The New CMMC Map Is Live. Here Is What Changed and Why.

On September 9 we replaced CMMC Map with a version rebuilt from the ground up. Same address (app.cmmcmap.com), same free assessment, every customer's work carried over. This post is the plain account of what is different, what is not, and the thinking behind it.

Why rebuild instead of add on

The first version of CMMC Map proved one thing: a small shop will do its own NIST SP 800-171 assessment if the 110 requirements are explained in plain English and the SPRS score updates as they go. That part worked. What people asked for next was a different kind of product. They wanted evidence attached to their answers, not just statuses. They wanted to see their package the way a prime or an assessor would see it. And they wanted to type less, because most of what a self-assessment asks about already lives in their Microsoft 365 tenant.

None of that bolts onto a questionnaire. So we rebuilt: new data model, new interface, and connections to the systems where the evidence already is.

What is new

One dashboard, three paths

The old app was built around one number, your SPRS score. The new dashboard shows all three things a small contractor is actually accountable for, each with its own count: CMMC Level 1 (15 safeguards), CMMC Level 2 self-assessment (110 requirements), and your SPRS score. Click any of them and you are looking at exactly the controls that path cares about. Third-party certification being paused changed none of these three, which is why they sit on the first screen.

Work, Review and Assessor: three lenses on the same package

The same assessment can now be viewed three ways. Work is where you answer and fix. Review is what a consultant or an owner uses to check progress across a team or across clients. Assessor shows the package the way an outside reviewer would read it: each requirement, its objectives, the written response, and the evidence behind it, with the gaps plain. If you have ever wondered "what would this look like to the person checking it," that is now one click.

Your Microsoft 365 or Google Workspace can file evidence for you

This is the biggest change. Connect a read-only account and CMMC Map reads your tenant's configuration and files the results against the right requirements: which users exist, whether multi-factor authentication is enforced, how devices are managed, what the audit settings are, and so on. It reads settings and metadata. It never opens your documents or your mail. Setup takes about ten minutes and everything it files is labeled with where it came from and when.

We were careful about the trust line here. The connector fills in evidence and suggests where it applies. It does not decide your status for you, and it does not write remediation into your plan. You stay the one attesting.

Interview prep built from your own answers

When a prime, a reviewer or an assessor asks about a control, they ask questions, not for a spreadsheet. The new app turns your responses into an interview cheat sheet: the questions an assessor asks for each requirement, with your own written answer next to it. It is the document people wished they had the night before a call.

Better documents, plus a Readiness Report

The SSP, the POA&M and the 14 policies still generate from your answers, and they read much closer to what a GRC shop would hand you. New is the Readiness Report: a reviewer's checklist of what a prime or an assessor checks in a self-assessment, applied to your package, with a list of every "implemented" that has nothing filed behind it. If you are a consultant, it carries a "Prepared by" line with your name.

For consultants: client workspaces and Ask the client

Consultants and MSPs run several clients from one account. Each client gets its own workspace ($75 a month per client, on one invoice, prorated). A Review-mode roster shows every client's standing on one page. And when you need something only the client can answer, Ask the client sends them the question inside the app and files the reply against the control.

The smaller things people will notice

• A calendar with your deadlines, affirmation dates and meetings on a month grid, with tasks on the days they are due.
• A training roster that shows every member against every course with 365-day renewal flags, exportable to CSV.
• Multi-factor authentication on your CMMC Map account.
• Support inside the app: a ticket form, a request for an onboarding call, and a troubleshooter that hands the transcript to a person when it cannot help. A person still reads every ticket.
• AI stays off until you turn it on. Every AI feature is opt-in per workspace, and the app works fully with it off. Nothing you enter trains a model. Details are on our AI and your data page.
• Four visual themes, because some people work in this app for hours.
• The Claude connector still lets you work your package from an AI assistant, with the same opt-in rule.

What did not change

Then	Now
Free 110-control assessment with a live SPRS score	Still free. No credit card, no trial clock.
Two paid tiers	One plan: $149 a month for the SSP, POA&M, 14 policies, the Readiness Report and AI guidance. Cancel anytime. Existing subscribers keep their current price.
Your statuses, written responses and uploads	All carried over. Nothing to re-enter.
app.cmmcmap.com	Same address.

Why now

The CMMC Reform Task Force delivers its recommendations this month. Whatever comes back, every plausible outcome rewards the same posture: a current self-assessment, evidence behind what you marked implemented, and documents you can hand over. The new CMMC Map is built for exactly that work, and it is built so a five-person shop can do it without hiring anyone.

Tell me what is broken or what is missing. I read every ticket myself, and the support form is on the Help page inside the app.