For defense contractors & DoD subcontractors
CMMC Level 2 readiness with a live SPRS score, not a spreadsheet
From 10 November 2026, Level 2 contracts require a C3PAO certificate instead of a self-assessment. KollGuard maps real scan evidence from your code, cloud and databases to all 110 NIST SP 800-171 requirements, computes your SPRS score with the DoD methodology, scopes the assessment, drafts your SSP and POA&M, and watches every vendor that touches CUI against the FedRAMP Marketplace and DFARS flow-down. Readiness and continuous monitoring — never a certification, and never a place for CUI.
- All 110 NIST SP 800-171 Rev 2 requirements with SPRS points, POA&M eligibility and the 32 CFR 170.21 conditional-status gates
- Scan evidence from GitHub, AWS, Azure, GCP and your databases fills the technical requirements automatically; you attest the process controls
- Assessment scoping with the five DoD asset classes (CUI, Security Protection, Contractor Risk Managed, Specialized, Out of scope)
- System Security Plan, POA&M in the DoD template and a Shared Responsibility Matrix — Markdown, CSV and OSCAL 1.0.4
- Supply-chain watch: FedRAMP Marketplace status vs the level your contract requires, DFARS 252.204-7012/7021 flow-down, subcontractor CMMC and SPRS
- Deadline reminders for the annual affirmation, triennial reassessment, SPRS validity and the 180-day POA&M closeout
- FedRAMP Rev 5 Low / Moderate / High baseline coverage from the same scan evidence
Frameworks covered:CMMC 2.0NIST SP 800-171DFARS 7012 / 7019 / 7020 / 7021FedRAMP Rev 5NIST 800-53SOC 2
Why DoD subcontractors pick KollGuard
- The SPRS score engine implements the DoD Assessment Methodology v1.2.1 and the conditional-certification rules, so the number you see is the number you would submit.
- Most GRC platforms price small subcontractors out of CMMC. KollGuard is self-serve, with the CMMC and FedRAMP modules on the Growth plan and no annual contract.
- Vendor Watch was built for supply chains: Nth-party mapping, flow-down tracking and a daily check of every CUI-handling vendor against the public FedRAMP Marketplace feed.
- KollGuard sits outside your CUI boundary. It stores attestations and metadata only, rejects text carrying CUI markings, is hosted in the United States, and publishes a CUI handling statement and Customer Responsibility Matrix you can drop into your SSP.
CMMC & FedRAMP guides
CUI handling statement + Customer Responsibility Matrix
How to document KollGuard in your SSP as an out-of-scope tool.
For govtech & public-sector vendors
NIST 800-53 and CIS Controls mapped from your real infrastructure.
FIPS readiness scanning
Find non-validated crypto before an assessor does.
Pricing
First scan free · Growth plan includes CMMC & FedRAMP readiness.
Frequently asked
- Does KollGuard certify us for CMMC?
- No. Only a C3PAO can certify Level 2 and only DIBCAC can certify Level 3. KollGuard gets you ready, tracks your SPRS score and deadlines, and produces the documents your assessor will ask for.
- Is KollGuard FedRAMP authorized? Do we need it to be?
- No, and no. KollGuard never stores, processes or transmits CUI, so DFARS 252.204-7012 FedRAMP Moderate equivalency does not apply to it. Document KollGuard as a Contractor Risk Managed or out-of-scope asset using our CUI handling statement.
- Is gov.kollguard.com a separate government instance?
- No. gov.kollguard.com and federal.kollguard.com are front doors to the same US-hosted service (AWS us-east-2 via Supabase). There is no isolated or GovCloud instance, and none is needed because KollGuard sits outside your CUI boundary — see the CUI handling statement.
- Can I put CUI in KollGuard?
- No. Describe your systems and controls and link to evidence held in your CUI environment. The product rejects text that carries CUI marking banners, and our statement explains the boundary.
- How is the SPRS score calculated?
- Per the NIST SP 800-171 DoD Assessment Methodology: 110 points minus 1, 3 or 5 per unmet requirement, with partial credit for the two multi-factor and FIPS crypto requirements, and the 32 CFR 170.21 rules for which items may sit on a POA&M at conditional status.
- What about Level 1?
- Level 1 is the 17 FAR 52.204-21 requirements. KollGuard scores and exports Level 1 the same way; switch the level on the CMMC page.
- Do you watch our subcontractors too?
- Yes. Mark a vendor as handling CUI, record the FedRAMP level your contract requires and the DFARS flow-down status, and KollGuard checks the FedRAMP Marketplace daily and raises a finding when a gap appears.
Run your first scan free
Connect a repo or database. See your posture in minutes.
Start free with a CMMC-focused workspace·Read the CUI handling statement