The Evidence Backbone: Your Locker, SSP, POAM, and Risk Register

Most contractors spend all their energy writing policies. Then the assessor asks for evidence — and they're staring at a shared drive full of files nobody can navigate. Policies are only half the toolkit.

When people imagine a CMMC compliance toolkit, they picture documents to write: an Access Control Policy, a set of procedures, maybe a configuration guide or two. That's a fair picture — those documents are real, they're required, and you can't pass without them.

But it's only half the picture. The other half is the part almost nobody plans for: assembling, organizing, and maintaining the evidence that proves those policies are actually running — plus the master documents that tie the whole program together. That half is where DIY efforts quietly fall apart, and it's the half this piece is about.

The Half-the-Job Problem

Writing a policy is a one-time act of composition. You describe how a control is supposed to work, you sign it, you file it. Done. That feels like progress — and it is — which is exactly why it's such a comfortable place to spend all your time.

Evidence is different. Evidence isn't written, it's collected. It accumulates as you operate: screenshots of settings, exported logs, CSV reports, signed reviews, configuration records. An assessor reads your policy, then immediately asks to see the proof it's real. That's the moment the two halves diverge.

The contractor who spent every hour on polished policies now faces a second job they never scoped — and usually discovers it the week before an assessment, when there's no time left to do it well. Files are scattered across a shared drive, named inconsistently, with no way to tell what's current, what's missing, or which practice any given screenshot even belongs to.

The Evidence Locker: Where the Other Half Lives

This is the piece most prospects don't picture — and it's the one that quietly does the heavy lifting. The Evidence Locker isn't file storage. It's a system built around each artifact, so the proof organizes itself as you implement instead of piling up for you to sort out later.

The key shift is when the organizing happens. You upload proof at the moment you complete each item, while you still remember what it is and why it matters. The Locker handles the filing. By the time an assessment rolls around, your evidence isn't a project to start — it's a package to export.

Why Automated Organization Is the Real Value

It's tempting to think evidence organization is a nice-to-have — something you could do yourself with enough folders and discipline. In practice, the manual version is where readiness goes to die.

That difference — between "a shared drive full of files no one can navigate" and "assessment-ready evidence in one export" — isn't cosmetic. It's the difference between a program that looks organized because it is, and one that raises doubts precisely because the proof is impossible to follow. Assessors read organization as a signal of maturity. Disorder reads as risk.

The L2 Master Documents: SSP, POAM, and Risk Register

For Level 2, the toolkit adds a set of master documents that sit above the individual artifacts. These are the documents an assessor opens first — the ones that frame everything else. They're also the ones DIY contractors most often stall on, neglect, or skip entirely.

Together with the dedicated CUI enclave configuration guides for Google Workspace for Government and Microsoft 365 GCC High, these master documents give an L2 self-assessment its spine. The artifacts prove individual controls run; the master documents prove the program is coherent, managed, and alive.

Why DIY Contractors Stumble Here

There's a pattern to how self-assessments come apart, and it almost always traces back to these documents.

• The SSP is daunting. A blank hundred-page template asking you to describe, in assessor-grade language, how 110 practices work in your specific environment is where momentum dies. The document sits at 12% complete for months, and the whole L2 effort stalls behind it.
• The POAM gets neglected. It's easy to create once and never touch again. But a stale POAM is worse than none — it tells an assessor you set up a tracking process and then abandoned it.
• The Risk Register often doesn't exist. Many contractors have never built one. When an assessor asks how you identify and treat risk on an ongoing basis, "we don't really have a document for that" is not the answer that holds up.

None of these fail because the contractor isn't capable. They fail because starting from a blank page, on the highest-stakes documents, with no structure and no cadence, is genuinely hard. A pre-filled SSP, a ready POAM framework, and a structured Risk Register change the starting point entirely — you're editing and maintaining, not inventing.

Evidence Isn't One-and-Done: The Roles and the Cadence

Here's the part that catches people off guard: even a perfectly assembled evidence set goes stale. An assessor doesn't want to see that you reviewed access once at setup — they want the last several quarters of reviews, this year's training records, the recent maintenance logs. Evidence is a stream, not a snapshot, and keeping it current is a shared job.

The Evidence Locker is what keeps that cadence from becoming chaos. Each review, log, and record uploads to its artifact as it's produced, stays organized automatically, and is ready to export the moment a quarterly review — or an assessment — comes around. The framework tells each role what to do and when; the Locker makes sure the proof lands where it belongs.

The Packages at a Glance

Both paid packages are self-assessment based — no $50K+ C3PAO fees for eligible programs. They're a stack, not an either/or: L1 gives you the Evidence Locker and FCI framework, L2 adds the SSP, POAM, and Risk Register for your CUI enclave.

An assessment isn't won by the policies you wrote. It's won by the evidence you can produce — organized, current, and date-stamped.