CMMC 2.0 compliance
that actually enforces the rules
The only CMMC tool that locks NIST 800-171 Rev 2 (not Rev 3), enforces 32 CFR 170.21 POA&M prohibitions, and blocks non-compliant SSP export when CUI is on commercial cloud. $2,499 one-time readiness package — you own every deliverable forever. Optional $199/mo monitoring.
110
NIST controls
320
Mock C3PAO objectives
6
Evidence connectors
Suspended
Phase 2, since 13 Jul 2026
Penn State University — $1.25M False Claims Act settlement (2024) for submitting inaccurate CMMC self-assessments. Aerojet Rocketdyne — $9M settlement (2022) for misrepresenting cybersecurity compliance. A false affirmation is a personal liability. Aegis Firma builds the documentation trail that protects you.
Everything a defense contractor needs
Built specifically for CMMC Level 2. Every rule from 32 CFR Part 170 is enforced in code, not left to the user to remember.
Real SPRS Score Calculator
Computes your exact SPRS score from −203 to +110 using DoD Assessment Methodology v1.2.1 weights. Partial-credit for 3.5.3 and 3.13.11 handled correctly.
POA&M Rule Enforcement
32 CFR 170.21 prohibits 6 controls (3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5, 3.12.4) and all 5-point controls from POA&M. These are hard-coded — no setting can relax them.
CUI Cloud Detection
Detects CUI on commercial M365 (not GCC High) or commercial Google Workspace and blocks compliant SSP export. Cites 3.13.11 / 3.13.16 in the block reason.
Customer-Specific SSP
SSP narratives must reference your actual evidence by ID. Stock-paragraph exports are blocked. Each of the 12 NIST 800-171 SSP sections is editable.
Mock C3PAO Assessment
NIST SP 800-171A Rev 2 objective-level scoring across all 110 controls. Identifies objective-level gaps before your real C3PAO review. Export gap report as Markdown.
Evidence Connectors
Auto-collect CMMC evidence from M365, Entra ID, AWS, Okta, Google Workspace, and Snowflake. Evidence maps automatically to the correct NIST controls.
Readiness Report
Green-light date projection based on POA&M closeout timeline and score trajectory. Shows exactly when you will reach the conditional certification floor of 88.
Subcontractor Flow-Down
DFARS 252.204-7012 requires primes to verify subs handling CUI. Track each sub's CMMC status, clause inclusion, incident reporting, and cloud service verification.
Cryptographic Audit Trail
Every control attestation, evidence upload, POA&M update, and affirmation is Ed25519-signed and stored append-only. C3PAO reviewers can verify the chain of custody.
We use NIST 800-171 Rev 2, not Rev 3 — and that's intentional
DoD Class Deviation 2024-O0013 (January 2024) explicitly prohibits CMMC assessments from using Rev 3. All assessments under 32 CFR Part 170 must use Rev 2 until DoD issues a new class deviation. Any CMMC tool that scores against Rev 3 will produce results that are incompatible with DoD contract requirements. Aegis Firma locks to Rev 2.
How we compare
Most CMMC tools are repurposed SOC 2 or GRC platforms. Aegis Firma is purpose-built.
| Feature | Aegis Firma $2,499 once + $199/mo | Exostar $10,000+ setup | Hyperproof ~$1,200/mo | Vanta CMMC ~$800/mo | Drata ~$1,500/mo | Apptega Custom |
|---|---|---|---|---|---|---|
| NIST 800-171 Rev 2 locked (DoD Class Deviation 2024-O0013) | Partial | |||||
| Real SPRS score calculator (−203 to +110) | Partial | Partial | ||||
| 32 CFR 170.21 POA&M prohibition enforcement | ||||||
| CUI-on-commercial-cloud detection (blocks non-compliant SSP) | ||||||
| Objective-level NIST 800-171A mock assessment across all 110 controls | ||||||
| Customer-specific SSP narratives (no stock paragraphs) | Partial | Partial | ||||
| DFARS 252.204-7012 subcontractor flow-down tracker | ||||||
| Cryptographic audit trail (Ed25519-signed) | ||||||
| Evidence connectors (M365, Entra, AWS, Okta, GWS, Snowflake) | Partial | Partial | Partial | Partial | ||
| Readiness report with green-light date projection | ||||||
| Annual affirmation packet generator | ||||||
| $2,499 one-time package, you own deliverables forever | ||||||
| Notes | Purpose-built for CMMC 2.0 | Legacy DoD portal, complex setup | General GRC — not CMMC-specific | SOC 2 tool with CMMC add-on | SOC 2 focused, CMMC module extra | General GRC, complex setup |
Competitor features based on publicly available documentation as of April 2026. Verify with vendors before purchasing.
CMMC rollout timeline — where the program actually stands
Dec 16, 2021
CMMC 2.0 rule finalized
32 CFR Part 170 published. Level 1 self-assessment, Level 2 C3PAO assessment.
Jan 24, 2024
DoD Class Deviation 2024-O0013
Locks CMMC assessments to NIST 800-171 Rev 2. Rev 3 is not used for CMMC.
Mar 1, 2025
Phase 1 — CMMC in select contracts
DoD begins including CMMC requirements in select new solicitations.
