1TEN

CMMC Map is a NIST SP 800-171 and CMMC self-assessment application built for small U.S. defense contractors without a compliance team. A 15-minute scoping wizard tells you which requirement applies (CMMC Level 1, CMMC Level 2 self-assessment, or the SPRS score under DFARS 252.204-7019) and pre-fills roughly 40% of your controls. Each of the 110 requirements is explained in plain English with an evidence checklist, and your DoD-weighted SPRS score updates as you answer. One click generates the System Security Plan, POA&M and all 14 required policies from your answers, plus a Readiness Report that applies a reviewer's checklist to your package. A read-only connection to Microsoft 365 or Google Workspace reads tenant configuration (users, MFA, device and audit settings) and files it as evidence; document contents are never read. Interview prep, an Assessor view, a compliance calendar, a training roster and MFA are included. Consultants manage clients in separate workspaces on one invoice.

Preparing for the Cybersecurity Maturity Model Certification (CMMC) assessment is a considerable investment from both time and money perspectives. Organizations handling Controlled Unclassified Information (CUI) within the defense industrial base should expect to have an authorized CMMC 3rd Party Assessment Organization (C3PAO) certify their implementation of NIST SP 800-171 security requirements. Assessors will evaluate how the contractor implements each of the 320 objectives across all applicable assets within the scope, including people, facilities, and technologies. The assessment process is expected to involve a review of artifacts, interviews of key personnel, and tests of the technical, administrative, and physical controls. As organizations prepare their body of evidence, they should establish a relationship between the artifacts, the security requirement objectives, and assets within scope.