Interactive tools
CMMC Level 2 Compliance System
A complete Notion-based operating system for your compliance program: control templates mapped to all 110 requirements, implementation workflows, readiness surveys, and evidence-tracking structures.
Open →CMMC Calculator
Free scoring tools built on the DoD Assessment Methodology — compute your real SPRS score, model remediation impact, and prioritize the deductions that matter.
Open ↗Policy Packs
NIST SP 800-171 Rev. 2-aligned policy and procedure sets written to be implemented, not shelved — each mapped to the control objectives an assessor will test.
Open →Free CMMC Readiness Checklist
A practical, no-registration starting point: the questions a C3PAO will ask, ordered by how expensive they are to fix late.
Open →CMMC Phase Checklist
What to do this week, this month, this quarter — interactive, printable, and mapped to the phase-in that started November 2025.
Open →CUI Scope Estimator
Three sliders, five minutes: see what your CMMC boundary looks like today versus after discovery — and what right-sizing it would save.
Open →Rev. 3 Transition-Readiness Checklist
Twelve questions that predict whether NIST SP 800-171 Rev. 3 is a managed delta or a rebuild for your program — free, no registration.
Open →CUI Applicability Analyzer
Three questions — customer, clauses, data — for a directional read on which CUI, 800-171, CMMC, or agency obligations likely apply to your contract.
Open →Field guides
The CMMC Deadline Playbook
The 32 CFR / 48 CFR phase-in as it actually works — where we are, what primes are demanding now, and a 90-day plan that keeps you biddable.
Read the guide →CUI Scope Reduction Field Guide
How regulated-data discovery maps your CMMC boundary, systems, users, and security dependencies before remediation.
Read the guide →CMMC Cost Planning Guide
The honest cost stack from discovery to assessment, and why scope — not tooling — is the biggest lever.
Read the guide →GCC High Migration Timeline
The phase-by-phase migration plan: what moves when, what breaks if you order it wrong, and where the long-lead items hide.
Read the guide →Rev. 2 vs. Rev. 3 Executive Guide
What actually changed — 17 families, ODPs, consolidation, 800-171A Rev. 3 — and why your contracts, not the publication date, decide which revision binds you.
Read the guide →The 17 Rev. 3 Families, Explained
The 14 carried-forward families plus the three new ones — Planning, Acquisition, SCRM — and what each demands operationally.
Read the guide →ODP Field Guide
Organization-Defined Parameters: who sets the values, how to build a defensible decision register, and the failure modes assessors catch.
Read the guide →Rev. 2 → Rev. 3 SSP Conversion
The five-pass conversion method that restructures your SSP for Rev. 3 without breaking the Rev. 2 view your contracts still need.
Read the guide →Rev. 3 Evidence Guide (800-171A)
Objective-level indexing, the examine/interview/test methods, evidence reuse from Rev. 2, and refresh cadences.
Read the guide →Microsoft Stack × Rev. 3
The six Microsoft security planes mapped to Rev. 3's 17 families — and where the new process families exceed what tooling can satisfy.
Read the guide →Dual-Baseline Operations
Operating Rev. 2 and Rev. 3 simultaneously: one implementation, two reporting views, per-customer ODP values.
Read the guide →GSA Authorization Lifecycle
Phase by phase: preparation, package, showstoppers, the authorization decision, and the continuous monitoring behind it.
Read the guide →NASA Contractor CUI Readiness
From agreement clause to operating program — including the research-environment boundary problem.
Read the guide →DOE CUI & UCNI Boundary Guide
Where CUI and UCNI must not blur: nested-compartment boundary design for DOE contractors.
Read the guide →For the ecosystem
Brilliant at the Basics — our independent DIB resource center supporting the DoW CIO's Brilliant at the Basics initiative: the IT and OT Top 10 translated into sequenced action, validation checks, and evidence guidance, plus a free 30-day plan builder. Free, no registration, at brilliantatthebasics.us ↗.
ESP Collective — a community for External Service Providers (MSPs, MSSPs, and C3PAOs) operating inside the CMMC ecosystem. Governance, shared practice, and peer standards at espcollective.com ↗.
When the tools say 'talk to someone' — talk to us.
Score yourself, estimate your scope, work the checklist. When you're ready for the fixed-scope version with a practitioner attached, this is the form. Or email rj@indirectit.com directly.