Same Practices, Same Artifacts, Same Signature

In Part 3, we looked at where Level 2 self-assessments actually stall. It's rarely the configuration. It's the documentation: roughly 176 files that have to describe your enclave, agree with each other, and get written by someone who has a business to run.

This piece is about the answer we've been offering qualifying clients: L2 CUI Enclave — Guided Documentation. If you've read about it in earlier parts of this series, this is the full explanation.

I'm going to explain it in a specific order, and the order is deliberate. A careful buyer is right to be wary of anything that sounds like a shortcut around a security control. So before anything else, here's everything that doesn't change.

The short version of what you're buying: you're buying back the drafting. The controls, the artifact set, and the review are the same as the standard package. What changes is that you're not staring at a blank System Security Plan (SSP) on a Tuesday night.

And it changes the timeline. In most cases, clients on the guided path complete their Level 2 enclave self-assessment in about 30 days. More on what that number depends on below.

1. What Stays the Same

Guided Documentation includes everything in the L2 CUI Enclave Package. Not a lighter version of it, not a summary of it. All of it.

The configuration work doesn't change either. You still configure the enclave from the guides, on dedicated CUI-only devices, Windows laptops or Chromebooks. We provide the templates, configuration guides, and consulting. You implement. The enclave is still built for limited CUI needs: no Active Directory, no SIEM, no enterprise IT department.

And the obligations behind all of it don't change. DFARS 252.204-7012 still applies where it's in your contract, Level 2 still sits on top of Level 1, and the requirements you're documenting are the same ones every Level 2 self-assessment answers to.

If you've worked through Volume 2 of my CMMC Practical Guides, this is the same practice set, organized the same way. The guided tier doesn't change what you're documenting. It changes how the first draft gets written.

2. What Changes: The Drafting

Here's the one thing that's different, named precisely: the blank-page problem across roughly 176 files.

In the standard package, you work through the 182 artifacts template by template. The templates give you the structure, but someone still has to write the parts only your company knows: how each requirement is actually met in your environment, by whom, and how often. That's the work that stalls in month two.

In the guided tier, you answer a structured set of questions about how your enclave is actually configured: your settings, your devices, your roles, your procedures. The things only you know, asked once, in an order that makes sense. Your answers become your documentation.

Why answers first works better

Two of the reasons Level 2 documentation stalls are built into the template-by-template approach. First, the person who configured the enclave usually isn't the person writing the documents, so every requirement turns into a back-and-forth. Second, 176 files written over weeks drift out of step with each other: the policy says quarterly, the procedure says monthly, and the SSP says something else again.

Starting from your answers addresses both. The person who knows the configuration can answer the configuration questions directly. And because your documents start from one set of answers instead of 176 separate drafting sessions, the same fact doesn't get written three different ways.

The shift in your sessions is the practical difference most clients notice first. When your consulting time isn't spent drafting, it's spent checking that the documents say what's true about your enclave, and that's a far better use of an expert's hour.

Drafting stops being the bottleneck. Configuration is still on your clock, and that's where the real time goes.

3. Where the Truth Comes From

This is the question a careful buyer should ask about any documentation help: whose word is this? The answer is the reason the guided tier works. There are three roles, and you hold the last one.

Notice what that structure protects. The documentation is never more confident than your answers, because your answers are what it's built from. And it's never unreviewed, because a consultant checks every document against the configuration before it's final.

That matters more now than it used to. As we covered earlier in this series, the third-party assessor left the picture in July, but the affirmation didn't. The person who signs is the person whose word the self-assessment rests on. The guided tier is built so that person signs documentation that describes their actual enclave, reviewed by someone who knows what to look for.

4. The Boundary

Before anyone asks, here's exactly where the tool sits relative to your CUI:

That's the whole design: your answers go in, documentation about your enclave comes out. The tool doesn't log into your Google Workspace or GCC High tenant, doesn't scan your devices, and doesn't need anything from inside the boundary you worked to build.

