Starting a CMMC self-assessment
CMMC stands for Cybersecurity Maturity Model Certification. It is a Department of Defense program that requires defense contractors to meet cybersecurity standards. RFI Hawk's free self-assessment walks you through every control in plain English.
Steps
-
From the dashboard, click CMMC Suite.
-
Click Start the Assessment.
-
The first questions help RFI Hawk decide your level:
- Do you handle Federal Contract Information (FCI)?
- Do you handle Controlled Unclassified Information (CUI)?
-
What is your IT environment (on-premises, cloud, mixed)?
-
Based on your answers, the system tells you which level you need (Level 1, Level 2, or Level 3) and starts the relevant control questions.
-
For each control, the system asks plain-English questions and you answer In Place, Partly In Place, Not In Place, or Does Not Apply.
[screenshot of a CMMC question with the four answer options]
-
The system saves every answer as you go. You can stop and come back any time.
-
When you finish, you get:
- Your level (1, 2, or 3)
- Your supplier score
- Your gap list (controls marked Not In Place)
- A draft Plan of Action and Milestones for your gaps
- A draft System Security Plan
What to do if it does not work
If you are not sure how to answer a question, click "I do not know" and the system gives you guidance. You can come back to the question later.
If a question does not apply to your environment, mark it Does Not Apply. The system requires a brief reason. The reason becomes part of your assessment record.