OSC — What do I document?

The CMMC Level 2 Assessment Guide does not score 110 controls — it scores ~320 individual NIST SP 800-171A objectives, and each objective contains a single verb that tells the assessor exactly what evidence type is required. Documentation verbs (“defined,” “specified,” “documented,” “established,” “identified”) demand written artifacts. Operational verbs (“monitored,” “implemented,” “enforced,” “performed,” “tested”) demand live evidence — logs, configs, dated records. Context-dependent verbs (“controlled,” “authorized,” “reviewed”) require both. A policy can never satisfy an operational verb; a log can never satisfy a documentation verb. Match the evidence to the verb and you have 80% of the readiness work done.