version releases, Kieri updates all the documents and you can download the new versions. A version control document tracks exactly what changed between updates so you can decide whether to pull in new sections or keep your customized versions.

The Databases That Build Your Evidence Library

One thing the KCD does differently from virtually every other documentation package is its intense focus on record keeping and generating proof that you’re actually performing required activities.

If you’re going to maintain books of records, you need a bookshelf. That’s what these databases provide.

The KCD includes database templates for tracking accounts, software inventory, hardware assets, incidents, and other critical compliance data. Each database identifies the specific information CMMC requires you to capture in that area.

You can implement these in SharePoint, create an Access database, or simply use the Excel spreadsheets themselves if you’re not technical. The key is capturing the right information, not using a specific technology.

Why You Need a Separate Account Management Database

One question that comes up constantly is why you can’t just export accounts from Active Directory instead of maintaining a separate database.

Here’s the problem. Active Directory shows you what accounts exist. It doesn’t show you that those accounts should exist.

A separate account management database demonstrates that you’re actively authorizing accounts that should be there. It proves you’re managing permissions intentionally. And it lets you track requirements that Active Directory simply cannot capture.

For example, your account database can show that each user completed required training before receiving access. It can track when background screenings were completed. It can flag when annual training renewals expire so you know which users need to recertify.

There’s another reason assessors want to see a separate list. When attackers break into a network, one of the first things they do is create their own accounts. If your only record of authorized accounts is Active Directory itself, you have no way to verify whether every account in there should actually exist. A separate authorization list lets you reconcile and catch unauthorized accounts.

Understanding the Visual Cues

Throughout all KCD documents, you’ll see consistent formatting that tells you what to do.

Yellow highlighted text indicates instructions. Read it, take whatever action is needed, then delete the instruction from your final document.

Light gray text shows examples. These demonstrate what real entries should look like, but you’ll replace them with information specific to your environment.

Bold text in angle brackets indicates variables you must customize. Things like your company name, specific job titles, or the name of your background check service. Even if you accept everything else exactly as written, you need to update these variables.

Policies That Actually Tell You What to Do

The KCD includes policies ranging from about two pages to eight pages, depending on the subject matter. These aren’t high-level statements of intent. They’re prescriptive documents that tell you specifically what to do.

Most policy templates you’ll find elsewhere say things like “the organization shall implement access controls.” That’s useless. It doesn’t tell you how to implement access controls or what “implementing” actually means for your environment.

KCD policies say things like “disable inactive accounts after 30 days” or “review access permissions quarterly.” You get specific timeframes and specific actions. If you’re not sure what’s reasonable, you can accept these numbers as safe defaults. If your situation requires something different, you know exactly what to customize.

Each policy follows a consistent structure. Purpose and scope at the beginning. Specific policy items with explanations in the middle. Related documents, roles and responsibilities, and signature blocks at the end.

That signature block matters more than you might think. Assessors want to see that leadership has formally committed to following the policy. A signed policy demonstrates organizational buy-in, not just IT department aspirations.

The Importance of Revision History

One detail that trips up many organizations is the revision history section at the end of each policy.

Assessors are trained that if a policy hasn’t been reviewed in more than a year, they almost have to reject it. A policy dated 2012 tells an assessor that nobody is actually paying attention to whether the organization follows it.

Keep your revision history current. Even if nothing changed, document that you reviewed the policy and confirmed it still applies. This small detail prevents a surprisingly common assessment failure.

User Agreements That Train While They Protect

The KCD includes standard user agreements that most IT departments already have in some form. Complex password requirements. Prohibitions on sharing credentials. Acknowledgment that activity may be monitored. Standard corporate IT stuff.

But the package also includes something unique. A Protection of Sensitive Information Agreement specifically designed for organizations handling Federal Contract Information and Controlled Unclassified Information.

This agreement serves double duty as both a binding commitment and a training document.

It defines what FCI and CUI actually look like in your specific environment. Not abstract government definitions, but concrete examples. Airplane schematics. Missile booster diagrams. Whatever CUI looks like for your particular contracts.

It explains labeling requirements so users know how to mark documents correctly. It specifies exactly how users should share CUI in your environment, whether that’s a particular secure file share or a specific approved method. It covers what users should and shouldn’t do with portable media.

This last point is critically important. If you don’t tell people exactly how to handle CUI correctly, they’ll come up with their own methods. Those methods probably won’t be secure. Give users a clear, approved path and they’ll follow it.

The Protection of Sensitive Information Agreement provides evidence for roughly 20 different assessment objectives. Users have been trained on proper transmission channels. They understand portable media restrictions. They know how to identify and handle CUI. One signed document demonstrates compliance across multiple requirements.

Administrative Processes Your Team Actually Follows

Every IT department knows how to do their job. They add new users. They provision equipment. They handle terminations. They manage system changes.

But has anyone written down how these processes work? Can you prove you’re doing them consistently?

The Administrative Processes document captures all those daily IT activities that everyone knows how to do but nobody documented. New user onboarding. Equipment provisioning. Account termination procedures. Each process is written out step by step.

