CMMC readiness check for small defense suppliers
Twenty-four questions on the items a CMMC Level 2 assessment depends on. Answer online in about six minutes, see your rating and fix list, and get a scored PDF to plan from.
Five sections, scoping first
- 01
Scope & documentation
An assessment starts with scoping and the System Security Plan. Get these right and everything after is easier. Written for Level 2; Level 1 covers a smaller set.
- 02
Access & identity
Access control and identification requirements are a large share of the 110, and assessors test them directly.
- 03
Protecting CUI
These requirements protect the information itself: in storage, in transit, on removable media and behind locked doors.
- 04
Monitoring & maintenance
Logging, patching, scanning and configuration management show an assessor the controls work day to day, not just on paper.
- 05
People & incidents
The people side of CMMC: everyone trained, a tested response plan, the DoD reporting route ready, and a senior official who signs.
Where small suppliers usually stand
CMMC turns the NIST SP 800-171 requirements that defense contracts have referenced for years into something verified: an annual affirmation, and at Level 2 either a self-assessment or an assessment by an authorized third-party organization (a C3PAO), depending on the contract. The requirements are being phased into DoD solicitations starting November 10, 2025.
Most of the work is not exotic. It is deciding where controlled unclassified information is allowed to live, writing the System Security Plan, turning on multi-factor authentication and validated encryption, and keeping the logs and records that prove the controls run. This check covers those items first, because an assessment cannot get far without them.
Atlas helps with readiness, not certification: we help you scope, close gaps and organize evidence, and you or a C3PAO perform the assessment. See our CMMC compliance support and managed IT for manufacturers.
References
Standards referenced
About the CMMC Readiness Check
Is this a CMMC assessment?
No. It is a readiness aid that shows where you stand on the items an assessment depends on. Only an affirmed self-assessment or an assessment by an authorized C3PAO counts toward CMMC status, and both use the full NIST SP 800-171A assessment objectives.
Which level does it cover?
It is written for Level 2, which applies when you handle controlled unclassified information. If your contracts only involve federal contract information, Level 1 applies: 15 basic safeguarding requirements and an annual self-assessment. Many of the same questions still apply.
What is SPRS?
The Supplier Performance Risk System, where DoD contractors post their NIST SP 800-171 assessment score and CMMC affirmations. Contracting officers check it, so a missing or out-of-date entry can cost you an award.
Does Atlas certify companies?
No. Atlas is not a C3PAO and does not issue CMMC status. We help you get ready: scoping, closing gaps, writing documentation and organizing the evidence an assessor will ask for.
Plan your path
to assessment.
Tell us what you found and we'll tell you what we'd fix first. No obligation.