An accurate CMMC self-assessment. Protect yourself from the False Claims Act.
Your SPRS score is a statement to the federal government, and a senior official at your company signs it. When the score runs ahead of the evidence, that signature is False Claims Act exposure. Garde1 runs a mock assessment of every objective, graded on the evidence it collects, before you self-attest, so the score you post is one you can back up.
The score is a statement. The signature makes it yours.
The affirmation is a statement to the federal government, and the Justice Department tests those statements under the False Claims Act. On September 1, 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that one of its networks didn't meet NIST SP 800-171 while it billed DoD. In July 2025 a California contractor and its private-equity owner paid $1.75 million over controls it hadn't implemented. The trouble is rarely a score that is too low. It is a score nobody can back up. What the settlement teaches →
Two levels. One signature.
Level 1 is always a self-assessment. Level 2 is one when the contract says Level 2 (Self), and since DoD paused third-party certification in July 2026, that is the version new contracts ask for. No posted self-assessment, no award. What the pause changed →
Level 1 (Self)
- 15 requirements from FAR 52.204-21, for companies that handle FCI only
- Every one has to be met. No POA&M is allowed
- Assessed and affirmed in SPRS every year
Level 2 (Self)
- 110 requirements and 320 assessment objectives from NIST SP 800-171
- Scored from 110 down. Conditional at 88 with only POA&M-eligible gaps, closed within 180 days
- Assessed every three years, affirmed every year
Seven steps, in this order.
Level 1 skips the SSP and the POA&M. Everything else applies to both.
1. Draw the scope
Decide which people, systems and places touch CUI or FCI. Everything after this is graded inside that line, so a wrong scope makes every later step wrong. How to scope a small company →
2. Write the SSP
The System Security Plan describes your systems and how each requirement is met. A Level 2 assessment without one cannot be completed. Keep the SSP and SPRS on the same scope →
3. Test every objective against evidence
Each requirement breaks into assessment objectives, 320 of them at Level 2. Each needs a record that says what it proves, where it came from and when. What evidence counts →
4. Score it
Start at 110 and subtract 1, 3 or 5 points for each requirement not fully met. The floor is −203. How SPRS scoring works →
5. Put only eligible gaps on a POA&M
A gap can stay open only if it is worth 1 point and isn't one of six named exceptions, with a score of 88 or more. Then you have 180 days. POA&M rules · Conditional or Final →
6. Enter it in SPRS
Through PIEE, a new CMMC record with your scope, CAGE codes and the result for each requirement. Every SPRS screen, in order →
7. Affirm it, then every year
A senior official at your company affirms the result in SPRS, and again each year. An MSP can prepare it. Only someone inside your company can sign. What the affirmation means →
Every objective, decided from evidence. Missing evidence is Not Met.
Garde1 does the grading a self-assessment usually leaves to the person who signs it. Level 1 is simpler: Garde1 checks that each of the 15 requirements has its record, for $150 a month. Level 1 →
Garde1 handles
- Collects evidence from your systems through 23 connectors, and reads what you upload
- All 320 NIST SP 800-171A objectives are scored one at a time, each against the evidence filed under it.
- Missing evidence is Not Met. Nobody at Garde1, and nobody at your company, can override a determination.
- Computes your SPRS score and whether it reaches Final, Conditional, or no status
- The SSP is written from the same evidence. A statement the evidence does not support is flagged for you, not published.
- Lays out every SPRS entry, requirement by requirement, and reminds your official 30, 14 and 7 days before each affirmation is due
Still yours
- Answer the questions only you can answer
- Connect your systems, or upload what Garde1 asks for
- Fix what is Not Met. Garde1 applies supported fixes once you approve them
- Your senior official enters and affirms in SPRS. Garde1 never signs for you
Others score what you tell them. Garde1 scores what it collects.
Every route ends with the same signature. What differs is what stands behind it.
The DoD guide and a spreadsheet
Free- Who decides “met”
- You do
- What backs the score
- Whatever you saved
- What your official signs
- Your own grade
- When it’s re-checked
- At the next affirmation
A compliance platform
Usually quoted- Who decides “met”
- You mark it, or a vendor test passes on the vendor’s defaults
- What backs the score
- Your answers, plus the tests that apply
- What your official signs
- Your grade, with some automation
- When it’s re-checked
- As tests run
- Who decides “met”
- Your evidence, objective by objective
- What backs the score
- The record filed under each of the 320 objectives
- What your official signs
- A grade with the evidence behind it
- When it’s re-checked
- Every scheduled run, about 12 minutes each
Self-assessment questions.
What is a CMMC self-assessment?
Your company grades itself against the CMMC requirements for its level, posts the result in SPRS, and a senior official affirms it is true. Level 1 covers 15 requirements and repeats every year. Level 2 (Self) covers 110 requirements and 320 objectives and repeats every three years, with an affirmation every year.
When is a Level 2 self-assessment enough?
When your contract or solicitation asks for CMMC Level 2 (Self). While DoD’s July 2026 pause on third-party certification lasts, new DoD contracts may ask only for Level 1 (Self) or Level 2 (Self). A prime can require a certificate only if it is in a subcontract you signed or in the prime’s own contract.
If an outside firm helps, is it still a self-assessment?
Yes. Help from an MSP, a consultant or software doesn’t change the type. The score and the affirmation are still your company’s.
How does Garde1 decide Met or Not Met?
At Level 2, a model reads the evidence filed under each of the 320 objectives and decides each one, constrained to a fixed set of outcomes. Missing evidence is Not Met, and no one can override a determination. Level 1 checks that each of the 15 requirements has its record.
How does an accurate self-assessment protect us under the False Claims Act?
The Act reaches false statements made knowingly, and knowingly includes reckless disregard of whether they are true (31 U.S.C. 3729). A score decided from evidence, with the record kept behind each objective, shows what you checked and when, and keeps the number you post from running ahead of what is in place. It is not legal advice; a government contracts lawyer can tell you where you stand.
Does Garde1 submit or affirm in SPRS for us?
No. Garde1 lays out every entry and reminds your official before each affirmation is due. The entry and the affirmation are made in SPRS by your company, and the affirmation by a senior official.
Is a Garde1 result a certification?
No. It is a mock assessment graded on your evidence, run before you self-attest. If your contracts call for C3PAO certification once it resumes, the same grade shows where you stand before the assessor arrives.