# sands-mvcc/cmmc architecture

> Architecture diagram of the GitHub repository sands-mvcc/cmmc, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-17). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sands-mvcc/cmmc
- Repository: https://github.com/sands-mvcc/cmmc

## Overview

This repository is a **static CMMC audit-preparation dashboard**: the entire application appears to be a set of linked HTML pages, with no visible backend, database, or build system in the repo snapshot.

**1) Entry and navigation layer**  
`index.html` is the likely landing page, with `dashboard.html` and `agenda.html` acting as the main navigation hubs. The app is organized as a brochure-style site where users move between pages via hyperlinks rather than through an API-driven workflow.

**2) Primary purpose: CMMC pre-audit preparation**  
The README states the project is for **CMMC Audit Dashboard** and **PreAudit preparation**. The page set reflects that goal: it collects assessment artifacts, control references, readiness material, and reporting views in one place.

**3) Core assessment artifact subsystem**  
Several pages correspond to standard CMMC/NIST-style evidence and assessment outputs:
- `SSP.html`, `SAR.html`, `POAM.html`, `VSR.html`
- `IRP.html`, `CMP.html`, `ALMR.html`, `ACM.html`
- `asset.html`, `maintenance.html`, `applicability.html`
These likely form the operational heart of the dashboard, where audit evidence and compliance status are reviewed.

**4) Tool-oriented pages for each artifact**  
The repository includes parallel “tool” pages such as `SSP_tool.html`, `SAR_tool.html`, `POAM_tool.html`, `VSR_tool.html`, `IRP_tool.html`, `CMP_tool.html`, `ALMR_tool.html`, `ACM_tool.html`, `Asset_tool.html`, `Maintenance_tool.html`.  
This suggests each artifact has an associated working page or guided helper, likely used to create, review, or manage that artifact in a structured way.

**5) Scenario/organization-specific content**  
Pages prefixed with `Acme_` such as `Acme_ACM.html`, `Acme_Asset_Inventory.html`, and `Acme_Maintenance.html` imply example or client-specific instances of the same compliance content. This indicates the dashboard supports templated content or sample organizational data.

**6) Reference and standards subsystem**  
Pages like `cui.html`, `dfars.html`, `nist171.html`, `apt.html`, `accesscontroll1.html`, and `matrix_energy.html` appear to provide compliance references, policy context, or control mappings. These pages likely support the evidence pages by explaining requirements and applicability.

**7) Readiness and review subsystem**  
`readiness.html`, `capabilities.html`, `evidence.html`, `reports.html`, `roles.html`, and `process.html` look like higher-level oversight views. These are the pages a manager or assessor would use to understand readiness posture, responsibilities, evidence completeness, and reporting status.

**8) Training, exercises, and narrative content**  
The many `assignment*.html`, `casestudy*.html`, `casestudies.html`, and `casestudy.html` pages suggest a training or instructional layer. These likely support walkthroughs, scenario-based learning, or audit-prep exercises rather than live operational data.

**9) Domain-specific inventory and operational support**  
The asset and maintenance pages indicate the dashboard is not only about documents but also about operational control areas tied to CMMC evidence: asset inventory, lifecycle maintenance, and configuration-related activities.

**10) Likely data flow in the site**  
A typical flow is: **landing/dashboard → reference or readiness pages → specific control/artifact pages → tool pages for completion → reports/evidence views**. The pages appear to be connected through manual navigation and embedded links, with the browser acting as the only runtime.

**11) Architectural boundary**  
This repo is best diagrammed as a **single static front-end content system** rather than a multi-tier application. The meaningful boundaries are between:
- navigation/dashboard pages,
- compliance artifact pages,
- standards/reference content,
- training/case-study content,
- and report/readiness views.

**12) Implementation implications**  
Because the repository is HTML-only in the tree, any dynamic behavior is likely minimal or embedded directly in the pages. The architecture is therefore centered on **content organization and cross-page navigation**, not services, persistence, or server-side orchestration.

