CMMC documentation that took weeks. Now ready in minutes.

DIBCAC is the Defense Industrial Base Cybersecurity Assessment Center — a government team inside the DoD that performs assessments for the highest-tier programs and for CMMC Level 3. A C3PAO (Certified Third-Party Assessment Organization) is a private firm authorized by the Cyber AB to perform CMMC Level 2 assessments. Most defense contractors handling CUI engage a C3PAO for L2; only a small number of programs trigger a DIBCAC-led L3 assessment. Our documentation is formatted for both.

Level 1 (Foundational) covers Federal Contract Information (FCI) and requires the 17 controls from FAR 52.204-21. It is annual self-assessment.

Level 2 (Advanced) covers Controlled Unclassified Information (CUI) and aligns to all 110 controls in NIST SP 800-171 Rev 2. Most programs require a triennial C3PAO assessment.

Level 3 (Expert) applies to the highest-priority CUI programs. It layers an additional 24 controls from NIST SP 800-172 on top of L2 and is assessed by DIBCAC.

SPRS (Supplier Performance Risk System) starts every contractor at 110. For each of the 110 NIST 800-171 controls not implemented, points are deducted — either 1, 3, or 5 points depending on the control's risk weight, so the score can range from −203 to +110. Many DoD primes now require an SPRS score above a stated threshold (often +88 or higher) before they will issue a subcontract. ComplianceArmor produces a SPRS score with a control-by-control breakdown of every deduction so you know exactly where to remediate first. Want a quick estimate of where you stand today? Run our free SPRS Score Calculator in 90 seconds.

Any organization in the Defense Industrial Base (DIB) supply chain that holds, processes, or transmits Federal Contract Information or Controlled Unclassified Information for the DoD. That includes prime contractors, subcontractors at any tier, manufacturers, R&D firms, IT and managed-service providers supporting DoD environments, and many professional services firms with DoD clients. CMMC requirements flow down through the entire supply chain via DFARS 252.204-7012 and the new DFARS 252.204-7021 clauses.

For CMMC Level 2: a System Security Plan (SSP) with 110 control narratives, the SPRS score with deduction breakdown, the Plan of Action & Milestones (POA&M), 14 security policies, 14 operational procedures, gap analysis, evidence checklist, CUI boundary documentation, control mapping matrix, responsibility matrix, interview prep guide, assessment readiness checklist, continuous monitoring plan, folder structure script, and executive summary. Branded, editable, and delivered in PDF, Word, HTML, CSV, and ZIP. Yours forever.

The documentation package itself ships in minutes once your scope is signed off. Total engagement timelines: CMMC Level 1 in 21 days, CMMC Level 2 in 60 to 75 days, Level 3 scoped per engagement. Compare to four to eight weeks of senior staff time per artifact, or twelve to twenty-four weeks for a boutique consultancy doing it from scratch.

CMMC Level 1 from $6,997 flat, 21-day delivery, no third-party assessor required.

CMMC Level 2 documentation package from $24,997 flat, 60-75 day delivery. The required C3PAO assessment fee runs $30K-$50K and is engaged separately — we disclose that on every pricing card so the total budget is transparent up front.

CMMC Level 3 is custom-scoped after a discovery call. DIBCAC-led assessment is government-administered.

Those are self-serve SaaS dashboards where your team still writes the SSP, the POA&M, and the policies. ComplianceArmor is a done-for-you engagement run by a Cyber AB Registered Provider Organization. Petronella Technology Group writes the package for you, scoped to your CUI environment, reviewed by four CMMC Registered Practitioners. You get an outcome and a binder, not a dashboard. Read the side-by-side breakdown on the CMMC compliance guide or the ComplianceArmor hub.