CMCGuardian turns a guided questionnaire into a Level 1 self-assessment, or a complete System Security Plan, POA&M and SPRS score for all 110 NIST SP 800-171 controls. Then it watches Microsoft 365 (including GCC High), Google Workspace, Okta, Saviynt, SailPoint, AWS and NinjaOne daily, so your documents stay true to how your systems really run.
Your data stays yoursRead-only connections, passkey sign-in, and we never touch CUI or patient data.See howReady to affirm
GCC High
Connected
Connected
Okta
Connected
Saviynt
Connected
SailPoint
Connected
GovCloud
Connected
NinjaOne
Connected
Slack/Teams
+ Jira tickets
The problem
Most small defense contractors are stuck between a $30k consultant and a blank 110-control spreadsheet. Neither gets you to a submittable score.
NIST SP 800-171 is dense and written for assessors, not founders. Knowing what each control requires is half the work.
No System Security Plan, no SPRS score. Without a current SPRS score and affirmation, you can lose eligibility for DoD contracts that require CMMC.
Outsourcing runs $15k–$40k and weeks of back-and-forth, for documentation you'll need to maintain yourself regardless.
How it works
No consultant, no template wrangling. Answer questions, review the draft, export the documents.
A guided questionnaire walks through all 110 controls, priority items first. No jargon decoding required.
CMCGuardian writes your SSP narrative and POA&M for every control and calculates your SPRS score using the DoD scoring methodology, then flags items for your review before anything is finalized.
Download a formatted SSP and POA&M with your real SPRS score calculated and ready for submission.
Live monitoring
Connect Microsoft 365 (commercial or GCC High), Google Workspace, Okta, Saviynt, SailPoint, AWS and NinjaOne with read-only access. CMCGuardian checks the settings behind your controls each day, shows how they move your SPRS score, and tells your team in Slack, Teams or Jira when something breaks.
Live results never change your answers on their own. You review every difference before your SSP changes.
MFA, admin roles, inactive accounts, audit logging, password rules and session timeouts are checked every day and tied to the NIST control they prove.
People who left but still have access, accounts nobody owns, unused accounts, overdue access reviews and separation-of-duties conflicts, counted every day.
Root and IAM MFA, password rules, CloudTrail logging, public S3 access, disk encryption and open SSH/RDP ports, checked across every region with a read-only key.
Laptop encryption, device compliance and Defender alerts from Microsoft Intune, plus antivirus, definitions and critical patches from NinjaOne.
When a check starts failing, your team hears about it where they already work, and a Jira ticket opens with the control and the fix. When it passes again, you hear that too.
Finds AI tools like ChatGPT, Claude or meeting-note bots that employees connected to Microsoft 365, so CUI doesn't leak into apps you haven't approved.
Each check saves dated evidence, ready to hand to an assessor.
When a check fails, you get clear steps to fix it, generated from counts only.
Security built in
Your compliance data is sensitive. CMCGuardian is designed to see as little as possible and protect what it keeps.
Connections can read settings only. CMCGuardian never changes your systems and never asks for super admin.
Sign in with your fingerprint, face or a security key. Passkeys can't be phished or reused.
Our AI sees totals like "3 admins without MFA", never names or email addresses.
We never read email, files, CUI or PHI. Secrets stay encrypted in the server environment.
See the output
Every plan is formatted to a consistent, assessment-grade standard: your score, your controls, your narrative, ready for self-assessment submission to SPRS. Review a complete sample before you pay anything.
System Security Plan
SPRS 88 of 1103.1 Access Control
SSP
POA&M
Gap report
Pricing
Start with a one-time assessment or subscribe for continuous compliance. No setup fees, no per-seat charges.
A Level 2 SSP, POA&M and gap report, or a Level 1 self-assessment report.
$1,499 one-time
Continuous compliance with ongoing regeneration as your environment changes.
$499 /mo
For primes managing supplier compliance across multiple orgs.
$1,499 /mo
See exactly what your System Security Plan will look like, then build it in days, not the weeks a consultant takes.
Contact
Questions about scope, pricing, or where to start? Send a note and we'll get back to you within one business day.