For small DoD subs — no IT staff or compliance team needed

The controls aren't the hard part. The documentation is.

CMMC Map walks you through all 110 controls in plain English and writes the SSP, POA&M, and policies as you go. Built for the 5–50 person shop where the owner is also the IT department.

See Where You Stand — Free How It Works
2-minute readiness check · 7-day free trial · No credit card · From $49/mo
CMMC Map readiness dashboard with live SPRS score
70%of CMMC work is documentation
110controls, in plain English
~40%pre-filled after the wizard
Nov 10, 2026C3PAO assessments begin

You can run a business. Nobody taught you NIST 800-171.

You wear every hat already.

Owner, salesperson, IT lead — and now compliance officer. CMMC landed on your desk because there's no one else's desk to land on.

Your prime is asking about your SPRS score.

And you're not entirely sure what a good answer looks like — or how to get one without a $50K consultant.

The NIST PDF wasn't written for you.

Three hours in, you've decoded 4 controls of 110. You're not slow — those documents were written for federal agencies with compliance teams.

That's the gap CMMC Map fills: it asks plain-English questions about your shop, then does the paperwork. You don't need to become a security expert — you need to get started.

From a blank spreadsheet to most of the way there

Four steps. About 15 minutes to your first real starting point.

CMMC Map scoping wizard — plain-English questions
Step one

Answer the scoping wizard

15 minutes of plain-English questions about your shop. No CMMC background needed.

All 110 CMMC Level 2 controls in plain English
Step two

Walk the 110 controls

Every control explained for a small business, with an evidence checklist for each.

CMMC Map document generator — SSP, POA&M, policies
Step three

Generate your documents

One click: SSP, POA&M, and all 14 required policies, assessor-ready.

CMMC Map readiness report with SPRS score
Step four

See where you stand

A live SPRS score and pass/fail per control, with evidence gaps called out.

That's roughly 70–80% of the documentation work done for you. A C3PAO handles the formal certification — CMMC Map gets you ready for it.

No. I — Documents

One click. Every document your C3PAO will ask for.

The part everyone leaves until last — done first. Auto-filled from your control answers, formatted for assessor review.

  • ✓System Security Plan (SSP)
  • ✓POA&M with remediation timeline
  • ✓All 14 required policies, as Word docs
  • ✓One-click Audit ZIP (Pro)
Document generator producing SSP and policies
Plain-English control walkthrough
No. II — Guidance

Plain English. No security degree required.

Every control comes with "what this means for your business" — written for the owner-operator, not the federal compliance officer. Stuck anyway? Ask the built-in AI anything, anytime.

  • ✓Plain-English explanation per control
  • ✓Evidence checklist — what to gather, what to write
  • ✓AI Q&A built into every plan
No. III — Score

Your live SPRS score. No scoring tables.

Recalculates as you work. Pass/fail per control with evidence gaps called out — so when your prime asks, you have an answer.

  • ✓Live SPRS score, always current
  • ✓Readiness Report on demand (Pro)
  • ✓Compliance calendar keeps evidence fresh — new
Scoping wizard pre-fills controls
No. IV — New: Training · Pro

Security awareness training, built in

The AT control family requires documented, recurring training for everyone in your shop. Most tools send you to a third-party vendor. CMMC Map Pro delivers it in-app — with the records to prove it.

  • ✓Covers AT.L2-3.2.1, 3.2.2, 3.2.3 — no per-seat vendor fees
  • ✓Per-employee completion tracking, assessor-verifiable
  • ✓Annual renewals auto-scheduled on your calendar

Learn more about the training module →

Security Awareness Basics
AT.L2-3.2.1 · All staff
Complete
Insider Threat Awareness
AT.L2-3.2.3 · All staff
Complete
Role-Based: Admin Duties
AT.L2-3.2.2 · IT lead
In progress
Annual Refresher 2026
Due Nov 1 · Auto-scheduled
Scheduled
November 10, 2026

C3PAO third-party assessments begin. Self-assessment and SPRS posting are already required under DFARS 252.204-7012/7019/7020. Walk in with the documentation done — not the scramble.

Start Your Free Readiness Check

Less than a C3PAO assessment. By a lot.

