Two ways in: build a scenario using illustrative service-package assumptions — or score all 110 controls yourself. No signup, no sales call, no black box.
Pick the inDirectIT packages you're weighing. Compare illustrative point assumptions, identify capabilities to verify, and explore a boundary scenario using Teramis.
Point values are illustrative assumptions, not measured engagement results or guaranteed SPRS improvements. Package capabilities may overlap. Your actual score depends on verified control implementation and evidence; discovery alone does not earn points.
Mark each control Met or Gap (a couple allow Partial credit). Your SPRS score, points at risk, and the System Security Plan gate update live.
Self-assessment estimate for planning — not an official SPRS submission. An official Basic Assessment requires a documented System Security Plan and is your own representation in SPRS. Scoring weights follow the DoD Assessment Methodology as configured in this tool.
Open gaps, highest point-impact first — where a compliance dollar buys the most SPRS score.
Send yourself a copy and inDirectIT will follow up with a fixed-scope path to close the gaps in priority order. Reviewed by a CMMC practitioner — not a drip campaign. Or email rj@indirectit.com directly.
Applicable DFARS 252.204-7019 and 252.204-7020 require current assessment records for covered systems. DoD personnel and authorized representatives of the assessed contractor can access the relevant SPRS records. Primes may request supplier representations or evidence to verify subcontract requirements; they do not have unrestricted access to other contractors' scores.
Each unimplemented control costs 1, 3, or 5 points off 110. The heavy-weighted gaps hurt most — so the order you close them in is the whole game.
Without a System Security Plan (3.12.4) there's no assessment to submit at all. This tool enforces that gate exactly like an assessor will.
Safeguarding and applicable self-assessment duties continue during the Phase II suspension. Review your solicitation, contract, subcontract, and amendments for the requirements that apply. Read the current CMMC status.
A real score survives an objective-level review — configurations and logs, not a binder of intentions. Score yourself honestly here.
Fourteen families, honest Met / Gap / Partial calls. Collapse each family as you clear it — no account, no export wall, no email to see your score.
Your SPRS score, points at risk, and the SSP gate recompute on every click. No submit button, no waiting, no black box.
Open gaps sort by point impact, so remediation budget lands where it lifts the score fastest — the assessor's own math, turned in your favor.
inDirectIT is a CMMC Level 2-certified compliance firm for the Defense Industrial Base. We turn this score into a fixed-scope remediation plan and run it from inside our own assessed GCC High environment — the certification we help you earn, we already hold.