CMMC Hashing Guide - Revision history

David at 01:30, 2 March 2026

2026-03-02T01:30:58Z

← Older revision		Revision as of 01:30, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Hashing Guide Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''		'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Hashing Guide Version 2.13, September 2024] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us]. Thank you.

	== NOTICES ==		== NOTICES ==

David: /* Process Overview */

2025-03-16T21:13:58Z

Process Overview

← Older revision		Revision as of 21:13, 16 March 2025
Line 39:		Line 39:
	During the course of the assessment, the team collects information through three assessment methods: interviews, artifact examination, and observation. This collection may include such activities as interviewing organization staff, examining the documents or the configuration of a device, and observing organization staff performing actions (Figure 1). It is important to collect evidence while performing these actions, to substantiate MET or NOT MET decisions for each CMMC requirement.		During the course of the assessment, the team collects information through three assessment methods: interviews, artifact examination, and observation. This collection may include such activities as interviewing organization staff, examining the documents or the configuration of a device, and observing organization staff performing actions (Figure 1). It is important to collect evidence while performing these actions, to substantiate MET or NOT MET decisions for each CMMC requirement.

	[[ File:ArtifactHashingToolFigure1.png \| center \| ~~'''~~Figure 1 - Assessment Execution~~'''~~ ]]		[[ File:ArtifactHashingToolFigure1.png \| center \| Figure 1 - Assessment Execution ]]

	The central location where collected assessment artifacts are stored may be a single root directory (Figure 2, Scenario 1) where all documents are stored. Optionally, the root directory may have subdirectories within it (Figure 2, Scenario 2). The Artifact Hashing Tool can operate in either scenario.		The central location where collected assessment artifacts are stored may be a single root directory (Figure 2, Scenario 1) where all documents are stored. Optionally, the root directory may have subdirectories within it (Figure 2, Scenario 2). The Artifact Hashing Tool can operate in either scenario.

	[[ File:ArtifactHashingToolFigure2.png \| center \| ~~'''~~Figure 2 - Folder Hierarchy Scenarios~~'''~~ ]]		[[ File:ArtifactHashingToolFigure2.png \| center \| Figure 2 - Folder Hierarchy Scenarios ]]

	Clearly naming artifacts will aid in the event of an audit or retrospective reviews of assessment data. Artifact filenames should follow a standardized naming pattern or be grouped by CMMC requirement.		Clearly naming artifacts will aid in the event of an audit or retrospective reviews of assessment data. Artifact filenames should follow a standardized naming pattern or be grouped by CMMC requirement.

David: /* Use Example */

2025-03-16T21:13:32Z

Use Example

← Older revision		Revision as of 21:13, 16 March 2025
Line 83:		Line 83:
	In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.		In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.

	[[ File:ArtifactHashingToolFigure3.png \| center ~~frame~~ \| Figure 3 - Assessment file directory before hash ]]		[[ File:ArtifactHashingToolFigure3.png \| center \| Figure 3 - Assessment file directory before hash ]]

	Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.		Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.

	[[File:ArtifactHashingToolFigure4.png\|\|Figure 4 - Successful execution of ArtifactHash.ps1]]		[[ File:ArtifactHashingToolFigure4.png \| center \| Figure 4 - Successful execution of ArtifactHash.ps1 ]]

	[[File:ArtifactHashingToolFigure5.png\|\|Figure 5 - Assessment file directory after script execution]]		[[ File:ArtifactHashingToolFigure5.png \| center \| Figure 5 - Assessment file directory after script execution ]]

	CMMCAssessmentArtifacts.log, in Figure 6, is a text file that contains the hashing algorithm used, hash value of each individual file in the directory, and the filename and path. This text file contains the list of artifacts. The filename is entered into the Hashed Data List data field in the CMMC instantiation of eMASS.		CMMCAssessmentArtifacts.log, in Figure 6, is a text file that contains the hashing algorithm used, hash value of each individual file in the directory, and the filename and path. This text file contains the list of artifacts. The filename is entered into the Hashed Data List data field in the CMMC instantiation of eMASS.

	[[File:ArtifactHashingToolFigure6.png\|\|Figure 6 - CMMCAssessmentArtifacts.log]]		[[ File:ArtifactHashingToolFigure6.png \| center \| Figure 6 - CMMCAssessmentArtifacts.log ]]

	CMMCAssessmentLogHash.log in Figure 7, is a text file that contains the single return value generated by creating a hash of CMMCAssessmentArtifacts.log. This hash is the string to enter in the Hash Value data field in the CMMC instantiation of eMASS.		CMMCAssessmentLogHash.log in Figure 7, is a text file that contains the single return value generated by creating a hash of CMMCAssessmentArtifacts.log. This hash is the string to enter in the Hash Value data field in the CMMC instantiation of eMASS.

