Part 1: Do You Need CMMC Level 1 or Level 2?
Answer three questions about your contract. This gives you a quick read, not a legal determination. See our full Level 1 vs Level 2 guide for the reasoning behind each question.
1. Does your contract include DFARS clause 252.204-7012?
2. Do you create, receive, store, or transmit Controlled Unclassified Information (CUI), such as technical data or program-specific drawings?
3. Has your prime or contracting officer confirmed in writing that you only handle Federal Contract Information (FCI), with no CUI?
Part 2: Partial SPRS Score Estimator
This checks the 42 highest-weighted controls in the NIST SP 800-171 assessment methodology, each worth 5 points toward your SPRS score. These are the controls that move your score the most, so they are the right place to start triage, but they are not the full 110-control picture.
Check any control that is not fully met in your environment today.