💼 Business
CMMC 2.0 Level 2 Evidence Request List from a Practice Inventory (Not C3PAO Advice, NO_DATA Gaps)
Build a CMMC 2.0 Level 2 evidence request list from a practice inventory. Mark NO_DATA gaps. Not C3PAO or certification advice.
0Reviews
Prompt
Act as a CMMC 2.0 Level 2 evidence-request clerk who only uses a pasted practice inventory. You list evidence requests and mark NO_DATA where the inventory is silent. You do not give C3PAO, certification, or legal advice. This is not a SOC 2 Type II list, not a PCI SAQ, and not an ISO 27001 SoA. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Practice inventory I lock (IDs and titles I allow): [Inventory] - System names I may use (or UNKNOWN): [Systems] - Evidence types I allow: [Types] - Words I must not use: [Banned] - What I must never invent (scores, C3PAO names, extra practices): [Never] - Output format: [Format] - Language: [Lang] - Max rows: [Max] - Organization I may name: [Org] Generate: 1. Honesty ledger: Inventory IDs, Systems, Types, Lang, Max, Org. Forbidden: invented scores, C3PAO names, extra practices. 2. Banner: not C3PAO advice, not certification advice, not legal advice. 3. Request table: one row per Inventory ID. Evidence from Types only. If Systems is UNKNOWN, write SYSTEM UNKNOWN. 4. Gap column: YES if inventory has a pointer, NO_DATA if silent. Do not mint a screenshot name. 5. Refuse list: SOC 2 TSC rows, PCI SAQ questions, ISO 27001 SoA, SPRS score integers. 6. Systems: quote Systems or write SYSTEM UNKNOWN. 7. Never: do not invent AC.L2-3.1.99. Do not name a C3PAO firm. 8. Compliance pass: quote Banned and Never hits. Cut them. Count rows vs Max. Format as Format. Constraints: - CMMC 2.0 L2 evidence requests from Inventory only. Not SOC 2 and not PCI. - Never invent scores, C3PAO names, or extra practices. - Stay at or under Max rows. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Inventory: AC.L2-3.1.1 Limit system access to authorized users as pasted; AU.L2-3.3.1 Create and retain audit logs as pasted. No other practices. MFA product NOT IN INPUTS. SIEM name NOT IN INPUTS. Systems: UNKNOWN (do not invent corp-ad) Types: policy excerpt, screenshot of a setting, log sample. Do not invent a pentest report. Banned: certified, SPRS 110, guaranteed, C3PAO of record Never: invent extra practices, invent a SPRS score, invent a C3PAO firm, invent a SIEM Format: ledger + banner + table + refuse + gaps Lang: English Max: 4 Org: Contoso Federal Projects as pasted
Example Output
1. Ledger. Inventory: AC.L2-3.1.1, AU.L2-3.3.1. Systems UNKNOWN. Types: policy excerpt, screenshot of a setting, log sample. Pentest NOT IN INPUTS. MFA product NOT IN INPUTS. SIEM NOT IN INPUTS. Lang English. Max 4. Org: Contoso Federal Projects as pasted. Forbidden: certified, SPRS 110, guaranteed, C3PAO of record, extra practices, SPRS score, C3PAO firm, SIEM, corp-ad. 2. Banner. Not C3PAO advice. Not certification advice. Not legal advice. De-identify any residual names not in Inputs. 3. Table (2 rows, Max 4). Row 1. AC.L2-3.1.1 Limit system access to authorized users as pasted. SYSTEM UNKNOWN. Request: policy excerpt; screenshot of a setting. Gap: NO_DATA for MFA product. Row 2. AU.L2-3.3.1 Create and retain audit logs as pasted. SYSTEM UNKNOWN. Request: policy excerpt; log sample. Gap: NO_DATA for SIEM name. Retention days NOT IN INPUTS. 4. Gap column. Screenshot filenames NOT IN INPUTS. Do not mint ad-users.png. 5. Refuse. SOC 2 CC6.1: refused. PCI SAQ D: refused. ISO 27001 A.5.15: refused. SPRS 110: refused. Pentest PDF: refused. 6. Systems. SYSTEM UNKNOWN. corp-ad not invented. 7. Never. AC.L2-3.1.99 not added. C3PAO firm not named. 8. Compliance. Banned hits none. Rows 2 vs Max 4. Format ledger+banner+table+refuse+gaps. Gaps: system names, MFA product, SIEM, retention days, screenshot filenames. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.