Three tools built by a CMMC Registered Practitioner for small defense and federal contractors who need a defensible answer, not a sales call. Work through the controls at your own pace and walk out with something you can stand behind.
Your contracts carry FAR 52.240-93 (formerly 52.204-21), whether they come from the Department of War or a civilian agency. Fifteen basic safeguarding requirements, and an affirmation you have to be able to defend.
You are measured against all 110 NIST SP 800-171 Rev 2 controls and every gap needs a POA&M behind it. Department of War contractors owe SPRS a score; everyone else owes the agency or the prime a defensible position.
Most self-scores fail on methodology, not effort. A second set of eyes before a prime or an assessor asks you to explain it.
Every tool is self-paced and includes 12 months of access. Nothing here replaces a certification assessment, and none of it is priced like it does.
Walk all 15 basic safeguarding requirements and reach a defensible met / not met position on each one.
All 110 controls scored the way the Department of War scores them, with the supporting documents you will be asked for first. Works the same for CUI under a civilian agency or a prime; there is simply no SPRS to post.
You already scored yourself. This is an independent review of whether that score survives scrutiny.
| Level 1 | Level 2 | SPRS Validation | |
|---|---|---|---|
| Price | $497 | $997 | $750 |
| SKU | GAC-TOOL-001 | GAC-TOOL-002 | GAC-ADD-006 |
| Applies when | You handle FCI only | You handle CUI | You have already scored |
| Market | DoW and federal | DoW and federal | DoW (SPRS) only |
| Controls covered | 15 requirements | 110 controls | Your existing scoring |
| Standard | FAR 52.240-93 | NIST SP 800-171 Rev 2 | Department of War assessment methodology |
| SPRS score produced | No, affirmation only | Yes | Reviewed, not produced |
| Policy documents | Not included | Level 2 Policy Mini-Set | Not included |
| POA&M support | Gap list only | Full POA&M structure | Reviewed for defensibility |
| Human review | Self-paced | Self-paced | Practitioner-led |
| Written deliverable | Assessment record | Assessment record and score export | Validation Report |
| Turnaround | Immediate access | Immediate access | Five business days |
Before any control gets scored, the tool walks you through what is in scope. Get the boundary wrong and every number after it is wrong too.
One control at a time, in language your team actually uses. Each one asks what you have implemented and what proves it.
Your answers assemble into the assessment record, gap list, and supporting documents. This is the paperwork a prime asks for.
Take your result to SPRS, or to the agency or prime that asked for it. If you want a second opinion before you do, add the Validation review.
Globe-America Consulting is a Service-Disabled Veteran-Owned Small Business working with small and mid-size Defense Industrial Base contractors and the broader federal contractor market. These tools carry the same guidance we give advisory clients, without the retainer.
Yes. The pause affects the phase-in schedule for certification assessment requirements. It does not remove the Level 1 and Level 2 self-assessment obligations already in effect, and it does not touch what your prime is contractually flowing down to you.
If a clause is in your contract today, it is enforceable today. Waiting on a schedule change is not a compliance position.
It comes down to what information your contract puts in your hands. If you receive Federal Contract Information and nothing more, you are at Level 1. If Controlled Unclassified Information is in scope, generally signaled by DFARS 252.204-7012 in your contract, you are at Level 2.
If you are not certain which applies, do not guess and do not buy. Book a consultation and we will read the clauses with you first.
No. Level 1 is a pass or fail affirmation, not a numerical score. You either meet all 15 requirements or you do not. Any tool selling you a Level 1 SPRS score is describing something that does not exist.
That is a Level 2 requirement, not a Level 1 requirement. FIPS 140 validated cryptography applies where CUI is protected. If you are Level 1 and someone has told you to go buy FIPS validated products, get a second read before you spend the money.
No, and it is not sold as one. These tools support the self-assessment work you are responsible for. Certification assessments at Level 2 are conducted by an authorized Third-Party Assessment organization. What these tools do is get you to the point where that assessment is survivable instead of expensive.
If you scored yourself without an outside read, it is worth checking. The most common problems we find are not arithmetic. They are scope drawn too wide or too narrow, partial credit claimed where the methodology does not allow it, and POA&M items with no closure path behind them.
A score you cannot explain in a meeting is a liability whether or not the math was right.
The two self-assessment tools do. FAR 52.240-93 sits in nearly every federal contract, and civilian agencies and primes invoke the same 110 NIST SP 800-171 controls when CUI is in scope. The Level 2 tool scores you the way the Department of War would; you simply keep the result as your readiness position instead of posting it to SPRS.
SPRS Score Validation is the exception. It reviews a score you have posted to SPRS, so it applies to Department of War contractors only. If you want the same second opinion on a federal or prime-facing position, book a readiness consultation instead.
Twelve months from purchase for both self-assessment tools. Remediation takes time and your answers change as you close gaps, so you can return and rescore throughout the year.
Then say so and we will scope it. The tools are the entry point to a full advisory engagement, and what you spend here is not wasted work. The assessment record you build carries directly into the engagement.
If you are not sure which that is, book a call. We would rather point you at the right tool than sell you the wrong one.