Main entry points: [`readiness.html`](https://github.com/sands-mvcc/cmmc/blob/main/readiness.html) (Readiness), [`evidence.html`](https://github.com/sands-mvcc/cmmc/blob/main/evidence.html) (Evidence), [`dashboard.html`](https://github.com/sands-mvcc/cmmc/blob/main/dashboard.html) (Dashboard), [`agenda.html`](https://github.com/sands-mvcc/cmmc/blob/main/agenda.html) (Agenda)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_navigation["Navigation"]
  node_index(("Home<br/>entry page<br/>[index.html]"))
  node_dashboard["Dashboard<br/>overview page<br/>[dashboard.html]"]
  node_agenda["Agenda<br/>planning page<br/>[agenda.html]"]
  node_readiness["Readiness<br/>status view<br/>[readiness.html]"]
  node_evidence["Evidence<br/>[evidence.html]"]
  node_reports["Reports<br/>reporting page<br/>[reports.html]"]
  node_process["Process<br/>workflow page<br/>[process.html]"]
end

subgraph group_artifacts["Artifacts"]
  node_ssp["SSP<br/>artifact page<br/>[ssp.html]"]
  node_sar["SAR<br/>artifact page<br/>[sar.html]"]
  node_poam["POA&M<br/>artifact page<br/>[POAM.html]"]
  node_vsr["VSR<br/>artifact page<br/>[vsr.html]"]
  node_irp["IRP<br/>response plan<br/>[irp.html]"]
  node_cmp["CMP<br/>continuity plan<br/>[cmp.html]"]
  node_acm["ACM<br/>access control<br/>[acm.html]"]
  node_asset["Assets<br/>inventory page<br/>[asset.html]"]
  node_maintenance["Maintenance<br/>operations page<br/>[maintenance.html]"]
end

subgraph group_references["References"]
  node_cui["CUI<br/>reference page<br/>[cui.html]"]
  node_dfars["DFARS<br/>reference page<br/>[dfars.html]"]
  node_nist171["NIST 171<br/>reference page<br/>[nist171.html]"]
  node_accesscontroll1["Access Ctrl<br/>reference map"]
  node_applicability["Applicability<br/>control scope<br/>[applicability.html]"]
end

subgraph group_learning["Learning"]
  node_assignments["Assignments<br/>learning hub<br/>[assignments.html]"]
  node_casestudies["Case Studies<br/>learning hub<br/>[casestudies.html]"]
end

node_index -->|"opens"| node_dashboard
node_index -->|"plans"| node_agenda
node_dashboard -->|"summarizes"| node_readiness
node_dashboard -->|"tracks"| node_evidence
node_dashboard -->|"surfaces"| node_reports
node_dashboard -->|"orients"| node_process
node_readiness -->|"depends on"| node_process
node_readiness -->|"reviews"| node_ssp
node_readiness -->|"reviews"| node_sar
node_readiness -->|"tracks"| node_poam
node_readiness -->|"includes"| node_vsr
node_evidence -->|"collects"| node_asset
node_evidence -->|"collects"| node_maintenance
node_evidence -->|"collects"| node_irp
node_evidence -->|"collects"| node_cmp
node_evidence -->|"collects"| node_acm
node_ssp -->|"informs"| node_sar
node_sar -->|"drives"| node_poam
node_poam -->|"rolls up"| node_reports
node_asset -->|"supports"| node_maintenance
node_acm -->|"maps to"| node_accesscontroll1
node_dfars -->|"maps to"| node_nist171
node_nist171 -->|"grounds"| node_cui
node_nist171 -->|"scopes"| node_applicability
node_assignments -->|"feeds"| node_agenda
node_casestudies -->|"feeds"| node_agenda
node_agenda -->|"drives"| node_assignments
node_agenda -->|"drives"| node_casestudies

