The Enclave Build · Part 4 of 6

Your answers become your documentation

Same practices, same artifacts, same signature. The guided path changes who holds the pen for the first draft, and in most cases gets you to a completed Level 2 enclave in about 30 days.

By Rob Maupin · Author of the CMMC Practical Guides series

In Part 3 we looked at where Level 2 self-assessments stall: not the configuration, but roughly 176 files of documentation. This is the full explanation of L2 CUI Enclave — Guided Documentation, in a deliberate order. A careful buyer should be wary of anything that sounds like a shortcut, so we start with what doesn't change.

The short version: you're buying back the drafting. The controls, the artifact set, and the review are the same. What changes is that you're not staring at a blank System Security Plan (SSP) on a Tuesday night.

1. What stays the same

Everything in the L2 CUI Enclave Package:

• The same 110 NIST SP 800-171 practices. None skipped or softened.
• The same 182 defined artifacts, roughly 176 files
• The same configuration guides for Microsoft 365 GCC High or Google Workspace
• The same pre-filled SSP structure, POAM framework, Risk Register, and evidence checklist
• Your consulting sessions, which don't go away
• Your signature on the affirmation

You still configure the enclave from our guides. It's the same practice set Volume 2 of my CMMC Practical Guides is organized around. The guided tier doesn't change what you document, only how the first draft gets written.

2. What changes: the drafting

Instead of working through 182 artifacts template by template, you answer a structured set of questions about how your enclave is actually configured: your settings, your devices, your roles, your procedures. Your answers become your documentation. Your sessions shift from "let's write this together" to "let's review what you have and get it signed."

Drafting stops being the bottleneck. Configuration is still on your clock, and that's where the real time goes.

Why answers first works better: the person who configured the enclave can answer the configuration questions directly, with no back-and-forth with whoever is writing. And because your documents start from one set of answers instead of 176 separate drafting sessions, the same fact doesn't get written three different ways.

3. Where the truth comes from

Three roles, and you hold the last one. Your answers capture your environment as you configured it. Our review checks the output against what you actually built. Your signature goes on the affirmation. Nothing gets attested that we haven't looked at together.

5. Fit comes first

Before you buy, we confirm this fits your environment. If it doesn't, we'll tell you and point you at the right path. Nobody should end up with documentation describing an environment they haven't built yet. In practice, it fits a self-assessment program with limited CUI needs, an enclave that's configured or being configured, and someone on your team who can follow the configuration guides. Part 6 of this series covers fit in full.

"Isn't this just boilerplate?"

It's the opposite of boilerplate. Boilerplate is a generic template that describes a company that isn't yours. This describes your configuration because your answers are what it's built from, and your consultant reviews every document before it goes in your Evidence Locker.

What you still own after sign-off

"Guided" isn't "handled." A Level 2 self-assessment is repeated every three years and affirmed every year. When your configuration changes, your documentation changes with it. Evidence still gets collected, and someone still puts their name on the affirmation each year. You just start from documentation that describes your enclave accurately, which makes keeping it accurate a lot easier.

Same finish line, less time in a text editor. If you've got someone who can execute the configuration guides, this is the version that gets you to a packaged, date-stamped self-assessment without the writing consuming your quarter. In most cases, that's about 30 days.

Coming up in The Enclave Build

Part 5: One enclave, scope to signature, with both platforms side by side.

Part 6: Who the guided tier fits, and where everyone else should go.

Talk soon,

Rob Maupin

Founder, Overwatch Tools · Author, CMMC Practical Guides: Volume 1 · Volume 2

Overwatch Tools | CMMC Compliance Solutions

Sent October 22, 2026. Reflects requirements in force at the time of sending; guidance may change. General information, not legal advice. Whether information you hold is CUI is determined by your contract and your contracting officer or prime.