Built on NIST SP 800-171 Rev 2
Your CMMC paperwork, drafted in plain English
ClearPath turns about an hour of multiple-choice questions into a CMMC Level 2 draft System Security Plan, a POA&M and your SPRS score, calculated with the official DoD methodology. Built for defense subcontractors with no IT staff.
- No CUI collected, ever
- Official DoD scoring weights
- Editable Word and CSV exports
- Cancel any time
SPRS score
87 / 110
DoD Assessment Methodology v1.2.1
Controls in place
101 of 110
- AC21/22
- AU8/9
- CM8/9
- IA10/11
- IR2/3
- MP8/9
- PE5/6
- RA2/3
- SC15/16
+ 5 families fully in place
Top gaps by points
9 open · −23 pts
- 3.3.1Create and keep audit logs−5
- 3.6.1Incident response plan−5
- 3.11.2Scan for vulnerabilities−5
- 3.5.3MFA for every account (remote and admin done)−3
110
controls
NIST SP 800-171 Rev 2
320
assessment objectives
NIST SP 800-171A
14
control families
Every family covered
v1.2.1
scoring methodology
DoD Assessment Methodology
How it works
From questions to documents in an afternoon
No consultant, no jargon. Answer what you know about your shop, and ClearPath does the mapping, scoring and drafting.
- 1
Answer plain-English questions
About an hour, at your own pace. Save and come back any time.
Identification and Authentication · 18 of 85
Who has to use a second step (like a phone app) when they sign in?
Everyone, every timeRemote and admin accounts onlyNobody yetI'm not sure - 2
Watch your SPRS score build
Each answer updates the score with the official DoD weights.
Live SPRS score
87 / 110
- 3.5.3 · remote and admin only−3
- 3.14.1 · automatic updates on0
- 3.3.1 · logging not turned on−5
- 3
Review and export your drafts
Read the SSP and POA&M, adjust, and download them for your records.
Precision-Machine-SSP-draft-v3.docx
System Security Plan · 110 controls
Precision-Machine-POAM-draft-v3.docx
Plan of Action and Milestones · 9 items
Precision-Machine-POAM-draft-v3.csv
For your tracker or spreadsheet
What you get
Everything a Level 2 self-assessment needs
The same core deliverables a consultant produces, drafted from your own answers.
Plain-English questionnaire
85 multiple-choice questions written for a shop owner, not a security engineer. Each one maps to the NIST SP 800-171A assessment objectives behind it.
Live SPRS score
Calculated with the DoD Assessment Methodology as you answer. Unanswered questions count against you, so the number is never flattering.
Draft System Security Plan
A section for every one of the 110 controls, written from your answers and marked where your answers don't support a claim.
Draft POA&M
Every gap as a plan-of-action item with its point value, ranked so the fastest points come first.
Word and CSV exports
Editable .docx files with your logo on the cover, plus a CSV for your own tracker. Every page carries the draft notice.
No CUI, by design
No file uploads and no free-text answers. The app asks about your environment, never what's in it.
Try the scoring
See how five controls move your score
Five of the 110 controls with their real DoD weights. Change an answer and watch the points change.
The deliverables
Documents written from your answers, never invented
Each SSP section states its status, its point impact and the answers behind it. Gaps become POA&M items you can act on.
System Security Plan · Identification and Authentication
3.5.3 Multi-factor authentication
Partially implementedDeduction: 3 points (methodology partial credit)
Precision Machine Co. requires multi-factor authentication for all remote access and for every account with administrative privileges, using Microsoft Authenticator through Microsoft 365.
Shop-floor accounts used for local network access currently sign in with a password only. Extending MFA to these accounts is tracked as POA&M item 4, with a target completion of November 3.
Traceability
3 of 4 assessment objectives met · from 2 questionnaire answers
A page of the draft SSP (sample company).
