Plain English · primary sources · no email gates
CMMC Readiness Guides
The questions defense contractors and subcontractors actually ask, answered first, with the numbers, the rule citations (32 CFR 170, NIST SP 800-171, the DoD Assessment Methodology), and free downloadable templates where they help.
NIST 800-171 SSP template
What an SSP must contain per 3.12.4, what assessors flag first, and a free blank template (Markdown or Word) — no email gate.
Read the guide →POA&M template (NIST 800-171)
The 32 CFR 170.21 eligibility rules — 88-point minimum, the never-eligible six, the 180-day clock — plus a worked example and a free blank template.
Read the guide →CMMC Level 2 cost
Real price bands by path — self-serve software, consultant-led, enclave route — with the C3PAO assessment fee separated out honestly.
Read the guide →CMMC Level 1 vs Level 2
The decision rule (FCI → Level 1, CUI → Level 2), a side-by-side comparison table, and a 2-minute quiz that tells you which one you need.
Read the guide →DFARS 252.204-7012 explained
Just got the clause in a contract? The three duties it imposes — safeguard, 72-hour reporting, flow-down — in plain English, plus your first-week action list.
Read the guide →Do I need CMMC certification?
Whether CMMC applies to you, which level, and the part most people miss — self-assessment vs a third-party C3PAO certification — plus four myths that catch contractors out.
Read the guide →CMMC Level 2 requirements (all 110)
Every NIST SP 800-171 Rev 2 requirement grouped by the 14 families, with each control’s SPRS point value, Level 1 membership, and POA&M eligibility — a free, searchable explorer.
Read the guide →DFARS 252.204-7021 explained
The clause that makes CMMC a condition of contract award — what it requires, how it differs from 7012 and 252.240-7997 (formerly 7019/7020), and what to do when a solicitation carries it.
Read the guide →CMMC software: Muster vs Vanta vs Drata
An honest comparison of CMMC readiness software for small defense contractors — pricing, data handling, SSP/POA&M drafting, and SPRS scoring, with where each tool genuinely wins.
Read the guide →CMMC compliance checklist
The two-phase Level 2 checklist for small contractors — self-assessment readiness (gap assessment, SSP, POA&M, SPRS) then C3PAO readiness — with a phase-by-phase table and the primary-source rules.
Read the guide →What is a CMMC gap assessment?
What a gap assessment covers, how it differs from the C3PAO assessment, self-serve vs. consultant honestly compared — and how to run one free against all 110 requirements.
Read the guide →How long does CMMC Level 2 take?
A realistic 12–24 month timeline, phase by phase (gap assessment, remediation, the C3PAO waitlist, the assessment, conditional closeout) — and what actually sets your finish date.
Read the guide →How to submit your SPRS score
The step-by-step PIEE → SPRS submission walkthrough, the email alternative, and why the score you post is a representation to the government you have to stand behind.
Read the guide →What counts as CUI?
What CUI actually is for a defense contractor — technical data, drawings, export-controlled material — the three questions everyone asks, CUI vs. classified, and what to do when you receive it.
Read the guide →What is a good SPRS score?
The honest answer by goal: 110 is perfect, 88 is the Conditional Level 2 floor, and there is no minimum number just to post and bid. What the bands mean, and why an inflated score is FCA exposure.
Read the guide →CMMC for small business (the no-$100K path)
The self-serve readiness path for small contractors: do the gap assessment, SSP, and POA&M yourself for a fraction of the $14K–40K consultant bill — with the separate, unavoidable C3PAO fee broken out honestly.
Read the guide →Do you need GCC High for CMMC?
The honest scoping answer: the rule requires a FedRAMP-Moderate-equivalent cloud for CUI, never GCC High by name. When export-controlled (ITAR/EAR) data makes GCC High the answer, when it doesn’t, and how a CUI enclave cuts the bill.
Read the guide →How to calculate your SPRS score
The SPRS math step by step: start at 110, subtract the 5/3/1 weighted deductions, apply the only two partial-credit cases (3.5.3 and 3.13.11), and read your number — floor −203. Then let the free calculator do it for you.
Read the guide →What is conditional CMMC Level 2 certification?
Hold an award while you remediate: the ≥ 88 score floor, why only POA&M-eligible (1-point) gaps may stay open, the six requirements never eligible, and the 180-day closeout clock that turns Conditional into Final (32 CFR 170.21).
Read the guide →How much does a C3PAO assessment cost?
The assessor fee by organization size ($30K–75K small, more for larger), what it does and doesn’t include, the levers that shrink it (scope), and how many C3PAOs there are (103) against ~78,000 obligated contractors.
Read the guide →New guides ship weekly. Every regulatory claim on these pages traces to a primary source (32 CFR 170, NIST SP 800-171 Rev 2, the DoD Assessment Methodology v1.2.1), re-verified at least monthly.
Reading is step zero. Your score is step one.
The free assessment computes your SPRS score with the exact DoD methodology and shows which gaps are POA&M-eligible and which must be fixed first.
Start the free assessment