Sample deliverables
See exactly what you get
Below is what WorkuGRC generates from a finished questionnaire: a live SPRS score, a draft System Security Plan, and a Plan of Action & Milestones. Your real documents are written from your answers — never invented.
This is a sample.
SPRS score
Self-assessment score
Calculated from the sample answers. Not an official DoD score.
24 points to gain — the gaps in this company's answers
- 3.1.8 Accounts do not lock after failed sign-ins1 point lost
- 3.3.3 Logged events are not reviewed1 point lost
- 3.5.3 MFA on remote access and admin accounts only3 points lost
- 3.6.3 Incident response plan is not practiced1 point lost
- 3.8.9 CUI backups are not encrypted and restricted1 point lost
- 3.11.2 No scheduled vulnerability scans5 points lost
- 3.11.3 Scan findings are not fixed and tracked1 point lost
- 3.13.11 Encryption not verified as FIPS-validated3 points lost
- 3.14.6 No monitoring for signs of attack5 points lost
- 3.14.7 Unauthorized use would not stand out3 points lost
Draft System Security Plan
Excerpt — 2 of the 14 control families, shown in full (14 of the 110 requirements). The full draft covers all 110 requirements and exports to Word, each section noting how much of the questionnaire backs it.
System Security Plan
Acme Machine Works
NIST SP 800-171 Revision 2 · CMMC Level 2 self-assessment
- Organization size
- 11-50 employees
- Industry
- Precision machining
- Information handled
- Handles CUI (CMMC Level 2)
- Standard
- NIST SP 800-171 Rev 2
- Date prepared
- 2026-11-13
We machine aluminum brackets and housings for defense primes.
Implementation summary
Requirements in each status, by family, from your own questionnaire answers.
| Family | Implemented | Partial | Planned | N/A | To complete |
|---|---|---|---|---|---|
| 3.5 Identification and Authentication (IA) | 10 | 1 | – | – | – |
| 3.11 Risk Assessment (RA) | 1 | – | 2 | – | – |
| Total | 11 | 1 | 2 | 0 | 0 |
3.5 Identification and Authentication (IA)
11 requirements · 10 implemented · 1 partial · 0 planned · 0 not applicable · 0 to complete
3.5.1 Identify users and devices
Implemented- Requirement
- Identify system users, processes acting on behalf of users, and devices.
- Implementation
- Acme Machine Works requires every person to sign in to company computers and systems with their own individual account. Shared logins are not used.
- Basis
- Questionnaire coverage: 3 of 3 assessment objectives answered
3.5.2 Authenticate before access
Implemented- Requirement
- Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
- Implementation
- Every account and device at Acme Machine Works requires a password, or a stronger sign-in method, before access is granted.
- Basis
- Questionnaire coverage: 3 of 3 assessment objectives answered
3.5.3 Multi-factor authentication
Partially implemented- Requirement
- Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
- Implementation
- Acme Machine Works has turned on multi-factor authentication for remote access and for administrator accounts. It is not yet turned on for all other users, so this requirement is partially implemented. The remaining gap is tracked in the Plan of Action and Milestones (POA&M).
- Basis
- Questionnaire coverage: 4 of 4 assessment objectives answered
3.5.4 Replay-resistant authentication
Implemented- Requirement
- Employ replay-resistant authentication mechanisms for network access to privileged and non- privileged accounts.
- Implementation
- Acme Machine Works has disabled outdated sign-in protocols, so only modern authentication is used.
- Basis
- Questionnaire coverage: 1 of 1 assessment objective answered
3.5.5 Prevent identifier reuse
Implemented- Requirement
- Prevent reuse of identifiers for a defined period.
- Implementation
- When someone leaves Acme Machine Works, their username is not given to a new person for a set period.
- Basis
- Questionnaire coverage: 2 of 2 assessment objectives answered
3.5.6 Disable inactive accounts
Implemented- Requirement
- Disable identifiers after a defined period of inactivity.
- Implementation
- Acme Machine Works disables accounts after a period of inactivity.
- Basis
- Questionnaire coverage: 2 of 2 assessment objectives answered
3.5.7 Password complexity
Implemented- Requirement
- Enforce a minimum password complexity and change of characters when new passwords are created.
- Implementation
- Acme Machine Works enforces password rules that set a minimum length and complexity.
- Basis
- Questionnaire coverage: 4 of 4 assessment objectives answered
3.5.8 Prohibit password reuse
Implemented- Requirement
- Prohibit password reuse for a specified number of generations.
- Implementation
- Acme Machine Works enforces password rules that prevent recent passwords from being reused.
- Basis
- Questionnaire coverage: 2 of 2 assessment objectives answered
3.5.9 Temporary passwords
Implemented- Requirement
- Allow temporary password use for system logons with an immediate change to a permanent password.
- Implementation
- Temporary passwords at Acme Machine Works must be changed at the first sign-in.
- Basis
- Questionnaire coverage: 1 of 1 assessment objective answered
3.5.10 Protect stored passwords
Implemented- Requirement
- Store and transmit only cryptographically-protected passwords.
- Implementation
- Acme Machine Works does not keep passwords in plaintext, such as in spreadsheets, documents or notes.
