For defense subcontractors with no IT staff
Your CMMC paperwork, drafted in plain English
Answer plain-English questions about your shop and get a draft System Security Plan, a draft Plan of Action and Milestones (POA&M) and your SPRS score.
Free, with no card. Multiple-choice answers only, so we never collect CUI. How we handle your data
Acme Machine Works
Sample
Self-assessment score
Requirements losing points
−24
Points lost
8
Not implemented
2
Partial
0
Not yet answered
- Points lost
- −24
- Not implemented
- 8
- Partial
- 2
- Not yet answered
- 0
All gaps (10)
- 3.1.8Limit unsuccessful logon attempts1 point lost
- 3.3.3Review logged events1 point lost
and 8 more
Fastest points first
High-value (5-point) gaps with the smallest effort.
- 3.11.2Scan for vulnerabilitiesDays · $500-5k5 points to gain
- 3.14.6Monitor for attacksWeeks · $500-5k5 points to gain
- Standard
- NIST SP 800-171 Revision 2: 110 requirements, 14 families, 320 assessment objectives
- Scoring
- DoD Assessment Methodology v1.2.1
- Your data
- No CUI. No document uploads.
- Price
- Free. No card.
Three steps from questions to draft documents
No consultant, no jargon. Answer what you know about your shop, and WorkuGRC does the mapping, scoring and drafting.
Step 1
Answer plain-English questions
About an hour, at your own pace. Save and come back any time.
Identification and Authentication
Question 35 of 85
Where is multi-factor authentication (MFA) turned on?
MFA is an extra step beyond the password, like a phone prompt or code. The DoD scoring gives partial credit if it covers remote and admin accounts but not everyone yet.
Everywhere — all usersRemote access and admin accounts only (selected)Nowhere yetI don't knowWe'll flag this for investigation. It counts as not implemented for now.Step 2
Watch your SPRS score build
Each answer updates the score with the weights in the DoD methodology.
Step 3
Review and export your drafts
Read the SSP and POA&M, set a responsible party and a milestone date for each POA&M item, then download the files to edit in Word.
Sample: the question, score and file names of a fictional company, Acme Machine Works.
Serious about your data, plain about our limits
Built for shops without an IT department, and honest about what a drafting tool can do.
We never accept CUI
The questionnaire is multiple-choice. The only upload is an optional cover logo, checked to be an image.
Your data is yours alone
Every record is scoped to your organization in the database itself, with row-level security and optional two-factor sign-in.
Honest about what we are
A drafting tool, not an auditor or a C3PAO. Every document is marked as a draft for your review.
Deletion you control
Schedule deletion any time. After a 30-day grace period we purge your account and every answer.
Document drafting uses Anthropic's Claude API. The AI writes the narrative text; your implementation status for each requirement is taken from your answers, not from the AI. Security and data handling
Documents written from your answers, never invented
Each SSP section states the requirement, its status and how much of the questionnaire backs it. Gaps in your answers become POA&M items with their point value and a milestone date.
System Security Plan · draft v3
Excerpt · Sample
3.5 Identification and Authentication
3.5.3 Multi-factor authentication
Partially implemented- Requirement
- Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
- Implementation
- Acme Machine Works has turned on multi-factor authentication for remote access and for administrator accounts. It is not yet turned on for all other users, so this requirement is partially implemented. The remaining gap is tracked in the Plan of Action and Milestones (POA&M).
- Basis
- Questionnaire coverage: 4 of 4 assessment objectives answered
Plan of Action & Milestones · draft v3
10 open items · −24 points
- 3.1.81 point lost
Limit unsuccessful logon attempts
Accounts do not lock automatically after several failed sign-in attempts.
Not implementedPOA&M-eligibleMilestone date: 30 days after the draftResponsible party: IT provider
- 3.3.31 point lost
Review logged events
What is logged is not reviewed periodically to confirm that the events that matter are captured.
Not implementedPOA&M-eligibleMilestone date: 60 days after the draft
- 3.5.33 points lost
Multi-factor authentication
Multi-factor authentication is turned on for remote access and administrator accounts only, not for all users.
