Frequently Asked Questions

The Cybersecurity Maturity Model Certification (CMMC) is a DoD program that requires defense contractors to demonstrate they meet specific cybersecurity standards before they can be awarded or maintain DoD contracts. It matters because failure to achieve the required certification level can disqualify your company from bidding on or retaining federal contracts.

CMMC 2.0, released in late 2021 and finalized in 2024, simplified the original five-level framework down to three levels and eliminated Level 1 third-party assessments. Level 2 now maps directly to NIST SP 800-171 r2 (110 controls), removing the unique CMMC practices that existed in 1.0. Self-assessments are allowed for some Level 2 contracts, but higher-priority programs still require a certified C3PAO assessment.

CMMC Level 2 applies to contractors that process, store, or transmit Controlled Unclassified Information (CUI). It requires implementation of all 110 security controls from NIST SP 800-171. If your company handles CUI under a DoD contract — including most defense subcontractors — you will likely need Level 2 compliance.

CMMC requirements are being phased in through DoD contract clauses. Phase 1 (starting 2025) includes self-assessment for non-critical programs. Phase 2 (2026) extends requirements more broadly. Phase 3 (2027+) requires C3PAO assessments for all programs handling CUI. Your specific timeline depends on when CMMC clauses appear in your contracts.

Non-compliance can result in contract termination, disqualification from future solicitations, and potential False Claims Act liability if you misrepresent your compliance status. The DoD is actively enforcing these requirements, and primes are increasingly flowing down CMMC requirements to subcontractors.

RegulatoryForge produces a complete CMMC Level 2 document package including a System Security Plan (SSP), Plan of Action & Milestones (POA&M), five core cybersecurity policy documents, a Control Responsibility Matrix (CRM), a Next Steps remediation guide, and a calculated SPRS score — all tailored to your organization based on your intake answers.

The documents are generated using your specific inputs about your environment, systems, and current practices. Control narratives reflect what you told us about your implementation status. However, you should review all generated content with someone knowledgeable about your environment before submitting to a DoD assessor. We generate a strong starting point, not a guaranteed pass.

RegulatoryForge produces documentation based on your self-reported inputs. We cannot verify that your technical controls are actually implemented correctly, conduct on-site assessments, or guarantee assessment outcomes. The documents reflect your stated posture — the accuracy of the final product depends on the accuracy and completeness of your intake answers.

No. The intake form guides you through each CMMC control with plain-language explanations of what each question is asking. Most small defense contractors can complete the intake without specialized cybersecurity knowledge. For more complex environments or if you are unsure about specific controls, we recommend consulting with a CMMC Registered Practitioner.

No. RegulatoryForge is a documentation generation tool, not a certification body. We are not a Certified Third-Party Assessment Organization (C3PAO) and do not conduct CMMC assessments. Our platform helps you prepare the documentation package required for self-assessment or third-party assessment — you still need a C3PAO for official certification under programs requiring it.

An SSP is the foundational CMMC document that describes your information system, the boundaries of your CUI environment, and how each of the 110 NIST SP 800-171 controls is implemented (or planned). Your generated SSP includes an executive summary, system description, network boundary narrative, and a control-by-control implementation status with written narratives for each control.

A Plan of Action & Milestones (POA&M) documents the security controls that are not yet fully implemented, along with your planned remediation actions and target completion dates. It is required for CMMC assessments and shows assessors you have a documented path to full compliance. Your generated POA&M lists every deficient control with recommended actions and a milestone timeline.

You receive five core cybersecurity policies: Access Control Policy, Incident Response Policy, Configuration Management Policy, Media Protection Policy, and System & Communications Protection Policy. Each is customized with your organization name, scope, and relevant control context. Additional policy documents may be added in future releases.

The Supplier Performance Risk System (SPRS) score is a numerical self-assessment score (-203 to 110) that reflects your CMMC Level 2 posture. Each of the 110 controls has a weighted point value. Controls you have implemented fully add points; unimplemented controls subtract points. Your generated score is calculated from your intake responses and must be submitted to the SPRS portal at sprs.csd.disa.mil.

Yes. You can return to your dashboard, update your intake responses, and regenerate your documents at any time. All plan tiers include unlimited regenerations so your documentation can stay current as your security posture improves or your environment changes.

Your SSP should be reviewed and signed by your organization's senior official responsible for cybersecurity — typically your CISO, CTO, or owner for small contractors. Policy documents should have acknowledgment signatures from all employees who are in scope for CMMC. These signatures are evidence that policies are actively enforced, not just on paper.

