AI-Guardrails

Unclassified operator layer · Small US DIB

AG-PUB-002 Pack contents · 01 Sep 2026
Not a DoD publication

Warfighter Delivery Pack · $49 · one CAGE

What’s in the pack

A print-and-fill kit. HTML for US Letter printing, Markdown for editing, plus the license. The download files are operator templates. They are not a portal and they do not contain CUI, classified information, or proposal text written for you. Educators looking for the class leave-behind: that SKU is Gate-Zero Pack (Partner Edition) — partner page. Shops buy this $49 pack today.

Fill every bracketed field yourself. These files ship empty of real program data on purpose. If a rule is uncertain, the pack says “confirm on the official page” and gives the URL. It does not invent DFARS clause text.

01

Bid-ready checklist

SAM.gov / CAGE / UEI / SPRS hygiene before you bid. Confirm registration is Active, UEI and CAGE match the IRS/legal name, and reps and certs are current. Open the live solicitation and hunt the actual clauses: FAR 52.204-21, DFARS 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021, 252.204-7025, and any class deviation named in Section I or L. Do not guess. Confirm on acquisition.gov or the solicitation PDF.

Includes a blank Section L/M matrix and a pink-team pass. No proposal ghostwriting.

02

CMMC Phase I operator sheet

Evidence worksheet and a 110-row tracker aligned to NIST SP 800-171 Revision 2 — still the scored CMMC Level 2 baseline as of 31 August 2026, not Rev 3. Assign an owner per control family. Locate your System Security Plan and POA&M (if any). Do not invent a SPRS score in this pack. Confirm scoring on 32 CFR 170.24.

As of this date: the DFARS CMMC acquisition rule took effect 10 November 2025; Phase I self-assessment remains in force; Phase II C3PAO assessments were suspended 13 July 2026. Confirm live status on the official CMMC page. This sheet is not an assessment and AI-Guardrails is not a C3PAO.

03

Blank CUI handling SOP template

An organization SOP you fill: what you handle, where it lives, who may access it, how it is marked, stored, transmitted, and destroyed, and what happens on a suspected incident. Confirm incident reporting on DFARS 252.204-7012 (72 hours / DIBNet as published) and confirm the DIBNet path on the official page if the URL has moved.

No CUI samples. No classified examples. Do not paste real CUI into the template files.

04

CDRL / deliverable tracker + weekly cadence

Stand up one tracker per contract. Due dates, owners, format, inspection, and submission path — unclassified delivery language only. Weekly cadence covers risks, schedule, and customer communications so CDRLs do not surprise the program office.

05

Owner approval board

One-page wall sheet. Staff may draft. Drafting tools may draft. Public release, proposal submission, SPRS entries, and incident reports are owner actions. The owner/PM initials the owner-only column. Guardrails, not autopilot.

Week one, compressed

  1. Read the license. One company, one CAGE, internal use.
  2. Print 01. Confirm SAM. Write company / CAGE / UEI on the cover block.
  3. Open every live solicitation or contract. Fill the clause matrix from the actual text.
  4. Print 02. Locate SSP and POA&M. Assign owners. Do not invent scores.
  5. Fill 03 as your org SOP. Keep real CUI out of the template files.
  6. Stand up 04 for the contract. Tape 05 on the wall.
  7. Owner review: SAM status, SPRS / affirmation date, open POA&M clock, next CDRL due date.

Conditional CMMC Status, where it still applies, has a published close-out clock — confirm 32 CFR 170.16 / 170.21 rather than trusting a secondary summary. Artifact retention: confirm the current sentence on eCFR (historically six years from a CMMC Status Date for some Level 1 records under 32 CFR 170.15) before you rely on it.

License, in one paragraph

The purchaser may use the pack for one legal entity identified by one CAGE code. Print, copy internally, and fill it in. You may not resell it, white-label it as a CMMC consulting product, or treat it as a C3PAO assessment, legal advice, or access to any software. Two CAGE codes means two licenses unless a multi-entity license is sold in writing.

Optional fill. If a partner sent you, Operator Assist can draft the bracketed fields from answers you provide. You still sign. Scope and limits.

$49 — Get the pack