Lawson CyberCompliance engineering · Est. 2026 Score check-in

CMMC Level 2 · Readiness check

How close are you to Level 2?

Twelve questions, about four minutes. You get an initial triage band and the three gaps that carry the most weight. It's a starting point for a conversation, not an assessment.

Answer for your company in general. Don't enter system names, network details, or CUI. No question needs them.

Only handle Federal Contract Information, not CUI? Level 1 applies to you. Use the free Level 1 workbook.

1How many employees does your company have?
2Do you handle Controlled Unclassified Information (CUI), or does a contract include DFARS 252.204-7012?
3When do you need CMMC Level 2?
4Do you have a written System Security Plan that describes your CUI environment?
5Is multifactor authentication required for every user, not just remote and admin logins?
6Is CUI protected with FIPS-validated encryption, for example in a GCC High tenant or on devices in FIPS mode?
7Do you keep a current inventory and a baseline configuration for every system that touches CUI?
8Are security logs collected, kept, and reviewed?
9Do you scan for vulnerabilities on a schedule and patch within a set time?
10Do you have a written, tested incident response plan that covers the 72-hour DoD reporting rule?
11Has all of your staff had security awareness training in the last 12 months?
12Do you have a written plan of action for every gap you already know about?
Where should we send your result?

You'll see your triage band on the next screen. Lawson Cyber then sends your top three gaps in plain language within 1 business day.

Your answers go by email to Lawson Cyber and are read only by Lawson Cyber. We use them to reply to you. We never sell them or share them beyond the services named in our privacy notice. No mailing list. Privacy notice.

This is an indicative readiness check. It is not a NIST SP 800-171 assessment, an SPRS score, or a CMMC certification, and it does not predict a C3PAO result. Do not enter it into SPRS. Only an authorized C3PAO certifies.