You can build a scenario from illustrative service-package assumptions, or score all 110 controls yourself on the DoD Assessment Methodology. Either way, the dial locks as the gaps close. There's no signup or sales call, and every point weight is on screen.
Pick the inDirectIT packages you're weighing. Compare illustrative point assumptions, identify capabilities to verify, and explore a boundary scenario using Teramis.
Point values are illustrative assumptions, not measured engagement results or guaranteed SPRS improvements. Package capabilities may overlap. Your actual score depends on verified control implementation and evidence; discovery alone does not earn points.
Mark each control Met or Gap (a couple allow Partial credit). Your SPRS score, points at risk, and the System Security Plan gate update live.
Self-assessment estimate for planning, not an official SPRS submission. An official Basic Assessment requires a documented System Security Plan and is your own representation in SPRS. Scoring weights follow the DoD Assessment Methodology as configured in this tool.
Open gaps are listed by point impact, highest first, which shows where a compliance dollar buys the most SPRS score.
Send yourself a copy and a CMMC practitioner at inDirectIT will review it and follow up with a fixed-scope path to close the gaps in priority order. You won't be added to a drip campaign. You can also email rj@indirectit.com directly.
Applicable DFARS 252.204-7019 and 252.204-7020 require current assessment records for covered systems. DoD personnel and authorized representatives of the assessed contractor can access the relevant SPRS records. Primes may request supplier representations or evidence to verify subcontract requirements; they do not have unrestricted access to other contractors' scores.
Each unimplemented control takes 1, 3, or 5 points off 110. The heavier-weighted gaps cost the most, so the order you close them in matters more than anything else.
Without a System Security Plan (3.12.4) there's no assessment to submit at all. This tool enforces that gate the same way an assessor will.
Safeguarding and applicable self-assessment duties continue during the Phase II suspension. Review your solicitation, contract, subcontract, and amendments for the requirements that apply. Read the current CMMC status.
A real score survives an objective-level review, which means configurations and logs instead of a binder of intentions. Score yourself honestly here.
Work through fourteen families and make an honest Met, Gap, or Partial call on each control, collapsing each family as you clear it. You don't need an account or an email address to see your full score.
Your SPRS score, points at risk, and the SSP gate recompute on every click, with no submit button, no waiting, and no hidden math.
Open gaps sort by point impact, so your remediation budget goes where it lifts the score fastest. It's the assessor's own math, used in your favor.
inDirectIT is a CMMC Level 2-certified compliance firm for the Defense Industrial Base. We turn this score into a fixed-scope remediation plan and run it from inside our own assessed GCC High environment. We already hold the certification we help you earn.
