Assess your CMMC 2.0 readiness — NIST 800-171 score, SPRS status, CUI handling, media protection, and access controls. Get your gap summary and CMMC level recommendation in 60 seconds.
CMMC at a glance: 300,000+ DoD contractors face mandatory CMMC Level 2 certification by 2026 — under DFARS 7012 (clause 252.204-7012). Without a current NIST 800-171 self-assessment posted to SPRS, you cannot receive new DoD contracts. Vanta, Drata, and Secureframe all have CMMC offerings — ComplianceStack is building ours. Take the assessment now to get your CMMC level recommendation and join the waitlist for our upcoming CMMC audit product.
7 questions covering NIST 800-171, SPRS, CUI handling, access controls, incident response, and vendor management.
Instant results in-browser. No data transmitted unless you join the waitlist.
Results are directional — not a substitute for a formal C3PAO assessment or DFARS 7012 compliance review.
The Cybersecurity Maturity Model Certification 2.0 (CMMC 2.0) is the DoD's framework for verifying that contractors and subcontractors in the Defense Industrial Base (DIB) have the cybersecurity controls in place to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
Level 1 (Foundational): 15 practices based on FAR 52.204-21. Annual self-assessment required. Companies handling only FCI (not CUI) may only need Level 1. Self-assessed — no third party required.
Level 2 (Advanced): 110 practices aligned to NIST SP 800-171 Rev 2. Required for contracts involving CUI. Third-party assessment by a C3PAO required for priority contracts by 2026. This is where most DIB subcontractors sit.
Level 3 (Expert): NIST SP 800-171 Rev 2 plus additional NIST SP 800-172 requirements. DoD-led assessment. Required for the most sensitive programs.
DFARS 7012 (clause 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting") is the legal instrument that flows CMMC requirements down to contractors. Key requirements under DFARS 7012:
CMMC 2.0 requirements are phasing into DoD RFPs. Companies that cannot demonstrate CMMC compliance risk being excluded from contract awards. The assessment below helps you understand where you stand against NIST 800-171 Rev 2 requirements — and what steps to take next.