CMMC Phase 2 is suspended. Your NIST 800-171 self-assessment isn't. CMMC Map walks all 110 controls in plain English and writes the SSP, POA&M and policies as you go — so the score you post is one you can defend.
The Department of War suspended CMMC Phase 2, including the November 10 milestone that would have put C3PAO assessments into new solicitations. A CMMC Reform Task Force has 60 days to report — roughly September 11. Here is the honest version of what that means for a small sub.
You wear every hat already — owner, salesperson, IT lead, and now compliance officer. This landed on your desk because there's no one else's desk to land on.
Your prime is asking about your SPRS score and you're not certain what a good answer looks like, or how to get one without a $50K consultant.
Three hours into the NIST publication you've decoded four controls out of 110. You're not slow. Those documents were written for federal agencies with compliance teams, not for a machine shop with twelve people and one server closet.
CMMC Map asks plain-English questions about your shop, then does the paperwork. You don't need to become a security expert. You need a defensible number and the documents behind it.
Four steps. About fifteen minutes to a real starting point.
Roughly 70% of this work is documentation. Auto-filled from your control answers, editable, and formatted the way an assessor expects to read it.
Find out where you stand without paying anything. If you want the documents an assessor asks for — the SSP, the POA&M, the 14 policies — that's $49 a month, cancel anytime. A formal assessment runs $50K and up.
I built CMMC Map because I watched small subcontractors get handed a 110-row spreadsheet and a deadline with nobody to ask. Most compliance tools sell you a dashboard when your real problem is that your scope is wrong — you don't know which systems are actually in the boundary, so every answer after that is guesswork.
This isn't a venture-backed platform with a support queue. When you email [email protected], I'm the one who answers. When a rule changes — like it did on July 13 — the site gets updated that week, because I'd rather tell you inconvenient news than let you find it from your prime.
The rules keep moving — July 13 proved that. Once or twice a month we send the changes that actually affect small subs, in plain English, like everything else we do.