NIST 800-171 (CMMC) Tabletop Audit
Are you ready for CMMC? Test your NIST 800-171 compliance across all 14 control families in 15 minutes.
What You'll Discover
Your CMMC Readiness Score
Get a comprehensive score (-600 to +600) showing your NIST 800-171 compliance across all 14 control families: Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Physical Protection, Risk Assessment, Security Assessment, System & Communications Protection, and System & Information Integrity.
DoD Contract Readiness
Understand your ability to bid on DoD contracts requiring CMMC Level 1 or Level 2 certification. Learn whether you can protect Controlled Unclassified Information (CUI) according to federal requirements.
CUI Protection Gaps
Identify specific weaknesses in your CUI protection program - from encryption and access controls to incident response and security monitoring. See exactly what assessors will flag.
Assessment Timeline
Receive realistic timeline estimates for reaching CMMC assessment readiness - from emergency remediation (6-12 months) to minor improvements (30-60 days) based on your current state.
Do you limit system access to authorized users, processes acting on behalf of authorized users, and devices?
Assessment Categories
We evaluate your organization across all 14 NIST 800-171 control families
Access Control (AC)
User authorization, least privilege, MFA, access reviews - fundamental to CUI protection
Identification & Authentication (IA)
User/device identification, password complexity, credential protection
System & Communications Protection (SC)
Boundary protection, FIPS 140-2 encryption, network segmentation, cryptographic controls
System & Information Integrity (SI)
Flaw remediation, malware protection, security alerts, vulnerability scanning
Incident Response (IR)
IR plan, testing, tracking, 72-hour DoD reporting - contract requirement
Media Protection (MP)
CUI marking/handling, portable media control, media sanitization before disposal
Audit & Accountability (AU)
Event logging, 90-day retention, log review, log protection from tampering
Configuration Management (CM)
Baseline configs, change control, system hardening, unnecessary service restriction
Awareness & Training (AT)
Annual security training, role-based training, completion tracking
Maintenance (MA)
Remote maintenance controls, monitoring, media sanitization procedures
Physical Protection (PE)
Physical access controls, visitor escorting, badge systems for CUI areas
Risk Assessment (RA)
Annual risk assessments, vulnerability scanning, remediation tracking
Security Assessment (CA)
Annual control assessments, POA&M for gaps, continuous improvement
Why This Assessment Is Different
Based on Real CMMC Assessments
Questions derived from actual CMMC assessments and NIST 800-171 audit findings - we know what assessors look for
CMMC Compliance Experts
Our team has extensive experience with CMMC assessments and defense contractor compliance - we know exactly what assessors look for
Brutally Honest Scoring
We tell you the truth about your CMMC readiness, even if it's uncomfortable - better to know now than during assessment
Let's Fix Your CMMC Compliance Gaps
Talk to Craig about your assessment results and get a customized plan to achieve CMMC certification.
(•••) •••-••••
No sales pitch • Honest assessment • 35+ years successfully running IT and security for businesses