You're Not Alone: Free Resources to Get You Started
Quick answer
You can start CMMC prep for free using official sources: the DoD CMMC website, NIST SP 800-171 Rev 2 (the 110 Level 2 controls), NIST SP 800-172 (Level 3 enhanced controls), the CMMC Assessment Guides, the NIST SP 800-171 DoD Assessment Methodology (SPRS scoring), and the SPRS portal where you submit your self-assessment score.
The path to CMMC compliance, especially Level 2, can feel overwhelming. The good news is that you don't have to start from a blank page. The government and other organizations provide a wealth of free resources to help you understand your obligations and begin your assessment.
Here are the essential, free resources every DIB contractor should download today.
1. The "Must-Haves" from the Source
These are the official documents. They are dense, but they are the "source of truth."
- DoD CMMC 2.0 Website: This is the DoD's official CMMC homepage. Bookmark it. It has the official model diagrams, scoping guides, and all the latest news.
- NIST SP 800-171 Rev 2: This is the playbook. CMMC Level 2 is based on the 110 security controls in this document. You must be familiar with it.
- NIST SP 800-172: If you are aiming for Level 3, you'll need this document, which outlines the enhanced security controls.
2. The "How-To" Assessment Guides
These documents tell you how to assess yourself against the controls.
- CMMC 2.0 Assessment Guides (Level 1 & 2): Found on the DoD CMMC site, these guides literally translate the 110 controls into plain-English objectives. They tell you exactly what an assessor will be looking for. This is arguably the most useful document you can have.
- NIST SP 800-171 DoD Assessment Methodology: This document explains how the DoD scores an assessment. It details the scoring system (starting at +110 and subtracting points for missing controls) and is essential for calculating your "SPRS score."
3. Your "Must-Submit" System
This is where you report your score before an audit.
- Supplier Performance Risk System (SPRS): This is the DoD's system where you must log in and submit your self-assessment score against NIST 800-171 (as required by the DFARS -7019 clause). Even if you're not ready for CMMC, you likely have this contractual obligation right now.
| Resource | What it gives you |
|---|---|
| DoD CMMC website | Official model diagrams, scoping guides, and the latest program news |
| NIST SP 800-171 Rev 2 | The 110 security controls that define CMMC Level 2 — your textbook |
| NIST SP 800-172 | The enhanced controls you'll need if you're aiming for Level 3 |
| CMMC Assessment Guides (L1 & L2) | Plain-English assessment objectives showing exactly what an assessor checks |
| DoD Assessment Methodology | How the DoD scores you (starting at 110, subtracting for missing controls) for your SPRS score |
| SPRS portal | Where you submit your NIST 800-171 self-assessment score, as required by DFARS -7019 |
Where to Begin?
Don't try to read everything at once. Here is your 3-step action plan:
- Download the CMMC Level 2 Assessment Guide. This is your checklist.
- Download NIST SP 800-171. This is your textbook for any controls you don't understand.
- Go through the Assessment Guide, line by line, and be brutally honest about whether you are doing what it asks. This is your "DIY gap analysis," and it will form the foundation of your compliance plan.
These tools will give you a clear picture of where you stand and how far you have to go. The next step is deciding how to close that gap.
Ready to Put This Into Practice?
Book a free 30-minute AI Workflow Audit. We'll identify your highest-ROI automation opportunity and show you the exact build plan.
Book Free AI Audit →