5. Fit Comes First

Before you buy, we confirm this fits your environment. If it doesn't, we'll tell you and point you at the right path. Nobody should end up with documentation describing an environment they haven't built yet.

In practice, the guided tier fits a self-assessment program with limited CUI needs, an enclave that's configured or being configured, and someone on your team who can follow the configuration guides. Part 6 of this series covers fit in full, including where everyone else should go.

Who Does What on Your Team

The Level 2 package is built around three roles inside your company. The guided tier doesn't change them. It changes where each one spends their time.

• IT Point Person. Configures the enclave from the guides, handles monthly maintenance, and collects evidence. In the guided tier, this is usually the person best placed to answer the configuration questions, because they're the one who made the settings. That removes the translation step between the person who built it and the person writing about it.
• Owner/Manager. Signs policies, makes approval decisions, and runs the quarterly reviews. In the guided tier, their time goes into reviewing documents with the consultant and approving them, not drafting them at night.
• CUI User(s). Follow the procedures, report incidents, and stay aware of their responsibilities. Their part is the same in either tier.

In a small business, one person may wear two of those hats. That's fine. The point is that the person answering each question is the person who actually knows the answer.

What You Still Own After Sign-Off

Being straight about this matters, because "guided" can sound like "handled." A Level 2 self-assessment isn't a one-time project. Under 32 CFR 170.16, it's repeated every three years and affirmed every year in between, with evidence kept for six years. After sign-off, these stay with you:

• Keeping the documentation true. When your configuration changes, your documentation has to change with it. A new device, a new CUI user, or a changed setting all need to show up on paper. Your consulting sessions are the place to raise them.
• Collecting evidence. Dated evidence that the controls actually operate, gathered on the schedule your procedures set, goes in your Evidence Locker.
• The annual affirmation. Every year, someone at your company puts their name on it. That's the strongest reason to keep your documentation accurate between assessments.

None of that is new work the guided tier creates. It's the work every Level 2 self-assessment carries. The difference is that you start from documentation that describes your enclave accurately, which makes keeping it accurate a lot easier.

"Isn't This Just Boilerplate?"

It's the most common question, and it's a fair one. Plenty of compliance products hand you a stack of generic documents with your company name pasted in.

It's the opposite of boilerplate. Boilerplate is a generic template that describes a company that isn't yours. This describes your configuration because your answers are what it's built from, and your consultant reviews every document before it goes in your Evidence Locker.

The test is simple. Boilerplate reads the same for every customer. Guided documentation reads differently for every customer, because every customer's answers are different. Two companies with the same platform and the same number of CUI users will usually end up with different documents, because they made different choices when they built their enclaves.

Standard or Guided: Same Finish Line

Both tiers get you to the same place: a packaged, date-stamped Level 2 self-assessment of your CUI enclave. The difference is how much of the writing lands on your desk.

Same finish line, less time in a text editor. If you've got someone who can execute the configuration guides, the guided tier is the version that gets you to a packaged, date-stamped self-assessment without the writing consuming your quarter. In most cases, that's about 30 days.

And if you'd rather write it all yourself, the standard package is still the right choice. So is the book.

📘 Prefer to do the writing yourself?

Volume 1: CMMC Level 1: the Level 1 foundation every Level 2 enclave sits beside.

Volume 2: CMMC Level 2: the same 110 practices and documentation, for the contractor writing it on their own.

Kindle from $12.99. See the full series →

The Bottom Line

The guided tier doesn't change what a Level 2 self-assessment requires. Same practices, same artifacts, same signature. It changes who holds the pen for the first draft, moves your consulting time from writing to reviewing, and in most cases gets you to a completed Level 2 enclave in about 30 days. You configure the enclave. We guide the build.

Coming Up in The Enclave Build

• Part 5: Building a Level 2 CUI Enclave, Start to Signature. One enclave, phase by phase, with both platforms side by side.
• Part 6: We'll Tell You If It Isn't the Right Fit. Who the guided tier is for, and where everyone else should go.