Score your compliance readiness in 15 minutes.
Pick one of five frameworks — CMMC Level 1, NIST 800-171, SOC 2, ISO 27001, or HIPAA — answer the same 12 NIST-CSF-functions-tagged questions, and leave with a per-framework 0..100 readiness score, the gap map, and the band that decides your next engagement.
5-framework shortlist
CMMC L1, NIST 800-171, SOC 2, ISO 27001, HIPAA. Same 12-question rubric, four domain-weighted buckets; the only thing that changes is which framework is being scored.
Local preview, authoritative re-score
Your per-framework score is rendered live as you answer, then re-scored server-side on submit. The result panel can't drift away from the server.
What 'pass' means
A band of ≥71 / 100 lands you in 'ready'; a band of ≥41 / 100 lands you in 'partial'. Self-attested readiness is NOT a certification — see the framework-specific banner on every result.
A readiness score is a self-attested readiness number against a published control set. The number answers one question: how ready is the org to pass the authoritative audit/attestation/assessment for this framework? We compute the number once on every submission using a deterministic + AI-validated scoring engine, then surface it with a band and a per-domain gap map so the next 30 minutes of hardening effort is obvious.
Each framework uses the same 12-question rubric (anchored to the six NIST CSF functions: Govern, Identify, Protect, Detect, Respond, Recover). Per the brief, the result panel labels each framework honestly — voluntary frameworks (CMMC L1, NIST 800-171, HIPAA) carry no certification claim; ‘certification’ frameworks (ISO 27001, FedRAMP) and ‘attestation’ frameworks (SOC 2) explicitly note that the score is self-attested, NOT the certification/attestation itself.
CMMC Level 1
Voluntary framework
Foundational safeguarding the CMMC v2.0 model — 17 practices covering FCI safeguarding. Any defence sub-contractor handling FCI/CUI starts here.
CMMC Model v2.0 (L1) — 17 practices, FedRAMP-equivalent safeguarding
HIPAA
Voluntary framework
HIPAA Security Rule — 45 CFR §164.302–318. The three safeguard buckets (administrative, physical, technical) plus breach notification. No formal certification exists; HHS enforces the floor.
HIPAA Security Rule (45 CFR §164.302–318) — administrative, physical and technical safeguards; no formal certification exists
ISO 27001
Certification · self-attested
ISO/IEC 27001:2022 — Annex A controls (93, merged from 114). A readiness score is no substitute for the certification body audit that issues the certificate.
ISO/IEC 27001:2022 — Annex A controls (93, merged from 114); certification issued by an accredited certification body
NIST 800-171
Voluntary framework
14 control families for protecting Controlled Unclassified Information in nonfederal systems, the policy spine behind CMMC L2 and FedRAMP Moderate.
NIST 800-171 r3 (2024) — 14 control families, 14/14 family-weighted rubric
SOC 2
Attestation · self-attested
AICPA Trust Services Criteria — Security plus any of Availability, Confidentiality, Processing Integrity, or Privacy. A self-attested readiness score cannot grant the SOC 2 attestation itself.
AICPA TSP Section 100 (2017, updated 2022) — Trust Services Criteria (security + at least one of availability/C/PI/P)
Question 1 of 12
12 questions · 15 minutes · 5-framework shortlist
Pick the framework to score
Each framework has the same 12-question NIST-CSF-functions-tagged rubric. The picker is only the front door; results are a per-framework readiness score, gap map, and band.