Defense and federal contractors, ready for assessment.
Your contracts depend on protecting federal information and proving it. TruOps keeps your requirements, evidence, and gaps in one place.
CMMC Level 2 practices
The 110 NIST SP 800-171 requirements, by domain
Coverage by obligation
Requirements met with current evidence
SPRS score
From the NIST SP 800-171 self-assessment
Dashed lines: 88, the minimum for conditional Level 2, and the full score of 110.
TruOps helps government contractors prepare for CMMC Level 1 and Level 2, implement NIST SP 800-171, keep the requirement-level evidence behind an SPRS self-assessment score, and track plans of action and milestones, with continuous control monitoring and sourced evidence for assessors. You still file in SPRS, and a C3PAO still performs certification assessments.
- CMMC is already in your contract language
- Your SPRS score doesn't match your requirement-level evidence
- Your subcontractors have to meet the same bar
The rules that apply
Most government contractors answer to several overlapping regimes at once. The common ones:
| Regime | What it asks for |
|---|---|
| CMMC 2.0 | Verified cybersecurity for DoD contractors, Levels 1 to 3 |
| NIST SP 800-171 | Protecting CUI in nonfederal systems |
| DFARS 252.204-7012 | Safeguarding covered defense information and incident reporting |
| NIST SP 800-53 / FedRAMP | For federal systems and cloud services |
Which ones apply depends on your size, location, and activities. TruOps runs whichever you need in one place and shows where they overlap.
The challenge
CMMC Phase 1 (since November 2025) means Level 1 and Level 2 self-assessments plus annual SPRS affirmations signed by a senior official. The planned November 2026 move to C3PAO certification was paused in July 2026 pending review, so your self-assessment has to hold up on its own. Most defense contractors still have an 800-171 spreadsheet, a consultant's SSP, and a POA&M that isn't connected to either.
- Your SPRS number can't be traced back to 110 requirements with evidence.
- Limited Level 2 POA&Ms have to close in 180 days, and they live in a document with no owners.
- Primes can't look up a sub's SPRS status, so flow-down is a contract clause with no assessment behind it.
What you're probably using today
Defense contractors usually have an 800-171 spreadsheet, a consultant's SSP, and a POA&M that isn't connected to either, and that package won't hold up with a C3PAO. TruOps gets you ready. You still file in SPRS, and the assessor still assesses.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| A consultant-built binder | The program was accurate the week the engagement ended. After the next surveillance audit, new framework, or acquisition, it's out of date. | Your binder becomes a working program, with recurring assessments that pre-fill, controls checked from your tools, and findings that keep an owner. |
| A CMMC readiness tool that scores a worksheet | A score without sourced evidence, scoping, or a working POA&M, and your affirming official still has to sign in SPRS. | Requirement-level status, owners, and sourced evidence. You still file in SPRS, and a C3PAO still issues the certification when the solicitation requires it. |
| A separate TPRM spreadsheet for subcontractors | Flow-down is a clause in the contract with no assessment behind it. | Subcontractors complete portal assessments against the same requirements, with findings you can track. |
What teams in this industry work on
Here are the programs government contractors run day to day, and what good looks like when an examiner, customer, or board asks.
| Use case | What good looks like |
|---|---|
| Requirement-level 800-171 status | Each of the 110 Rev. 2 requirements (CMMC Level 2) has a status, an owner, and sourced evidence, which is the basis of the SPRS score you report |
| SSP and POA&M in one list | Gaps are findings with owners, plans, and dates. Limited POA&Ms at Level 2 have to close within 180 days of conditional status |
| Self-assessment and C3PAO paths | Phase 1 (since November 2025) relies on Level 1 and Level 2 self-assessments and annual SPRS affirmations. The planned November 2026 C3PAO phase was paused in July 2026 pending review. TruOps prepares your package, and you still file in SPRS and work with a C3PAO. |
| Subcontractor flow-down | Primes can't look up a sub's SPRS status. Assess subs through a portal against the same requirements and keep the evidence they showed you. |
| A stable CUI boundary | Scope the systems that handle FCI or CUI so the assessment boundary stays put |
What makes it hard
- Requirements are detailed, and assessors expect evidence for every one.
- Gaps have to be tracked with plans and dates.
- Subcontractors have to meet the same bar.
How TruOps helps
- Assess each 800-171 requirement with sourced evidence and a clear status.
- Track gaps as findings with owners, plans, and dates for your POA&M.
- Flow requirements down to subcontractors through vendor assessments.
How TruOps helps
- One platform
- Compliance, risk, vendor, and customer assessments share the same questionnaires, evidence, and findings.
- Pre-filled with sources
- Assessments open with answers pulled from your documents and tools, each with a source.
- Vendor portal
- Third parties answer, upload proof, and fix findings in their own portal.
- Exam-ready history
- Results saved as of their date, with every decision in one audit log.
Questions
Which compliance requirements apply to government contractors?
Common ones include CMMC 2.0, NIST SP 800-171, DFARS 252.204-7012, NIST SP 800-53 / FedRAMP. Which ones apply depends on your size, location, and activities. TruOps runs any of them in one place and shows where they overlap.
Can TruOps calculate an SPRS score?
TruOps tracks the status of each NIST SP 800-171 requirement, which is what the DoD Assessment Methodology score you report in SPRS is based on.
Does TruOps file SPRS or replace a C3PAO?
No. TruOps prepares a requirement-level package with sourced evidence so you can calculate your score and go through a self-assessment or C3PAO assessment with confidence. You still enter results in SPRS, and C3PAO assessments are recorded in eMASS. TruOps isn't a Certified Third-Party Assessment Organization.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Related
See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.