- Basis
- Questionnaire coverage: 2 of 2 assessment objectives answered
3.5.11 Obscure password entry
Implemented- Requirement
- Obscure feedback of authentication information.
- Implementation
- Password fields on Acme Machine Works systems hide what is being typed.
- Basis
- Questionnaire coverage: 1 of 1 assessment objective answered
3.11 Risk Assessment (RA)
3 requirements · 1 implemented · 0 partial · 2 planned · 0 not applicable · 0 to complete
3.11.1 Assess risk
Implemented- Requirement
- Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
- Implementation
- Acme Machine Works assesses the risks to its systems and data at least once a year and keeps a written record of the assessment.
- Basis
- Questionnaire coverage: 2 of 2 assessment objectives answered
3.11.2 Scan for vulnerabilities
Planned (not implemented)- Requirement
- Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
- Implementation
- Acme Machine Works has not yet implemented vulnerability scanning on a schedule or after major changes. This deficiency is tracked in the Plan of Action and Milestones (POA&M).
- Basis
- Questionnaire coverage: 5 of 5 assessment objectives answered
3.11.3 Fix vulnerabilities
Planned (not implemented)- Requirement
- Remediate vulnerabilities in accordance with risk assessments.
- Implementation
- Acme Machine Works has not yet implemented a process to fix the vulnerabilities that scans find, worst first, and track them until closed. This deficiency is tracked in the Plan of Action and Milestones (POA&M).
- Basis
- Questionnaire coverage: 2 of 2 assessment objectives answered
Showing 3 of the sample's 14 requirements.
Plan of Action & Milestones (POA&M)
Every gap in your answers becomes a remediation row with a plain-English fix, a rough effort and cost band, and a milestone date. You set the milestone date and the responsible party; the rest you edit in Word.
A POA&M does not make every gap acceptable.
Plan of Action & Milestones · draft v3
10 open items · −24 points
- 3.1.81 point lost
Limit unsuccessful logon attempts
Accounts do not lock automatically after several failed sign-in attempts.
Plan: Turn on an account-lockout policy, for example a 15-minute lock after 5 failed attempts. This is a built-in setting in Windows, Microsoft 365 and Google Workspace.
Not implementedPOA&M-eligibleEffort: Hours · $0Milestone date: 2026-12-13Responsible party: IT provider
- 3.3.31 point lost
Review logged events
What is logged is not reviewed periodically to confirm that the events that matter are captured.
Plan: Write down which events are captured and review the list at least once a year.
Not implementedPOA&M-eligibleEffort: Hours · $0Milestone date: 2027-01-12
- 3.5.33 points lost
Multi-factor authentication
Multi-factor authentication is turned on for remote access and administrator accounts only, not for all users.
Plan: Turn on multi-factor authentication for every remaining user account.
Partially implementedFix firstEffort: Days · <$500Milestone date: 2026-12-13Responsible party: IT provider
- 3.6.31 point lost
Test incident response
The incident response plan is not practiced at least once a year.
Plan: Run a tabletop walkthrough of a ransomware or breach scenario once a year and update the plan with what is learned.
Not implementedPOA&M-eligibleEffort: Days · $0Milestone date: 2027-02-11Responsible party: Office manager
- 3.8.91 point lost
Protect CUI backups
Backups that contain CUI are not both encrypted and restricted to authorized people.
Plan: Encrypt backups that contain CUI and limit who can reach them, on-site and in the cloud.
Not implementedPOA&M-eligibleEffort: Days · <$500Milestone date: 2027-01-12
- 3.11.25 points lost
Scan for vulnerabilities
Vulnerability scans are not run on a schedule or after major changes.
Plan: Run a vulnerability scanner on a regular schedule, monthly is common, and after major changes.
Not implementedFix firstEffort: Days · $500-5kMilestone date: 2027-01-12
- 3.11.31 point lost
Fix vulnerabilities
There is no process to fix the vulnerabilities that scans find, worst first, and track them until closed.
Plan: Fix scan findings starting with the most serious, and track each one to closure.
Not implementedPOA&M-eligibleEffort: Weeks · <$500Milestone date: 2027-02-11
- 3.13.113 points lost
FIPS-validated encryption
CUI is encrypted, but the encryption has not been verified as FIPS-validated.
Plan: Use FIPS 140-validated modules wherever CUI is encrypted, and turn on FIPS mode where it is available.
Partially implementedPOA&M-eligibleEffort: Weeks · <$500Milestone date: 2027-02-11
- 3.14.65 points lost
Monitor for attacks
Systems and network traffic are not monitored for signs of attack.
Plan: Watch for unusual activity using the firewall, endpoint tools and log reviews. A low-cost monitoring service can help a small shop.
Not implementedFix firstEffort: Weeks · $500-5kMilestone date: 2027-02-11
- 3.14.73 points lost
Detect unauthorized use
Unauthorized use of company systems would not stand out today.
Plan: Review sign-ins and activity for anything unexpected, such as odd hours or unknown accounts, and investigate.
Not implementedFix firstEffort: Days · $0Milestone date: 2027-02-11
Get your own — built from your answers
Answer plain-English questions about your shop and WorkuGRC drafts all of this for you. All of it is free, with no card required.