CMMC readiness, end to end
Theme
Phase 2 drill-down: 2e control-directional triage

Control triage

How every requirement gets a "do you actually do this?" answer before anyone hunts for proof: pre-filled from the tool stack and any existing SSP, walked with the client, and then used to decide which controls get evidence requests at all.

195 → 59
Level 2 Perform objectives in scope, and evidence requests actually sent after the prune
24 of 44
tool-stack guesses the client corrected: why a guess ranks last
153
plain-language triage questions, one per requirement
4
working views, each a to-do list for one kind of answer

The whole pipeline

Three buttons seed the answers, a person confirms them with the client, and one later job reads the result.

Call or read Claims written

Only the SSP job leaves the isolated runner, because it sends the client's SSP text to a language model. The other two are plain lookups. None of the three ever writes the proven Status: a claim and a finding live in different fields.

1

Seed: three sources of a first answer

Every claim records where it came from, so a weaker guess can't pass for a stronger one.

Claim SourceWritten byRanks
Client-confirmedThe consultant, during the walkHighest; no job overwrites it
InterviewThe consultant, from an interview answerSecond; no job overwrites it
SSP (unverified)The SSP job, from the client's existing planThird; replaces only blanks, its own earlier claims and tool-stack guesses
Tech-stack inferredThe pre-fill job, from the inventoryLowest; only fills blanks or refreshes its own earlier guesses

Mine existing SSP

  1. Find the client's one document marked as an SSP with extracted text. None: stop and say so. Several: stop and ask which.
  2. Send it to a language model in overlapping windows of 60,000 characters, with three rules: only controls from the given list, silence is not a claim, and never upgrade what the plan says.
  3. Discard any claim naming a control outside the list; keep the first mention of a duplicate.
  4. Write each claim as "SSP (unverified)", report the controls the plan is silent on, then run the discrepancy check.

Pre-fill claims from tools

For each requirement, the job collects the functions its evidence calls for (say, endpoint protection and log collection) and compares them with the functions the client's inventoried products provide.

Functions needed vs presentProposed claim
All presentImplemented
Some presentPartially Implemented
None present, and the control needs software or hardwareNot Implemented, marked "likely gap, confirm before recording"
None present, and the control is process-onlyLeft blank for a person
No function mapping for the controlLeft blank for a person

A claim that has a status but no source is treated as a person's and left alone, with a note to set the source. The "likely gap" guess is gated on whether a control needs a tool at all, so a physical or process control is never proposed as a gap just because nothing in the inventory does it. The positive guess isn't gated: an earlier version that gated both left 18 identity controls wrongly unanswered.

Flag claim discrepancies

For every requirement claimed Implemented that needs a tool and has a function mapping, the check looks for a matching product in the inventory. None found writes "DISCREPANCY: claimed Implemented, but the inventory has none of the tools..." to Triage Flags. It is a prompt to ask, never a verdict: a built-in operating system feature can satisfy a control without any product in the catalog.

2

Walk: confirm with the client

Four views, each one kind of answer still to settle.

ViewShowsThe consultant
1 DiscrepanciesRows with a Triage FlagWalks them live: which tool does this?
2 Needs answerRows with no claim yetAsks the question shown, records the answer
3 Likely gapsTool-stack guesses of Not ImplementedConfirms the gap or corrects it
4 Confirm pre-filledThe other tool-stack guessesConfirms or corrects
  1. Ask in the client's language. Each requirement row shows its triage question, with follow-up probes and "what good looks like". Level 1, Level 2, Level 3 and Rev 3 are all covered.
  2. Record three things: the answer as Claimed Status, how they do it in their words as Claimed How, and Claim Source set to Client-confirmed.
  3. Done when every requirement has a claim. In the synthetic Level 2 run the walk ended at 19 Implemented, 31 Partially, 59 Not Implemented and 1 Not Applicable, all client-confirmed.
3

Prune: what the claims decide

One job reads the claims mechanically. The rest is the consultant's next step.

Claimed StatusEvidence requests (Phase 4)Remediation
Implemented, Partially ImplementedOpened for the requirement's Perform objectivesOnly if proof later fails
Not ImplementedNever openedThe consultant marks its objectives NOT MET; that opens the POA&M
Not ApplicableNever openedNone; applicability is set separately
Unknown, or no claim yetNever openedStays open in view 2

The evidence job works from an allow-list, so anything other than Implemented or Partially Implemented gets no request. In the synthetic Level 2 run, 195 Perform objectives were in scope, 94 sat under a claimed Implemented or Partial requirement, and 59 of those had an evidence recipe, so 59 requests went out.

A claim is not a finding. The proven Status (MET, NOT MET, Not Yet Assessed) is computed from marked objectives and never reads a claim. A client's "no" saves the evidence hunt, but it doesn't open a POA&M or move the SPRS score on its own; a person turns it into a finding.

Decision log

The calls that shaped triage, and when they were made.

DecisionWhyWhen
Claims in their own fields, per requirement, with a sourceA claim must never look like an assessed result2026-07-21
Gate the "likely gap" guess on whether a control needs a toolPhysical and process controls were being flagged as gaps2026-07-21
The pre-fill only fills blanks or refreshes its own guessesA guess must never overwrite a person2026-07-22
A question bank and four working viewsThe walk needs plain questions and a clear to-do list2026-07-22
Triage jobs made base-awareThey had silently run against the template2026-07-27
Client self-reporting designed: ask blind, "how" required, no N/APre-filled answers lead the client; N/A is a scoping call2026-09-04
Three buttons, with the SSP read by a model on the egress runnerNo terminal step left in the phase that prunes the evidence hunt2026-09-18
No job overwrites a person's claim, including one typed without a sourceThe SSP job had been replacing interview answers; a typed answer with no source looked blank to both jobs2026-09-30

Known gaps