Three tools built by a CMMC Registered Practitioner for small defense contractors who need a defensible answer, not a sales call. Work through the controls at your own pace and walk out with something you can stand behind.
Your contracts carry FAR 52.204-21. Seventeen basic safeguarding requirements, and an annual affirmation you have to be able to defend.
You are scored against all 110 NIST SP 800-171 Rev 2 controls, you owe SPRS a score, and every gap needs a POA&M behind it.
Most self-scores fail on methodology, not effort. A second set of eyes before a prime or a C3PAO asks you to explain it.
Every tool is self-paced and includes 12 months of access. Nothing here replaces a certification assessment, and none of it is priced like it does.
Walk all 17 basic safeguarding requirements and reach a defensible met / not met position on each one.
All 110 controls scored the way DoD scores them, with the supporting documents you will be asked for first.
You already scored yourself. This is an independent review of whether that score survives scrutiny.
| Level 1 | Level 2 | SPRS Validation | |
|---|---|---|---|
| Price | $497 | $1,497 | $750 |
| SKU | GAC-TOOL-001 | GAC-TOOL-002 | GAC-ADD-006 |
| Applies when | You handle FCI only | You handle CUI | You have already scored |
| Controls covered | 17 practices | 110 controls | Your existing scoring |
| Standard | FAR 52.204-21 | NIST SP 800-171 Rev 2 | DoD assessment methodology |
| SPRS score produced | No, affirmation only | Yes | Reviewed, not produced |
| Policy documents | Not included | Level 2 Policy Mini-Set | Not included |
| POA&M support | Gap list only | Full POA&M structure | Reviewed for defensibility |
| Human review | Self-paced | Self-paced | Practitioner-led |
| Written deliverable | Assessment record | Assessment record and score export | Validation Report |
| Turnaround | Immediate access | Immediate access | Five business days |
Before any control gets scored, the tool walks you through what is in scope. Get the boundary wrong and every number after it is wrong too.
One control at a time, in language your team actually uses. Each one asks what you have implemented and what proves it.
Your answers assemble into the assessment record, gap list, and supporting documents. This is the paperwork a prime asks for.
Take your result to SPRS. If you want a second opinion before you do, add the Validation review.
Globe-America Consulting is a Service-Disabled Veteran-Owned Small Business working exclusively with small and mid-size Defense Industrial Base contractors. These tools carry the same guidance we give advisory clients, without the retainer.
Yes. The pause affects the phase-in schedule for certification assessment requirements. It does not remove the Level 1 and Level 2 self-assessment obligations already in effect, and it does not touch what your prime is contractually flowing down to you.
If a clause is in your contract today, it is enforceable today. Waiting on a schedule change is not a compliance position.
It comes down to what information your contract puts in your hands. If you receive Federal Contract Information and nothing more, you are at Level 1. If Controlled Unclassified Information is in scope, generally signaled by DFARS 252.204-7012 in your contract, you are at Level 2.
If you are not certain which applies, do not guess and do not buy. Book a consultation and we will read the clauses with you first.
No. Level 1 is a pass or fail affirmation, not a numerical score. You either meet all 17 requirements or you do not. Any tool selling you a Level 1 SPRS score is describing something that does not exist.
That is a Level 2 requirement, not a Level 1 requirement. FIPS 140 validated cryptography applies where CUI is protected. If you are Level 1 and someone has told you to go buy FIPS validated products, get a second read before you spend the money.
No, and it is not sold as one. These tools support the self-assessment work you are responsible for. Certification assessments at Level 2 are conducted by an authorized C3PAO. What these tools do is get you to the point where that assessment is survivable instead of expensive.
If you scored yourself without an outside read, it is worth checking. The most common problems we find are not arithmetic. They are scope drawn too wide or too narrow, partial credit claimed where the methodology does not allow it, and POA&M items with no closure path behind them.
A score you cannot explain in a meeting is a liability whether or not the math was right.
Twelve months from purchase for both self-assessment tools. Remediation takes time and your answers change as you close gaps, so you can return and rescore throughout the year.
Then say so and we will scope it. The tools are the entry point to a full advisory engagement, and what you spend here is not wasted work. The assessment record you build carries directly into the engagement.
If you are not sure which that is, book a call. We would rather point you at the right tool than sell you the wrong one.