A formal assessment runs $50K+. Get ready first. Every plan starts with a 7-day free trial. No contracts, cancel anytime.

Starter

$49/month
  • ✓All 110 controls + document generation
  • ✓Live SPRS score & dashboard
  • ✓Compliance calendar + fillable forms
  • ✓150 AI queries / month
Start with Starter

Pro

$149/month
  • ✓Everything in Starter
  • ✓Built-in security training (AT controls)
  • ✓Unlimited AI + Readiness Report
  • ✓Teams, workspaces & Audit ZIP bundle
Start with Pro

Common questions

When does CMMC actually become mandatory?
Two phases. Phase 1 — self-assessment and SPRS score posting — has been required since November 10, 2025 for any DoD contractor handling CUI under DFARS 252.204-7012/7019/7020. Phase 2 — mandatory C3PAO third-party assessment — begins November 10, 2026. Source: DoD CMMC FAQ Revision 2.3.
Does NIST 800-171 Rev 3 change my CMMC requirements?
Not yet — and not for a while. CMMC assessments, SPRS scoring, and DFARS compliance are all based on NIST SP 800-171 Revision 2 (110 controls). DoD has not adopted Rev 3; doing so requires new rulemaking, which is expected to take years. Build to Rev 2 today — that's what your C3PAO will assess against. CMMC Map tracks rule changes and will update when DoD formally transitions.
Do I need to upload CUI to use CMMC Map?
No. CMMC Map is a compliance readiness guide. You upload compliance documentation — policies, configuration screenshots, training records — not controlled technical data. Every upload is automatically scanned for CUI indicators before it enters our system.
Will CMMC Map replace my C3PAO?
No — and we're upfront about that. CMMC Map prepares you for a C3PAO assessment. The formal certification requires a Certified Third-Party Assessment Organization. We get you audit-ready; the C3PAO conducts the audit.
Do I need to know CMMC to use this?
Not at all. That's the whole point. Every control is explained in plain English with business context and step-by-step guidance. If you've never heard of NIST 800-171, start here.
How does the AI assistant work?
The AI assistant is powered by Claude Sonnet and is included with every plan — no separate API keys or per-token billing. Starter gets 150 queries per month, Pro gets unlimited. Your conversations are private to your workspace.
How long does CMMC Level 2 certification take?
For most small defense contractors, 12–18 months from start to certification. CMMC Map structures that timeline into phases so you're always moving forward — not staring at a 110-row spreadsheet wondering where to start.
I don't have any IT staff. Can I still use this?
Yes — this is exactly who CMMC Map is built for. Every control is rewritten in plain English with a "what this means for your business" explainer. The AI assistant answers questions about your specific setup. If you can run a small business, you can run this. The average shop hits audit-ready in 8–12 weeks of evening work.
What if I'm a 5–10 person shop?
You're our target customer. Starter ($49/month) is built for solo owners and very small teams. Pro ($149/month) makes sense once 2+ people work on compliance together and you want unlimited AI, the Readiness Report, the AI Tool Usage Policy wizard, and the one-click Audit ZIP.
Can I paste CUI into the AI Q&A?
No. The AI Q&A is a cloud-hosted assistant — it does not process Controlled Unclassified Information. Use it for control interpretation, policy language, and compliance how-tos. For document uploads, the CUI scanner flags anything that looks like CUI before storage.
I'm overwhelmed and don't know where to start.
Start with the free readiness check. The 15-minute scoping wizard asks straightforward questions about your shop, then pre-fills about 40% of the 110 controls automatically. You go from 110 unknowns to a real starting point in one sitting. No credit card required.

Have questions first?

Tell us a little about your shop and we'll get back to you — usually same day. No sales pressure, no obligation.

We reply from a real inbox ([email protected]). Your info is never shared or sold.

The CMMC Brief

CMMC rules shift constantly. Once or twice a month we send the changes that actually affect small subs — in plain English, like everything else we do.

  • ✓Rule changes & deadline updates, decoded
  • ✓One practical tip per issue
  • ✓No spam, unsubscribe anytime

Get audit-ready — without the scramble.

See where you stand in about 2 minutes. No credit card, no commitment.

See Where You Stand — Free