Evidence & SSP
Build a record that connects your environment, responsibilities, and operating evidence.
Find your next step
RSS feed7 guides
- Evidence & SSP
How does Garde1 take me from scope to a defensible CMMC record?
Answer questions about your company once. Garde1 builds your scope, writes the SSP and 14 policies, reads evidence from your tools, scores all 110 requirements, and hands you the fixes.
Kyle Fahey - Evidence & SSP
What is a Customer Responsibility Matrix, and what do shared and inherited mean?
A CRM lists who does each control: the provider, both of you, or just you. Shared rows are where assessments go wrong. Real Google and PreVeil rows, decoded.
Andrew Erne - Evidence & SSP
How do I keep my SSP and SPRS assessment describing the same environment?
Your SSP, workbook, and SPRS entry must name the same system, CAGEs, providers, and devices. How SSPs drift and how to catch it before you submit.
Andrew Erne - Evidence & SSP
CMMC evidence: what supports a self-assessment?
Connect evidence to assessment objectives, show what each record covers, and keep missing populations, contradictions and remediation rechecks visible.
Kyle Fahey - Evidence & SSP
CMMC mock assessment: scope, evidence, findings, and limitations
Ask what a mock examines, how missing proof is handled, and how fixes are verified. Separate useful preparation findings from official assessment results.
Andrew Erne - Evidence & SSP
What does MET look like in a 20-person company?
One requirement, AC.L2-3.1.1, worked end to end at a 20-person shop: six objectives, one expired guest account, and why five of six is still NOT MET.
Kyle Fahey - Evidence & SSP
What does a C3PAO actually ask for on assessment day?
Your SSP, scope, inventory, diagram, provider matrices, and proof for each objective, then a live demonstration. And the usual reasons a requirement fails.
Kyle Fahey
