Free CMMC self-assessment
Know your real SPRS score.
Before you sign your name to it.
Work through every NIST 800-171 objective the way an assessor would, in plain English, and watch your score update as you go. No security background needed. No consultant required. When you’re ready to run the whole program, it upgrades to dibfi without re-entering a thing.
The real problem
“We think we’re around a 70. We’ve never actually sat down and counted.”
Your SPRS score is a number you submitted, affirmed, and are legally on the hook for. Most contractors estimated it once, from a spreadsheet, in an afternoon.
The tools that could tell you otherwise either cost thousands a year or hand you 110 controls with no explanation. So the number sits there, unverified, until someone asks how you got it.
What changes here
Count it properly.
For free.
CMMC Toolbox walks all 320 assessment objectives, one at a time, each with the NIST guidance on what it means and what an assessor would examine.
Set your finding, record why, and the score recalculates with DoD weights applied. At the end you have a number you can defend and a report that shows your work.
Choose how you want to start
Two ways in, depending on
where you already are.
Self Assessment
Know exactly where you stand
Work all 320 objectives and record a real determination on each one. Your SPRS score updates live with DoD weights applied, so the number you submit is the number your records support.
Gap Assessment
Find out what you have to fix
A lighter checklist pass built for scoping. Mark what is already in place, set a priority on what isn't, and leave with a prioritized remediation roadmap you can hand to whoever does the work.
320
Assessment objectives, the same set an assessor works through
14
Control families, each with its own gap breakdown
110
Maximum SPRS score, calculated with real DoD weights
30
Days free, no credit card and no sales call
What it’s like to use
One objective at a time,
until the number is real.
You open it.
Objective one is waiting.
No blank page, no wall of 110 controls. One objective, what it means in practice, and what an assessor would examine to verify it.
+62
Your score moves
as you work.
Every finding you set recalculates the score automatically, with the DoD weights applied the way SPRS applies them. No spreadsheet math, and no guessing which gaps cost you the most.
Your reasoning,
recorded as you go.
Write down how each objective is met and what proves it, right where you make the call. Six months later that note is the difference between a defensible score and a guess.
Saved automaticallyWalk away with a number
you can actually defend.
Score worksheet, domain-by-domain breakdown, and your gap list, all downloadable. Hand it to leadership, hand it to counsel, or use it to scope the work ahead.
Why this exists
The alternative is a spreadsheet
or a $20,000 consultant.
Neither is a good way to find out where you stand. One is free and probably wrong; the other is right and out of reach for most small contractors.
Consultant
$20k+
to tell you where you stand
Weeks of lead time before you learn anything
Priced out of reach for most small shops
You don't keep the working record
DIY spreadsheet
$0
and no idea if it's right
110 controls, no explanation of any of them
Scoring math by hand, weights guessed
No working record when someone asks
CMMC Toolbox
Free
for 30 days, no credit card
All 320 objectives, in plain English
SPRS score calculated automatically
Downloadable score worksheet and gap report
Built by a certified CMMC Lead Assessor
Upgrades to the full dibfi program with your work intact
When you’re ready for the rest
Scoring is step one.
dibfi is the other 35 months.
Knowing your score is the easy part. Staying at that score through three years of reviews, evidence expiry, and annual affirmations is where most programs quietly fall apart. That’s what the full platform is for, and everything you build here carries straight into it.
Compliance Operations
Access reviews, log reviews, scans, and tabletops scheduled automatically with reminders before anything comes due. Completing a task generates its audit evidence automatically.
Automated evidence collection
Connect Microsoft 365 and dibfi scans your real configuration, generates control status from it, and maps the resulting evidence automatically. Fewer screenshots, more actual security work.
SSP Builder & policies
Implementation statements generated automatically from your answers, assembled into a living System Security Plan. Change the environment and the SSP changes with it.
POA&M that stays honest
Every gap becomes a plan of action at the objective it belongs to, with owners and milestones, so you always know which fixes move your score the most.
Assessor checkpoint reviews
Spend a credit and a certified CMMC Lead Assessor reviews your actual work: your scoring calls, your evidence, your statements. A written Pass or Fix, not an AI score.
Attestation archive
A dated, tamper-evident snapshot of your score, POA&M, and SSP as they existed on your affirmation date. The file you hand over when someone says prove it.
Nothing gets re-entered. Your findings, rationale, and score migrate from CMMC Toolbox into dibfi automatically, so the work you do free is the foundation of the full program, not a throwaway first pass.
See what dibfi includesCommon questions
No fluff. Just answers.
- Is it really free?
- Yes. Full access to all 320 objectives, live SPRS scoring, your rationale notes, and your downloadable report for 30 days, with no credit card. The window is deliberate: long enough to finish a real assessment, and it means your data doesn't sit on our servers indefinitely.
- What happens after 30 days?
- Export your report before the window closes, or upgrade to dibfi and your entire assessment moves with you: findings, rationale, and score, with nothing to re-enter or re-score. From there the paperwork starts running itself, with recurring tasks scheduled automatically and evidence generated as the work gets done.
- What exactly do I get at the end?
- A score worksheet showing every objective and the finding you recorded, a domain-by-domain breakdown, and your gap list ordered by the DoD points each one costs you. Downloadable as CSV and printable to PDF, so it survives outside this tool.
- Do I need a security background?
- No. Every objective is written in plain English, with the NIST guidance on what it means in practice and what an assessor would examine. If you can describe how your company actually works, you can complete the assessment.
- Is this the same as a real assessment?
- It's a self-assessment, which is exactly what DFARS 252.204-7012 requires you to perform and affirm. It is not a C3PAO certification assessment. What it gives you is the honest internal number, scored the way an assessor would score it.
- How does this relate to dibfi?
- Same engine, same assessor, smaller scope. CMMC Toolbox is the free front door: assess yourself and get a defensible score. dibfi is the full program that keeps that score true — Compliance Operations scheduling your recurring reviews and generating their evidence automatically, Microsoft 365 scans collecting evidence from your real configuration, a living SSP, POA&M tracking, and checkpoint reviews from a certified Lead Assessor. Your Toolbox assessment migrates into it automatically.
Stop guessing at your score.
Go find out.
All 320 objectives, live SPRS scoring, and a downloadable gap report. Free for 30 days, no credit card, no sales call. Upgrade to dibfi whenever you want the automation and the assessor behind it.
Free for 30 days · No credit card · Upgrade anytime and your work comes with you