Cybersecurity, AI & CMMC Resources
A curated collection of free, publicly available resources to help organizations strengthen their cybersecurity posture, govern AI responsibly and navigate CMMC compliance.
Why we share these resources freely: We believe every organization — and the entire Defense Industrial Base — benefits when businesses have access to the best available guidance, regardless of whether they work with us. These resources are a great starting point. When you’re ready for expert help putting them into practice, ZFG is here to help.
Free Tools from ZFG
Practical resources we built for small defense contractors
CMMC Compliance Roadmap for Small Business
Our free 16-page guide to the 8 phases of CMMC Level 2 self-assessment readiness — the same roadmap we use with clients.
PocketCMMC Mobile App
All 110 NIST SP 800-171 requirements in plain language, with SPRS scoring reference and offline access. Free on iOS and Android.
CMMC Level 2 Cost Calculator
Estimate what CMMC Level 2 compliance could cost your organization based on your size and current security maturity.
ZFG on LinkedIn
Follow Zero Fault Guidance for CMMC updates, cybersecurity and AI governance insights, and practical guidance for growing businesses.
Cybersecurity Frameworks & Guidance
Foundational frameworks for building a security program in any industry
NIST Cybersecurity Framework (CSF) 2.0
The widely adopted framework for managing cybersecurity risk, organized around Govern, Identify, Protect, Detect, Respond and Recover. A strong starting point for any organization.
CISA Cyber Essentials
A plain-language guide for leaders of small businesses on the essential actions to build a culture of cybersecurity and reduce risk.
CIS Critical Security Controls
A prioritized set of safeguards to defend against the most common attacks, with implementation groups sized for organizations of every maturity level.
CISA Known Exploited Vulnerabilities Catalog
The authoritative list of vulnerabilities being actively exploited in the wild. Use it to prioritize patching where it matters most.
AI Security & Governance
Frameworks and guidance for adopting AI securely and responsibly
NIST AI Risk Management Framework (AI RMF)
NIST’s voluntary framework for managing the risks of AI systems, organized around Govern, Map, Measure and Manage, with a companion playbook and generative AI profile.
ISO/IEC 42001 — AI Management Systems
The international standard for establishing, implementing and continually improving an AI management system. Useful for organizations formalizing AI governance.
OWASP Top 10 for LLM Applications
The most critical security risks for applications built on large language models — including prompt injection, sensitive information disclosure and supply chain risks.
CISA Artificial Intelligence Resources
CISA’s hub for AI security guidance, including joint guidance on deploying AI systems securely and protecting the data used to train and operate them.
Official DoD & Government Resources
Authoritative guidance directly from the Department of Defense and federal agencies
DoD CIO CMMC Resources & Documentation
The official DoD CMMC resource page with the Final Rule, assessment guides, scoping guidance for all three levels, scoring methodology, and official model documentation.
NIST SP 800-171 Rev 2
The foundational standard for CMMC Level 2. Contains all 110 security requirements for protecting CUI in nonfederal systems. This is what your SSP, policies, and controls must address.
NIST SP 800-171A — Assessment Procedures
Defines the assessment objectives and methods (examine, interview, test) for each of the 110 controls. This is essentially the playbook an assessor follows — for self-assessments and C3PAO assessments alike.
DoD Assessment Methodology (DoDAM)
The official scoring methodology for NIST SP 800-171 assessments, including the SPRS scoring formula, point values per control, and how the 110-point scoring system works.
NARA CUI Registry
The official registry of Controlled Unclassified Information categories maintained by the National Archives. Use this to understand what types of CUI your organization may handle.
32 CFR Part 170 — CMMC Final Rule
The full regulatory text of the CMMC program as published in the Code of Federal Regulations. The definitive legal reference for CMMC requirements and assessment procedures.
Cyber AB & Assessment Resources
The Cyber AB (formerly CMMC-AB) accredits C3PAOs and manages the CMMC ecosystem
The Cyber AB (Accreditation Body)
The official accreditation body for the CMMC ecosystem. Find accredited C3PAOs, Registered Practitioner Organizations (RPOs), and certified assessors through their marketplace.
Cyber AB Marketplace
Search for accredited C3PAOs to conduct your Level 2 assessment, find RPOs for consulting support, and verify practitioner credentials. Use this when you’re ready to schedule your assessment.
