CMMC Level 2 Implementation System
SSP Builder, POA&M Tracker & Self-Assessment Scoring for NIST 800-171 | Offline Tool
$697.00
Your SPRS score is one number. Backing it up takes 110 requirements, 320 objectives, an SSP, and a POA&M that all agree.
Most defense contractors preparing for Cybersecurity Maturity Model Certification (CMMC) Level 2 keep the requirements in one spreadsheet, the System Security Plan (SSP) in a document that drifts out of date, evidence in a shared folder, and the Plan of Action and Milestones (POA&M) somewhere else. When it's time to calculate a score or brief the person who signs the affirmation, nobody is sure the pieces match.
The CMMC Level 2 Implementation System puts all of it in one offline workspace. You record a finding for each assessment objective. The score, the Conditional-status check, the POA&M, a prioritized gap list, and a draft SSP all come from those same entries, so they can't drift apart.
What makes it different
A score you don't have to calculate, checked against the Conditional-status rules. Mark each of the 320 objectives MET, NOT MET, or N/A, and the score calculates using the CMMC point values (32 CFR 170.24), including the 3-or-5-point cases for multifactor authentication and FIPS-validated encryption. It stays labeled provisional until all 110 requirements are scored. The status check tests the 32 CFR 170.21 criteria: a minimum score of 88, the 1-point POA&M rule, the six requirements never permitted on a POA&M, and a documented plan for every NOT MET item. It also calculates your 180-day closeout date.
An SSP Builder that uses the work you've already done. The implementation statement you write on each requirement card, plus your system description, boundary, roles, asset inventory, service providers, and exceptions, becomes a draft SSP PDF covering all 110 requirements. A completeness checklist shows what's still missing.
Evidence and gaps in one prioritized list. Reference each piece of evidence by file name and location, link it to the specific objectives it supports, and mark drafts as drafts. Gap Analysis gathers NOT MET and unscored requirements, MET objectives without final evidence, incomplete POA&Ms, supplier issues, risks, and policies into one list ranked High, Medium, and Low.
What's included
All 110 NIST SP 800-171 Rev. 2 requirements and 320 assessment objectives, each with the assessment methods, discussion, examples, and assessment considerations from the public CMMC Assessment Guide, Level 2 (v2.13), plus red flags for each of the 14 domains
Scope & Asset Inventory organized by the five Level 2 asset categories
Supplier tracking: External Service Providers (FedRAMP status, customer responsibility matrix) and subcontractors (CUI shared, DFARS flow-down, confirmed CMMC status)
Per-requirement owner, target date, implementation status, provider, enduring exceptions, and temporary deficiencies
POA&M with required-field checks, milestones, and the 180-day closeout deadline
Policy Tracker with an optional 27-entry suggested starting list (status, approval, and review dates; no template text)
Risk Register with a visible 1-5 likelihood and impact rubric, linked to requirements
Executive Dashboard, Requirement Tracker, Evidence Register, and a local activity log
Five PDF reports, each with an on-screen preview: Executive Summary, System Security Plan (draft), POA&M, Evidence Register & Gaps, and Risk & Policy Register. Unbranded, so they're your documents.
Private by design: runs entirely offline in your browser, with no account, subscription, or server. Backup files are encrypted by default (AES-256-GCM, Advanced Encryption Standard), and a Privacy Screen hides your work when you step away or switch tabs.
What you get
nfosec-cmmc-l2-implementation-system.html: the interactive system. Open it in a current version of Chrome or Edge.
nfosec-cmmc-l2-welcome-and-quickstart.pdf: a 3-page Welcome & Quickstart
nfosec-cmmc-l2-user-guide.pdf: a 15-page User Guide with linked table of contents
nfosec-cmmc-l2-implementation-sample-acme.json: a fully worked sample workspace for a fictional contractor, so you can see every screen populated before you start
Built for compliance leads, IT managers, Information System Security Officers, and operations leaders at small and mid-sized defense contractors preparing a Level 2 self-assessment or a voluntary C3PAO (CMMC Third-Party Assessment Organization) assessment.
Current regulatory context (checked October 24, 2026): CMMC Phase II is suspended until further notice, so contracts may currently require only Level 1 (Self) and Level 2 (Self). DFARS 252.204-7012, NIST SP 800-171, SPRS scores, and annual affirmations remain in effect. The tool shows this notice with its check date and follows the 32 CFR 170 scoring and POA&M rules, which were unchanged as of that date.
This is a self-assessment and documentation tool. It does not certify compliance, submit anything to SPRS, or replace an assessment or legal advice. Results reflect what you enter.
License: for internal use by a single organization. No redistribution or resale. Consulting licenses for MSPs, RPOs, and consultants working with multiple clients are available on request.
Instant digital download. Questions? support@n-fosec.com | n-fosec.com
FAQ
Will this get us certified or tell us we're compliant? No. It organizes your self-assessment, calculates the score from the findings you enter, and checks those entries against the published Conditional-status criteria. It is not an assessment, certification, or independent verification, and it doesn't submit anything to SPRS.
CMMC Phase II is suspended. Do I still need this? Level 2 (Self) requirements, DFARS 252.204-7012, NIST SP 800-171, SPRS scores, and annual affirmations are still in effect. The suspension pauses contract requirements for C3PAO and Level 3 assessments; it doesn't remove the need to implement and document the 110 requirements. The tool shows a dated regulatory notice; always confirm against your own contracts.
Does it cover NIST SP 800-171 Rev. 3? No. It follows Rev. 2 and the CMMC Assessment Guide v2.13, which is what CMMC uses as of October 2026. A proposed rule to move CMMC to Rev. 3 had not been published as of that date.
Does it store my evidence files? No. It records file names, locations, and which objectives each one supports. Your files stay where they are. Browse... fills in a file name only; the file is never opened or uploaded.
Where is my information stored? Is it sent anywhere? Your work saves automatically in your own browser on your own computer. Nothing is sent to N-FOSEC or any server. That saved copy is not encrypted, so download encrypted backups regularly. There is no password recovery for encrypted backups.
Does it include policy templates? No. The Policy Tracker tracks your policies and procedures (status, owner, approval, review dates, linked requirements) and includes an optional suggested list of titles. It contains no template text.
I'm an MSP, RPO, or consultant. Can I use it with multiple clients? The standard license covers one organization, and each workspace holds one assessment scope. A consulting license is available on request: support@n-fosec.com.