New · 9 Sep 2026 CMMC Map was rebuilt: Microsoft 365 evidence, interview prep, a Readiness Report. Certification is still paused; Level 1, Level 2 and SPRS are not. What changed →
For consultants, vCISOs and MSPs

Every client in one login. Every deliverable under your name.

A workspace per client, a review view across all of them, and the SSP, POA&M and policies written from the client's own answers. You keep the relationship, the judgment and the hours. The structure, the evidence and the documents stay in one place between visits.

Start with your first clientSee a Readiness Report →
$149 a month for your account, $75 a month per client. One invoice, prorated.
Your clientsReview mode
ClientPathScoreOpenWaiting on
Apex MachiningL2 self98 / 1104Client · 2 answers
Northfield CompositesL2 self61 / 11027You · evidence review
Harbor PrecisionL115 / 172Ready · report
Delta Avionics SvcSPRS-3819Client · M365 consent
Ridgeline FabL2 self110 / 1100Affirmed · Aug 28
One login. Each client is its own workspace with its own score, evidence and documents. Review mode shows all of them on one screen and tells you who the next move belongs to.
How an engagement runs

The five steps you already run, in one place.

Nothing here changes your method. It changes how much of it lives in email threads and loose Word files.

01 · Day one
Add the client
A new workspace takes a minute. Run it yourself, or invite the client's point of contact and let them answer what only they know. They see their workspace and nothing else.
02 · First call
Scope it
The wizard settles which path the client is on: Level 1, Level 2 self-assessment, or an SPRS score to submit. The controls that apply light up. The ones that don't stay out of the way.
03 · Between calls
Ask the client
The questions you'd normally send by email go out from the control itself. The answer lands on that control, with a timestamp, ready for you to review. No more reconciling three threads.
04 · Evidence
Pull what Microsoft 365 already knows
With the client's consent, the evidence reader checks MFA, device policy, audit logging and the rest against the tenant. The CUI discovery scan shows where the sensitive files actually live. Findings, not screenshots.
05 · Deliver
Generate, edit, hand over
The SSP, the POA&M and all 14 required policies come out as Word files written from the client's answers. The Readiness Report goes out with your firm on the cover as the preparer. You edit, you deliver.
Three ways to look

One screen across every client. Deep inside one. The way an assessor would read it.

Review

The roster

Every client, their score, what's open, and whose move it is. This is the Monday-morning screen.
  • Waiting on client and waiting on you, separated
  • Score movement since the last visit
  • Affirmation dates and calendar deadlines per client
Work

Inside one client

The 110 controls in plain English, grouped the way you'd walk them with the client. Evidence and answers on the control.
  • Objectives first, so partial credit is visible
  • Fix-it list grouped by what actually fixes it
  • Key-controls lens for the five-pointers
Assessor

How it will be read

The same workspace, arranged the way a reviewer checks it: objective, evidence, gap. Use it for interview prep before the client is ever asked.
  • Unevidenced list with no narrative to hide behind
  • Reviewer checklist inside the Readiness Report
  • Interview prep per control
The point: you spend the engagement on scoping calls, remediation advice and the hard judgment calls. The tool holds the structure, the evidence and the documents so none of that gets lost between visits.
What the client sees

Their workspace, your name on the work.

A client invited into their workspace sees a clean, plain-English view of their own assessment. Nothing about your other clients. Nothing that reads like a vendor's dashboard.

On the cover
Prepared by your firm
The Readiness Report carries your firm as preparer, and your logo prints on every generated document cover. CMMC Map is a line in the footer.
In their inbox
Questions with the control attached
When you ask the client something, it arrives by email with the requirement it belongs to. They answer from the questions card on their workspace dashboard, and the answer lands on that control with a timestamp.
After the engagement
A login they keep
Invite the client's point of contact and they keep their own sign-in to the workspace: the score, the evidence, the documents, the affirmation dates. If they later want it moved under their own account, one email to support and we do it.
Pricing

Two numbers. No seats, no tiers, no annual contract.

Your account
$149 / month
  • Everything in CMMC Map: document generation, Microsoft 365 evidence readers, CUI discovery scan, AI assistant, training with completion records
  • Review mode across every client
  • Your firm on the Readiness Report and document covers
  • Team members included
Start your account
Each client workspace
$75 / month per client
  • Full workspace: scoping, 110 controls, evidence, generated SSP, POA&M and 14 policies
  • Ask the client, with answers landing on the control
  • Added to your invoice, prorated as clients come and go
  • The client's point of contact keeps a login
Add your first client
Five clients is $524 a month, all in. No annual contract. Cancel a client workspace any time and it stops billing at the end of that month.
Questions

What consultants ask before they add the first client.

Do my clients need their own CMMC Map account?
No. You add a client workspace from your account and either run it yourself or invite their point of contact into it. If you invite them, they see only their workspace. They never see your other clients.
How is it billed?
Your account is $149 a month and includes everything: document generation, evidence readers, the AI assistant, training. Each client workspace is $75 a month, added to the same invoice and prorated when clients start or stop mid-month. There are no seats to count.
What if a client wants to keep the workspace after the engagement?
They already have it. Invite their point of contact as a member and they sign in to their own workspace whenever they like, during and after the engagement. If they want it moved under their own account, email [email protected] and we will separate it, with everything intact.
Does CMMC Map decide whether a client is compliant?
No. It restates the requirements in plain English, tracks the client's answers and evidence, and writes the documents from those answers. The judgment calls, the remediation advice and the relationship stay with you.
Can I bring my own templates or policy language?
Every generated document is a Word file you edit before it goes to the client. Many consultants keep their own policy language and use the generated SSP and POA&M as the starting point. Nothing is locked.
Is client data kept separate?
Each workspace is isolated at the database level. Evidence, answers and documents belong to that workspace. Access is logged. Nothing a client uploads is used to train a model.

Add your first client this afternoon.

Start with your own account, add a client workspace, and have a scoped control walk in front of them by the next call.

Get startedBook a 20-minute walkthrough
No card to start. $149 a month for your account, $75 per client after that.