How adoption works
The Master Library
inDirectIT owns and maintains it. When a requirement or an interpretation changes, we update the library and your adopted documents follow without a rewrite.
Your adoption record
One signed record for your organization lists the release you adopted, who holds each role, your parameter values, and any deviations. You re-affirm it every year, so it cannot drift unnoticed.
Your operating procedures
The steps your people perform for the requirements you own or share with us. Your SSP, POA&M, and evidence stay yours and are never part of the library.
What it covers
- A policy and a matching procedure for every Rev. 3 family, each with a Rev. 2 crosswalk, so the same documents serve today's contracts and the transition.
- Plans for incident response and supply chain risk management, plus Rules of Behavior and the library's own document-control standard.
- A shared-responsibility matrix across all 320 CMMC Level 2 assessment objectives: what inDirectIT performs, what your team performs, what you share, and what Microsoft's cloud already covers, so nothing falls between the managed service and your organization.
The first release is in independent review. Adoption opens to managed-compliance clients once it is approved, and your adopted release then appears in your client portal. A documentation baseline supports a program; it is not a certification or an assessment result.
To start before then, use the free policy pack templates. They are mapped to the control families and open to everyone.
Questions we get about it
Is this a policy template pack?
No. A template pack is a one-time delivery you then maintain alone. The Master Library is adopted by reference and maintained for you; your signed adoption record captures only what is specific to your organization.
Does adopting the library make us compliant?
No document set does. The library gives you a current, consistent documentation baseline and a clear division of responsibility; compliance is established by implementing and evidencing the controls, and certification by an assessment.
Stop rewriting policy every year.
Tell us what your current policy set looks like and when your assessment is due, and we will plan the adoption around it. Or email rj@indirectit.com directly.