click node_index "https://github.com/sands-mvcc/cmmc/blob/main/index.html"
click node_dashboard "https://github.com/sands-mvcc/cmmc/blob/main/dashboard.html"
click node_agenda "https://github.com/sands-mvcc/cmmc/blob/main/agenda.html"
click node_readiness "https://github.com/sands-mvcc/cmmc/blob/main/readiness.html"
click node_evidence "https://github.com/sands-mvcc/cmmc/blob/main/evidence.html"
click node_reports "https://github.com/sands-mvcc/cmmc/blob/main/reports.html"
click node_process "https://github.com/sands-mvcc/cmmc/blob/main/process.html"
click node_ssp "https://github.com/sands-mvcc/cmmc/blob/main/ssp.html"
click node_sar "https://github.com/sands-mvcc/cmmc/blob/main/sar.html"
click node_poam "https://github.com/sands-mvcc/cmmc/blob/main/POAM.html"
click node_vsr "https://github.com/sands-mvcc/cmmc/blob/main/vsr.html"
click node_irp "https://github.com/sands-mvcc/cmmc/blob/main/irp.html"
click node_cmp "https://github.com/sands-mvcc/cmmc/blob/main/cmp.html"
click node_acm "https://github.com/sands-mvcc/cmmc/blob/main/acm.html"
click node_asset "https://github.com/sands-mvcc/cmmc/blob/main/asset.html"
click node_maintenance "https://github.com/sands-mvcc/cmmc/blob/main/maintenance.html"
click node_assignments "https://github.com/sands-mvcc/cmmc/blob/main/assignments.html"
click node_casestudies "https://github.com/sands-mvcc/cmmc/blob/main/casestudies.html"
click node_cui "https://github.com/sands-mvcc/cmmc/blob/main/cui.html"
click node_dfars "https://github.com/sands-mvcc/cmmc/blob/main/dfars.html"
click node_nist171 "https://github.com/sands-mvcc/cmmc/blob/main/nist171.html"
click node_accesscontroll1 "https://github.com/sands-mvcc/cmmc/blob/main/accesscontroll1.html"
click node_applicability "https://github.com/sands-mvcc/cmmc/blob/main/applicability.html"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_index,node_dashboard,node_agenda,node_readiness,node_evidence,node_reports,node_process toneBlue
class node_ssp,node_sar,node_poam,node_vsr,node_irp,node_cmp,node_acm,node_asset,node_maintenance toneAmber
class node_cui,node_dfars,node_nist171,node_accesscontroll1,node_applicability toneMint
class node_assignments,node_casestudies toneRose
```

## Components

### Navigation

Entry points and high-level dashboard views.

- [Home](https://github.com/sands-mvcc/cmmc/blob/main/index.html): entry page · Primary landing page for the static dashboard. · `index.html`
- [Dashboard](https://github.com/sands-mvcc/cmmc/blob/main/dashboard.html): overview page · Main summary hub for audit-prep navigation. · `dashboard.html`
- [Agenda](https://github.com/sands-mvcc/cmmc/blob/main/agenda.html): planning page · Preparation planning and task sequencing hub. · `agenda.html`
- [Readiness](https://github.com/sands-mvcc/cmmc/blob/main/readiness.html): status view · High-level readiness and posture overview. · `readiness.html`
- [Evidence](https://github.com/sands-mvcc/cmmc/blob/main/evidence.html): evidence view · Evidence collection and completeness view. · `evidence.html`
- [Reports](https://github.com/sands-mvcc/cmmc/blob/main/reports.html): reporting page · Roll-up reporting and review output. · `reports.html`
- [Process](https://github.com/sands-mvcc/cmmc/blob/main/process.html): workflow page · Operating flow and preparation process. · `process.html`

### Artifacts

Assessment records, operational controls, and helper pages.

- [SSP](https://github.com/sands-mvcc/cmmc/blob/main/ssp.html): artifact page · System security plan content and review. · `ssp.html`
- [SAR](https://github.com/sands-mvcc/cmmc/blob/main/sar.html): artifact page · Security assessment report content. · `sar.html`
- [POA&M](https://github.com/sands-mvcc/cmmc/blob/main/POAM.html): artifact page · Plan of action and milestones tracking. · `POAM.html`
- [VSR](https://github.com/sands-mvcc/cmmc/blob/main/vsr.html): artifact page · Validation or review summary record. · `vsr.html`
- [IRP](https://github.com/sands-mvcc/cmmc/blob/main/irp.html): response plan · Incident response planning content. · `irp.html`
