What this is, and what it is not

A pattern library, not a score tracker

ControlVerdict is not an SPRS calculator, a POA&M tool, or a place to score your organization. Ratings attach to examples — reusable, sanitized descriptions of how a practice can be implemented — so the community can argue where the line sits.

A single example often covers only some of a practice’s assessment objectives on purpose. For CMMC (and similar frameworks), you typically need more than one pattern to address every objective in a control. The product is a repository of pieces; you assemble what fits your scope.

Above the line, below the line

Compliance frameworks state requirements; they do not enumerate the implementations that satisfy them. Two organizations can read the same practice statement, build visibly different things, and both be defensible — or one can be well short and not know it until an assessment. The published guidance is deliberately implementation-neutral, which is correct for a standard and unhelpful when you are deciding what to build on a Tuesday.

The useful knowledge — where the line actually falls — mostly lives in the heads of people who have run or sat through assessments. ControlVerdict exists to write some of it down: concrete examples, explicit verdicts, and stated reasoning, attached to the objective text they are being judged against.

How ratings are counted

Each example is rated on a seven-level scale (overachiever through start-over), with required gaps and/or finish-line details depending on the level. Raters also mark how much of each assessment objective the example covers — covered, partially covered, or not covered — because one write-up rarely clears every objective alone. That language is intentional: coverage of an example is not an OSC “applicable / N/A” finding. A bare tally is noise; the reasoning is what turns a score into an argument you can evaluate.

• Raw score counts every verdict equally — one member, one vote.
• Weighted score counts a verified Certified Assessor’s verdict as 3 votes. Both scores are always shown side by side, so the weighting is visible rather than hidden inside a single number.
• Divergence is surfaced, not smoothed. When assessors and the wider community disagree, the example says so explicitly. That gap is often the most informative thing on the page.
• Small samples are labelled as such. Nothing is called a consensus below 3 verdicts, and “above the line” requires a weighted score of at least 75%.
• You cannot vote on your own example, one account gets one verdict per example, and changing your mind updates your verdict while preserving the history.

Consensus here is evidence about community opinion. It is not a determination, an interpretation from any authority, and not a defense in an assessment. The only bodies whose readings bind you are the ones in your contract. New here? Start with the quick tour. For how ratings are counted, see How verdicts work.

Certified Assessor verification

Assessor status is granted by an administrator who checks a credential against an authoritative source out of band. Only a reference to what was checked is stored, and it is never shown outside the admin console. Verification can be revoked, and revoking it removes the extra weight from that account’s future and existing verdicts alike.

There is deliberately no self-service path to the badge. The badge is the reason assessor verdicts carry more weight, so it has to be worth something.

How your data is handled

• Your email address is not public. It is used for sign-in links and is visible only to administrators. Your public identity is a handle you choose.
• No passwords. Sign-in uses single-use email links, so there is no password database to breach and nothing to reuse across sites.
• Sessions live in the database rather than in a bearer token, which means signing out — or an administrator suspending an account — revokes access immediately instead of at token expiry.
• No third-party analytics or advertising. No tracking scripts are loaded; the content security policy would block them if any were added.
• Removal is reversible. Moderated content is soft-deleted so a mistake can be undone and a discussion does not lose its structure.

To report a vulnerability or possible CUI, see Security.

Moderation

Examples are reviewed by an administrator before they appear publicly. Review is primarily a sanitization check. An example that arguably falls below the line is not removed for being wrong — the verdict system exists precisely to say so in public. Content is removed for unsanitized detail, spam, or abuse.

Every administrative action is recorded in an append-only audit log with the acting account attached, written in the same transaction as the change itself. Rules for what may be posted and how disagreement is handled are in the community guidelines. If content of yours was removed or your account was suspended and you think it was mistaken, see Appeals.

Control text and attribution

Practice statements and assessment objectives are quoted verbatim from NIST SP 800-171 Rev. 2 and NIST SP 800-171A, with CMMC practice identifiers as published in the CMMC Assessment Guide — Level 2. Normative text is never paraphrased, summarized, or reworded here; where you see it styled as a quotation, it is one. NIST publications are US Government works in the public domain. Community commentary is clearly separated from normative text throughout.

This project is not affiliated with or endorsed by NIST, the Department of Defense, the Cyber AB, or any C3PAO.

Scope of this release

CMMC Level 2 practices and assessment objectives are seeded with verbatim text from the Assessment Guide and NIST sources. The schema also supports additional frameworks — adding one is a data change plus minor labelling, not a rewrite. Accuracy of quoted text is the constraint on that work, not the code.