GridTailor

Free readiness check

Where do you stand? Find out in 15 minutes.

22 questions on CMMC Level 2 and engineering health. Your score updates as you answer. Nothing is sent unless you ask for a follow-up.

CMMC Level 2 (NIST SP 800-171)

3.1 Access Control

Do users get only the access their role needs, reviewed at least quarterly?

3.1 Access Control

Do systems lock after inactivity and show an authorized-use banner?

3.5 Identification & Authentication

Is multi-factor authentication required for every user, including email and cloud consoles?

3.2 Awareness & Training

Does everyone complete security and CUI-handling training every year?

3.3 Audit & Accountability

Are logins and admin actions logged centrally, protected from tampering, and kept for a year or more?

3.4 Configuration Management

Do you have documented, enforced configuration baselines for laptops and servers or cloud?

3.6 Incident Response

Do you have a tested incident response plan that covers the DFARS 72-hour reporting rule?

3.8 Media Protection

Is CUI encrypted at rest on laptops, servers, backups and removable media?

3.9 Personnel Security

Is access removed the same day someone leaves?

3.11 Risk Assessment

Do you scan for vulnerabilities and fix critical findings on a defined timeline?

3.12 Security Assessment

Do you have a current System Security Plan and a POA&M?

3.13 System & Communications Protection

Do you know exactly which systems store or process CUI (your boundary)?

3.13 System & Communications Protection

Is CUI protected in transit and at rest with FIPS-validated encryption?

3.14 System & Information Integrity

Are systems patched and protected by anti-malware or endpoint detection?

Engineering health

Leadership

Is one person accountable for technology strategy and architecture decisions?

Cloud

Is your cloud infrastructure defined as code (e.g. Terraform) and reviewed before changes?

Cloud

Do engineers use SSO for cloud access, with no long-lived access keys?

Delivery

Does every change go through code review and automated tests before production?

Reliability

Are backups automated and has a restore been tested in the last 6 months?

Reliability

Are you alerted to outages and errors before customers tell you?

Cost

Do you have cloud budgets and review spend at least monthly?

Leadership

Is there a written technology roadmap for the next 12 months?