	[[File:ArtifactHashingToolFigure7.png\|\|Figure 7 - CMMCAssessmentLogHash.log]]		[[ File:ArtifactHashingToolFigure7.png \| center \| Figure 7 - CMMCAssessmentLogHash.log ]]

	=== Supplemental Information ===		=== Supplemental Information ===

David: /* Use Example */

2025-03-16T21:12:34Z

Use Example

← Older revision		Revision as of 21:12, 16 March 2025
Line 83:		Line 83:
	In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.		In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.

	[[ File:ArtifactHashingToolFigure3.png \| frame \| Figure 3 - Assessment file directory before hash ]]		[[ File:ArtifactHashingToolFigure3.png \| center frame \| Figure 3 - Assessment file directory before hash ]]

	Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.		Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.

David: /* Use Example */

2025-03-16T21:12:19Z

Use Example

← Older revision		Revision as of 21:12, 16 March 2025
Line 83:		Line 83:
	In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.		In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.

	[[File:ArtifactHashingToolFigure3.png\| ~~center~~ \|~~'''~~Figure 3 - Assessment file directory before hash~~'''~~]]		[[ File:ArtifactHashingToolFigure3.png \| frame \| Figure 3 - Assessment file directory before hash ]]

	Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.		Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.

David: /* Use Example */

2025-03-16T21:11:14Z

Use Example

← Older revision		Revision as of 21:11, 16 March 2025
Line 83:		Line 83:
	In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.		In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.

	[[File:ArtifactHashingToolFigure3.png\|\|Figure 3 - Assessment file directory before hash]]		[[File:ArtifactHashingToolFigure3.png\| center \|'''Figure 3 - Assessment file directory before hash''']]

	Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.		Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.

David: /* Process Overview */

2025-03-16T21:06:01Z

Process Overview

← Older revision		Revision as of 21:06, 16 March 2025
Line 39:		Line 39:
	During the course of the assessment, the team collects information through three assessment methods: interviews, artifact examination, and observation. This collection may include such activities as interviewing organization staff, examining the documents or the configuration of a device, and observing organization staff performing actions (Figure 1). It is important to collect evidence while performing these actions, to substantiate MET or NOT MET decisions for each CMMC requirement.		During the course of the assessment, the team collects information through three assessment methods: interviews, artifact examination, and observation. This collection may include such activities as interviewing organization staff, examining the documents or the configuration of a device, and observing organization staff performing actions (Figure 1). It is important to collect evidence while performing these actions, to substantiate MET or NOT MET decisions for each CMMC requirement.

	[[ File:ArtifactHashingToolFigure1.png \| center \| Figure 1 - Assessment Execution ]]		[[ File:ArtifactHashingToolFigure1.png \| center \| '''Figure 1 - Assessment Execution''' ]]

	The central location where collected assessment artifacts are stored may be a single root directory (Figure 2, Scenario 1) where all documents are stored. Optionally, the root directory may have subdirectories within it (Figure 2, Scenario 2). The Artifact Hashing Tool can operate in either scenario.		The central location where collected assessment artifacts are stored may be a single root directory (Figure 2, Scenario 1) where all documents are stored. Optionally, the root directory may have subdirectories within it (Figure 2, Scenario 2). The Artifact Hashing Tool can operate in either scenario.

	[[File:ArtifactHashingToolFigure2.png\|\|Figure 2 - Folder Hierarchy Scenarios]]		[[ File:ArtifactHashingToolFigure2.png \| center \| '''Figure 2 - Folder Hierarchy Scenarios''' ]]

	Clearly naming artifacts will aid in the event of an audit or retrospective reviews of assessment data. Artifact filenames should follow a standardized naming pattern or be grouped by CMMC requirement.		Clearly naming artifacts will aid in the event of an audit or retrospective reviews of assessment data. Artifact filenames should follow a standardized naming pattern or be grouped by CMMC requirement.

Wikiadmin: /* Process Overview */

2025-03-16T21:02:37Z

Process Overview

← Older revision		Revision as of 21:02, 16 March 2025
Line 39:		Line 39:
	During the course of the assessment, the team collects information through three assessment methods: interviews, artifact examination, and observation. This collection may include such activities as interviewing organization staff, examining the documents or the configuration of a device, and observing organization staff performing actions (Figure 1). It is important to collect evidence while performing these actions, to substantiate MET or NOT MET decisions for each CMMC requirement.		During the course of the assessment, the team collects information through three assessment methods: interviews, artifact examination, and observation. This collection may include such activities as interviewing organization staff, examining the documents or the configuration of a device, and observing organization staff performing actions (Figure 1). It is important to collect evidence while performing these actions, to substantiate MET or NOT MET decisions for each CMMC requirement.

