Starter kits for CMMC Level 2 and DCAA

CMMC Level 2 starter kit

For a small contractor that handles Controlled Unclassified Information and is preparing for a CMMC Level 2 self-assessment or a C3PAO assessment.

What is in it

• A system security plan template with one block for each of the 110 NIST SP 800-171 Revision 2 requirements, each listing its 320 NIST SP 800-171A assessment objectives in their own words, and a first section for the boundary, the CUI flows, the 32 CFR 170.19 asset categories, and external service providers.
• Fourteen short policies, one for each requirement family, each ending in an approval block with name, title, signature, and date lines.
• A plan of action and milestones template, with the 32 CFR 170.21 limits on what can sit on one quoted at the top, owners and dates for each item, and the 180-day closeout date worked out from your Conditional status date.
• An evidence checklist of typical examples of proof, labeled as examples. It is not an assessor's checklist.
• A scoring worksheet that adds up an estimate out of 110 using the point values in 32 CFR 170.24. It shows the total, and says Incomplete until every requirement is answered. An SPRS entry sheet lists the fields you will type into SPRS. A scoring dashboard shows the estimate, the status it supports, the rows answered, and a chart of points lost by family.
• A scoping workbook: an asset inventory with the 32 CFR 170.19 categories quoted, an enclave decision, and a log of what is out of scope and why.
• A CUI data flow template, with each flow numbered to match the system security plan.
• A shared responsibility matrix with one tab per provider and all 110 requirements. The provider columns are left blank for you to fill from the provider's own matrix, with questions to ask each provider.
• An incident response plan with the DFARS 252.204-7012 reporting path, an incident report worksheet, and a tabletop exercise with an after-action report.
• An SPRS and affirmation walkthrough: who can enter what, the fields to enter, the 32 CFR 170.22 affirmation, and a record to sign.
• A FIPS cryptography guide: validated versus compliant, how to check the NIST CMVP list, and a cryptography inventory.
• A requirement mapping matrix: for each requirement, the policy section, the plan block, the evidence checklist entry, and whether a gap on it can sit on a Conditional POA&M.
• An evidence tracker: one row per NIST SP 800-171A objective, 320 in all, with the method, the file name, the date, and the result, rolled up to each requirement.
• A Status and currency page listing each rule the kit relies on and the date it was checked, a change log, and a one-page Back office readiness note on where CMMC and DCAA work overlap.
• A worked example for Example Fabrication LLC, a fictional company, with every page marked FICTIONAL EXAMPLE.

How the zip is laid out

• 00 Start here.docx
• 00 Start here.pdf
• 01 Plan
• 02 Policies
• 03 Assess
• 04 Evidence
• 05 Worked example (fictional)
• 06 Reference

Start here comes as a Word document and a PDF, with a plan for your first hour.

What it does not do

The kit does not certify your company or make a requirement met. The worksheet gives an estimate, not your official SPRS score. A C3PAO assessment is a separate event. A filled template still has to match what your system does. On July 13, 2026, the Department of War suspended CMMC Phase 2. Phase 1 self-assessments remain, and the first page of the kit explains what that means for a Level 2 (Self) assessment and for DFARS 252.204-7012.

Requirement text is from NIST SP 800-171 Revision 2. Scoring and plan of action rules are from 32 CFR 170.21 and 170.24. Citations checked October 20, 2026. Kit last updated October 20, 2026.

Price: $199

Buy the CMMC Level 2 kit, $199→

DCAA starter kit

For a small contractor that expects a preaward survey of its accounting system on Standard Form 1408, or wants its books to be able to answer one.

What is in it

• An SF 1408 readiness checklist. Each criterion is in the form's own words, followed by what it asks and what to pull from your files.
• A timekeeping policy covering daily time, corrections, charge codes, and supervisor approval, with a training acknowledgement and a signature page.
• A timesheet with daily entry, a certification, supervisor approval, and a correction log.
• A labor distribution that ties each pay period to payroll and the ledger.
• A job cost ledger by contract that ties to the general ledger each month.
• A chart of accounts split into direct, fringe, overhead, G&A, and unallowable, with a FAR 31.205 reference where one applies and steps to load it into your ledger.
• An indirect rate worksheet with pools, bases, and formulas, actual rates beside your provisional billing rates, a labor rate build, and a year-to-date view by month.
• A short guide to costs that FAR subpart 31.2 treats as unallowable, and how to keep them out of a bill. Each cite is given in both the codified FAR and the Revolutionary FAR Overhaul Part 31 text where they differ.
• A segregation of duties matrix that flags where one person holds two duties and asks for the control that covers it.
• A month-end close checklist to sign off each month.
• An accounting policies and procedures manual to write your procedures in.
• A Status and currency page listing each rule the kit relies on and the date it was checked, a change log, and a one-page Back office readiness note on where DCAA and CMMC work overlap.
• A worked example for Example Fabrication LLC, a fictional company, with every page marked FICTIONAL EXAMPLE.

How the zip is laid out

• 00 Start here.docx
• 00 Start here.pdf
• 01 Plan
• 02 Policies
• 03 Assess
• 04 Records
• 05 Worked example (fictional)
• 06 Reference

Start here comes as a Word document and a PDF, with a plan for your first hour.

What it does not do

DCAA does not approve or certify accounting software, and filling in these templates does not make an accounting system acceptable. A rate in the worksheet is not a billing rate until the contracting officer or the administering agency agrees to it. The kit does not prepare an incurred-cost submission.

SF 1408 criteria are the words on Standard Form 1408, Rev. 1/2014. Cost principles are from FAR subpart 31.2, cited to both the codified FAR and the Revolutionary FAR Overhaul Part 31 text where the paragraph letters differ. Citations checked October 20, 2026. Kit last updated October 20, 2026.

Price: $149

Buy the DCAA kit, $149→

Both kits together

The two kits above in one purchase, with the same files and the same limits.

$299 for both, $49 less than buying the two kits separately.

Buy both kits, $299→

How you get the files

After you pay, the checkout sends you to a download page with a link for each kit you bought. We also email the same links to the address on your receipt. Links work for 7 days.

• The CMMC Level 2 kit is one zip file with 39 files: 29 Word documents (.docx), 9 Excel workbooks (.xlsx), and 1 PDF (.pdf).
• The DCAA kit is one zip file with 24 files: 11 Word documents (.docx), 12 Excel workbooks (.xlsx), and 1 PDF (.pdf).
• The bundle gives you both zip files, 63 files in all.

Each kit is licensed to one company for its own internal use; edit and share the files inside your company, but do not resell or republish them.

What the pages look like

Rendered from the files in the zip with LibreOffice. Word and Excel show the same layout.

What changed in version 1.2

• In the CMMC kit: an evidence tracker with one row per NIST SP 800-171A objective, 320 in all, rolled up to the 110 requirements and to the value you type in the scoring worksheet.
• Every blank is a gray field you click and type over, and what you type is normal text with no shading left behind. Repeated names such as the company fill with one Find and Replace.
• The scoring worksheet says plainly that there is no CMMC status yet when an open POA&M item is not eligible for a Conditional status.
• Each policy has Definitions, Exceptions, Enforcement, and Procedures sections. The system security plan names the policy file for each family and the Affirming Official.
• In the DCAA kit: a funds check at the 75 percent notice point of the limitation of cost and funds clauses, a charge code list on the timesheet, and a sign-off block on the SF 1408 checklist.
• Every Word and Excel file passes the Open XML schema check before it ships, and wide sheets print at a readable size.

Each zip carries the full change log in 06 Reference.