Commonly Accepted and Practiced CMMC Operation Matrix

Commonly Accepted and Practiced CMMC Operating Model

The Commonly Accepted and Practiced CMMC Operating Model (CAPCOM) serves as the comprehensive repository for all CMMC Level 2 security requirements, assessment objectives, and methodologies for evidence collection and evaluation. Powered by Claude's advanced Large Language Model technology, CAPCOM provides guidance for evaluating information system compliance with the Department of Defense's Cybersecurity Maturity Model Certification program. Security professionals and IT leaders can leverage this AI-enhanced model to systematically identify gaps between their organizational infrastructure and CMMC requirements, enabling strategic remediation planning and implementation.

For inquiries and reporting errors on this wiki, please contact us. Thank you.

Access Control (AC)

AC.L2-3.1.1 – Authorized Access Control [CUI Data]

Practice and Assessment Objectives	LLM Prompt	LLM Response
AC.L2-3.1.1 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).		LLM Prompt Template
[a] authorized users are identified.	LLM Prompt	LLM Response
[b] processes acting on behalf of authorized users are identified.	LLM Prompt	LLM Response
[c] devices (and other systems) authorized to connect to the system are identified.	LLM Prompt	LLM Response
[d] system access is limited to authorized users.	LLM Prompt	LLM Response
[e] system access is limited to processes acting on behalf of authorized users.	LLM Prompt	LLM Response
[f] system access is limited to authorized devices (including other systems).	LLM Prompt	LLM Response