CMMC Assessor

Assess CMMC Level 2 and Level 3 compliance against NIST SP 800-171 Rev 2 (110 controls) and NIST SP 800-172 enhanced controls. Maps each control to Embry OS features, workstation configuration, and detected gaps.

Commands

Control Families (14)

Assessment Logic

Each control is checked against 3 tiers:

1. Technical — Can the control be verified programmatically?

   • File permissions, service configuration, crypto settings
   • Socket ACLs, D-Bus policy, firewall rules

2. Configuration — Is it configured in embry.yaml / BlueBuild?

   • Image hardening, kernel parameters, service enablement
   • DISA STIG overlay application

3. Operational — Does it require human/process verification?

   • Training records, incident response plans, personnel screening
   • Marked as "MANUAL_REVIEW" with guidance for assessors

Output Format

{
  "assessment": {
    "level": 2,
    "date": "2026-02-18T00:00:00Z",
    "system": "Embry OS v0.2.0",
    "total_controls": 110,
    "satisfied": 72,
    "partial": 18,
    "not_satisfied": 8,
    "not_applicable": 5,
    "manual_review": 7
  },
  "controls": [
    {
      "id": "AC.L2-3.1.1",
      "family": "AC",
      "title": "Authorized Access Control",
      "nist_ref": "3.1.1",
      "status": "SATISFIED",
      "evidence": [
        "KDE session requires PAM authentication",
        "D-Bus services require org.embry.* interface auth",
        "Unix socket permissions restrict to uid 1000"
      ],
      "embry_features": ["kde-session", "dbus-auth", "socket-perms"],
      "remediation": null
    }
  ]
}

Integration

• Memory: Stores assessment results for drift detection across runs
• Extractor: Reads NIST SP 800-171 PDF to extract control definitions
• SPARTA: Maps controls to ATT&CK techniques via cascade analysis
• ops-compliance: Extends existing SOC2/GDPR framework with CMMC