CMMC Level 2 software that covers all 110 requirements
Gardience covers all 110 CMMC Level 2 requirements from one console. It checks and fixes the technical requirements on your Windows and Linux machines, collects your records for the rest through upload links, keeps a live SPRS score, and writes the System Security Plan, POA&M, and a signed evidence pack. Starter plus CMMC costs $10,000 a year.
- -203 to 110SPRS score, technical side done in 35 minutes
- 110requirements tracked, each with status, evidence, and statement
- $10,000a year: Starter plus the CMMC add-on
- 90 daysfree trial with CMMC included
CMMC Level 2 is the Department of Defense requirement for contractors that handle controlled unclassified information (CUI): the 110 security requirements of NIST SP 800-171 Rev. 2, scored in the Supplier Performance Risk System (SPRS) out of 110. Gardience is a console on your own servers that does the technical work and keeps the evidence for every requirement in one place.
How does Gardience cover all 110 requirements as CMMC compliance software?
#Two ways, side by side in the same assessment:
- On your machines. Gardience checks the settings each requirement needs on every Windows and Linux machine in scope, fixes them with your approval, and records the result: patching, encryption, firewall, audit logs, account settings, antivirus, application allowlisting, and more.
- From your records. For people, paper, and building requirements, upload your records or send an upload link to whoever has them. Gardience reminds them until it arrives. Each upload marks its requirement met and writes the statement, naming who provided it and when.
| Family | What Gardience checks and fixes on machines | What you upload or connect |
|---|---|---|
| Access Control (AC) | Account lockout, session lock, sign-in banners, remote access, firewall, network device settings | Wireless and mobile device records, or Microsoft 365 and Okta |
| Awareness and Training (AT) | Training records, collected by link | |
| Audit and Accountability (AU) | Audit policy, log size, auditd alerts, time sync, tamper-evident Gardience audit log | Log review records |
| Configuration Management (CM) | Security baseline, STIG scans, application allowlisting, software inventory, change approvals | Change control policy |
| Identification and Authentication (IA) | Password settings, replay-resistant network sign-in, one-time codes or single sign-on for the console | Multifactor evidence from Microsoft 365, Okta, or Active Directory |
| Incident Response (IR) | Incidents recorded with the 72-hour DoD reporting clock | Incident test records |
| Maintenance (MA) | Approved maintenance runs, multifactor sign-in for remote maintenance | Maintenance records for outside staff |
| Media Protection (MP) | Removable storage blocked or encrypted, and scanned | Records for paper and media handling |
| Personnel Security (PS) | People who left, from Active Directory, Okta, or an HR termination report | Screening records |
| Physical Protection (PE) | Visitor logs and building access records | |
| Risk Assessment (RA) | Vulnerability scans with CISA KEV and EPSS, fixed with approval | Risk assessment |
| Security Assessment (CA) | System Security Plan and POA&M written from the assessment | Your plan to close open items |
| System and Communications Protection (SC) | Firewall, FIPS mode, BitLocker and LUKS disk encryption with key escrow, VPN split tunneling | Network diagram and boundary |
| System and Information Integrity (SI) | Patching, antivirus (Defender, CrowdStrike, SentinelOne, and others), security alerts |
What does an assessor get?
#- A live SPRS score, scored with the DoD method in 32 CFR 170.24, including partial credit where the rule allows.
- A System Security Plan with a statement for every requirement, written from what Gardience found.
- A POA&M for every open item, with a plan and a date.
- A signed evidence pack: every check result, uploaded record, and approval, signed with Ed25519 and checkable offline with the public key inside.
- STIG Viewer checklists for each scanned Windows and Linux machine, ready for eMASS. See STIG automation.
How fast is it?
#On a 50-machine test network with 20 Windows servers holding CUI, Gardience patched the machines, applied every CMMC setting and its security baseline, turned on FIPS mode, and encrypted all 20 system drives after each recovery key was in the vault. From the first step to an SPRS score of 110 took 35 minutes for the technical side. The method and logs are on the proof page.
How does it work, step by step?
#| Step | What you do | Time |
|---|---|---|
| 1 | Install Gardience on a Linux server inside your network, or offline | About 5 minutes |
| 2 | Enroll the machines that store, process, or protect CUI | Under an hour |
| 3 | Run the CMMC check and approve the fixes | Minutes |
| 4 | Adopt the policy templates and send upload links for your records | Days, at your team's pace |
| 5 | Export the SSP, POA&M, and evidence pack; enter your score in SPRS | Minutes |
What does CMMC Level 2 cost with Gardience?
#Industry estimates put a first year of CMMC Level 2 readiness at $70,000 to $250,000, much of it consultants at $250 to $400 an hour doing the technical work Gardience automates. Gardience is $10,000 a year: Starter at $6,000 plus the CMMC add-on at $4,000, both included in the free 90-day trial. The assessor's fee is separate either way; the DoD's own estimate for a small company's Level 2 assessment is $104,670 over three years. See the full breakdown of what CMMC Level 2 costs.
Buy Starter + CMMC for $10,000 a year, or start the free trial first.
Where does CMMC stand today?
#The DoD paused Phase 2, the third-party assessments, on July 13, 2026. Phase 1 stays in force: Level 1 and Level 2 self-assessments and the SPRS score you report are still required in contracts, and DFARS 252.204-7012 still requires NIST SP 800-171. A score you report has to be true, and Gardience keeps it tied to evidence. See what still applies.
Questions
#Does Gardience perform the CMMC assessment?
#No. An authorized assessor (C3PAO) performs the Level 2 assessment. Gardience covers all 110 requirements and produces the evidence the assessor reviews: the SPRS score, the System Security Plan, the POA&M, and a signed evidence pack.
Can Gardience run inside a CUI enclave with no internet?
#Yes. Gardience installs from a signed offline bundle, its license is verified offline, and the evidence pack is checked offline with the public key inside it. See deployment options.
What happens when a machine falls out of compliance?
#A requirement marked met whose check starts failing goes back to not met, with a plan of action and a date, so the score you report stays true.
Can a consultant or MSP run CMMC for several clients?
#Yes. Consultants and MSPs use Gardience for their clients through the partner program.
How do I estimate my score first?
#Use the free SPRS score calculator: mark each requirement and it scores your implementation the DoD way. The CMMC Level 2 checklist lists every requirement with its SPRS points and the records assessors ask for.
Sources
#Checked November 7, 2026.
- 32 CFR Part 170, the CMMC program rule, and 32 CFR 170.24, the CMMC scoring methodology (SPRS points, partial credit, and the 88-point Conditional Level 2 minimum in 32 CFR 170.21).
- DoD NIST SP 800-171 Assessment Methodology, version 1.2.1, the point values the rule adopts.
- NIST SP 800-171 Rev. 2, the 110 security requirements.
- The final CMMC program rule in the Federal Register, October 15, 2024, including the DoD's assessment cost estimates.
Gardience results, with their method and logs, are on the proof page.
Read more
- CMMC Phase 2 is paused: what defense suppliers still owe
- STIG and CIS evidence for assessors: Windows and Linux
- Air-gapped patch management for Windows and Linux
- CISA KEV list: what it means for your servers
Check your CMMC Level 2 score, then close the gaps
Score all 110 requirements free with the SPRS calculator. Gardience then checks and fixes the technical side on your Windows and Linux machines and keeps the evidence for the rest: Starter plus the CMMC add-on is $10,000 a year, free for 90 days.
Free SPRS score calculatorBuy Starter + CMMCCMMC Level 2 checklistBook a 15-minute CMMC walkthrough