Interactive tools
CMMC Level 2 Compliance System
A complete Notion-based operating system for your compliance program: control templates mapped to all 110 requirements, implementation workflows, readiness surveys, and evidence-tracking structures.
Open →CMMC Calculator
Free scoring tools built on the DoD Assessment Methodology. Compute your SPRS score, model what remediation would change, and decide which deductions to fix first.
Open ↗Policy Packs
Policy and procedure sets aligned to NIST SP 800-171 Rev. 2 and written to be put into practice. Each one maps to the control objectives an assessor will test.
Open →Free CMMC Readiness Checklist
A practical, no-registration starting point: the questions a C3PAO will ask, ordered by how expensive they are to fix late.
Open →CMMC Phase Checklist
What to do this week, this month, and this quarter, mapped to the phase-in that started in November 2025. Work through it on screen or print it.
Open →CUI Scope Estimator
In five minutes, two sliders and one question compare your CMMC boundary today with the boundary after discovery, and show what right-sizing it would save.
Open →Rev. 3 Transition-Readiness Checklist
Twelve questions that predict whether NIST SP 800-171 Rev. 3 is a managed delta or a rebuild for your program. It's free and needs no registration.
Open →CUI Applicability Analyzer
Three questions about your customer, your clauses, and your data give a directional read on which CUI, 800-171, CMMC, or agency obligations likely apply to your contract.
Open →Field guides
The CMMC Deadline Playbook
How the 32 CFR and 48 CFR phase-in works in practice: where the rollout stands, what primes are demanding now, and a 90-day plan that keeps you biddable.
Read the guide →CUI Scope Reduction Field Guide
How regulated-data discovery maps your CMMC boundary, systems, users, and security dependencies before remediation.
Read the guide →CMMC Cost Planning Guide
The honest cost stack from discovery to assessment, and why scope is a bigger lever on cost than tooling.
Read the guide →GCC High Migration Timeline
The phase-by-phase migration plan: what moves when, what breaks if you order it wrong, and where the long-lead items hide.
Read the guide →Rev. 2 vs. Rev. 3 Executive Guide
What changed in Rev. 3 (17 families, ODPs, consolidation, 800-171A Rev. 3), and why the revision that binds you is the one your contracts name, whatever the publication date.
Read the guide →The 17 Rev. 3 Families, Explained
The 14 carried-forward families plus the three new ones (Planning, Acquisition, and SCRM), and what each demands in day-to-day operations.
Read the guide →ODP Field Guide
Organization-Defined Parameters: who sets the values, how to build a defensible decision register, and the failure modes assessors catch.
Read the guide →Rev. 2 → Rev. 3 SSP Conversion
The five-pass conversion method that restructures your SSP for Rev. 3 without breaking the Rev. 2 view your contracts still need.
Read the guide →Rev. 3 Evidence Guide (800-171A)
Objective-level indexing, the examine/interview/test methods, evidence reuse from Rev. 2, and refresh cadences.
Read the guide →Microsoft Stack × Rev. 3
The six Microsoft security planes mapped to Rev. 3's 17 families, and where the new process families ask for more than tooling can satisfy.
Read the guide →Dual-Baseline Operations
Operating Rev. 2 and Rev. 3 simultaneously: one implementation, two reporting views, per-customer ODP values.
Read the guide →GSA Authorization Lifecycle
Phase by phase: preparation, package, showstoppers, the authorization decision, and the continuous monitoring behind it.
Read the guide →NASA Contractor CUI Readiness
From agreement clause to operating program, including the boundary problem in research environments.
Read the guide →DOE CUI & UCNI Boundary Guide
Where CUI and UCNI must not blur: nested-compartment boundary design for DOE contractors.
Read the guide →For the ecosystem
Brilliant at the Basics is our independent DIB resource center supporting the DoW CIO's Brilliant at the Basics initiative. It translates the IT and OT Top 10 into sequenced action, validation checks, and evidence guidance, and adds a free 30-day plan builder. It's free, with no registration, at brilliantatthebasics.us ↗.
ESP Collective is a community for External Service Providers (MSPs, MSSPs, and C3PAOs) working inside the CMMC ecosystem. It covers governance, shared practice, and peer standards at espcollective.com ↗.
If a tool tells you to talk to someone, talk to us.
Score yourself, estimate your scope, and work the checklist first. When you want the fixed-scope version with a practitioner attached, use this form, or email rj@indirectit.com directly.