How long does the CMMC readiness assessment take?

About 10 minutes. The assessment asks short questions about your organization's size, IT environment, and current security practices across all 14 NIST 800-171 control families. You don't need to pull documentation or involve technical staff — just answer based on what you know about your current setup. You'll receive your results immediately, including an estimated SPRS score, prioritized gap list, realistic cost range, and a personalized PDF report you can download or share with your leadership team.

What's the difference between FCI and CUI?

FCI (Federal Contract Information) is information generated for or provided by the federal government that isn't intended for public release — standard contract paperwork, project communications, basic delivery details. CUI (Controlled Unclassified Information) is more sensitive: technical drawings, specifications, source code, system designs, or anything marked "for official use only." If your contracts only involve FCI, you need CMMC Level 1 (17 controls, self-attestation). If you handle CUI, you need CMMC Level 2 (110 NIST 800-171 controls), which typically requires a third-party C3PAO assessment.

Do I need CMMC Level 1 or Level 2?

It depends on what type of government information you handle. Level 1 (17 controls, self-attestation) applies if your contracts only involve FCI — standard contract paperwork without sensitive technical data. Level 2 (110 NIST 800-171 controls) applies if your contracts involve CUI — technical drawings, controlled exports, or anything marked sensitive. Most defense contractors performing actual DoD work need Level 2. The Greypike readiness assessment identifies which level applies to your situation based on questions about your contract scope and the type of information you handle.

What is NIST SP 800-171?

NIST Special Publication 800-171 is the federal cybersecurity standard for protecting Controlled Unclassified Information in non-federal systems. The current revision defines 110 security requirements organized into 14 control families: access control, audit and accountability, awareness and training, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. Compliance with NIST 800-171 is the technical foundation for CMMC Level 2 certification, and your SPRS score is calculated directly from these 110 requirements.

When does CMMC become mandatory?

CMMC enforcement began with Phase 1 in November 2025, requiring Level 1 self-attestation on applicable new contracts. Phase 2, starting November 2026, expands the rules to require Level 2 certifications on contracts that involve CUI — that's the major inflection point for most defense contractors. Phase 3 and Phase 4 follow in 2027 and 2028, with CMMC requirements appearing in virtually all DoD solicitations by full rollout. If you've been waiting to start your compliance program, the runway is now measured in months, not years.

Is the CMMC readiness assessment really free?

Yes — no cost, no credit card, no required sales call. We built this tool because every defense contractor deserves a clear picture of where they stand before committing to a paid assessment or full compliance program. The free assessment gives you an estimated SPRS score, the gaps you'll need to close to reach Level 1 or Level 2, and a realistic cost range based on your organization size. If you decide to work with Greypike afterward, that's a separate conversation — but the assessment results are yours to keep regardless.

Will I get an actual SPRS score from this?

You'll get an estimated SPRS score based on your responses. SPRS (Supplier Performance Risk System) uses a scale where you start at 110 and lose points for each NIST 800-171 control not fully implemented. Your official SPRS score for contract submission must be calculated against documented evidence and a formal System Security Plan (SSP) — which is what our paid engagements produce. The free assessment estimate is highly useful for understanding your current position, planning remediation priorities, and showing leadership where investment is needed before formal scoring.

Free CMMC Readiness Assessment: See Your Gaps in 10 Min

CMMC Readiness Assessment — Greypike

Step 1 of 3 — Your organization

Step 1 of 3

Tell us about your organization

A few quick questions so we can personalize the assessment to your scope and size.

Does your work involve sensitive government information?

CUI (Controlled Unclassified Information) is sensitive data like technical drawings, specifications, or materials marked "for official use only." If you handle CUI, you need Level 2 certification (110 requirements). If you only handle FCI (Federal Contract Information — standard contract paperwork), you only need Level 1 (17 requirements).

Employees who work with sensitive government information

How many of your employees actually access CUI systems (not your total headcount). If you're a 50-person company but only 10 people work on DoD contracts, this number is 10.

Current email & file system

GCC High is Microsoft's government cloud. If you're not sure, you're almost certainly on standard Microsoft 365.

When's your first CMMC-required contract deadline?

The earliest date by which you need to be certified. This might be a new contract award, a renewal, or a task order going through a prime contractor.

Who handles your IT and security?

Helps us estimate how quickly you can execute the remediation work.

Your estimated SPRS score

—/110

Not Eligible

Below 88

Must remediate to 88+ before C3PAO assessment.

Conditional

88 – 109

Eligible for Conditional L2 with POA&M. Full remediation within 180 days.

Final

110

Fully eligible for Level 2 Final status.

Where you're losing points

Preparation costs — how Greypike compares

Year 1 preparation costs only (licensing + labor + tooling + hardware + compliance program). C3PAO assessment costs are shown separately below — they apply equally regardless of which preparation path you choose.

Assessment & certification costs

The fees you pay a certified third-party assessor (C3PAO) to formally certify your environment. Certification is valid for three years.

Year 1 assessment cost range

—

One-time assessment fee + optional pre-assessment readiness review.

Total Year 1 all-in (Preparation + Assessment)

Your full CMMC investment with Greypike, excluding internal staff time.

—

Your prioritized next steps

↓

Download your full PDF report

A personalized 4-page assessment you can share with leadership — includes your SPRS score, the control-family breakdown, cost comparison, and prioritized actions.

We'll use your email to follow up with any questions about your results. No spam.

✓ Your PDF is downloading now. If it doesn't start automatically, check your browser's download folder.
We'll be in touch shortly to discuss your results.

See how ready you are
before your assessment.

Tell us about your organization

12-question security diagnostic

Where you're losing points

Preparation costs — how Greypike compares

Assessment & certification costs

Your prioritized next steps

Download your full PDF report

Questions? Let’s talk.

Company

Services

Resources

See how ready you arebefore your assessment.

Tell us about your organization

12-question security diagnostic

Where you're losing points

Preparation costs — how Greypike compares

Assessment & certification costs

Your prioritized next steps

Download your full PDF report

Questions? Let’s talk.

Company

Services

Resources

See how ready you are
before your assessment.