Guide · Agent skill
How to use the CMMC Level 2 Compliance Assistant agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This skill is a packaged set of instructions, reference files, a report template and a Python script that an AI agent can load when you ask it about CMMC Level 2 readiness. It is aimed at defense contractors and subcontractors who handle Controlled Unclassified Information (CUI) under DoD contracts, and at the IT and compliance staff who support them. After this guide you will know how to install the skill, how to phrase requests so the agent uses it, and what it can and cannot do for you.
CMMC Level 2 Compliance Assistantmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the achieving-cmmc-level-2-compliance ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Gather your inputs. Collect your contract clauses, asset inventory, network diagram and the status and official DoD weight of each requirement.
- 5Ask a natural request. Describe your task, such as scoping the CUI boundary or computing an SPRS score, in plain language.
- 6Run the scoring script if needed. Run python3 scripts/process.py on a JSON file of requirement statuses to get the score and gaps.
- 7Verify the output. Have qualified assessors and legal counsel check the readiness report before relying on it.
What the skill makes the agent do
When installed, the agent works through the steps a defense contractor needs to prepare for CMMC Level 2 certification. That covers deciding which systems fall inside the CUI boundary, walking through the 110 NIST SP 800-171 requirements across 14 families, computing a SPRS score using the DoD Assessment Methodology weights, and structuring a Plan of Action & Milestones (POA&M) for unmet items.
The output follows a template that produces a CMMC Level 2 Readiness Report covering applicability and CUI categories, scope, and related sections.
- Scopes assets into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope
- Walks through the 110 requirements and the How to record in the System Security Plan (SSP)
- Computes the SPRS score by starting at 110 and subtracting weighted values of unmet requirements
- Helps organize a POA&M with owner, remediation and milestone for each unmet item
Install the skill: download the ZIP and unzip it
Download the ZIP from this page and unzip it into one of two locations. For a personal skill available across your projects, unzip it into ~/.claude/skills/. For a skill that only applies to one project, unzip it into that project's .claude/skills/ folder.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills rather than unzipping it into a folder.
- Personal install: ~/.claude/skills/
- Project install: the .claude/skills/ folder inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the skill
~/.claude/skills/achieving-cmmc-level-2-compliance/Trigger the skill with natural requests
You do not need a special command. The skill's description lists the situations it covers, so ask in plain language about the task. Good triggers include a contract carrying DFARS 252.204-7012, 7019, 7020 or 7021, a request to compute or improve an SPRS score, a request to build an SSP or POA&M for 800-171, or a question about which systems are inside the CUI boundary.
Name the facts the agent needs: your contract clauses, your asset list, and the status of each requirement. The more concrete you are, the more useful the report.
- "Our prime contract includes DFARS 252.204-7012 and -7021. Which of our systems are in the CUI boundary?"
- "Help me compute our SPRS score from this list of requirement statuses."
- "Draft a POA&M for the unmet 800-171 requirements in this spreadsheet."
- "Are we Level 1 or Level 2 if we only receive FCI?"
What you need before you start
The skill requires Python 3 to run scripts/process.py. The script does not supply scoring weights, so you must provide a JSON file that describes each requirement's status and its official DoD weight. The skill does not use the network.
You should also have an asset inventory and network diagram so scope can be defined before controls are assessed, and a documented SSP. The reference material assumes NIST SP 800-171 Rev 2 and the DoD Assessment Methodology weights.
- Python 3
- A JSON file with each requirement's status and official DoD weight
- An asset inventory and network diagram
- Knowledge of which contracts carry CUI
Run the scoring script
The script calculates the score and readiness gaps from a JSON list of requirement statuses. Keep the weights in your JSON file sourced from the official DoD methodology, since the script uses whatever weights you give it.
Check the script's own help or source before running it on real data, because this guide does not list its flags or input schema beyond the description above.
- Input: a JSON file of requirement statuses with official DoD weights
- Output: the calculated score and readiness gaps
python3 scripts/process.pySafety notes: scripts and data handling
This skill runs scripts, so review scripts/process.py before you run it on sensitive data. The skill does not use the network, according to its listing, so your requirement data is not sent out by the skill itself. Still, treat any file describing your CUI environment as sensitive.
Most important: the skill is guidance, not certification. Formal assessment requires a C3PAO or DoD process, and the agent's output should be verified by qualified assessors and legal counsel. The reference files are static, and the agent may not check current DoD sources, so confirm rules and weights yourself.
- Read scripts/process.py before running it
- Keep CUI-describing files under your normal data controls
- Verify all outputs with qualified assessors and legal counsel
- Check current DoD sources for rules, weights and POA&M requirements
Tips for better results
Give the agent the scope first. Many scoring and POA&M questions depend on which assets are in scope, so ask for scoping before asking for a score.
Ask for the highest-weighted unmet items first. The reference material notes that clearing 5-point and then 3-point items is the usual way to get a score above the conditional threshold.
- Scope before scoring
- Ask for a worked example to see the report structure, which the template provides
- Re-run scoring after each control change so the POA&M stays current
What people use it for
- Scoping which engineering workstations, file shares and security tools fall inside a CUI enclave
- Drafting a POA&M for unmet 800-171 requirements with owners and milestones
- Calculating a SPRS score from a list of requirement statuses and DoD weights
- Preparing a readiness report to review with a consultant before a C3PAO assessment
- Deciding whether a subcontract needs Level 1 or Level 2 scope based on whether CUI is present
Frequently asked questions
How do I install the CMMC Level 2 agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
What do I need to run it?
You need Python 3 to run scripts/process.py. You also need a JSON file describing each requirement's status and its official DoD weight, because the script does not supply weights.
Is the skill free to use?
The skill is published under the Apache-2.0 licence, as listed on this page. Check the licence file in the repository for the full terms.
Does this skill certify my company for CMMC?
No. The skill is guidance only. Formal Level 2 assessment requires a C3PAO or DoD process, so verify the output with qualified assessors and legal counsel.
Does the skill send my data over the network?
According to its listing, the skill does not use the network. It does run scripts, so review scripts/process.py before running it on sensitive data.
Is the skill up to date with current CMMC rules?
Not guaranteed. The skill relies on static reference files, and the agent may not check current DoD sources. Confirm current rules, weights and POA&M requirements at the official DoD CMMC site and in 32 CFR Part 170.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits compliance and security leads at defense contractors, IT teams building an SSP or POA&M for NIST SP 800-171, and consultants who want a structured starting point for SPRS scoring. It does not certify anything, and it may rely on rules or weights that have changed, so pick a qualified assessor or a current official source if you need a formal determination.
Download the skill