Store your compliance documents in a system that is itself in scope for CMMC — meaning the same environment you described in your SSP. Access should be restricted to personnel with a need to know. Common approaches include a SharePoint site within Microsoft 365 GCC, a Google Drive in a GovCloud environment, or a local file server with access controls. Do not store CUI-adjacent documents in consumer cloud storage (personal Dropbox, Gmail, etc.).

Your SSP should be updated whenever there is a significant change to your information system — new software, new personnel with system access, architectural changes, or when controls are remediated. Your POA&M should be updated whenever a POA&M item is completed, a new gap is identified, or milestone dates change. At minimum, review both documents annually and after any security incident.

The Supplier Performance Risk System (SPRS) is a DoD portal at sprs.csd.disa.mil where contractors submit their NIST 800-171 self-assessment scores. To submit: log in with your CAC or ECA certificate, navigate to 'NIST SP 800-171 Assessment', and enter your score, assessment date, and system scope description. Contracting officers can view your score when evaluating bids. Submit your score before your contract requires CMMC compliance — late submissions can disqualify bids.

Bring your signed SSP, current POA&M, all policy documents with signed acknowledgments, an evidence package organized by control family (screenshots, logs, configuration exports, access control records), your network diagram, and system inventory. Your assessor will also want to interview key personnel (IT admin, security lead, HR) so brief them beforehand. Having a well-organized evidence package is the single biggest factor in a smooth assessment.

NIST SP 800-171 Control 3.2.1 requires all personnel with access to CUI to receive cybersecurity awareness training. Control 3.2.2 requires role-based training for individuals with security responsibilities. At minimum, all staff need annual awareness training covering: phishing recognition, password hygiene, CUI handling procedures, and incident reporting. IT and security roles need deeper training on the controls they manage.

Acceptable training includes vendor-provided courses (KnowBe4, Proofpoint, SANS), DoD-provided free resources (DoD Cyber Exchange at cyber.mil), internal training sessions with attendance records, or phishing simulation programs. The key requirement is documentation: you must be able to show assessors who was trained, what they were trained on, and when. Certificates of completion, training logs, or LMS records all work.

Maintain a training log or use an LMS (Learning Management System) that generates completion records. At minimum, keep a spreadsheet with: employee name, date of hire, date of initial training, date of most recent annual refresher, and training topic or course name. Store signed acknowledgment forms showing employees read and agreed to your policies. Assessors will ask for this evidence for controls 3.2.1 and 3.2.2.

Six months before: engage your C3PAO and schedule the assessment. Three months before: complete all POA&M items you can realistically close, run a mock internal assessment using your SSP as a guide, confirm your evidence package is complete and organized. One month before: brief key staff who will be interviewed, do a tabletop walk-through of your incident response procedure, verify your training records are current. One week before: do a final review of your SSP narratives against actual practice — assessors will probe for gaps between documentation and reality.

RegulatoryForge focuses on compliance documentation. For training content, we recommend: the DoD Cyber Exchange (cyber.mil) for free CMMC and CUI handling training, the CMMC Accreditation Body (cyberab.com) for practitioner resources, and SANS Security Awareness for commercial training programs. If you use RegulatoryForge's Consultant plan, your CMMC Registered Practitioner may also provide training as part of their engagement.

Yes. Free 7-day trial with 1 preview generation (3 SSP narratives, 2 policies, 1 SOP, 5 POA&M rows). No credit card required. The preview covers the Access Control family and can be downloaded as Word documents. Upgrade to a paid plan for the full 110-control SSP and the complete document package.

The DIY plan is designed for individual contractors managing compliance for a single organization. The Consultant plan adds multi-client dashboard capabilities, white-label document branding, bulk generation, and client progress tracking — ideal for CMMC Registered Practitioners and Registered Provider Organizations (RPOs) managing multiple clients.

Yes. You can upgrade or downgrade your plan at any time from your account billing settings. Upgrades take effect immediately; downgrades take effect at the end of your current billing period. Annual plans are billed upfront but can be canceled for a prorated refund within the first 30 days.

Both options are available. Monthly billing provides flexibility with no long-term commitment. Annual billing saves approximately 17% compared to monthly pricing. You can choose your preferred billing cycle at checkout.

We accept all major credit cards (Visa, Mastercard, American Express, Discover) through our secure payment processor, Stripe. We do not store card details on our servers. Government purchase cards (GPC) are accepted as standard Visa cards.