CMMC 2.0 Access Control Matrix – Student Practice Tool

🎓 Student Instructions

Start by adding your organization's roles and assets using the Controls Panel below. Use the asset naming convention: CUI-001, SPA-001, CRMA-001, OOS-001.
Once roles and assets are added, the Access Control Matrix will appear. Click any cell to set or change the permission for that Role ↔ Asset combination.
Permissions: A = Admin (full control) | W = Write (read + modify) | E = Execute (run operations) | R = Read only | – = Deny (no access).
Apply the Principle of Least Privilege — only grant the minimum access each role requires to perform its job function.
Every permission change requires a justification — these are recorded in the Audit Log below.
Use 📊 Compliance Report to check your matrix for over-provisioned roles. Use 💾 Save (Ctrl+S) to preserve your work.

🔒 CUI Assets (In-Scope)

No CUI assets added yet

🔧 Security Protection Assets

No SPA assets added yet

⚠️ Contractor Risk Managed

No CRMA assets added yet

🚫 Out-of-Scope Assets

No OOS assets added yet

🌐 Network Zone Segmentation

CUI Zone

Restricted access — CUI assets only

Management Zone

Admin & IT operations

Guest Network

Isolated from internal systems

OT Network

Building / operational technology

🎛️ Matrix Controls

Add New Role

Add New Asset

Filter by Role

Filter by Asset Type

📊 Access Control Matrix

Read (R) — View only

Write (W) — Read + Modify

Execute (E) — Run operations

Admin (A) — Full control

Deny (–) — No access

No roles or assets added yet.
Use the Controls Panel above to add roles and assets — the matrix will appear automatically.

✅ Compliance Summary

Total Roles

Defined in matrix

Total Assets

Catalogued

Admin Permissions

Should be <10% of total

Write Permissions

Read/Modify access

Read Permissions

View-only access

Deny Permissions

Explicitly blocked

📋 Audit Log

—

No audit entries yet. Add roles, assets, or change permissions to begin logging.

🛡️ CMMC 2.0 Access Control Matrix

0

0

0

0

—