SPRS score calculator
Tick the 800-171 requirements you have not met: your SPRS score from 110, the 88 line and which gaps may go on a POA&M.
Assessment & SPRS
4 tools, 12 guides, 4 comparisons
Before anyone assesses the shop, the shop assesses itself: each requirement read against what people and machines actually do, a score worked out, and every gap written down with a date.
These pages walk that sequence in order and say which kind of assessment a contract can ask for today, while part of the program is on hold.
Tools
CMMC Level 1 self-assessment checklist
The 15 FAR 52.204-21 requirements, met, not met or N/A, with evidence notes and the yearly SPRS affirmation.
NIST SP 800-171 checklist (CMMC Level 2)
All 110 Rev 2 requirements and their 800-171A objectives: mark met, partial, not met or N/A, then export a CSV or print.
CMMC cost estimator
DoD's own per-assessment cost figures from the CMMC final rule, by level, path and business size, beside your quotes.
Comparisons
- CMMC consultants and RPOs for small contractorsSix consultants, RPOs and C3PAOs checked against the rule and the Cyber AB register, and why your consultant cannot assess you.6 vendors compared
- CMMC vs NIST SP 800-171The standard and the program that checks it: who assesses, how the score is counted, and what a contract binds today.
- CMMC vs FedRAMPYour certification next to your cloud provider's: where they meet in DFARS 7012 and what Moderate equivalency asks.
- CMMC vs ISO 27001What an ISO 27001 certificate or SOC 2 report carries over to CMMC Level 2, read through NIST's own mapping table.
Guides
- CMMC status today: Phase 2 suspended, what still appliesWhat binds today, every CMMC date with its source, a quarter plan for small shops, and the triggers that would change the status.11 min read
- What is CMMC compliance?The CMMC program in plain words: three levels, who needs which, who assesses, SPRS, POA&Ms and what binds today.13 min read
- How to get CMMC certifiedThe path in 8 steps, from scoping to SPRS and the affirmation, with what applies today while Phase 2 is suspended.17 min read
- CMMC Level 2 requirements by familyThe 110 NIST SP 800-171 Rev 2 requirements by family: point weights, the 88 Conditional minimum, the six never on a POA&M.19 min read
- CMMC Level 1 requirements (FAR 52.204-21)The 15 FAR 52.204-21 safeguards explained for a small shop, the evidence to keep, and the yearly SPRS self-assessment.16 min read
- DFARS 252.204-7019 and -7020: the SPRS score clausesThe two SPRS score clauses for a small shop: the Basic self-assessment, the 3-year clock, Medium and High, and what the deviation changes.15 min read
- CMMC requirements for small businessesWhat CMMC asks of a 5 to 50 person shop today: no size exemption, Level 1 or 2 (Self), DoD's own cost figures and free help.13 min read
- What is a CMMC RPO?What a Registered Practitioner Organization can and cannot do, RPO vs C3PAO, and how to check a Marketplace listing.13 min read
- What is a C3PAO?What C3PAO stands for, what a CMMC third-party assessor does, how one is authorized, and its role while Phase 2 is suspended.12 min read
- CMMC deadline: the dates that bind your shop todayThe phase dates as Part 170 wrote them, what the suspension changed, the clocks that still run, and a helper for your SPRS dates.9 min read
- SPRS login and how to submit your SPRS scorePIEE access, the SPRS Cyber Vendor User role, a NIST Basic score or a CMMC self-assessment, the affirmation and the CMMC UID.18 min read
- NIST 800-171 controls by familyAll 110 Rev 2 requirements in NIST's words, by family: CMMC ids, basic or derived, Rev 3 names. Searchable, with a link per row.14 min read
Other topics
- Scoping & CUIFind where CUI lives in a small shop, draw the boundary around it, and sort every laptop, share and machine into or out of scope.4 tools, 7 guides, 3 comparisons
- SSP, POA&M & policiesThe system security plan, the plan of action and milestones, and the policies behind them: what goes in each and how to keep them current.3 tools, 3 guides, 2 comparisons
- Vendors & cloudCloud suites, email and file sharing, enclaves and service providers, compared on what the rule asks of them.2 guides, 8 comparisons