Skip to main content

Sample account · read-only

Ridgeline Machining: three years in one compliance briefcase.

A fictional 40-person defense supplier that has used CMMC Agent since 2024. Each year's assessment is saved as its own version, so the history stays intact for primes and assessors.

Sample data. Ridgeline Machining is not a real company and these scores are illustrative. Readiness scores are self-assessments, not certifications.

SPRS score by year

  • 2024 assessment-42
    Controls met
    61/110
    Open POA&M
    38
    Evidence files
    74

    First self-assessment. MFA, FIPS encryption and incident response were the biggest gaps.

  • 2025 assessment58
    Controls met
    89/110
    Open POA&M
    14
    Evidence files
    212

    MFA rolled out company-wide; SSP rewritten; quarterly access reviews started.

  • 2026 assessment104
    Controls met
    108/110
    Open POA&M
    2
    Evidence files
    341

    Ready for a C3PAO assessment. Two low-weight items remain on the POA&M.

The timeline

  1. Mar 2024 — Workspace created; 110 controls answered
  2. Jun 2024 — First SPRS score submitted (−42)
  3. Nov 2024 — Multi-factor authentication closed (+5)
  4. Apr 2025 — Annual re-assessment: 2025 version saved alongside 2024
  5. Sep 2025 — Prime contractor flowed down DFARS 7012 — SSP shared with assessor role
  6. Feb 2026 — FIPS-validated encryption closed; incident response plan tested
  7. Sep 2026 — 2026 version: SPRS 104, two items open

Why it becomes your briefcase

Every year adds a version instead of overwriting the last. Evidence, review history and the audit log carry forward, so renewals, prime flow-downs and a future C3PAO assessment start from what you already proved.

Start your own briefcase

Find your SPRS score in an afternoon

Answer plain-English questions for all 110 controls. CMMC Agent calculates your score and builds your SSP and POA&M.

Start a free self-assessment

Readiness tool — not a C3PAO. CMMC Agent does not certify compliance.