u/ProofOk1899

Hi all,

I am responsible within my organization for CMMC lvl2 and document the SSP

I would like to ask: how do you typically attach evidence to the document? Is it sufficient to include screenshots alone, or should supporting policies also be linked for each individual control?

I would appreciate your input.