CMMC Assessor
Assess CMMC Level 2 and Level 3 compliance against NIST SP 800-171 Rev 2 (110 controls)
and NIST SP 800-172 enhanced controls. Maps each control to Embry OS features,
workstation configuration, and detected gaps.
Commands
| Command |
Description |
./run.sh assess --level 2 |
Run full CMMC Level 2 assessment (110 controls) |
./run.sh assess --level 3 --profile high |
Level 3 with enhanced SP 800-172 controls |
./run.sh assess --family AC |
Assess single family (Access Control) |
./run.sh gap-report |
Generate gap analysis with remediation steps |
./run.sh controls |
List all 110 NIST SP 800-171 controls |
./run.sh families |
List 14 control families |
./run.sh map-feature <feature> |
Map Embry OS feature to controls it satisfies |
./run.sh status |
Quick pass/fail summary |
./run.sh export --format json |
Export assessment as JSON for auditors |
./run.sh export --format ssp |
Export as System Security Plan skeleton |
Control Families (14)
| ID |
Family |
Controls |
Embry OS Coverage |
| AC |
Access Control |
22 |
KDE session, D-Bus auth, socket perms |
| AT |
Awareness & Training |
3 |
N/A (organizational) |
| AU |
Audit & Accountability |
9 |
journald, ArangoDB audit log |
| CM |
Configuration Management |
9 |
BlueBuild immutable image, embry.yaml |
| IA |
Identification & Authentication |
11 |
KDE Wallet, PAM, D-Bus auth |
| IR |
Incident Response |
3 |
monitor-security, SPARTA alerts |
| MA |
Maintenance |
6 |
BlueBuild updates, OSTree |
| MP |
Media Protection |
4 |
LUKS, CUI marking |
| PE |
Physical & Environmental |
6 |
N/A (facility controls) |
| PS |
Personnel Security |
2 |
N/A (organizational) |
| RA |
Risk Assessment |
3 |
SPARTA cascade, /hack |
| CA |
Security Assessment |
4 |
/assess, /security-scan |
| SC |
System & Communications Protection |
16 |
TLS, socket isolation, air-gap |
| SI |
System & Information Integrity |
7 |
/security-scan, SAST, deps audit |
Assessment Logic
Each control is checked against 3 tiers:
Technical — Can the control be verified programmatically?
- File permissions, service configuration, crypto settings
- Socket ACLs, D-Bus policy, firewall rules
Configuration — Is it configured in embry.yaml / BlueBuild?
- Image hardening, kernel parameters, service enablement
- DISA STIG overlay application
Operational — Does it require human/process verification?
- Training records, incident response plans, personnel screening
- Marked as "MANUAL_REVIEW" with guidance for assessors
Output Format
{
"assessment": {
"level": 2,
"date": "2026-02-18T00:00:00Z",
"system": "Embry OS v0.2.0",
"total_controls": 110,
"satisfied": 72,
"partial": 18,
"not_satisfied": 8,
"not_applicable": 5,
"manual_review": 7
},
"controls": [
{
"id": "AC.L2-3.1.1",
"family": "AC",
"title": "Authorized Access Control",
"nist_ref": "3.1.1",
"status": "SATISFIED",
"evidence": [
"KDE session requires PAM authentication",
"D-Bus services require org.embry.* interface auth",
"Unix socket permissions restrict to uid 1000"
],
"embry_features": ["kde-session", "dbus-auth", "socket-perms"],
"remediation": null
}
]
}
Integration
- Memory: Stores assessment results for drift detection across runs
- Extractor: Reads NIST SP 800-171 PDF to extract control definitions
- SPARTA: Maps controls to ATT&CK techniques via cascade analysis
- ops-compliance: Extends existing SOC2/GDPR framework with CMMC
1---2name: cmmc-assessor3description: Assess CMMC Level 2/3 compliance by mapping NIST SP 800-171 controls to Embry OS features and detected configurations. Generates gap analysis reports.4---5
6# CMMC Assessor
7
8Assess CMMC Level 2 and Level 3 compliance against NIST SP 800-171 Rev 2 (110 controls)
9and NIST SP 800-172 enhanced controls. Maps each control to Embry OS features,
10workstation configuration, and detected gaps.
