Tools
Implementation recipes
A practice page tells you what a requirement asks. A recipe is organised by the job instead: one worked path from prerequisites to a test you can repeat, with every setting quoted from the vendor's own page and dated. Each recipe supports several practices and does not by itself meet any of them.
How these were made: written from the vendors' documentation, each setting with the vendor's words and the date the page was read. Expert CMMC has not run these configurations in a lab. Run the tests at the end of each recipe on your own systems before you rely on it.
- From vendor documentation, not run by Expert CMMC
Company Windows laptops reach company data only when they are compliant
Every Windows laptop that signs in to company email, files and apps is enrolled in Intune, passes a compliance policy you wrote, and is refused when it does not, including a laptop that is enrolled but has no policy assigned.
Supports AC.L1-b.1.i, AC.L2-3.1.1, IA.L1-b.1.vi, IA.L2-3.5.2, AC.L2-3.1.18
Last reviewed November 12, 2026
Open - From vendor documentation, not run by Expert CMMC
Remote access for a small office: FortiGate IPsec VPN with FortiClient and Entra ID sign-in
People working away from the office reach the office network only through an encrypted IPsec tunnel to the office FortiGate, after signing in to Microsoft Entra ID with multifactor authentication, with their IPv4 traffic sent through the tunnel, IPv6 blocked outside it, and every connection logged; the tests at the end show what a connected laptop can still reach directly. One worked example: other VPN products can do the same job, and naming this one is not a ranking.
Supports AC.L2-3.1.12, AC.L2-3.1.13, AC.L2-3.1.14, IA.L2-3.5.3, SC.L2-3.13.7
Last reviewed November 12, 2026
Open - From vendor documentation, not run by Expert CMMC
Encrypted backups and removable drives: four cases, each with an unlock and a restore test
CUI on a Windows computer's own drives, on a Mac, on a USB stick or external backup drive, is encrypted in the way that fits that case, every recovery key is kept where you can find it and can be read by the roles you name (and, for a Mac, by its user), unencrypted USB drives cannot be written to from company Windows computers while the approved hardware-encrypted backup model still can, and each case ends in an unlock or restore test you can repeat.
Supports SC.L2-3.13.16, MP.L2-3.8.6, MP.L2-3.8.9, MP.L2-3.8.7, AC.L2-3.1.19, SC.L2-3.13.11
Last reviewed November 12, 2026
Open