Plan of Action and Milestones · draft v3
9 open items · −23 pts recoverable
| # | Control | Weakness to fix | Points | Target | Status |
|---|---|---|---|---|---|
| 1 | 3.3.1 | Create and keep audit logs | −5 | Nov 7 | In progress |
| 2 | 3.6.1 | Incident response plan | −5 | Nov 28 | Planned |
| 3 | 3.11.2 | Scan for vulnerabilities | −5 | Nov 14 | Planned |
| 4 | 3.5.3 | MFA for every account (remote and admin done) | −3 | Nov 3 | In progress |
| 5 | 3.13.16 | Encrypt CUI at rest | −1 | Dec 12 | Planned |
| 6 | 3.1.8 | Limit unsuccessful logon attempts | −1 | Nov 21 | Planned |
| 7 | 3.8.9 | Protect CUI backups | −1 | Dec 5 | Planned |
| 8 | 3.10.4 | Log physical access | −1 | Dec 19 | Planned |
| 9 | 3.4.9 | Control user-installed software | −1 | Jan 9 | Planned |
The matching POA&M: nine items, 23 points recoverable (sample company).
Which level are you?
It comes down to whether you handle CUI
If your contracts or flow-downs mention CUI or DFARS 252.204-7012, you are almost certainly Level 2. Level 3 is out of scope.
| Topic | CMMC Level 1 | CMMC Level 2 · what ClearPath drafts |
|---|---|---|
| What you handle | Federal Contract Information (FCI) only | Controlled Unclassified Information (CUI) |
| Requirements | 15 safeguards, FAR 52.204-21 | 110 controls, NIST SP 800-171 Rev 2 |
| Score | Pass or fail per safeguard | SPRS score from 110 down to −203 |
| Documents | Annual self-attestation | SSP, POA&M and annual affirmation |
| Contract clause | FAR 52.204-21 | DFARS 252.204-7012 / -7019 / -7020 |
| ClearPath | Free Level 1 checker | Full drafting tool, $79 a month |
5–50
person shops: machining, precision manufacturing, services
Built for shops without an IT department
Serious about your data, plain about our limits
We never accept CUI
The questionnaire is multiple-choice. The only upload is an optional cover logo, checked to be an image.
Your data is yours alone
Every record is scoped to your organization in the database itself, with row-level security and optional two-factor sign-in.
Honest about what we are
A drafting tool, not an auditor or a C3PAO. Every document is marked as a draft for your review.
Deletion you control
Schedule deletion any time. After a 30-day grace period we purge your account and every answer.
Pricing
A fraction of one consultant invoice
CMMC consultants typically quote $1,250 to $1,500 a month. ClearPath drafts the same core documents, and you keep control of every word.
Free tools
Check where you stand before you spend anything.
$0
No account, no card
- CMMC Level 1 checker (FAR 52.204-21)
- 12-question SPRS score estimator
- Results sent by email
Readiness
For shops that must report an SPRS score.
$79 / month
or $790 a year (two months free)
- Full 110-control questionnaire in plain English
- SPRS score with the official DoD methodology
- Draft SSP and POA&M from your answers
- Word and CSV exports with your logo
- Gap dashboard ranked by points
Cancel any time. The questionnaire and live score stay free.
ClearPath produces drafts you review and own. It is not an auditor, a C3PAO, or a source of legal or compliance advice, and it does not certify compliance or guarantee assessment outcomes. We never collect CUI. See our Terms.
FAQ
Questions owners ask before they start
Something else on your mind? We answer every email.
Do you ever see our CUI?
No. The questionnaire is multiple-choice and asks about your environment, never what is in it. There are no file uploads apart from an optional cover logo, so CUI has nowhere to go.
Is this an audit or a certification?
No. ClearPath is a drafting tool. It produces drafts you review and own. It is not an auditor, a C3PAO, or legal advice, and it does not certify compliance.
Which version of NIST SP 800-171 do you use?
Revision 2: 110 controls, 14 families and 320 assessment objectives. It is the version CMMC Level 2 assesses against today.
Do we need a C3PAO certificate right now?
In most cases, not today. Phase 2 (third-party certification) was suspended on July 13, 2026 and is under review, so a self-assessment, an SPRS score and the annual affirmation are what's required. Always check your solicitation. Official DoD CIO CMMC page.
How is the SPRS score calculated?
With the DoD Assessment Methodology v1.2.1: start at 110 and subtract 5, 3 or 1 for each control not fully in place. Only MFA and FIPS encryption earn partial credit.
What happens if we cancel?
The questionnaire and your live score stay free. You can schedule deletion at any time, and we purge everything after a 30-day grace period.
Know your SPRS score before your prime asks
Start your draft today. You'll have a score and documents to review by the end of the afternoon.