The contract sets the level and the information you handle sets the boundary, and those two decisions shape everything that follows. Before any tooling, draw the CUI enclave as tightly as you can: the practices apply to whatever sits inside it, so a small boundary is a small programme. Then score each Level 2 practice against NIST SP 800-171, record the evidence and owner, and open a POA&M entry for every gap. Only then is it worth judging software, and the test is native CMMC support: 800-171 mapping, a maintained SSP and POA&M, and evidence an assessor can walk through.
2 pages on CMMC 2.0, in the order the work happens. Jump to the stage you are at, or read straight through.
Draw the CUI boundary and confirm the level your contract sets, score every Level 2 practice, hold a POA&M for the gaps, and judge platforms on whether they maintain the SSP and POA&M rather than on a CMMC roadmap promise.
The free compliance check runs the CMMC 2.0 gap assessment in about five minutes and gives you a scored report you can take to a board meeting.
14-day free trial · no credit card · unlimited users