Jul 13, 2026
Phase 2 suspended
The Department of War suspended Phase 2 — which was to begin Nov 10, 2026 and make a C3PAO Level 2 assessment a condition of award — and froze the later phases pending a CMMC Reform Task Force review. Level 2 and Level 3 assessment requirements are being removed from active solicitations and contracts.
In force now
What the suspension did not touch
DFARS 252.204-7012, Phase 1 Level 1 and Level 2 self-assessments, NIST SP 800-171 Rev 2, your SPRS score posting and your annual affirmation all continue to apply. The program rule was not repealed.
One-time package, optional monitoring
Pay once for cert prep deliverables you own forever. Add monitoring monthly to keep your posture current. Return at year three for recertification.
One-time packages — own forever
CMMC Level 1 Package
FAR 52.204-21 — 17 controls. One-time package, you own the deliverables.
You own all deliverables — no expiration
- Initial 17-control self-assessment
- SPRS score calculator + initial scoring
- POA&M for any gaps identified
- Annual affirmation packet template
- 30-day implementation support email
- All deliverables yours to keep — no expiration
CMMC Level 2 Readiness Package
NIST SP 800-171 Rev 2 — 110 controls. Full cert prep, you own everything.
You own all deliverables — no expiration
- Full 110-control gap assessment
- SSP generation with customer-specific narratives
- Mock C3PAO assessment (320 NIST 800-171A objectives)
- POA&M with 180-day remediation timeline
- DFARS subcontractor flow-down templates
- Evidence vault with initial setup
- Cryptographic audit trail (Ed25519-signed)
- 30-day implementation support email
- All deliverables yours to keep — no expiration
CMMC Level 2 Recertification
Year-3 cert refresh — updated SSP, new gap analysis, new POA&M.
You own all deliverables — no expiration
- Updated SSP reflecting current state
- Re-assessment against current 110 controls
- New POA&M for newly identified gaps
- SPRS score trend (year-over-year)
- Updated evidence vault
- Annual affirmation refresh
- All deliverables yours to keep — no expiration
Optional monitoring — cancel anytime
CMMC L1 Monitoring
Ongoing FAR 52.204-21 monitoring after your initial package.
Billed monthly · cancel anytime
Requires the matching one-time package before you subscribe.
- Continuous control status monitoring
- Auto-reminder for annual affirmation
- Regulatory update alerts
- Evidence collection prompts (90-day cycles)
- Cancel anytime
CMMC L2 Monitoring
Ongoing NIST 800-171 monitoring after your readiness package.
Billed monthly · cancel anytime
Requires the matching one-time package before you subscribe.
- Continuous 110-control monitoring
- Evidence connectors (M365, Entra, AWS, Okta, Google, Snowflake) — on the roadmap
- Auto-reminder for annual affirmation
- Regulatory + DFARS update alerts
- DFARS subcontractor flow-down tracking
- Quarterly readiness review reports
- Cancel anytime
CMMC Enterprise Monitoring
Multi-org monitoring for MSPs and prime contractors.
Billed monthly · cancel anytime
- Everything in CMMC L2 Monitoring
- Unlimited sub-org management
- Bulk subcontractor tracking
- Aggregated SPRS dashboard
- DFARS 252.204-7012/7021 prime + sub reporting
- Dedicated compliance advisor
- API access
- SCIM provisioning
- Cancel anytime
CMMC Level 2 certification requires a third-party assessment by a C3PAO (Certified Third-Party Assessment Organization). Aegis Firma generates your documentation — you submit to SPRS.mil and schedule your C3PAO. Prices in USD, billed via our payment provider.
Common questions
Does Aegis Firma submit my SPRS score to DoD?
No. Aegis Firma generates your SPRS documentation and affirmation packet. You submit to SPRS.mil using your own CAC or PKI credentials. We never store your SPRS credentials.
Which version of NIST 800-171 does this use?
Rev 2 only. DoD Class Deviation 2024-O0013 (January 2024) locks CMMC assessments to Rev 2. We will not upgrade to Rev 3 until DoD issues a new class deviation permitting it.
What are the 6 POA&M-prohibited controls?
3.1.20 (External Connections), 3.1.22 (Control Public Info), 3.10.3 (Escort Visitors), 3.10.4 (Physical Access Logs), 3.10.5 (Manage Physical Access), 3.12.4 (System Security Plan). Per 32 CFR 170.21, these must be fully implemented before assessment — no deferred remediation allowed.
What is the conditional certification score floor?
A SPRS score of 88 or above is required for Conditional Level 2 certification. Below 88 means no certification — not even conditional. Aegis Firma blocks SSP export and flags this threshold on every scoring screen.
Is there a free CMMC tool available?
Yes — the SPRS calculator at /cmmc/calculator is free. Enter your control statuses and get your SPRS score instantly, with a gap report and email gate for the full breakdown.
How does the one-time package model work?
You buy the readiness package once ($799 for Level 1, $2,499 for Level 2 readiness, $1,499 for year-3 recertification). All deliverables — SSP, POA&M, mock C3PAO assessment, evidence vault — are yours forever. There is no expiration. Optional monitoring ($199/mo for Level 2) keeps the documentation current and runs the evidence connectors on a 90-day cycle. You can cancel monitoring anytime without losing the deliverables you already paid for.
Your SPRS score is visible to contracting officers today
CMMC Phase 2 is suspended, but your self-assessment, SPRS score posting and annual affirmation are not. Know your score, build your POA&M, and generate your SSP before your next DoD contract review.