	[[ File:ArtifactHashingToolFigure1.png \| \| Figure 1 - Assessment Execution ]]		[[ File:ArtifactHashingToolFigure1.png \| center \| Figure 1 - Assessment Execution ]]

	The central location where collected assessment artifacts are stored may be a single root directory (Figure 2, Scenario 1) where all documents are stored. Optionally, the root directory may have subdirectories within it (Figure 2, Scenario 2). The Artifact Hashing Tool can operate in either scenario.		The central location where collected assessment artifacts are stored may be a single root directory (Figure 2, Scenario 1) where all documents are stored. Optionally, the root directory may have subdirectories within it (Figure 2, Scenario 2). The Artifact Hashing Tool can operate in either scenario.

Wikiadmin: /* Process Overview */

2025-03-16T20:59:36Z

Process Overview

← Older revision		Revision as of 20:59, 16 March 2025
Line 39:		Line 39:
	During the course of the assessment, the team collects information through three assessment methods: interviews, artifact examination, and observation. This collection may include such activities as interviewing organization staff, examining the documents or the configuration of a device, and observing organization staff performing actions (Figure 1). It is important to collect evidence while performing these actions, to substantiate MET or NOT MET decisions for each CMMC requirement.		During the course of the assessment, the team collects information through three assessment methods: interviews, artifact examination, and observation. This collection may include such activities as interviewing organization staff, examining the documents or the configuration of a device, and observing organization staff performing actions (Figure 1). It is important to collect evidence while performing these actions, to substantiate MET or NOT MET decisions for each CMMC requirement.

	[[File:ArtifactHashingToolFigure1.png\|\|Figure 1 - Assessment Execution]]		[[ File:ArtifactHashingToolFigure1.png \| \| Figure 1 - Assessment Execution ]]

	The central location where collected assessment artifacts are stored may be a single root directory (Figure 2, Scenario 1) where all documents are stored. Optionally, the root directory may have subdirectories within it (Figure 2, Scenario 2). The Artifact Hashing Tool can operate in either scenario.		The central location where collected assessment artifacts are stored may be a single root directory (Figure 2, Scenario 1) where all documents are stored. Optionally, the root directory may have subdirectories within it (Figure 2, Scenario 2). The Artifact Hashing Tool can operate in either scenario.

David: /* Use Example */

2025-03-16T19:34:22Z

Use Example

← Older revision		Revision as of 19:34, 16 March 2025
Line 82:		Line 82:
	==== Use Example ====		==== Use Example ====
	In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.		In this simple example, a C3PAO has used four files provided by an OSC to support an assessment. The four assessment related files are in a directory along with the PowerShell script as shown in Figure 3.

	[[File:ArtifactHashingToolFigure3.png\|\|Figure 3 - Assessment file directory before hash]]		[[File:ArtifactHashingToolFigure3.png\|\|Figure 3 - Assessment file directory before hash]]

	Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.		Figure 4 shows the successful execution of the PowerShell script and Figure 5 shows the same directory with the addition of the two PowerShell output files.

	[[File:ArtifactHashingToolFigure4.png\|\|Figure 4 - Successful execution of ArtifactHash.ps1]]		[[File:ArtifactHashingToolFigure4.png\|\|Figure 4 - Successful execution of ArtifactHash.ps1]]

	[[File:ArtifactHashingToolFigure5.png\|\|Figure 5 - Assessment file directory after script execution]]		[[File:ArtifactHashingToolFigure5.png\|\|Figure 5 - Assessment file directory after script execution]]

	CMMCAssessmentArtifacts.log, in Figure 6, is a text file that contains the hashing algorithm used, hash value of each individual file in the directory, and the filename and path. This text file contains the list of artifacts. The filename is entered into the Hashed Data List data field in the CMMC instantiation of eMASS.		CMMCAssessmentArtifacts.log, in Figure 6, is a text file that contains the hashing algorithm used, hash value of each individual file in the directory, and the filename and path. This text file contains the list of artifacts. The filename is entered into the Hashed Data List data field in the CMMC instantiation of eMASS.

	[[File:ArtifactHashingToolFigure6.png\|\|Figure 6 - CMMCAssessmentArtifacts.log]]		[[File:ArtifactHashingToolFigure6.png\|\|Figure 6 - CMMCAssessmentArtifacts.log]]

	CMMCAssessmentLogHash.log in Figure 7, is a text file that contains the single return value generated by creating a hash of CMMCAssessmentArtifacts.log. This hash is the string to enter in the Hash Value data field in the CMMC instantiation of eMASS.		CMMCAssessmentLogHash.log in Figure 7, is a text file that contains the single return value generated by creating a hash of CMMCAssessmentArtifacts.log. This hash is the string to enter in the Hash Value data field in the CMMC instantiation of eMASS.

	[[File:ArtifactHashingToolFigure7.png\|\|Figure 7 - CMMCAssessmentLogHash.log]]		[[File:ArtifactHashingToolFigure7.png\|\|Figure 7 - CMMCAssessmentLogHash.log]]