Evidence Package // Acme Precision Manufacturing

System Security Plan

system-security-plan.json SSP

The SSP describes the system boundary, enumerates components, and documents how each CMMC L2 requirement is implemented. Below is the metadata and one sample implemented-requirement.

{
  "system-security-plan": {
    "uuid": "b8190c64-4280-57b0-9044-3ae79a16e441",
    "metadata": {
      "title": "Acme Precision Manufacturing CUI Environment -- System Security Plan",
      "last-modified": "2026-04-12T13:26:14Z",
      "version": "0.1.0",
      "oscal-version": "1.2.1",
      "parties": [
        { "type": "organization", "name": "Acme Precision Manufacturing, Inc." },
        { "type": "organization", "name": "grc.engineering" }
      ]
    },
    "system-characteristics": {
      "system-name": "Acme Precision Manufacturing CUI Environment",
      "description": "AWS-hosted CAD/CAM and ERP systems processing ITAR technical drawings",
      "authorization-boundary": {
        "description": "AWS account 111222333444 -- VPC-isolated CUI processing environment..."
      }
    }
  }
}

Sample Implemented Requirement: AC.L2-3.1.1

Each implemented-requirement links statements to Prowler check IDs and enforcement artifacts.

{
  "control-id": "AC.L2-3.1.1",
  "description": "This component limits AWS access to authorized users...",
  "props": [
    { "name": "implementation-status", "value": "implemented" }
  ],
  "statements": [
    {
      "statement-id": "AC.L2-3.1.1_smt.a",
      "description": "Root account is sealed. iam_no_root_access_key is satisfied...",
      "props": [{
        "name": "prowler-check-ids",
        "value": "iam_no_root_access_key,iam_root_mfa_enabled"
      }],
      "links": [
        { "href": "terraform/main.tf", "rel": "implementation" },
        { "href": "steampipe/ac-l2-3.1.1.sql", "rel": "validation" }
      ]
    }
  ]
}

Assessment Results

assessment-results.json AR

Each result block contains observations from a Prowler scan. Every observation has a check ID, pass/fail status, severity, and the timestamp when the check executed.

Raw OSCAL Observation

{
  "uuid": "ba8b4ab4-a840-429a-ab70-e2e3773eb06b",
  "title": "Ensure ACM certificates are not expiring within 30 days",
  "description": "Prowler check acm_certificates_expiration_check: Pass. Resource: AwsAcmCertificate arn:aws:service:us-east-1:111222333444:acme-erp-cert",
  "methods": ["AUTOMATED"],
  "collected": "2026-04-12T12:55:35Z",
  "props": [
    { "name": "prowler-check-id", "value": "acm_certificates_expiration_check" },
    { "name": "prowler-status", "value": "Pass" },
    { "name": "prowler-severity", "value": "High" }
  ]
}

Plan of Action and Milestones

poam.json POA&M

12 open items with a current SPRS score of 62. Each item is linked to specific failing observations in the assessment results.

Raw OSCAL POA&M Item

{
  "uuid": "9d71e057-43d0-412e-a60c-42175329ed97",
  "title": "3.1.1 -- Limit system access to authorized users",
  "description": "Requirement 3.1.1 has 1 failing check(s) across 1 resource(s).",
  "props": [
    { "name": "sprs-points", "value": "5" },
    { "name": "severity", "value": "critical" },
    { "name": "poam-id", "value": "POAM-3_1_1" },
    { "name": "status", "value": "open" }
  ],
  "related-observations": [
    { "observation-uuid": "7de3a278-2ea7-4e2b-911e-b39880c99871" }
  ]
}

Component Definition: AWS IAM

aws-iam-ac-l2-3.1.1.json Component Definition

This component covers the IAM layer of AC.L2-3.1.1 -- 9 of the 26 Prowler checks that map to NIST SP 800-171 Rev 2 section 3.1.1. Four statements decompose the control into verifiable sub-goals.

Enforcement Layers

{
  "component-definition": {
    "metadata": {
      "title": "grc-eng AWS IAM Component -- AC.L2-3.1.1 (IAM layer)",
      "oscal-version": "1.2.1"
    },
    "components": [{
      "title": "AWS Identity and Access Management (grc-eng baseline)",
      "type": "service",
      "purpose": "Limit AWS access to authorized users, processes, and devices at the IAM layer, per CMMC AC.L2-3.1.1",
      "control-implementations": [{
        "source": "trestle://profiles/cmmc-l2/profile.json",
        "implemented-requirements": [{
          "control-id": "AC.L2-3.1.1",
          "props": [
            { "name": "implementation-status", "value": "implemented" }
          ],
          "statements": [/* 4 statements: smt.a through smt.d */]
        }]
      }]
    }]
  }
}

Component Definition: AWS CloudTrail + GuardDuty

aws-cloudtrail-au-l2-3.3.1.json Component Definition

Covers AU.L2-3.3.1 -- system audit log creation and retention. Multi-region CloudTrail with S3 data events, CloudWatch integration with 365-day retention, VPC flow logs, and GuardDuty continuous monitoring.

Component Definition: AWS Encryption at Rest

aws-encryption-rest-sc-l2-3.13.11.json Component Definition

Covers SC.L2-3.13.11 -- FIPS-validated cryptography for CUI at rest. All storage services use AWS KMS Customer Managed Keys backed by FIPS 140-2 Level 3 HSMs.

Provenance and Chain of Custody

provenance/ Metadata

This evidence package was generated by an automated compliance-as-code pipeline. No manual editing occurred after generation.

Tool Chain

Verification Commands

# Verify file integrity
sha256sum -c SHA256SUMS

# Verify GPG signature (requires grc.engineering public key)
gpg --verify SHA256SUMS.sig SHA256SUMS

# Validate OSCAL schema compliance
trestle validate -f system-security-plan.json
trestle validate -f assessment-results.json
trestle validate -f poam.json