Free · fourteen questions · a 15-minute call · a written summary the same day
Which CMMC families are worth an hour?
Fourteen questions, one for each requirement family in NIST SP 800-171. Each describes something you can either do today or cannot — no checklists to look up, no jargon to decode. Answer them yourself below, or walk through them with us on a free 15-minute scoping call and get a written summary the same day.
- Requirements
- 110
- Assessment objectives
- 320
- Families
- 14
- Questions here
- 14
Who it's for
Defense subcontractors who hold, or are bidding for, contracts that carry DFARS 252.204-7012 (controlled unclassified information) or FAR 52.204-21 (federal contract information), and who want to know where to look first before paying anyone for a full review.
It is most useful when something is coming up: a contract option, a new solicitation, a prime asking for your SPRS status, a new facility, or a new IT hire being handed NIST SP 800-171.
Two ways to use it
On your own, right now. Answer the fourteen questions below. Your answers stay in this browser and are never sent anywhere — there is nothing to submit and no email to give. The page lists the families worth an hour as you go. About fifteen minutes.
With us, on a free 15-minute scoping call. We work out three things, in this order:
- Whether you hold CUI or only FCI — which decides whether you are looking at Level 1 or Level 2.
- Where that data actually lives and who touches it — which decides how big your scope is.
- The same fourteen questions, walked live. “Not sure” counts the same as “no”, because in front of an assessor they have the same consequence.
What you get
A written summary, sent the same day, whether or not you take it any further. It is plain text so it reads on a phone and pastes into an email. It sets out:
- Where the accountability sits. Of the 110 requirements, the share that usually sits with a provider, the share that is genuinely shared and the share in families usually classified as yours — and which of your flagged families fall on your side. That split is our characterization of common practice, not part of any standard; which ones you actually carry is settled requirement by requirement. We publish the full shared responsibility matrix.
- The families worth an hour, each with the reason it matters and the size of the area involved — the size of the area worth looking at, not a count of what you fail.
- What did not flag — and a plain note that this is a much smaller claim than the family being met.
What it isn't
- Not a score. We do not give a readiness percentage or an SPRS figure. Fourteen questions cannot produce one honestly, and a number that looks official and turns out wrong is worse than no number.
- Not an assessment or a certification. Nothing here examines your evidence. We are not a C3PAO and we do not certify anyone.
- Not an all-clear. If nothing flags, the summary says that most likely means the questions were read generously — not that the environment is complete.
- Not legal advice, and not a statement of what your contract requires.
What happens next
Nothing, unless you ask. The summary is yours either way.
If the summary shows areas worth a closer look, the next step is a paid scoped gap analysis: all 110 requirements and 320 objectives against evidence, a defined CUI boundary, and the System Security Plan and POA&M an assessor actually reads. It is a fixed fee, quoted before you sign. We will also tell you plainly if you don't need GCC High. That only applies when you don't handle CUI. If you handle CUI on commercial Microsoft 365, you need the migration.
If CUI is in scope and it lives in Microsoft 365 today, our Microsoft 365 GCC High migration page sets out what moving it involves.
Book a free 15-minute scoping call — or answer the questions below first.
1 Access Control
Could you produce a list of everyone who can reach CUI today, without building it first?
Access control is the largest family. If the list has to be assembled, it is not being reviewed, and leavers tend to still be on it.
2 Awareness and Training
Has everyone who handles CUI completed security training in the last twelve months, with a record you could show?
A provider can supply the material; it cannot make your people sit through it. The record is the part usually missing, not the training.
3 Audit and Accountability
If someone opened a CUI file last Tuesday, could you find out who?
Logging that exists but is not retained or searchable answers this question with a shrug, which is the same as no.
4 Configuration Management
Is there a written baseline for how a laptop is built, and would you notice if one drifted from it?
Most firms have a build. Fewer have it written down, and fewer again would spot a machine that stopped matching.
5 Identification and Authentication
Is multi-factor authentication enforced for every person who can reach CUI, and do you know how the accounts that cannot use it are protected instead?
The gap is almost never ordinary staff. It is the shared mailbox, the old service account, and the admin who is an exception. Asked about accounts rather than people, this question flagged firms whose non-interactive service accounts are covered by other means, which the requirement does not ask them to change.
6 Incident Response
If ransomware hit tonight, is there a written plan naming who does what, and has anyone rehearsed it?
A plan nobody has walked through is a document, not a capability.
7 Maintenance
When a machine goes out for repair, is there a record of what was on it and who handled it?
Maintenance is where CUI leaves the building legitimately and without anyone recording that it did.
8 Media Protection
Do you know where every copy of CUI lives, including backups, USB drives and anything a person has on a home machine?
Media protection fails on the copies nobody counted rather than the ones they did.
9 Personnel Security
Is screening done before someone gets CUI access, and is access removed the day they leave?
The leaving half is where this fails. Accounts outlive employment far more often than screening is skipped.
10 Physical Protection
Can you say who physically entered any area holding CUI systems last month?
If your systems are hosted, much of this is inherited from the platform — but the premises where people work are still yours, and a badge system nobody reads produces no evidence either way.
11 Risk Assessment
Has anything been formally assessed for risk in the last year, with a written result?
Vulnerability scanning is not a risk assessment, though it is often offered as one.
12 Security Assessment
Is there a current system security plan, and does it describe the environment you actually run?
An SSP written for the environment of two years ago is a common and expensive finding.
13 System and Communications Protection
When CUI leaves your network — email, file transfer, a laptop taken home — do you know what protects it, and whether that protection is FIPS-validated?
Validated is the operative word, and it is where commercial tooling quietly does not qualify. Knowing which mechanism applies is the point; this family also covers boundary protection and segmentation.
14 System and Information Integrity
Are security patches applied on a defined schedule, and could you show what is currently outstanding?
Patching usually happens. Being able to evidence it on demand usually does not.
What this suggests
We have not given you a readiness score or an SPRS figure. Fourteen questions cannot produce one honestly, and a number that looks official and turns out to be wrong is worse than no number — the first real assessment would contradict it.
This is an indicator, not an assessment. It is based on fourteen questions, one per requirement family. CMMC Level 2 is assessed against 320 objectives across 110 requirements, and nothing here has examined any of them. Cloud Kings is not a C3PAO and does not perform certification assessments.
If you want the real thing
A scoped gap analysis walks all 110 requirements and 320 objectives, and produces the System Security Plan and POA&M an assessor actually reads. We will also tell you plainly if you don't need GCC High. That only applies when you don't handle CUI. If you handle CUI on commercial Microsoft 365, you need the migration.
Book a scoping call