Federal Compliance
Know your SPRS score before the prime asks for it.
Aegis Firma walks all 110 CMMC Level 2 controls with the 320 NIST SP 800-171A assessment objectives behind them, scores you the way the DoD scores you, generates the System Security Plan from your own answers, and tracks each POA&M item against its 180-day clock.
No account needed to see where you stand across the control families.
- CMMC Level 2 controls, each with its own evidence
- 110CMMC Level 2 controls, each with its own evidence
- NIST SP 800-171A assessment objectives behind them
- 320NIST SP 800-171A assessment objectives behind them
- the POA&M clock, tracked per item
- 180 daysthe POA&M clock, tracked per item
- your score, with its trend over time
- SPRSyour score, with its trend over time
The prime has sent the flow-down clause and wants a date.
DFARS 252.204-7012 has been in your subcontracts for years; what changed is that somebody is now checking. A prime asks for your SPRS score, or a solicitation names a CMMC level, and the honest answer is that nobody has ever walked the 110 controls line by line. A consultant will do it for tens of thousands of dollars. This does the walk, keeps the answers, and produces the documents.
What you get, and where it lives
Every line below is a working part of the product with its own page. Open any of them.
- CMMC readiness assessment
Walk all 110 controls at the objective level — 320 objectives — recording what is in place, what is partial and what is missing, with the evidence attached to each.
- SPRS score and trend
The DoD self-assessment score computed the way the methodology computes it, with the history so you can show movement rather than a single number.
- System Security Plan
An SSP generated from the answers you gave during the assessment, so the plan and the assessment cannot disagree with each other.
- POA&M tracking
Every gap becomes a plan-of-action item with an owner and a date, tracked against the 180-day limit.
- CUI scoping
Work out which of your systems are actually in scope before you assess them — the step that decides how big and how expensive the rest of it is.
- Free CMMC self-assessment
Start without an account and see where you stand across the control families.
- For defense subcontractors
What the flow-down clauses require of you specifically, and in what order to deal with them.
- An auditor portal
Invite an assessor or a prime’s security team to a read-only view of the evidence, instead of emailing a folder of screenshots.
What it costs
The self-assessment is free. Level 1 readiness is a one-time $799 package and Level 2 is $2,499 — every deliverable yours to keep, with no expiry. Keeping Level 2 current afterwards is $199 a month, and optional. If you want CMMC inside the same record as every other door, the Federal plan is $1,999 a month.
See CMMC pricingWhere we stop
We are not a C3PAO and we do not certify anybody. A certification assessment is performed by an accredited third party, and nothing produced here substitutes for it. What this does is the work you have to do before that assessment is worth booking: the walk, the score, the plan and the evidence, in a form an assessor recognises.
Check us before you buy
The prime has sent the flow-down clause and wants a date.
No account needed to see where you stand across the control families.
Start the free self-assessment