CMMCForge • CMMC Level 2 GRC

AU (Audit): Immutable audit_logs table + every key action logged.
AC/IA: Role-based access, JWT auth, org scoping, password hashing (PBKDF2).
SC/MP: Client-side AES-GCM encryption for CUI evidence before R2 storage.
CM: Versioned migrations, control status history, evidence versioning.
IR/RA: POA&M tracker, risk ratings, continuous monitoring stubs.

Hosted on Cloudflare • Aligned to NIST SP 800-171 Rev. 2