For Defense contractors & CMMC OSCs
A CMMC self-assessment you can defend, not just file.
“If I sign it and I'm wrong, that's my name on it.”
Tuesday morning: An SPRS score filed months ago, and nothing to show if a prime — or an investigator — asks what it was based on.
They search for:
CMMC Level 2 compliance softwareNIST 800-171 trackingSPRS score calculatorPOA&M templatedefensible CMMC self-assessment
How CMDash answers it
Your CMMC level, practice by practice
All 110 Level 2 practices across 14 domains, each with its own status — not a single percentage that hides which domain is behind, and not a number you typed into a spreadsheet once.
The record behind every practice, kept
Every practice carries the evidence behind it, dated. If a prime, an investigator or next year's version of you asks what the score was based on, the answer is already attached — not reconstructed from memory.
The self-assessment and POA&M package, exported
The official self-assessment export and POA&M in the format a C3PAO expects, built from the same live practice data as the level view above — the same package whether you export it today or in a year.
Watch: CMMC practice to SPRS score
- 0:00From CMMC practice to SPRS score, in a silent minute. Everything shown is a seeded demo workspace.
- 0:09Every framework you report on, in one place — CMMC Level 2 beside the rest, each with its own status.
- 0:18Every practice carries the evidence behind it, traced back to the integration or upload that produced it.
- 0:28The SPRS score, computed from that same practice data — something you can walk an assessor through, not a number you hope holds up.
- 0:37A POA&M generated from the open practices, in the shape a C3PAO expects to review.
- 0:47The official self-assessment package, exported — built from the same live practice data as the level view above.
- 0:53Pricing is public and the trial is self-serve. Everything shown was sample data in a demo workspace.
Frameworks built for the assessment
CMMC Level 1
The 17 foundational safeguarding practices for Federal Contract Information, mapped to FAR 52.204-21, with an annual self-assessment tracker.
CMMC Level 2
All 110 practices across 14 domains, with practice-level evidence, SPRS scoring, and the official self-assessment and POA&M artifacts a C3PAO asks for by name.
CMMC Level 3
The 24 NIST SP 800-172 enhanced requirements selected in 32 CFR 170.14(c)(4), with the rule's verbatim text, for programs that need them on top of Level 2.
FedRAMP Moderate
The full NIST SP 800-53 Rev 5 Moderate baseline across all 19 control families, with the verbatim public-domain control text.
Where the evidence comes from
Amazon Web Services
Reads your AWS configuration directly — root MFA, root access keys, password policy, S3 Block Public Access, CloudTrail, KMS key rotation and EBS encryption. Needs a read-only IAM credential and nothing else; no Security Hub subscription required.
Microsoft Azure
Reads your Azure subscription configuration directly — storage account public access and secure transfer, managed-disk encryption, and activity-log export. Needs a Reader role assignment; no Defender for Cloud plan required.
Okta
MFA enrolment and factor coverage, suspicious sign-in events, and the SaaS app catalog — the broadest identity signal cmdash ingests.
CrowdStrike Falcon
Pulls managed hosts, detections, and host vulnerabilities from Falcon so endpoint-protection controls are evidenced by live agent coverage rather than a spreadsheet.
Asked for proof by a prime or an insurer?
You answer a request from a free workspace, share only the claims you choose, and withdraw the grant whenever you like. See how relying parties request and read proof.