- [CMP](https://github.com/sands-mvcc/cmmc/blob/main/cmp.html): continuity plan · Continuity or contingency planning content. · `cmp.html`
- [ACM](https://github.com/sands-mvcc/cmmc/blob/main/acm.html): access control · Access control material used in compliance prep. · `acm.html`
- [Assets](https://github.com/sands-mvcc/cmmc/blob/main/asset.html): inventory page · Asset inventory and related control data. · `asset.html`
- [Maintenance](https://github.com/sands-mvcc/cmmc/blob/main/maintenance.html): operations page · Maintenance and lifecycle support content. · `maintenance.html`

### References

Standards, mappings, and compliance context.

- [CUI](https://github.com/sands-mvcc/cmmc/blob/main/cui.html): reference page · Controlled unclassified information context. · `cui.html`
- [DFARS](https://github.com/sands-mvcc/cmmc/blob/main/dfars.html): reference page · Defense Federal Acquisition Regulation reference. · `dfars.html`
- [NIST 171](https://github.com/sands-mvcc/cmmc/blob/main/nist171.html): reference page · Primary compliance standard reference. · `nist171.html`
- [Access Ctrl](https://github.com/sands-mvcc/cmmc/blob/main/accesscontroll1.html): reference map · Access control reference or control mapping page. · `accesscontroll1.html`
- [Applicability](https://github.com/sands-mvcc/cmmc/blob/main/applicability.html): control scope · Scope and applicability mapping for controls. · `applicability.html`

### Learning

Assignments and case-study content for guided preparation.

- [Assignments](https://github.com/sands-mvcc/cmmc/blob/main/assignments.html): learning hub · Hub for guided assignment pages. · `assignments.html`
- [Case Studies](https://github.com/sands-mvcc/cmmc/blob/main/casestudies.html): learning hub · Hub for scenario-based case studies. · `casestudies.html`

## Connections

- Home → Dashboard: opens · Landing page routes into the main dashboard.
- Home → Agenda: plans · Landing page also exposes the agenda view.
- Dashboard → Readiness: summarizes · Dashboard rolls up readiness posture.
- Dashboard → Evidence: tracks · Dashboard links to evidence status.
- Dashboard → Reports: surfaces · Dashboard surfaces reporting views.
- Dashboard → Process: orients · Dashboard connects to the operating workflow.
- Readiness → Process: depends on · Readiness is grounded in the defined process.
- Readiness → SSP: reviews · Readiness ties back to the SSP.
- Readiness → SAR: reviews · Readiness ties back to the SAR.
- Readiness → POA&M: tracks · Readiness tracks remediation items.
- Readiness → VSR: includes · Readiness includes validation or review records.
- Evidence → Assets: collects · Evidence includes asset inventory material.
- Evidence → Maintenance: collects · Evidence includes maintenance material.
- Evidence → IRP: collects · Evidence can include incident response artifacts.
- Evidence → CMP: collects · Evidence can include continuity artifacts.
- Evidence → ACM: collects · Evidence can include access control material.
- SSP → SAR: informs · Assessment findings feed back into the SSP/SAR loop.
- SAR → POA&M: drives · Assessment findings generate remediation items.
- POA&M → Reports: rolls up · Open remediation is reflected in reporting.
- Assets → Maintenance: supports · Asset inventory and maintenance are linked operational controls.
- ACM → Access Ctrl: maps to · Access control content is supported by the reference map.
- DFARS → NIST 171: maps to · DFARS context points into the NIST 171 reference.
- NIST 171 → CUI: grounds · Standards reference is informed by CUI context.
- NIST 171 → Applicability: scopes · Applicability page clarifies which controls are in scope.
- Assignments → Agenda: feeds · Assignment content is used in preparation planning.
- Case Studies → Agenda: feeds · Case studies support guided preparation and review.
- Agenda → Assignments: drives · Agenda links into assignment-based preparation content.
- Agenda → Case Studies: drives · Agenda links into case-study content.