The score that goes to the DoD, computed rather than typed

The problem

Almost every CMMC consultant runs assessments in an Excel workbook per client. That works until it doesn't. The scoring is arithmetic in a formula nobody checks, and the score is submitted to the Department of Defense, where a wrong one means False Claims Act exposure. Then there's everything around it. The System Security Plan and the POA&M are written by hand and eat up most of an engagement's billable hours. Evidence is chased through email threads with nothing tying a document to the control it proves. Answers come from interviewing people about their configuration rather than from the configuration itself. And because each client lives in a separate workbook, a consultancy carrying twenty of them has no way to see the whole book at once.

What we built

We built a platform where one consultant login manages many client organizations, each in its own workspace, with the separation enforced in the database itself rather than only on the screen. Assessments run against the official control catalogs, 15 at Level 1 and the 110 of NIST SP 800-171 at Level 2, with verification guidance on each question and a sprint mode for working quickly. SPRS scores are computed live to the DoD's own method across its full range, including the unusual cases most spreadsheets get wrong. The catalog itself is generated from the official sources, with automated tests checking that the scoring rules always hold. A what-if simulator answers the question every client asks: fix these six controls and the score moves from here to there. POA&M tracking enforces the eligibility rules, so the tool won't let you defer a control the rules say can't be deferred. Evidence is requested from clients, tracked, and filed against the control it supports, and a Microsoft 365 collector pulls the client's actual tenant configuration so assessment questions are answered from real data. The deliverables that used to be written by hand now come straight out of the assessment: the SSP, the gap report, the POA&M, the SPRS report, the shared responsibility matrix, the asset inventory and the evidence index.

The outcome

The number submitted to the government is computed rather than entered, from a catalog generated out of official sources and checked by tests, which gives far more confidence than a formula in a workbook. Deliverables that used to take up most of an engagement now come out of the assessment data, and the consultants review them instead of writing them. Evidence comes from the client's real tenant configuration instead of an interview, which is quicker and much easier to defend in front of a third-party assessor. And because every client sits in one system with history and benchmarks, the consultancy can watch its whole book of business at once instead of opening twenty workbooks. That makes it possible to sell readiness as an ongoing service rather than selling assessments as one-off projects.