- Space and defense suppliers preparing for a CMMC Level 2 assessment
- DIB contractors that must submit or improve a SPRS score
- Teams that need a living SSP and PoAM, not a one-time document
- Suppliers with IoT and OT assets inside their CUI boundary
CMMC 2.0 & NIST 800-171 Readiness
CMMC 2.0 Compliance for Space & Defense
Built for the defense industrial base. Track all 110 NIST SP 800-171 controls, calculate your SPRS score, build your SSP and PoAM, and package audit-ready evidence for your C3PAO — with automated vulnerability scanning mapped to controls.
✓ 110-control coverage ✓ Real-time SPRS score ✓ SSP & PoAM ✓ C3PAO-ready evidence
NIST SP 800-171 controls
SPRS scoring
SSP & PoAM builder
Continuous monitoring
Why CMMC Readiness Stalls
110 Controls, Spreadsheet Chaos
Tracking NIST SP 800-171 status across 14 domains in spreadsheets is error-prone and impossible to keep audit-ready
Guessing at Your SPRS Score
Contractors submit a self-assessment score to the DoD but can't see how each control moves the number
SSP and PoAM Overload
The System Security Plan and Plan of Action & Milestones are mandatory — and painful to build and maintain by hand
No Proof for Your C3PAO
You've done the work but can't package evidence in the format an assessor expects to see
Evidence Automation Built for CMMC 2.0
Full 110-Control Coverage
Track every NIST SP 800-171 control across all 14 CMMC domains with status, owners, implementation notes, and linked evidence in one place
Real-Time SPRS Scoring
Watch your SPRS score update as you close controls, see which gaps cost the most points, and model remediation impact before you commit resources
Automated Control Evidence
Vulnerability scanning (including Tenable ingestion) auto-maps findings to the controls they satisfy or threaten, with remediation proof and continuous drift detection
Which CMMC Level Do You Need?
CMMC Level 1
17 practices protecting Federal Contract Information (FCI). Annual self-assessment. We help you scope, implement, and attest.
CMMC Level 2
All 110 NIST SP 800-171 controls for Controlled Unclassified Information (CUI). Self- or C3PAO-assessed. Our core focus — SPRS, SSP, PoAM, and evidence.
CMMC Level 3
Adds selected NIST SP 800-172 enhanced controls for the highest-priority programs. We track the extended control set alongside your Level 2 baseline.
Your required level and assessment type are set by your DoD contract and applicable DFARS clauses. Certification for Level 2 is granted only by an accredited C3PAO — Scan Ninja prepares you for that assessment.
What You Get
- Control Matrix: All 110 NIST SP 800-171 controls across 14 domains, with status and owners
- SPRS Dashboard: Real-time score, gap ranking, and what-if remediation modeling
- SSP Builder: System Security Plan assembled from control notes and asset inventory
- PoAM: Plan of Action & Milestones with owners, dates, and aging alerts
- Assessor Package: C3PAO-ready evidence export with SHA-256 chain-of-custody
Scanning + Evidence
Roughly a third of the 110 controls carry a technical signal we assess for you
Our scanner auto-maps findings to the controls they satisfy or threaten — from vulnerability management to configuration, inventory, boundary, and encryption checks — so your evidence stays current between assessments. The rest is tracked with human-attested workflows.
What's Included
- All 110 NIST SP 800-171 controls tracked across 14 domains
- Real-time SPRS score calculation and history
- System Security Plan (SSP) assembly and export
- Plan of Action & Milestones (PoAM) with owners and aging alerts
- Automated vulnerability scanning mapped to controls
- Tenable ingestion, enrichment, and remediation proof reporting
- Continuous monitoring with control-regression and evidence-TTL alerts
- C3PAO-ready evidence package with chain-of-custody
- 30/60/90 day CMMC readiness roadmap
How It Works
1
Define Your Scope
Establish your assessment boundary and inventory the IT, space, IoT, and OT assets that handle FCI or CUI
2
Baseline Your Score
Assess all 110 controls, auto-map scan findings, and see your current SPRS score and biggest gaps
3
Close Gaps with Proof
Work your PoAM, remediate findings, and generate before/after closure evidence for each control
4
Package for Assessment
Export your SSP, SPRS scorecard, PoAM, and evidence in the format your C3PAO expects
Who This Is For
- Space and defense primes, subs, and suppliers in the defense industrial base (DIB)
- DoD contractors handling FCI or CUI under DFARS 252.204-7012
- Propulsion, satellite, launch, and ground-segment manufacturers
- IoT and OT-heavy suppliers bringing connected devices into CMMC scope
- Teams replacing manual spreadsheet-based 800-171 tracking
Not a fit if…You need a C3PAO to formally certify you today. Scan Ninja gets you assessment-ready and works alongside your chosen C3PAO — we don't issue the certification ourselves.
Request CMMC Readiness Review
Tell us about your contracts, scope, and target CMMC level and we'll schedule a readiness assessment.
Frequently Asked Questions
No. Only an accredited C3PAO (Certified Third-Party Assessment Organization) can certify CMMC Level 2, and Level 1 is a self-assessment. Scan Ninja prepares your organization for assessment: we track all 110 NIST SP 800-171 controls, calculate your SPRS score, help you build your SSP and PoAM, automate evidence collection, and package everything for your assessor.
CMMC 2.0 is the Department of Defense framework for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Level 1 (17 practices) covers FCI and is self-assessed annually. Level 2 aligns to all 110 NIST SP 800-171 controls and is required for most contractors handling CUI. Level 3 adds a subset of NIST SP 800-172 controls for the highest-priority programs. Your required level is set by your contract and DFARS clauses.
Under DFARS 252.204-7019/7020, contractors submit a Supplier Performance Risk System (SPRS) self-assessment score to the DoD. The score starts at 110 and points are subtracted for each unimplemented control based on its weight. Scan Ninja calculates your score in real time as you update control status, shows which controls cost you the most points, and lets you model the impact of remediation before you do the work.
Roughly a third of the 110 controls have a technical signal our scanner can evaluate — for example vulnerability management, configuration and inventory checks, boundary and encryption checks, and patch status. We auto-map those findings to the relevant controls. The remaining controls (policies, training records, physical security, and process evidence) are tracked with human-attested evidence workflows.
Yes. The SSP is a mandatory CMMC artifact, and the PoAM documents how you'll close open controls on a schedule. Scan Ninja assembles your SSP from your control implementation notes and asset inventory, and maintains a living PoAM with owners, milestone dates, and aging alerts — both exportable in assessor-ready formats.
Yes. Many defense industrial base suppliers operate space systems, connected devices, and operational technology inside their CMMC scope. We help you define the assessment boundary, inventory those assets, and generate remediation proof across mixed IT/IoT/OT estates.