NIST SP 800-171 Rev. 2 (CMMC Level 2) compliance, built by a Lead CMMC Assessor

The complete documentation, evidence, and automation defense contractors and MSPs need to walk in ready. Assessor-built, without the five-figure consulting invoice.

See a complete domain — freeCompare the tiers

Created by a Lead CMMC Assessor (LCCA) · CCA · CCP · Performs assessments and staffs teams for half a dozen C3PAOs

Verify on the Cyber-AB Marketplace

See the actual documents

Most kits hand you documents and wish you luck. The Compliance Engine gives you the documentation, the guidance to make it real in your environment, and the evidence to back it up.

Pre-written, GCC High-ready, not blank templates. Your team edits what’s different, you never start from scratch.

See What’s Included

Start Where You Are. Scale as You Grow.

Every tier includes a single-organization license. Upgrade at any time and your original purchase price applies toward the new tier.

Compare the tiers

Every tier builds on the one before it. Start where you are, upgrade anytime.

What’s includedStarterProfessionalMOST POPULARComplete
Domain policies — all 14 + FIPS151515
System Security Plan (SSP)✓✓✓
Policy customization guide✓✓✓
Tracking tools, registers & matrices✓✓✓
Agreements & forms✓✓✓
Self-assessment & evidence workbooks✓✓✓
Implementation roadmap & tracker✓✓✓
Per-control procedures—50+50+
SSP domain implementation sections—✓✓
Master customization guide (all documents)—✓✓
Incident response plan + playbooks—77
Risk & security assessment toolset—✓✓
Microsoft 365 / Sentinel guides—88
Network architecture reference—✓✓
Assessment prep packages (APREP)——14
Automation scripts — Python + PowerShell——52
Consultant licensing discount——✓
Total files48155226
Get startedGet startedGet started
Not sure yet? See every file included →  or  get the free AU sample pack →

Who built the Compliance Engine

Jil Wright, an experienced Lead CMMC Assessor (LCCA), knows what gets examined, what gets asked, and what sinks an organization before it gets out of Phase 1. Every document reflects what she wants to see when she’s the one running an assessment.

As President of Wrightbrained Security, with nearly 25 years in IT, she has performed CMMC Level 2 assessments and readiness work for everyone from small manufacturers to Fortune 100 primes. Her mission is simple: take what she learns on the assessor’s side of the table and build the tools she wishes contractors already had, so compliance is achievable for the organizations that don’t have an enterprise budget to throw at it.

More About JilVerify on CyberAB Marketplace

Who Is it for?

Organizations Seeking Assessment (OSAs)

Complete NIST SP 800-171 Rev. 2 (CMMC Level 2) documentation without the enterprise overhead. Policies, procedures, evidence tools, and a pre-filled SSP — all built and mapped. Your team implements; the customization guides walk you through every control, step by step.

Consultants & MSPs

Stop rebuilding documentation from scratch for every client. Deploy one proven, repeatable framework across every engagement and bill your expertise, not your document time. Licensed per client, with $500 off each additional organization.

Questions buyers ask

The questions real people ask before spending real money on compliance docs. Don’t see yours? Ask, it goes right to Jil.

Yes. The suspension paused the C3PAO assessment requirement, not the security requirement. Implementing NIST SP 800-171 Rev. 2 is still required under DFARS 252.204-7012, and self-assessments, SPRS scores, and annual affirmations all continue. What changed is who checks your work, not whether the work has to be done, and self-attesting to a score you cannot evidence carries its own False Claims Act exposure. Everything in the Compliance Engine is what you need either way.

Each purchase is a single-organization license. You can use the documents across your own environment as much as you need, for one company. If you’re an MSP or consultant deploying for multiple clients, you’ll want the Complete tier’s consultant licensing, which includes a per-client discount so you’re not paying full price every time. One org, one license; multiple clients, ask about the consultant option.

CMMC Level 2 is built on NIST SP 800-171 Rev. 2 today, and that has not changed. The proposed FAR CUI rule points at Rev. 3 for CUI across federal contracts. Your license covers the crosswalk either way: every tier includes a year of updates, so if Rev. 3 becomes a requirement while your license is active, the updated documents come to you as part of what you already bought. You are not buying the kit twice because the goalposts moved.

Because this is a digital product delivered in full at purchase, sales are final. That’s exactly why the free AU sample pack exists: you get a complete domain to evaluate. You get the real policy, SSP language, procedure, and assessor questions so you can judge the quality before you spend a dollar. Read the sample, then buy with confidence.

You’ll get a download link by email right after checkout for immediate access to your tier’s full document suite. The policies, SSP, and everything included at your level are delivered as editable files ready to customize for your environment. You’ll also get access to where all of the files are stored so that you can have immediate access if a file is updated or if a tool is added. The whole kit is yours the moment you purchase.

The Compliance Engine gives you assessor-grade documentation, the guidance to implement it, and the evidence tooling to back it up, the pieces most organizations pay consultants five figures to produce. What it can’t do is run your environment for you; you still have to implement the controls and generate real evidence. Think of it as the expert-built foundation that makes readiness achievable without an enterprise consulting budget, not a button that makes compliance automatic. If you need help scoping your environment, assistance adding a physical component, or have other needs, just reach out. We can help!

The policies, SSP, and procedures map to the GCC High architecture and the customization guidance walks you through tailoring them. However, it doesn’t take much to tailor them to most environments. Download the free AU domain and see how hard it would be to customize for your needs. Get in touch if you have more questions.

Yes. Start where you are, and if you need more later, upgrade anytime. Your original purchase applies toward the new tier, so you’re not paying twice to move up.

That’s exactly who the Complete tier’s consultant licensing is built for. You get the full suite plus a per-license discount for each client you deploy it for, so it scales with your book of business instead of eating your margin. Each client needs their own license.

See the quality before you decide

Read a complete CMMC domain — the real policy, SSP language, procedure, and assessor questions — free.

Get the free AU packCompare the tiers