Partially implementedFix firstMilestone date: 30 days after the draftResponsible party: IT provider
Showing 3 of 10 items. See the full sample
See how five requirements move your score
Five of the 110 requirements with their real DoD weights. Change an answer and watch the points change.
3.5.3 Multi-factor loginWho signs in with a second factor?
3 points deducted3.13.11 FIPS encryptionHow are your laptops and file shares encrypted?
3 points deducted3.3.1 Audit loggingIs logging turned on for logins and changes?
5 points deducted3.6.1 Incident planDo you have a written incident response plan?
5 points deducted3.14.1 PatchingDo computers patch themselves promptly?
0 points deductedFree for defense subcontractors
Everything below is free, with no card required. You keep control of every word.
Plain-English questionnaire
About 85 multiple-choice questions, written for a shop owner.About 85 multiple-choice questions written for a shop owner, not a security engineer. A few are follow-ups that depend on your answers.
NIST SP 800-171 mapping
Each answer maps to the SP 800-171A objectives behind it.Each answer maps to the SP 800-171A assessment objectives behind it. The SSP export lists every objective with its status.
Live SPRS score
Calculated with the DoD methodology as you answer.Calculated with the DoD Assessment Methodology as you answer. Unanswered questions count against you, so the number is never flattering.
Draft System Security Plan
A section for every one of the 110 requirements.A section for every one of the 110 requirements, written from your answers and marked where your answers don't support a claim.
Draft POA&M
Each gap in your answers, with its points, a fix and a date.Every gap in your answers as a plan-of-action item with its point value, a plain-English fix and a milestone date.
Gap dashboard
The fastest points first.The fastest points first, and which gaps must be fixed before any can be deferred to a POA&M.
Word and CSV exports
Word for the SSP and POA&M, CSV for the POA&M.Editable .docx files, with your logo on the SSP cover, plus a POA&M CSV for your own tracker. Every export carries the draft notice.
Free tools, no account
A Level 1 check and a 12-question SPRS score estimator, with your result sent by email if you ask.
WorkuGRC produces drafts you review and own. It is not an auditor, a C3PAO, or a source of legal or compliance advice, and it does not certify compliance or guarantee assessment outcomes. We never collect CUI. See our Terms.
Which level are you? It comes down to CUI
If your contracts or flow-downs mention CUI or DFARS 252.204-7012, you are almost certainly Level 2. Level 3 is out of scope.
CMMC Level 2
What WorkuGRC drafts- What you handle
- Controlled Unclassified Information (CUI)
- Requirements
- 110 requirements, NIST SP 800-171 Rev 2
- Score
- SPRS score from 110 down to −203
- Documents
- SSP, POA&M and annual affirmation
- Contract clause
- DFARS 252.204-7012 and 252.204-7021; 252.204-7019 and -7020 in older contracts
CMMC Level 1
A free check, no accountFederal Contract Information only: 15 safeguards under FAR 52.204-21, pass or fail for each, with an annual self-attestation.
Questions owners ask before they start
Something else on your mind? We answer every email.
Do you ever see our CUI?
No. The questionnaire is multiple-choice and asks about your environment, never what is in it. There are no document uploads, only an optional cover logo. Never enter CUI or contract details in any field.
Is this an audit or a certification?
No. WorkuGRC is a drafting tool. It produces drafts you review and own. It is not an auditor, a C3PAO, or legal advice, and it does not certify compliance.
Which version of NIST SP 800-171 do you use?
Revision 2: 110 requirements, 14 families and 320 assessment objectives. It is the version CMMC Level 2 assesses against today.
Do we need a C3PAO certificate right now?
In most cases, not today. Phase 2 (third-party certification) was suspended on July 13, 2026 and is under review, so a self-assessment, an SPRS score and the annual affirmation are what's required. Always check your solicitation. Official DoD CIO CMMC page.
How is the SPRS score calculated?
With the DoD Assessment Methodology v1.2.1: start at 110 and subtract 5, 3 or 1 for each requirement not fully in place. Only MFA and FIPS encryption earn partial credit.
What if we stop using it?
WorkuGRC is free, so there is nothing to cancel. You can schedule deletion at any time, and we purge everything after a 30-day grace period.
Know your SPRS score before your prime asks
Start with the questionnaire. Your score builds as you answer, and your draft documents follow.