Which CMMC level do I need?
Five questions on your information, clauses and role give the CMMC level, the assessment type and what applies today.
CMMC and NIST 800-171 Tools for Small Defense Contractors
Free scoping tools, plain-English guides and vendor comparisons for small defense contractors working through CMMC and NIST SP 800-171.
- In scope
- Laptops that open CUI
- The file share holding drawings
- Email that receives CUI
- The badge reader on the shop door
- Out of scope
- The marketing website
- Payroll with no CUI in it
- A printer that never prints CUI
- Phones that never touch CUI
Free tools for the work itself
Checklists, worksheets and calculators that run in your browser. No account, no sign-up.
SPRS score calculator
Tick the 800-171 requirements you have not met: your SPRS score from 110, the 88 line and which gaps may go on a POA&M.
POA&M template builder
Build a CMMC POA&M row by row, checked against 32 CFR 170.21: the 88-point minimum, 1-point gaps only, 180-day closeout.
CMMC scoping worksheet
List every asset, sort it into the 32 CFR 170.19 Level 2 categories, and export the inventory for your SSP.
CMMC Level 1 self-assessment checklist
The 15 FAR 52.204-21 requirements, met, not met or N/A, with evidence notes and the yearly SPRS affirmation.
System security plan (SSP) template
Fill in the SSP that NIST 800-171 3.12.4 asks for, checked against its eight assessment objectives.
How scoping works
List where controlled information arrives, where it is kept and where it goes next.
Mark which people, machines and rooms touch it, and which never do.
Work through the security requirements for everything inside the line, and only that.
Browse by topic
Scoping & CUI
Find where CUI lives in a small shop, draw the boundary around it, and sort every laptop, share and machine into or out of scope.
4 tools, 7 guides, 3 comparisons
Assessment & SPRS
Self-assessments, the SPRS score and getting ready for an assessor, worked through in plain English.
4 tools, 12 guides, 4 comparisons
SSP, POA&M & policies
The system security plan, the plan of action and milestones, and the policies behind them: what goes in each and how to keep them current.
3 tools, 3 guides, 2 comparisons
Vendors & cloud
Cloud suites, email and file sharing, enclaves and service providers, compared on what the rule asks of them.
2 guides, 8 comparisons
Vendors, read against the rule
Each comparison reads the vendors' own documentation against what the rule asks of that kind of product.
- Best CMMC enclave options for small contractorsSix ways to put CUI in a small box, from an encrypted file app to one hardened laptop, read against DFARS 7012 and 32 CFR 170.19.6 vendors compared
- ITAR compliance software for small manufacturersFour trade compliance suites and two technical-data tools read against the ITAR: screening, USML, licences, records.6 vendors compared
- CMMC consultants and RPOs for small contractorsSix consultants, RPOs and C3PAOs checked against the rule and the Cyber AB register, and why your consultant cannot assess you.6 vendors compared
- Best CMMC compliance software for small contractorsSix tools read against the rule: 800-171 coverage, SPRS scoring, SSP and POA&M, and FedRAMP status.6 vendors compared
- Vanta vs Drata (and Secureframe) for CMMCTwo SOC 2-first platforms and Secureframe read against CMMC Level 2: SPRS score, SSP, POA&M and FedRAMP listing.3 vendors compared
- Microsoft GCC High alternatives for small defense contractorsGCC High and five other ways to hold CUI email and files, read against DFARS 7012: FedRAMP status, FIPS, ITAR and incident rules.6 vendors compared
Guides to the rule text
One rule, clause or decision per guide, quoted from its primary source and dated.
- What is CUI?Controlled unclassified information from 32 CFR 2002 and the CUI Registry: categories, Basic vs Specified, who decides, handling.11 min read
- DFARS 252.204-7012 explained, paragraph by paragraphThe safeguarding clause for a small shop: NIST SP 800-171 Rev 2, FedRAMP Moderate cloud, 72-hour reports and 90-day images.16 min read
- What is NIST SP 800-171?The CUI standard explained: what it covers, Rev 2 vs Rev 3 and its parameters, why DoD binds Rev 2, and how 800-171A feeds SPRS.15 min read
- CUI training for a small contractor's staffWhat NIST SP 800-171 3.2.1 to 3.2.3 ask, the free NARA and DoD training, and a staff plan with a printable record.12 min read
- DDTC registration under the ITARWho must register under 22 CFR 122, the exemptions, the DS-2032 in DECCS, the fee tiers, renewal and the five-day rule.13 min read
- What is ITAR compliance?Why no ITAR certificate exists, compliant vs registered, and the six duties the rule puts on a small manufacturer.16 min read
Start here
Draw the line before the assessor does.