Set up your evidence folder with the AffirmReady folder kit

A ready-made folder structure and evidence index you can drop into any system

KB-040 | Applies to: All plans | Last reviewed: October 7, 2026

Keeping evidence organized is most of the battle. To save you the setup work, we built a free folder kit. It is a set of empty folders, one for each of the 15 CMMC Level 1 requirements, plus a short note in each folder explaining what goes there and an evidence index spreadsheet to track everything in one place.

What is in the kit

When you unzip the kit, you get one top-level folder named CMMC L1 Evidence with this structure:

CMMC L1 Evidence
  0 Start Here (evidence index and company-wide documents)
  1 Access Control
    01 Authorized users and devices
    02 What each user can do
    03 Outside connections and systems
    04 Public website and social posts
  2 Identification and Authentication
    05 User and device IDs
    06 Passwords and sign-in
  3 Media Protection
    07 Disposing of drives and paper
  4 Physical Protection
    08 Office access
    09 Visitors, keys, and badges
  5 System and Communications Protection
    10 Firewall and network boundary
    11 Public-facing systems kept separate
  6 System and Information Integrity
    12 Updates and patching
    13 Antivirus protection
    14 Antivirus updates
    15 Virus scans
  7 Annual Affirmation

The six family folders match the evidence guides KB-032 through KB-037, and the numbered subfolders match the 15 requirements in the order AffirmReady shows them. Each subfolder contains a short READ ME file with examples of what to save there. You can delete the READ ME files once you are comfortable.

What the two extra folders are for

• 0 Start Here holds the evidence index spreadsheet and any document that supports several requirements at once, such as a one-page security policy.
• 7 Annual Affirmation holds your yearly record: a dated copy of your self-assessment results, a screenshot or confirmation of your SPRS entry, and a note of who affirmed and when. Add a new subfolder each year, such as 2026 and 2027.

How to use it

1. Download the folder kit from the Help Center at affirmready.com, or ask our support team to email it to you.
2. Unzip it on your computer. On Windows, right-click the file and choose Extract All. On a Mac, double-click it.
3. Upload the CMMC L1 Evidence folder to your company's file system. The guides for SharePoint and OneDrive (KB-041), Google Drive (KB-042), and Dropbox (KB-043) show exactly how.
4. Limit access to the folder to the people who need it, such as the owner, office manager, and IT provider.
5. Start saving evidence into the matching subfolders and record each item in AffirmReady.

Naming your files

Put the date first so files sort in order and anyone can see at a glance how current they are. For example: 2026-10 MFA setting screenshot.png or 2026-10 Visitor log Q3.pdf.

Keeping things safe

• Use a business account your company controls, not a personal account belonging to one employee.
• Never save passwords, MFA codes, or account numbers in the evidence folder. Crop or blur them out of screenshots.
• Do not put Controlled Unclassified Information (CUI) in the evidence folder or in AffirmReady.
• Do not email evidence as attachments. Share it through your file system instead.

Already have a folder?

You do not need to start over. If you already keep evidence somewhere sensible, keep using it. The kit is just a shortcut. What matters is that each piece of evidence has a home and AffirmReady knows where it is.

Still need help?

Email support@affirmready.com and include your company name and the email address on your AffirmReady account. Our team is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, and replies within one business day.

For CMMC Level 1 readiness purposes only. Not legal advice. Your company is responsible for the accuracy of its self-assessment and affirmation.