Know exactly where you stand on CMMC.
Free assessment in 20 minutes.
300,000 DoD contractors must comply with CMMC. Most don't know what level they need, which systems are in scope, or how big their gaps are. REAEGIS tells you — free, in under 20 minutes.
No account required. No credit card. Takes 20 minutes. Used by prime contractors and subcontractors across the DIB.
Does this sound familiar?
You are not alone.
"I have a DoD contract and no idea if I need CMMC Level 1, 2, or 3."
"My prime contractor is asking about my CMMC status and I don't know what to tell them."
"I've heard CMMC remediation can cost $200K+ and I have no idea where to start."
"I handle some kind of government data but I don't know if it's CUI or just FCI."
"My IT systems are a mix of on-prem, cloud, and employee laptops — I don't know what's in scope for an assessment."
"I need to respond to a CMMC questionnaire from a prime and I don't know the answers."
Seven steps to full CMMC clarity
Guided by AI. Based on official DoD guidance. Done in 20 minutes.
Tell us what you do for DoD and what kind of contract you have. We determine which CMMC requirements apply to your business.
Not sure if you handle CUI? Describe your work in plain English and our AI determines your CUI status and which categories apply.
Add every IT system that touches your work. We suggest assets you might have missed based on your company type and contract.
Show us how CUI moves between your systems. We build your data flow diagram in real time.
We categorize each system — in scope or out of scope — and generate your formal boundary description.
Answer quick questions per security domain. Our AI maps your answers to all 110 NIST SP 800-171 practices and estimates your SPRS score.
Download four documents — all free. Your CMMC level, asset inventory, data flow diagram, and full gap analysis.
Everything you need to understand your CMMC posture — free.
CMMC Level Determination
Level 1, 2, or 3 — determined from your actual contracts and data, not a guess. With the legal basis for the determination (DFARS clause, CUI category, contract type).
Scoping Report (PDF)
A formal PDF document with your assessment boundary description, asset summary, and CUI data flow diagram. C3PAO-ready formatting.
Gap Analysis vs 110 Practices (Excel)
Every NIST SP 800-171 practice with your estimated implementation status. Color-coded. Prioritized by risk. Ready to share with your leadership or prime.
CUI Data Flow Diagram (PNG/SVG)
A visual map of how CUI flows through your systems. Required for your SSP and your C3PAO assessment.
Built for every DoD contractor
Small businesses and startups
You just won your first DoD contract and the prime is asking about CMMC. You need to know your level and your gaps now.
Prime contractors
You need to assess your subcontractor base. Share this tool with subs who need to understand their CMMC obligations before you can onboard them.
Established defense contractors
You have a prior NIST SP 800-171 assessment but your environment has changed. Use this to revalidate your scope before your next C3PAO assessment.
Built by the team behind REAEGIS
REAEGIS is the compliance automation platform used by programs operating under FedRAMP High, DoD IL4/IL5, and eMASS. We built the CMMC scoping wizard because we kept seeing the same problem: contractors who are serious about compliance but have no idea where to start.
This wizard is based on the official DoD CMMC Model v2.0, NIST SP 800-171 Rev 2, and the CMMC Scoping Guidance published by the Office of the Under Secretary of Defense for Acquisition and Sustainment. Every output is grounded in official guidance — not estimates or opinions.
References: DoD CMMC Model v2.0 · NIST SP 800-171 Rev 2 · CMMC Scoping Guidance · DFARS 252.204-7012
Ready to know where you stand?
Free assessment. No account required. No credit card. Takes 20 minutes.
Your responses are saved automatically. Return any time to continue where you left off.