How RegulatoryForge Works
From intake to audit-ready documents in five simple steps. No cybersecurity degree required.
Five Steps to Compliance Documentation
Complete your CMMC Level 2 document package without expensive consultants.
Create Your Account
Sign up for a free RegulatoryForge account. No credit card required to get started. Your account gives you access to the intake form and dashboard.
Complete the Intake Form
Answer plain-language questions about your IT environment, systems, staff, and current security practices. The form walks you through all 110 NIST SP 800-171 controls in logical groups.
AI Generates Your Documents
Our AI engine processes your responses and builds a tailored compliance document package — your SSP, POA&M, policies, and SPRS score. First drafts in minutes. You review and finalize.
Review & Download
Review your generated documents in the dashboard. Make any needed edits, then download everything as formatted DOCX files ready for submission or assessor review.
Submit Your SPRS Score
Log in to the SPRS portal at sprs.csd.disa.mil and enter your calculated score. Your documentation package supports your score and provides evidence for assessors.
What Gets Generated
Every RegulatoryForge account generates a complete document package tailored to your organization — not generic templates.
System Security Plan (SSP)
Core DocumentA complete SSP describing your information system boundary and how each of the 110 NIST SP 800-171 controls is implemented — the cornerstone of your CMMC submission.
Plan of Action & Milestones (POA&M)
Core DocumentDocuments every control gap with a planned remediation action and target date. Required for CMMC assessments when not all controls are fully implemented.
5 Cybersecurity Policies
PoliciesAccess Control, Incident Response, Configuration Management, Media Protection, and System & Communications Protection policies — all customized for your organization.
Control Responsibility Matrix (CRM)
SupportingA matrix mapping all 110 controls to the responsible party — your organization, a cloud service provider, or shared responsibility. Clarifies accountability for assessors.
Next Steps Guide
RemediationA step-by-step action plan matched to your certification path — verifying your SSP against your environment, assigning owners and dates to every POA&M item, distributing policies, collecting evidence, and submitting your score.
SPRS Score Report
ScoreYour calculated NIST SP 800-171 self-assessment score (-203 to 110) with a control-by-control breakdown. Ready to submit to the SPRS portal at sprs.csd.disa.mil.
Why RegulatoryForge Instead of a Consultant?
Cost
Typical consultant fees of $15,000–$50,000+
Starting at $97/month
Speed
6–12 weeks for document prep
First drafts in minutes
Control
Dependent on consultant availability
Update anytime from your dashboard
Transparency
Black-box process
See every control, every narrative
* Consultant figures are typical market pricing, not a quote or a guarantee of savings. RegulatoryForge is a documentation tool: if your contract requires a third-party assessment, a C3PAO engagement is separate from and additional to this.
Who built this
Built by a career Security Control Assessor and Army veteran
RegulatoryForge was built by an assessor who has reviewed the documents small contractors submit, and wanted to give them a starting point that reflects what assessors actually look for.
Questions? support@regulatoryforge.com
CMMC status as of October 2026
DoD suspended CMMC Phase 2 — the requirement for a third-party C3PAO assessment at Level 2 — on July 13, 2026. DFARS Class Deviation 2026-O0025 Rev. 3, reissued September 3, 2026, keeps that pause in force.
What still applies
- NIST SP 800-171 Rev. 2 — all 110 security requirements
- DFARS 252.204-7012, in force since 2017
- Level 2 (Self) assessments in applicable solicitations
- A current SPRS score, submitted and kept up to date
- An annual affirmation by a senior company official
RegulatoryForge is built for that self-assessment work. If your contract requires a third-party assessment, the C3PAO preparation tools are here too.
Ready to get started?
Create your free account today. No credit card required. Your first document drafts are a few answers away.
No credit card required · Cancel anytime
Generated documents are strong drafts built from what you enter. You verify them against your environment and stand behind the score you post to SPRS.