CMMC 2.0 Readiness Assessment

Answer 12 quick items mapped to NIST 800-171 (Level 2 focus). Get an instant score, a **proxy SPRS**, and a branded gap report.

Organization

Company Name Contact Email (optional) Target Level

Choose the option that best reflects your current state. Scoring: Strong (5) • Partial (3) • Not in place (1).

1) AC 3.1.1 — Limit system access to authorized users and processes.

2) AC 3.1.7 — Prevent non-privileged users from performing privileged actions.

3) IA 3.5.3 — Multi-factor authentication (remote/admin access).

4) IA 3.5.7 — Password policy aligned with NIST 800-63B (length, reuse, breach blocklist).

5) CM 3.4.1 — Baseline configuration for systems and devices (CIS, STIG, etc.).

6) CM 3.4.6 — Least functionality (disable unnecessary services & protocols).

7) AU 3.3.1 — Create, protect, and retain audit logs for CUI systems.

8) AU 3.3.5 — Correlate and review logs; alert on anomalies.

9) IR 3.6.1 — Incident Response plan, roles, and communications.

10) IR 3.6.3 — IR testing (e.g., tabletop exercise) with after-action items.

11) RM 3.12.2 — Security assessments at planned intervals; track results.

12) CA 3.12.1 — Periodic control assessments & governance (SSP/POA&M maintained).

Note: **SPRS shown is an approximation** scaled from your readiness score; official SPRS uses weighted deductions per practice.