Free self-check · about three minutes
How ready are you for CMMC Level 2?
Answer 10 questions on scope, documentation, evidence and ownership and you'll see your readiness band (Early, Developing or Nearly ready) straight away, before any email. Leave your name and work email for the three gaps to close first, a short write-up, the right first step for your platform and a PDF report.
Not an SPRS score. This self-check gives a readiness band from your own answers. It is not an SPRS score, an assessment or a determination of compliance, and it doesn't map to the DoD Assessment Methodology.
Takes about three minutes. You'll see your readiness band right away. We keep your email and your result band, not your individual answers. Never enter CUI, contract details or credentials. Unsubscribe anytime.
Question 1 of 10
Evidence
Please don't send CUI, contracts, credentials or security evidence through any form on this site.
Your answers stay in this browser tab and are never sent to us.
The bands
What the bands mean
under 40%
Early
- The program is at the start. That's fine: the cheapest decisions are the ones made before money is spent on tools.
40% to under 75%
Developing
- Real work is under way, but scope, documents and evidence don't line up yet. That's the most common place to be.
75% or more
Nearly ready
- Most of the foundations are in place. The work now is closing the remaining gaps and proving each requirement with evidence.
Questions
The CMMC Level 2 Self-Check, answered
Is this an SPRS score?
- No. This self-check gives a readiness band from your own answers. It is not an SPRS score, an assessment or a determination of compliance, and it doesn't map to the DoD Assessment Methodology. It's a short way to see where to start and what to close first.
What does the Self-Check cover?
- 10 questions in four areas: scope, documentation, evidence and ownership. They draw on NIST SP 800-171 Rev. 2, the 110 requirements behind CMMC Level 2, for example the system security plan (3.12.4), the POA&M (3.12.2) and multifactor authentication (3.5.3). Each answer is one tap: Yes, Partly, or No / Not sure. No free text.
How is the readiness band worked out?
- Each answer earns points (Yes 2, Partly 1, No / Not sure 0), weighted by how much that question matters for an assessment. The total, as a share of the maximum, sets the band: Early (under 40%), Developing (40% to under 75%) or Nearly ready (75% or more). The three largest gaps are the questions where the most weighted points were missed.
What should I do after the Self-Check?
- It depends on your band and your platform. Early or Developing, with email and files in a Microsoft 365 commercial or GCC tenant: Microsoft 365 Hardening, four guided sessions in which your admin makes the changes. Nearly ready, or on GCC High, Google Workspace, AWS, Google Cloud or not sure: the Level 2 Readiness Assessment, which is platform-neutral. A 30-minute scoping call can confirm either, or say "not us yet".
Who has to sign off on a CMMC Level 2 self-assessment?
- Level 2 self-assessments are followed by an affirmation from a senior official, and it's repeated annually. That's one reason a single named person should own the program week to week.
What happens to my answers?
- They stay in your browser tab for the session, and your band is worked out there. If you ask for the three largest gaps, ForgePoint keeps your name, work email, band, score, three largest gaps, platform, the suggested next step and the date in its CRM, and emails you a copy. Your individual answers are never sent or stored, and the PDF report is drawn on request and not kept. Anonymous analytics count how far people get (question numbers only, never answers).
On Microsoft 365?