SPRS (Supplier Performance Risk System)
Where you submit your NIST 800-171 self-assessment score. Required under DFARS 252.204-7019/7020. Your score (out of 110) is entered here and visible to DoD contracting officers.
CMMC Training Academy — Documentation Library
A comprehensive collection of CMMC-related documents including assessment guides, reference materials, NIST publications, and training resources compiled in one place.
Free Government Assistance Programs
Free or low-cost programs specifically designed to help small defense contractors
Project Spectrum (DoD OSBP)
Free DoD initiative providing cybersecurity training, readiness assessments, and CMMC preparation resources for small businesses in the defense industrial base. Includes CMMC Level 1 and Level 2 courses and free readiness checks.
APEX Accelerators (formerly PTACs)
97 centers nationwide providing free advisory support for CMMC planning, gap assessment guidance, and referrals to certified RPOs and C3PAOs. Funded by the DoD to help small businesses.
Small Business Development Centers (SBDCs)
~900 locations nationwide offering free and low-cost services. SBDC advisors can help you understand CMMC requirements, develop compliance plans, and identify cost reduction strategies.
CSIAC (Cyber Security Information Analysis Center)
Provides up to 4 hours of free technical advisory services for cybersecurity questions. For longer engagements, offers government-rate pricing. A great resource for specific technical questions.
Free Templates & Documentation Tools
Starting points for building your compliance documentation
NIST Official SSP Template
The official System Security Plan template from NIST. A basic starting framework that requires substantial customization — but it’s the authoritative starting point.
Peak InfoSec — Free SSP & DTM Templates
Free SSP templates, Document Traceability Matrix, scope diagram templates, and assessment readiness questionnaire from a practicing CMMC assessor. Includes helpful video walkthroughs.
DoD ESTCP Cybersecurity Templates
About twenty downloadable documents from the DoD’s Environmental Security Technology Certification Program, including incident response forms and a comprehensive IT policy document.
Strike Graph — Free Editable CMMC Templates
Editable templates organized by Level 1, 2, and 3 covering every required domain. Includes example evidence, expert tips, and notes on common pitfalls. No email required to download.
Secureframe — CMMC Documentation Templates
Templates for key CMMC documents including SSP, POA&M, configuration management procedures, and incident response plans. Created by former auditors.
CMMC Policy Creator
Automated policy generator created by a Certified CMMC Assessor. Fill in a form and receive complete, control-mapped policy documents for Level 1 (7 policies) or Level 2 (15 policies).
Technical & Configuration Resources
Tools for implementing and validating security controls
CIS Benchmarks
Industry-standard security configuration baselines for operating systems, cloud platforms, and applications. Use these to meet CMMC configuration management requirements (CM family).
NIST National Vulnerability Database (NVD)
The U.S. government repository of all published software and hardware vulnerabilities (CVEs). Use this to meet vulnerability management requirements (RA and SI families).
CISA SCuBA (Secure Cloud Business Applications)
Detailed security configuration guidance for Microsoft 365 and Google Workspace from CISA. Directly applicable to meeting CMMC secure configuration requirements for cloud platforms.
DISA STIGs (Security Technical Implementation Guides)
DoD’s official hardening guides for operating systems, applications, and network devices. Referenced in CMMC for secure configuration settings (CM.L2-3.4.2).
Community & Learning Resources
Forums, curated link collections, and educational materials
CMMCAudit.org — Templates & Tools Directory
One of the most comprehensive curated lists of CMMC templates, tools, and resources on the internet. Includes reviews and evaluations of each resource with practical commentary.
KLC Consulting — CMMC & NIST Resource Collection
A thorough collection of authoritative links covering CMMC resources, NIST 800-171 resources, CUI resources, and DFARS resources. Well-organized and regularly updated.
ND-ISAC MSP Evaluation Questionnaire
Scoring template for evaluating IT managed service providers for CMMC support. Essential if you’re considering outsourcing IT to an MSP — helps you ask the right questions.
r/CMMC (Reddit Community)
Active community of CMMC practitioners, assessors, and contractors sharing real-world experiences, cost data, implementation tips, and lessons learned. Great for peer insights.
Ready to Go Beyond Templates?
Free resources are a great starting point. Turning them into a working security program, a sound AI governance approach or an assessment-ready CMMC environment is where expert guidance pays off.
Schedule Consultation