Understanding the CIO and CISO Roles

Throughout the KCD, you’ll see references to two key roles. The CIO and the CISO.

The way Kieri defines these roles for small organizations might differ from how large enterprises use the titles.

The CIO in KCD terms is your main IT person. The one responsible for keeping systems functional and users productive. They’re working in the environment every day, handling tickets, managing changes, keeping things running.

The CISO is more of a part-time oversight role. They’re not necessarily working on the system daily. Instead, they review changes to make sure security isn’t compromised. They check that privileged users are operating within their authorized scope. They perform audit log reviews.

This separation demonstrates one of the harder CMMC requirements. Separation of duties. You need multiple people involved in security oversight, not just one person checking their own work.

Your actual titles might be IT Manager and Virtual CISO. Or IT Lead and Security Officer. Or IT Administrator and Company President. The titles don’t matter. What matters is that responsibilities are clearly assigned and separated appropriately.

The Cybersecurity Maintenance Checklist That Keeps You Compliant

Here’s where the KCD really separates itself from other documentation packages.

Most templates tell you what you need to do. The Cybersecurity Maintenance Checklist tells you when to do it and provides detailed procedures for how to do it.

The checklist organizes all ongoing compliance activities by frequency. Weekly tasks address the highest-risk, most likely to fail items. Monthly tasks handle important but less urgent activities. Quarterly, biannual, and annual tasks round out the schedule.

Weekly Tasks

Weekly tasks focus on things that can go wrong quickly and cause serious damage.

New vulnerabilities get discovered constantly. Attackers develop new techniques. Your weekly checks ensure you’re not blind to emerging threats.

You verify audit logs are still capturing properly. You check for unauthorized devices on your network. You confirm your security tools are functioning. These take about 30 minutes per week for a small company.

Monthly Tasks

The first week of each month, you complete weekly tasks plus monthly tasks. This takes about three hours for a small organization.

A big chunk of that time goes to the Change Approval Board meeting, which we’ll cover next. But monthly tasks also include reviews and checks that don’t need weekly attention but shouldn’t wait an entire quarter.

Quarterly, Biannual, and Annual Tasks

As you move to less frequent tasks, the time investment increases but so does the interval between efforts.

Quarterly tasks add about three more hours when they come due. Biannual tasks are more intensive. Annual tasks, which include everything from the less frequent intervals, typically take one to two weeks to complete thoroughly.

That sounds like a lot, and it is. That’s CMMC. But at least you know exactly what needs to happen and when, rather than discovering gaps during your assessment.

Building Your Evidence Treasury

Here’s the critical piece. You create a new copy of the checklist each week. Date the filename. Complete that week’s tasks. Save it.

Over a year, you accumulate 52 completed checklists. When an assessor asks whether you’re performing a particular practice, you pull up the relevant checklist from January or July or whenever that task was due. You show them your notes, your results, your evidence of completion.

This transforms “we do that” into “here’s proof we did it on this date, and this date, and this date.” Assessors love seeing mature, consistent processes with documented history.

The CAB Meeting That Proves Oversight

The Change Approval Board Meeting Notes template serves multiple purposes beyond just change management.

You create a new copy each month, typically at the same time you’re completing monthly maintenance tasks. This meeting brings together your CIO role and your CISO role to demonstrate that separation of duties exists and functions.

Section One Covers Escalation Items

The meeting starts by reviewing ongoing compliance problems. Do you have a system that’s out of compliance? Have you had that conversation and tracked progress toward resolution?

Do you have vulnerabilities that haven’t been patched according to policy? Not routine new vulnerabilities that you handle normally, but exceptions that require discussion and potentially drastic measures like taking systems offline.

These items stay on the agenda every month until they’re resolved. You can’t just forget about compliance gaps.

Section Two Handles Change Management

Traditional change management questions live in section two. What changes are proposed? What are the security impacts? Were changes approved or rejected? What changes completed since last meeting and are there any leftover activities?

This documents that changes go through proper review rather than just happening ad hoc.

Section Three Provides Privileged User Oversight

CMMC requires oversight of your privileged users to ensure they’re not going rogue. Section three addresses this directly.

Have you added new IT staff? Why? Is that appropriate given their role?

Your security officer reviews audit logs and incident reports to verify privileged users are doing what they’re supposed to do, following proper procedures, staying within their authorized scope.

Section Four Runs a Quarterly Mini Assessment

One of the most misunderstood CMMC requirements involves ongoing security control monitoring. You’re supposed to continuously assess whether your controls are working.

The KCD simplifies this by identifying specific requirements that are most likely to fail and building them into a quarterly review during your CAB meeting.

You don’t assess every control quarterly. That would be overwhelming. You focus on the controls that tend to drift or degrade and verify they’re still functioning.

One important note from the assessors. You do the actual testing before the meeting, not during it. Come to the CAB with results ready to discuss. Talk about what needs improvement. You don’t need to rehash everything that’s working fine.

The FIPS Document That Makes Assessors Happy

The requirement for FIPS 140-2 validated cryptography causes more pain than almost any other CMMC practice. Not because the technical implementation is hard, but because proving you’re using validated encryption modules is incredibly confusing.

