Powered by
Built by certified CMMC assessors
Free CMMC self-assessment
Run your entire CMMC
self-assessment. For free.
Not a scoping quiz or a five-question lead magnet. All 320 assessment objectives, your real SPRS score, and a ranked gap list, on the same engine dibfi runs. Free, and no credit card.
The real problem
“We think we’re around a 70. We’ve never actually sat down and counted.”
Your SPRS score is a number you submitted to the government, affirmed as accurate, and are personally on the hook for under the False Claims Act. Most contractors estimated it once, from a spreadsheet, years ago.
Checking it properly meant hiring someone, or finding a free tool that turns out to be twelve questions and a “book a call” button. So the number sits there, unverified, until a prime asks for it or an assessor asks how you got it.
What changes here
Count it properly.
For free.
CMMC Toolbox gives you the whole assessment, not a teaser. Every one of the 320 objectives an assessor works through, scored the way they score it, with your findings recorded as you go.
Your score moves as you answer, weighted the way DoD weights it. By the end you know your real number, which domain is dragging you down, and which three fixes buy back the most points.
Choose how you want to start
Two ways in, depending on what
you need to walk away with.
Self Assessment
Walk away with a defensible number
The complete self-assessment, free. Work all 320 objectives, set an honest Met or Not Met on each, record the evidence behind it, and watch your real number appear. This is the same assessment you would pay someone to run for you.
Gap Assessment
Walk away with a to-do list
The complete gap assessment, free. A faster pass across the same 320 objectives: mark what's in place, flag what isn't, and leave with a prioritized roadmap you can hand to your IT provider or use to budget the year.
320
Objectives, all of them, the same set an assessor works through
14
Domains scored separately, so you know exactly where you're weakest
110
Point maximum, and you'll see every point you're currently losing
$0
For the whole assessment, with no credit card and no sales call
What it’s like to use
A real assessment,
not a lead-magnet quiz.
The full 320,
one at a time.
Nothing is held back or sampled down. You work the complete objective set with a sample of the assessor guidance on each, stopping and resuming whenever you want across the 60 days.
+62
Watch your real score
appear, answer by answer.
Weighted the way DoD weights it, including the two partial-credit rules almost everyone gets wrong. No spreadsheet math, no second-guessing, and no surprise the first time somebody official asks.
You find out which
three fixes pay the most.
Not a wall of 106 gaps. A ranked list, heaviest points first, so you can walk into Monday knowing exactly what to hand your IT provider and roughly what it buys you.
Ranked by point valueYour record stays yours.
Even after the free window.
Nothing gets deleted. After 60 days your assessment locks read-only, so your score, your domain breakdown, and your gap list are still there to look at. Upgrade whenever you want to keep working on it.
Why this exists
Just to find out where you stand:
a spreadsheet, or $20,000.
This is the assessment alone: a self-assessment or gap assessment, scored and documented. Not remediation, not the SSP, not the program that follows. One option is free and probably wrong; the other is right and out of reach for most small contractors.
Consultant
$20k+
for the assessment alone, before any fixes
Weeks of lead time before you learn a single finding
Priced out of reach for most small shops
You get a PDF, not a record you can keep working in
DIY spreadsheet
$0
and no idea if it's right
110 controls, no explanation of any of them
Scoring math by hand, weights guessed
No evidence trail when someone asks
CMMC Toolbox
Free
the same assessment, for 60 days
The complete assessment, all 320 objectives
SPRS score calculated automatically
Ranked gap list and a downloadable report
Scored by certified CMMC assessors' logic, not a generic checklist
Upgrades to the full dibfi program with your work intact
When you’re ready for the rest
Scoring is step one.
dibfi is the other 35 months.
Knowing your score is the easy part. Staying at that score through three years of reviews, evidence expiry, and annual affirmations is where most programs quietly fall apart. That’s what the full platform is for, and everything you build here carries straight into it.
Compliance Operations
Access reviews, log reviews, scans, and tabletops scheduled automatically with reminders before anything comes due. Completing a task generates its audit evidence automatically.
Automated evidence collection
Upload and store the actual files, connect Microsoft 365, and dibfi scans your real configuration and maps the resulting evidence automatically. Exports as a hashed, dated package that proves what you had and when.
Full assessor guidance
Every objective carries the complete plain-English guidance: what it means in practice, what evidence is accepted, and where teams usually fail it. Plus the SSP Builder that turns your answers into a living System Security Plan.
POA&M that stays honest
Every gap becomes a plan of action at the objective it belongs to, with owners and milestones, so you always know which fixes move your score the most.
Assessor checkpoint reviews
Spend a credit and a certified CMMC assessor reviews your actual work: your scoring calls, your evidence, your statements. A written Pass or Fix, not an AI score.
Attestation archive
A dated, tamper-evident snapshot of your score, evidence, POA&M, and SSP as they existed on your affirmation date. The file you hand over when someone says prove it.
Nothing gets re-entered. Your findings, evidence, and score migrate from CMMC Toolbox into dibfi automatically, so the work you do free is the foundation of the full program, not a throwaway first pass.
See what dibfi includesCommon questions
No fluff. Just answers.
- Is it really free?
- Yes, and it's the whole assessment, not a trimmed-down version. All 320 objectives, live SPRS scoring, your domain breakdown, and your ranked gap list, free for 60 days with no credit card and nobody calling you.
- What happens after 60 days?
- Nothing disappears. Your assessment freezes read-only: your score, domain breakdown, and gap list stay visible for as long as you want them. What stops is editing, re-running, and starting a new assessment. Upgrade to dibfi and it unlocks with everything intact, nothing to re-enter or re-score.
- Do I have to upload our actual documents?
- No, and deliberately so. You note what evidence exists by name and description; no files leave your environment, so nothing sensitive lands on our servers. Actual file storage and the hashed evidence export live in dibfi, where the environment is built for it.
- Do I need a security background?
- Every objective comes with a sample of the assessor guidance that ships in full inside dibfi: enough to answer honestly if you know how your company actually runs. If you want the complete guidance library on every objective, that's what the paid platform is for.
- Is this a real assessment or a marketing quiz?
- It's a real self-assessment, the same thing DFARS 252.204-7012 requires you to perform and affirm, across the same 320 objectives an assessor works through. It is not a C3PAO certification assessment, and it won't submit to SPRS for you. What it gives you is the honest internal number, before anyone else calculates it for you.
- How does this relate to dibfi?
- Same engine, same assessor, smaller scope. CMMC Toolbox is the free front door: assess yourself and get a defensible score. dibfi is the full program that keeps that score true: Compliance Operations scheduling your recurring reviews and generating their evidence automatically, Microsoft 365 scans collecting evidence from your real configuration, a living SSP, POA&M tracking, and checkpoint reviews from certified CMMC assessors. Your Toolbox assessment migrates into it automatically.
You can know your real score
by the end of today.
The whole assessment, all 320 objectives, your real number, and a ranked list of what to fix first. Free for 60 days, no credit card, no sales call.
Free for 60 days · No credit card · Your assessment stays readable afterward, and upgrades with your work intact