Checklists, crosswalks, matrices, and templates — every one generated from the same practice guidance published on this site, so they cannot drift out of date. Open an asset and print it, or save it as a PDF from your browser.
None of these assets is official Department of War material and none confers compliance, certification, or contractual standing. Each carries a version, a review date, and a link back to the live guidance it was generated from. The official campaign ↗ remains authoritative for the practices themselves.
One page per track covering all twenty practices with owner, effort, stage, and the single question an executive should ask about each.
The first two weeks, sequenced — the 24-hour and 14-day actions from every practice in the first three stages, with space for owner and date.
Every implementation step and validation check for the ten IT practices, in the site's recommended sequence.
Every implementation step and validation check for the ten OT practices, with the safety and change-control considerations attached to each.
The governance, configuration, operations, and validation artifacts worth retaining for each IT practice, with a column for where yours lives.
The governance, configuration, operations, and validation artifacts worth retaining for each OT practice, including maintenance-window and safety-review records.
Every practice mapped to Rev. 2 requirement identifiers with relationship type, confidence, and an explicit caveat for each row.
Practices mapped to Rev. 3 requirement identifiers where a reviewed mapping exists, with the same relationship, confidence, and caveat structure.
Which practices influence which CMMC Level 2 practice identifiers — stated as influence, not as coverage or readiness.
Practices mapped to CSF 2.0 outcome identifiers, useful for reporting the campaign against a framework leadership already recognizes.
Practices mapped to CIS Controls v8.1 safeguards — the most operationally concrete of the crosswalks, and a useful bridge for MSP conversations.
A blank-by-design matrix for agreeing, in writing, who implements, who operates, who evidences, and who is accountable for each practice.
What the campaign is, what it is not, the six-stage sequence, the questions a board should ask, and the honest statement of what implementation does and does not do for contractual obligations.
A structured template for a first-month plan: the 24-hour, 14-day, and 30-day actions with owner, date, validation check, and evidence to retain.
A quarter-length roadmap organized by the six-stage sequence, with a current-and-target maturity column for each practice.
All assets version 1.0, reviewed . Filenames are stable, so a saved PDF can be matched to the version it came from.
