What this is
An independent calculator
CMMC Pal applies the public NIST SP 800-171 DoD Assessment Methodology v1.2.1 to the 110 requirements. It shows the SPRS score, the points missing by family, and the controls that would move the score most. It is not affiliated with the DoD, the Cyber AB, or any C3PAO.
Built for small contractors
The site is written for the 10–250 person contractor who has CUI on a DoD contract and no dedicated security team. That is why the calculator runs in the browser, requires no account, and shows the method rather than hiding it behind a sales call.
How we keep it accurate
Primary sources
Scoring follows the DoD Assessment Methodology v1.2.1 and the eligibility rules in 32 CFR 170.21. Where a page summarizes a rule, it links to the primary source: the eCFR, DFARS 252.204-7012, or the DoD methodology.
Corrections
If you find a scoring error or a stale policy statement, email [email protected] with the page URL and the source. Corrections are made on the page and noted in the changelog; scoring bugs are treated as the highest priority.
What this is not
It is not a C3PAO assessment, a compliance determination, or legal advice. The output is a gap analysis. Official assessment results come only from a C3PAO or the DoD, and contract interpretation belongs with your contracting officer or counsel.
Referral links, where present, may earn a commission. They do not change the scoring or the order of the recommendations; the disclosure appears at the point of recommendation.
Contact
Email: [email protected]. We aim to reply within two business days.
For the current CMMC status, see CMMC Status. For the scoring method, see SPRS Scoring Method.