Overview
  1. 03.01: Access Control
  2. 03.02: Awareness and Training
  3. 03.03: Audit and Accountability
  4. 03.04: Configuration Management
  5. 03.05: Identification and Authentication
  6. 03.06: Incident Response
  7. 03.07: Maintenance
  8. 03.08: Media Protection
  9. 03.09: Personnel Security
  10. 03.10: Physical Protection
  11. 03.11: Risk Assessment
  12. 03.12: Security Assessment and Monitoring
  13. 03.13: System and Communications Protection
  14. 03.14: System and Information Integrity
  15. 03.15: Planning
  16. 03.16: System and Services Acquisition
  17. 03.17: Supply Chain Risk Management

Evidence Heatmap R3

One cell per requirement, colored by implementation status, with the number of attached evidence files in the corner. Evidence presence shows coverage, not assessment readiness — a control can be evidenced and still fall short of its assessment objectives.

The free web app covers the 17 CMMC Level 1 practices — Get the desktop app to work on all 110 requirements.

Not startedPartially implementedImplementedHas work remainingNot implementedNot applicable2Evidence files