Policies. Engineered.

CMMC Level 2 requires a written policy for each of the 14 security domains. 1TEN generates all 14 from the configuration and implementation data you entered during your requirements assessment, so each policy describes your actual environment instead of a blank template.

14 CMMC domain policies generated

Per policy Version history and approvals

Word export Formatted for review and signing

What Drives Generation

Each policy is built from the implementation data you entered when assessing your requirements: which tools handle each control, how access is provisioned, who owns each domain, and what your incident response procedures actually are. The Policy Generator synthesizes that data into policy language that describes your specific environment, not a hypothetical one.

The difference shows the moment an assessor reads it. A policy that names your MFA platform, describes the enrollment process, and identifies the administrator responsible for exceptions reads as genuine. It answers the follow-up questions before they are asked. A template policy invites them.

Procedures Alongside Policies

Policies state what your organization does. Procedures describe how it gets done, and CMMC assessors examine both. A policy without supporting procedures is an incomplete documentation package. The Policy Generator produces the domain-level policy and the associated procedures together, keeping the two in sync as your environment changes.

Procedures are generated at the practice level, with step-by-step implementation detail for the controls that require it. When a requirement asks you to document how your organization handles media sanitization or how incident response notifications are made, the procedure output gives assessors the specificity they need to verify the control without an extended interview.

What You See Inside

14 domain policies

Generated from your requirements-assessment data across every CMMC domain: AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC, and SI.

Specific to you

Policy content references your actual tools, systems, and responsible parties, not generic placeholders.

Procedures included

Practice-level procedures generated alongside each domain policy, kept in sync with it.

Versioned and approved

Every regeneration creates a new version with prior versions preserved, plus an approval workflow tracking reviewer, date, and signature.

Word export

Export formatted with policy statement, scope, roles, procedures, and practice references for final review and signing.

In the SSP, regenerated on demand

Policies embed in the SSP Export package, and regenerate when you update an implementation detail in the Requirements Browser.

Coverage

All 14 Domain Policies

Access Control Policy

User access provisioning, least privilege, remote access, and CUI access controls.

Awareness and Training Policy

Security awareness training requirements, role-based training, and frequency.

Audit and Accountability Policy

Audit log requirements, retention period, review frequency, and protection.

Configuration Management Policy

Baseline configuration, change control, software restrictions, and least functionality.

Identification and Authentication Policy

Authenticator management, MFA requirements, password policy, and privileged accounts.

Incident Response Policy

Incident reporting, response procedures, notification requirements, and testing.

Maintenance Policy

Authorized maintenance, remote maintenance controls, and maintenance personnel.

Media Protection Policy

Media access, transport, sanitization, disposal, and CUI marking.

Personnel Security Policy

Personnel screening, termination procedures, and transfer controls.

Physical Protection Policy

Physical access controls, visitor management, monitoring, and facility protection.

Risk Assessment Policy

Risk assessment frequency, vulnerability scanning, and risk response.

Security Assessment Policy

Control assessment, POA&M management, and system security plan maintenance.

System and Comms Protection Policy

Boundary protection, encryption, network segmentation, and remote access.

System and Info Integrity Policy

Malware protection, security alerts, patch management, and monitoring.

Practices

Practices Satisfied

Practice ID	Description
All 14 Domains	Domain-level policy requirements across Access Control, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, System and Information Integrity, and Awareness and Training.
CA.L2-3.12.4	Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, and how security requirements are implemented.