Find gaps against the 800-171 recovery requirements
Before a CMMC assessment, you want a quick read on which backup and recovery requirements you can't yet show evidence for.
- You get
- An interview, one question at a time, then a table of each requirement's status, evidence, fix and POA&M eligibility.
- Works in
- ChatGPT
- Claude
- Copilot
- Gemini
Fill in the blanks
A few words each is enough. Leave a blank empty and the assistant will ask you or assume.
Describe, don't paste: no CUI, personal data, hostnames, IP addresses or credentials. What you type stays on this page until you copy it or open it in an assistant.
Your prompt0 of 2 filled
I'm preparing for a CMMC Level 2 assessment at a [Company size, e.g. 150-person] [Industry, e.g. defense manufacturer]. Interview me about these NIST SP 800-171 Rev. 2 requirements: 3.8.9 (protect backup CUI), 3.6.1 (incident-handling capability), 3.6.2 (track, document and report incidents), 3.6.3 (test incident response), 3.13.11 (FIPS-validated cryptography), 3.13.16 (CUI at rest). For each one, tell me in a sentence what an assessor expects to see, then ask me one question to test whether we meet it. Ask one question at a time and wait for my answer. When we're done, give me a table: requirement, status (met / partial / not met), evidence to collect, the fix if it's not met, and whether it can go on a POA&M under the CMMC rule (32 CFR 170.21). Order the fixes by effort, smallest first. If you aren't sure about a scoring or POA&M rule, say so instead of guessing. Some details above are still in square brackets. Ask me for them before you answer, rather than guessing.
Before you paste
Answer honestly; the table is only useful if "partial" means partial.
Then check the answer
Cyber Readiness Scorecard
Score your recovery readiness in ten minutes
More compliance prompts
All 28 prompts- Draft the backup section of your System Security PlanYou need SSP language for NIST SP 800-171 requirement 3.8.9 and don't want to start from a blank page.
- Write a POA&M entry for a backup gapYou've found a gap and need a Plan of Action and Milestones entry an assessor will accept.
- Check whether your cloud backup provider can hold CUIYour backups include CUI and go to a cloud service, and you need to know whether that service meets DFARS 7012.
- Prepare for your cyber insurance renewalYour renewal questionnaire asks about backups, and a weak answer can raise your premium or put a claim at risk.
- Answer a customer's security questionnaire about backupsA customer or prime sent a security questionnaire and the backup and recovery section is yours to fill in.
Want a person to check the answer?
AI gets you a first draft. A KELYN engineer can tell you whether it would hold up in an assessment or a real recovery.