Repository navigation
Welcome to the OpenCMMC Wiki!
Open-source CMMC readiness. Practical compliance. Evidence you control.
OpenCMMC is a free, open-source cybersecurity compliance platform developed by BlockSiFr to help organizations understand, implement, assess, and maintain readiness for the Cybersecurity Maturity Model Certification (CMMC).
Our mission is simple: Make cybersecurity compliance accessible, actionable, transparent, and verifiable.
OpenCMMC helps defense contractors, subcontractors, small businesses, managed service providers, and compliance professionals navigate CMMC requirements without unnecessary complexity or expensive proprietary software.
The platform is designed to bring together:
CMMC Requirements: Explore CMMC Level 1 and Level 2 requirements and applicable assessment objectives.
Guided Assessments: Evaluate implementation status, identify gaps, and document findings.
Evidence Management: Organize supporting artifacts, ownership, and verification records.
Readiness Tracking: Monitor progress, remediation priorities, and outstanding compliance obligations.
POA&M Management: Track Plans of Action and Milestones with accountable owners and deadlines.
SPRS Score Support: Calculate and review scores using the applicable DoD assessment methodology.
Reporting and Exports: Produce assessment summaries, evidence inventories, and compliance documentation.
Continuous Readiness: Move from periodic preparation toward sustained compliance visibility.
Feature availability and validation status are documented in the project repository. Planned functionality should not be treated as implemented or independently validated.
Explore the Repository: Review the project documentation, installation instructions, and current release.
Install OpenCMMC: Set up the platform using the supported deployment method.
Establish Your Scope: Identify systems, organizational boundaries, and applicable CMMC requirements.
Begin Your Assessment: Evaluate control implementation and record supporting evidence.
Address Identified Gaps: Prioritize remediation and track corrective actions.
Review Your Readiness: Generate reports and prepare for the applicable assessment process.
Cybersecurity compliance should not require organizations to surrender control of their sensitive information or become dependent on expensive software subscriptions.
OpenCMMC is designed around four principles:
Open by default. Publicly inspectable source code and transparent development.
Evidence over assertions. Compliance claims should be backed by relevant, reviewable documentation.
Security by design. Minimize unnecessary data collection and protect sensitive assessment information.
Continuous improvement. Help organizations strengthen security posture beyond a single assessment.
OpenCMMC is an independent, open-source project. It is not endorsed, accredited, or certified by the Department of Defense or the Cyber AB.
Using OpenCMMC does not itself constitute CMMC certification, establish eligibility for a government contract, replace an authorized C3PAO assessment where required, or guarantee compliance.
Organizations remain responsible for determining applicable requirements, validating assessment results, protecting Controlled Unclassified Information (CUI), and following current DoD and CMMC assessment procedures.
OpenCMMC welcomes contributions from cybersecurity engineers, compliance assessors, defense contractors, developers, researchers, and the broader open-source community.
Help us improve documentation, expand assessment capabilities, identify security issues, and make meaningful compliance tooling more accessible.
Cybersecurity readiness should be achievable by every organization responsible for protecting sensitive information.
Your AI has credentials. BlockSiFr gives it boundaries!
Website: https://blocksifr.com
Explore the source code, follow development, and contribute through the OpenCMMC GitHub repository.
Open tools. Stronger security. Verifiable readiness.
# Welcome to the OpenCMMC Wiki!Open-source CMMC readiness. Practical compliance. Evidence you control.
OpenCMMC is a free, open-source cybersecurity compliance platform developed by BlockSiFr to help organizations understand, implement, assess, and maintain readiness for the Cybersecurity Maturity Model Certification (CMMC).
Our mission is simple: Make cybersecurity compliance accessible, actionable, transparent, and verifiable.
OpenCMMC helps defense contractors, subcontractors, small businesses, managed service providers, and compliance professionals navigate CMMC requirements without unnecessary complexity or expensive proprietary software.
The platform is designed to bring together:
- CMMC Requirements: Explore CMMC Level 1 and Level 2 requirements and applicable assessment objectives.
- Guided Assessments: Evaluate implementation status, identify gaps, and document findings.
- Evidence Management: Organize supporting artifacts, ownership, and verification records.
- Readiness Tracking: Monitor progress, remediation priorities, and outstanding compliance obligations.
- POA&M Management: Track Plans of Action and Milestones with accountable owners and deadlines.
- SPRS Score Support: Calculate and review scores using the applicable DoD assessment methodology.
- Reporting and Exports: Produce assessment summaries, evidence inventories, and compliance documentation.
- Continuous Readiness: Move from periodic preparation toward sustained compliance visibility.
Feature availability and validation status are documented in the project repository. Planned functionality should not be treated as implemented or independently validated.
- Explore the Repository: Review the project documentation, installation instructions, and current release.
- Install OpenCMMC: Set up the platform using the supported deployment method.
- Establish Your Scope: Identify systems, organizational boundaries, and applicable CMMC requirements.
- Begin Your Assessment: Evaluate control implementation and record supporting evidence.
- Address Identified Gaps: Prioritize remediation and track corrective actions.
- Review Your Readiness: Generate reports and prepare for the applicable assessment process.
| Section | Description |
|---|---|
| Getting Started | Installation and initial configuration |
| CMMC Fundamentals | CMMC levels, practices, and assessment objectives |
| Assessment Guide | Conducting structured readiness assessments |
| Evidence Management | Collecting, organizing, and reviewing evidence |
| SPRS Scoring | Assessment scoring and methodology |
| POA&M Management | Managing remediation activities |
| Reporting | Generating and exporting reports |
| Security Architecture | Data protection, access controls, and deployment |
| Developer Guide | Contributing code and integrations |
| Roadmap | Implemented capabilities and upcoming development |
Cybersecurity compliance should not require organizations to surrender control of their sensitive information or become dependent on expensive software subscriptions.
OpenCMMC is designed around four principles:
Open by default. Publicly inspectable source code and transparent development.
Evidence over assertions. Compliance claims should be backed by relevant, reviewable documentation.
Security by design. Minimize unnecessary data collection and protect sensitive assessment information.
Continuous improvement. Help organizations strengthen security posture beyond a single assessment.
OpenCMMC is an independent, open-source project. It is not endorsed, accredited, or certified by the Department of Defense or the Cyber AB.
Using OpenCMMC does not itself constitute CMMC certification, establish eligibility for a government contract, replace an authorized C3PAO assessment where required, or guarantee compliance.
Organizations remain responsible for determining applicable requirements, validating assessment results, protecting Controlled Unclassified Information (CUI), and following current DoD and CMMC assessment procedures.
OpenCMMC welcomes contributions from cybersecurity engineers, compliance assessors, defense contractors, developers, researchers, and the broader open-source community.
Help us improve documentation, expand assessment capabilities, identify security issues, and make meaningful compliance tooling more accessible.
Cybersecurity readiness should be achievable by every organization responsible for protecting sensitive information.
Your AI has credentials. BlockSiFr gives it boundaries!
Website: https://blocksifr.com/
Explore the source code, follow development, and contribute through the OpenCMMC GitHub repository.
Open tools. Stronger security. Verifiable readiness.