Your Policies Are Only as Good as the Controls Behind Them

Policy & Procedure Writing for Real-World CMMC Compliance

A binder full of well-written policies has never stopped a breach, and it has never passed a CMMC assessment on its own. Assessors aren’t grading your prose — they’re checking whether what’s written on the page actually happens on your network, every day, whether anyone is watching or not.

We’ve written before about the importance of aligning policy with technical controls. This time we’re going deeper: what assessors actually check, where organizations most often get caught, and how to map your documentation to the control families that matter.

What Auditors Actually Look For

A CMMC assessor isn’t reading your access control policy for grammar. They’re pulling threads: Does this policy match what’s configured in Active Directory? Does the account review cadence in the document match the timestamps in the actual review logs? Can you produce a screenshot, a report, or an audit trail that proves the policy was followed last month — not just that it exists?

In practice, assessors triangulate four things for every control: the written policy, the technical implementation, the evidence that ties them together, and the actual workflows. A gap in any one of the three is a finding.

The Most Common Misalignment Failures

After years of preparing organizations for assessment, a handful of failure patterns show up again and again:

• Policies written for a different environment. The document describes MFA enforced organization-wide; the actual configuration only covers privileged accounts.
• Stale procedures. The policy references a tool or process the organization stopped using two systems ago.
• No named owner. A procedure exists, but no one can say who is responsible for executing it, so it quietly stops happening.
• Evidence that doesn’t exist. The policy promises quarterly access reviews, but there’s no log, ticket, or sign-off proving the last one occurred.
• Copy-paste templates. Generic language pulled from a template that was never adapted to the organization’s actual systems, roles, or risk profile.

Any one of these can turn a routine control review into a finding — and findings compound. A single unaddressed gap tends to raise questions about everything else in the SSP.

Documentation Without Enforcement Is a Liability

Here’s the uncomfortable part: a policy that isn’t enforced is arguably worse than no policy at all. An unwritten practice is a gap. A written, unenforced policy showing the workflow of that police and SOP with documented evidence that your organization knew the requirement and didn’t meet it. Assessors — and, in the event of a breach, regulators and contracting officers — treat that difference seriously.

This is why Dragnet approaches policy and procedure writing as an operational exercise, not a documentation exercise. Before we draft a single policy, we map it to what’s actually configured, who actually owns it, and what evidence will actually exist to prove it. The document comes last, not first.

Mapping Policies to CMMC Control Families

CMMC Level 2 is built on 110 practices across 14 domains, and your policy set needs to speak the same language as the assessment. A few of the domains where misalignment is most common:

Access Control (AC): Policies must reflect exactly how account provisioning, least privilege, and remote access are configured — not an idealized version of it. If your policy says role-based access control governs CUI systems, your identity provider needs to show it.

Identification and Authentication (IA): This is where MFA gaps live. Your policy should specify where multifactor authentication is enforced, for whom, and under what conditions — and it should match your actual authentication logs, not an aspiration for “next quarter.”

Audit and Accountability (AU): Policies need to define what gets logged, how long logs are retained, and who reviews them. Assessors will ask to see the review, not just the retention setting.

System and Information Integrity (SI): Covers patch management, malware protection, and flaw remediation. Your policy’s stated patching cadence needs to match your actual patch history — a common and easily-caught discrepancy.

Getting these four domains right doesn’t guarantee a clean assessment, but misalignment in any of them is one of the fastest ways to generate findings.

Building Policies That Hold Up

Strong CMMC documentation isn’t about volume — it’s about accuracy. A shorter policy set that precisely mirrors your actual environment will outperform a comprehensive one full of assumptions and templates every time.

Dragnet’s Policy & Procedure Writing service is built around this principle. We work directly with your team to map requirements to real technical controls, assign clear ownership, and build documentation that will hold up under scrutiny — because it reflects what you’re actually doing, not what a template says you should be doing.

If your policies haven’t been reviewed against your actual environment recently, now is the time.

Schedule a CMMC Discovery Call