CMMC Compliance
Without the Enterprise Tax
Score all 110 controls and get a defensible SPRS number tonight — free, no account, and nothing leaves your browser. Add plain-English guidance and SSP/POA&M export when you're ready.
No signup · No card · Runs in your browser
CMMC compliance is mandatory.
Enterprise pricing shouldn't be.
Enterprise tools cost $50K–$300K a year
GRC platforms are built for large enterprises with dedicated compliance teams — not a shop where the owner is also the IT department.
C3PAO assessments require prep
You need to self-assess and remediate gaps before an assessor arrives. Level 2 C3PAOs are booking 4–6 months out.
110 controls demand documentation
Level 2 requires evidence for every NIST 800-171 control, an SSP, and a POA&M for what's not done yet. Spreadsheets lead to failures.
Deadlines are now
CMMC requirements are in contracts as of November 2025. If a prime or contracting officer has asked for your SPRS score, the clock is already running.
Everything you need for CMMC self-assessment
Work through the 17 Level 1 practices or all 110 Level 2 controls. Mark each one met, partially met, or not met, keep implementation notes, and watch your SPRS score update as you go.
Example — scores follow the DoD assessment methodology
Every control, in plain status Free
All 17 Level 1 or 110 Level 2 controls across 14 domains, with met / partial / not-met tracking and per-control notes.
SPRS score, computed for you Free
Weighted deductions, the −203 floor, and partial credit for 3.5.3 and 3.13.11 — the number a prime or contracting officer is asking for.
Plain-English guidance per control Paid
Ask what a control actually means for a shop your size and what "met" looks like. Only the control ID is sent — never your answers or notes.
SSP and POA&M, assembled in your browser Paid
Generate your System Security Plan and Plan of Action & Milestones from your answers, then print to PDF. Your org name and notes never reach our server.
Three steps to CMMC readiness
Assess your controls Free
Open the tool, pick Level 1 or Level 2, and work through the checklist. Progress saves in your browser; export a JSON backup any time.
Get your SPRS score Free
Your score updates as you answer. Send it to your prime, self-report to SPRS, and see exactly which controls are costing you points.
Close the gaps Paid
Add plain-English guidance for each control, then generate your SSP and POA&M for C3PAO readiness — all assembled client-side.
Score for free. Pay when you want help.
The assessment and your SPRS score are free for good. Paid plans add AI guidance and document export. Monthly, cancel any time, 14-day free trial — no card required to start.
Free
Get the number your prime is asking for.
- Level 1 and Level 2 assessment (all 110 controls)
- SPRS score, computed as you go
- Implementation notes per control
- JSON backup & restore
- No account, no card, nothing leaves your browser
Starter
For shops handling FCI that want a translator.
- Everything in Free
- Plain-English AI guidance for every control
- About 250 control explanations a month
- Email support
Professional
For C3PAO preparation — CUI, all 110 controls.
- Everything in Starter
- About 1,250 control explanations a month
- SSP generation
- POA&M generation
- PDF export of your documents
- Priority support
Business
For larger contractors or MSPs assessing several shops.
- Everything in Professional
- About 6,000 control explanations a month
- Direct email line for scoping questions
- C3PAO introductions and custom reporting — planned, not yet available
Explanation counts are estimates based on a typical control explanation (~800 tokens). Free assessment data stays in your browser; upgrading only adds your email for billing.
Built different. Priced different.
Your real alternatives aren't a $50K GRC suite. They're the spreadsheet your prime attached — or nothing.
| Capability | Raptor CMMC Prep | The spreadsheet | Enterprise GRC |
|---|---|---|---|
| Level 1 & 2 assessment | ✓ Guided | ✓ Manual | ✓ |
| SPRS score | ✓ Computed, free | You do the math | ✓ |
| Plain-English guidance | ✓ Per control | ✗ | Add-on or consultant |
| SSP & POA&M | ✓ Generated from your answers | Write from scratch | ✓ |
| Where your data lives | ✓ Your browser only | ✓ Your PC | Vendor-hosted |
| Price | $0 to score · $49/mo to upgrade | Free | $50,000+/yr |
Ready for guidance and documents?
Start a 14-day trial of AI guidance and SSP/POA&M export. Your assessment stays in this browser — we only need an email for billing.
Where should we send the receipt?
That's the only personal detail we ask for. Your control answers, notes, and company name never leave your browser.
Rule of thumb: if a prime or contracting officer asked for your SPRS score, or your contract has DFARS 252.204-7012, you're Level 2.
Not ready? Keep using the free assessment — it's yours for good.
Choose your plan
14 days free on either plan. No charge until the trial ends; cancel from the Stripe portal any time.
Need Business, or assessing several shops? Talk to us. Or keep using the free assessment.
Your trial is active in this browser
AI guidance and document export are unlocked here. There's no separate login: your assessment lives in this browser, so export a JSON backup from the tool before switching devices. Stripe has emailed your receipt.
Open the assessment
Built by a cybersecurity professional, for defense contractors.
Raptor was founded by a security practitioner whose career spans corporate enterprises and small businesses — including healthcare IT and defense contracting.
The gap was obvious: small defense contractors were being priced out of CMMC compliance by enterprise suites costing $50,000–$300,000 a year, or left alone with a spreadsheet.
Raptor is early and founder-run. That means you get a straight answer from the person who built it, a price that reflects where we are, and an architecture that can't leak your data because it never receives it.
The architecture is the privacy policy.
Your assessment describes your IT configuration and your gaps. That is exactly the kind of data a vendor should never hold. So the product is built so that we can't.
- Answers, notes, and org details stay in your browser. They're saved in local storage on your device. Export a JSON backup any time; delete it any time.
- Scoring sends only control IDs and met / not-met status to our API so the SPRS weights stay server-side. No names, no notes, nothing identifying.
- AI guidance is asked about a control, not about you. The request carries a bare control ID. Your answers are never sent to the model.
- SSP and POA&M are assembled client-side. There is no upload step for your documents.
- What we do hold: an email address if you subscribe to a paid plan or the newsletter, and Stripe holds your payment details. No cookies are set by this site; theme and assessment preferences use local storage only.
{ controlId } for AI guidance
answers · notes · org name
anything about your assessment
Questions? Ask the founder.
Not sure whether you're Level 1 or Level 2, what a prime's email actually requires, or which plan fits — write and you'll get a straight answer.