CMMC Level 2 compliance, step by step
From your first asset to a finished SSP, POA&M and SPRS score. Here is how CMMC2Ready guides you through every requirement and objective.
Enter your business details
Your organization's details are entered once and used in your SSP.
Organization & System Details
Add your assets
Choose the asset type, such as workstations, servers, firewalls, cloud services, or facilities, and answer a few multiple-choice questions. CMMC2Ready assigns each asset a CMMC category: CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized Asset, or Out-of-Scope. You can change the category if you have a reason to. Identical assets, such as 10 matching laptops, can be added as one entry.
Add Asset
Work through your requirements
Open a family, then a requirement, then an objective. Each objective shows a suggested policy, procedures for the asset types you've added, and the evidence to collect. Edit anything, upload your evidence, and mark the objective Met or Not Applicable. Progress shows at every level.
3.1.1[a] — authorized users are identified.
The organization shall maintain current records identifying each authorized user of organizational systems and the user's role.
The account management responsible person shall obtain an export or report of active organizational system accounts at least monthly, verify that each account is associated with a named individual and role, and retain the dated report.
A dated active-account export showing each account identifier, the associated individual's name, account status, and role or group information.
Review your documents
Policy and procedure text from your objectives is assembled into documents, mapped using the document lists in NIST's assessment guidance. A document becomes available to preview once you've confirmed the objectives that feed it.
Policy & Procedure Documents
Compiled from confirmed policy and procedure statements.
Generate your SSP and POA&M
Your SSP compiles from your details, assets, and objectives. After making changes, regenerate it to bring it up to date. Requirements you mark as planned appear in your POA&M with the plan details you enter. We tell you when CMMC rules may not allow a requirement on a POA&M, but the decision is yours.
System Security Plan
Compiled from your workspacePlan of Action & Milestones
Requirements marked as planned appear here.
Remediation actions, responsible owner, milestones, and target completion date.
Track your score
Your SPRS score is calculated from the requirements you've met, using the DoD Assessment Methodology.
SPRS score
Calculated using the DoD Assessment Methodology.
What CMMC2Ready doesn't do
It doesn't conduct assessments or replace a C3PAO.
CMMC2Ready prepares your documentation and evidence. Your assessment is carried out separately, either as your own self-assessment or by an accredited C3PAO.
It doesn't submit your score to SPRS.
CMMC2Ready calculates your score from the requirements you've met. Submitting it to SPRS is up to you, through the DoD's PIEE portal.
Try CMMC2Ready free for 14 days
Know exactly where you stand for CMMC Level 2. Check your SPRS score, assemble your POA&M, and customize your SSP risk-free for 14 days.