The KCD includes a 13-page FIPS Validation Strategy and Risk Assessment document specifically for Windows 10 and Microsoft 365 environments. It also covers encryption for Outlook on iPhones and Android devices.

This document explains what you need to discuss, how to discuss it, and what evidence you need to provide. It includes tables showing where CUI is stored and how it’s protected. It provides direct links to the NIST certificates proving the modules you’re using are actually FIPS validated.

If you’re using the covered technologies, your work is essentially done. If you’re using something different, you at least have a clear template showing exactly what information you need to document.

When Kieri Solutions went through their own CMMC assessment by DIBCAC, the government assessors said this FIPS document was the best documentation on the subject they had ever seen from any company. That includes major defense contractors with far more resources.

The System Security Plan That Assessors Actually Want to See

The System Security Plan is the centerpiece of your CMMC documentation. Without a good SSP, you won’t make it past readiness review or scoping, let alone through an actual assessment.

The KCD System Security Plan runs about 177 pages. That sounds intimidating, but most of that length comes from pre-filled content that you customize rather than create from scratch.

Why Most SSPs Fail

When organizations come to Kieri seeking CMMC certification, they often show up with what they think is a completed SSP. It might be a 10-page Excel spreadsheet with one or two sentences per practice.

The response for a requirement might just say “we do this.” That’s not assessable. An assessor can’t verify anything from a statement that vague. They don’t know what you’re actually doing, where you’re doing it, or how they would test it.

The KCD SSP forces specificity. For each of the 320 assessment objectives in CMMC Level 2, you address exactly what that objective requires.

How the SSP Addresses Each Requirement

For every CMMC practice, the SSP includes the practice ID, the practice statement, and checkboxes for implementation status. Standard stuff that every SSP template includes.

But the KCD goes much further.

Cross-mappings to other frameworks like NIST 800-53 help you connect CMMC requirements to FedRAMP cloud audit reports. If your cloud provider is FedRAMP authorized, you can map between their security controls and your CMMC requirements.

Recommended responsible parties suggest whether the CIO or CISO should own each practice. For small organizations where everyone wears multiple hats, this guidance prevents confusion about who handles what.

The assessment objectives for each practice appear right where you’re addressing them. This matters more than you might realize.

CMMC Level 2 has 320 assessment objectives. After three straight days of updating your SSP, by the time you reach the end, you will miss something if you’re not looking at the objectives directly. Missing even one or two assessment objectives for critical practices can cause you to fail your assessment outright. Having the objectives right there prevents that mistake.

Pre-Written Responses That Actually Apply

Where KCD templates address a practice, the SSP includes that reference and tags which assessment objectives the document handles.

An assessor can read that section 4.1 of the Access Management Policy addresses assessment objective (a) for a particular practice. They know exactly where to look to verify your implementation. They don’t have to hunt through a document library trying to figure out where you addressed each requirement.

More than 240 of the 320 assessment objectives are addressed at least partially through KCD templates. In many cases, using the template means you’ve already met the requirement. The policy exists. The procedure is documented. The database captures the required information. You just need to confirm you’re following what’s written.

For technical requirements that vary by environment, the SSP provides example text showing what a response should look like. You customize to fit your specific systems, but you’re not starting from nothing.

Appendices That Support Your Assessment

The SSP includes appendices for information referenced across multiple practices or too detailed to include inline.

Appendix B supports a mature self-assessment program with example tests for procedure-based and policy-based assessment objectives. Before your official assessment, you can use these same tests to verify you’re ready. Better to discover gaps yourself than have an assessor find them.

Assessors often adopt whatever testing approach you’ve documented rather than creating their own. If your self-assessment tests are thorough and well-structured, the assessor knows what results to expect. This consistency benefits everyone.

One Important Limitation

If you purchase the KCD, Kieri Solutions cannot perform your official CMMC assessment.

The KCD constitutes consulting. Kieri is providing substantial assistance with your compliance program. Assessment organizations cannot both consult and formally assess the same client. That would create an obvious conflict of interest.

Kieri can help with customization. They can perform informal readiness assessments to check if you’re prepared. They can answer questions and provide guidance. But the official certification assessment must come from a different C3PAO.

This limitation actually demonstrates Kieri’s ethical approach. Many organizations blur the line between consulting and assessment. Kieri maintains clear separation.

Getting Started with the KCD

The Kieri Compliance Documentation provides a complete foundation for CMMC Level 2 compliance. Databases for record keeping. Policies that prescribe specific actions. User agreements that train and protect. Maintenance checklists that keep you compliant over time. Meeting templates that demonstrate oversight. A System Security Plan that assessors actually want to review.

Ready to see more? Download the KCD brochure at kieri.com/kcd for complete details on what’s included.

Want to discuss your situation? Schedule a consultation at kieri.com to talk with Certified CMMC Assessors about whether the KCD fits your compliance needs.

---

Kieri Solutions is one of 54 authorized C3PAOs in the United States. The Kieri Compliance Documentation is based on the policies, procedures, and implementations Kieri used to pass their own CMMC Level 2 assessment by DIBCAC.