11
12## Commands
13
14| Command | Description |
15|---------|-------------|
16| `./run.sh assess --level 2` | Run full CMMC Level 2 assessment (110 controls) |
17| `./run.sh assess --level 3 --profile high` | Level 3 with enhanced SP 800-172 controls |
18| `./run.sh assess --family AC` | Assess single family (Access Control) |
19| `./run.sh gap-report` | Generate gap analysis with remediation steps |
20| `./run.sh controls` | List all 110 NIST SP 800-171 controls |
21| `./run.sh families` | List 14 control families |
22| `./run.sh map-feature <feature>` | Map Embry OS feature to controls it satisfies |
23| `./run.sh status` | Quick pass/fail summary |
24| `./run.sh export --format json` | Export assessment as JSON for auditors |
25| `./run.sh export --format ssp` | Export as System Security Plan skeleton |
26
27## Control Families (14)
28
29| ID | Family | Controls | Embry OS Coverage |
30|----|--------|----------|-------------------|
31| AC | Access Control | 22 | KDE session, D-Bus auth, socket perms |
32| AT | Awareness & Training | 3 | N/A (organizational) |
33| AU | Audit & Accountability | 9 | journald, ArangoDB audit log |
34| CM | Configuration Management | 9 | BlueBuild immutable image, embry.yaml |
35| IA | Identification & Authentication | 11 | KDE Wallet, PAM, D-Bus auth |
36| IR | Incident Response | 3 | monitor-security, SPARTA alerts |
37| MA | Maintenance | 6 | BlueBuild updates, OSTree |
38| MP | Media Protection | 4 | LUKS, CUI marking |
39| PE | Physical & Environmental | 6 | N/A (facility controls) |
40| PS | Personnel Security | 2 | N/A (organizational) |
41| RA | Risk Assessment | 3 | SPARTA cascade, /hack |
42| CA | Security Assessment | 4 | /assess, /security-scan |
43| SC | System & Communications Protection | 16 | TLS, socket isolation, air-gap |
44| SI | System & Information Integrity | 7 | /security-scan, SAST, deps audit |
45
46## Assessment Logic
47
48Each control is checked against 3 tiers:
49
501. **Technical** — Can the control be verified programmatically?
51 - File permissions, service configuration, crypto settings
52 - Socket ACLs, D-Bus policy, firewall rules
53
542. **Configuration** — Is it configured in embry.yaml / BlueBuild?
55 - Image hardening, kernel parameters, service enablement
56 - DISA STIG overlay application
57
583. **Operational** — Does it require human/process verification?
59 - Training records, incident response plans, personnel screening
60 - Marked as "MANUAL_REVIEW" with guidance for assessors
61
62## Output Format
63
64```json
65{
66 "assessment": {
67 "level": 2,
68 "date": "2026-02-18T00:00:00Z",
69 "system": "Embry OS v0.2.0",
70 "total_controls": 110,
71 "satisfied": 72,
72 "partial": 18,
73 "not_satisfied": 8,
74 "not_applicable": 5,
75 "manual_review": 7
76 },
77 "controls": [
78 {
79 "id": "AC.L2-3.1.1",
80 "family": "AC",
81 "title": "Authorized Access Control",
82 "nist_ref": "3.1.1",
83 "status": "SATISFIED",
84 "evidence": [
85 "KDE session requires PAM authentication",
86 "D-Bus services require org.embry.* interface auth",
87 "Unix socket permissions restrict to uid 1000"
88 ],
89 "embry_features": ["kde-session", "dbus-auth", "socket-perms"],
90 "remediation": null
91 }
92 ]
93}
94```
95
96## Integration
97
98- **Memory**: Stores assessment results for drift detection across runs
99- **Extractor**: Reads NIST SP 800-171 PDF to extract control definitions
100- **SPARTA**: Maps controls to ATT&CK techniques via cascade analysis
101- **ops-compliance**: Extends existing SOC2/GDPR framework with CMMC
majiayu000