Self-assessment, without grading yourself.

Automated SPRS, based on your actual evidence, not what you select. Garde1 reads the Microsoft 365, Google Workspace or AWS you already run, grades all 320 objectives, and writes your policies and SSP from what it finds. You don't need to know a thing about CMMC. First score in about 12 minutes.

Book a demoSee how it works

Start a 14-day trialNot sure which level?

At a glance
Scope
CMMC Level 2
Coverage
110 controls · 320 objectives
Documents
14 policies in about 30 minutes
Mock assessment
Results in about 12 minutes
Output
C3PAO-ready package
app.garde1.com/dashboard
Illustrative product previewsample data
Overdue Remediation for AC.L1-3.1.22
Domain Compliance Heatmap
All 14 CMMC domains by compliance level
AC73%
AT67%
AU67%
CM56%
IA36%
IR33%
MA83%
MP67%
PS50%
PE67%
RA67%
CA75%
SC56%
SI43%
0%
50%100%
Evidence Collection Progress
Track evidence gathering across all controls
Controls with Evidence91
Controls Needing Evidence19
Automated Collection84
Manual Collection7
Collection Rate83%
Assessment Summary
Last Assessment
2 days ago
SPRS 39
SPRS Score
39 +31
vs 8 at first assessment
Assessments Completed
6 ↑
since onboarding
Evidence Review
91/110
controls with evidence
C3PAO ReadinessNot readySPRS Score >= 88Required Documents (SSP, POA&M)Evidence FreshnessPOA&M Items Current

Week three of a sample tenant: 8 at the first mock, 39 now. The sample report shows the same shop at 82 after remediation. Read the report.

FCI only? CMMC Level 1 for $150 a month
Automated SPRS

Based on your actual evidence. Not what you select.

The only CMMC platform that grades all 320 objectives from evidence it collects from your systems, and computes your SPRS score from those grades. You don't need to know a thing about CMMC.

Most CMMC tools

IA.L2-3.5.3 Multifactor authenticationMet
Based on
What you selected. Your SSP says it, and you post it.
SPRS 110

Garde1

IA.L2-3.5.3 Multifactor authenticationNot Met · −5
Based on
2 admin accounts with no MFAMicrosoft Entra · collected today
Require MFA for admin rolesApprove fix
SPRS 105
320
objectives graded every run
23
connectors, read-only
SHA-256
on every collected record
0
override buttons

An example, not a customer. Fixes on Professional and up. Subject to the vendor’s API availability. “Only”: competitors' public materials, October 2026.

The choice

Three ways to get CMMC done. Only one does the work for you.

Two of them hand you the shovel. Prices are the published range or the vendor’s median contract.

Hire a consultant

$50K–$200K
Who does the work
They do, by the hour
Your documents
Their template, billed by the hour
Your SPRS score
Their opinion of their own work
What you keep
A binder that drifts the day it’s signed

Buy a checklist tool

$2K–$25K a year
Who does the work
You do
Your documents
Templates you fill in
Your SPRS score
Whatever you select
What you keep
A tracker of what you typed
From $1,999 a month
Who does the work
Garde1. You answer what no system can show and approve fixes
Your documents
Written from what your systems show
Your SPRS score
Measured from your evidence. Nothing to select, no override
What you keep
An assessor-ready package that stays current
See it on your own environment →

Consultant range: typical all-in cost of reaching Level 2 (Secureframe, Huntress, 2026). Checklist tools: FutureFeed at the low end, Drata's median contract (Vendr) at the high end.

How it runs

Five steps. Garde1 does almost all of it.

The steps marked in green are yours. Everything else is software.

  1. Scope

    Maps where CUI lives, and flags where your answers contradict what your tools show, before an assessor finds it.

    YouAnswer plain questions

  2. Connect

    Collects evidence through a catalog of 23 connectors: 5 generally available, with the rest in beta. Microsoft 365, Google Workspace and CrowdStrike are generally available; AWS and Okta are in beta.

    YouSign in once per system

  3. Fix

    Checks your settings against DISA STIG and CIS baselines, credits what Microsoft 365 and Google Workspace cover under their published responsibility matrices, and applies supported fixes once you approve them.

    YouClick approve*

  4. Document

    Writes your 14 domain policies and the SSP from your real environment. A fact it does not have is marked for you to fill, not filled in.

    YouReview and sign

  5. Prove

    Scores all 320 objectives against your evidence, computes your SPRS score, builds the POA&M and lays out every SPRS entry. When C3PAO assessments resume, it opens a portal for your assessor (Professional and up) once you reach SPRS 88.

    YouSelf-attest in SPRS

*Supported settings only, on Professional and up, subject to the vendor's API availability. Everything else comes with step-by-step instructions. See exactly what's left to you →

Pricing

Priced like software,
not consulting.

Getting to Level 2 the traditional way typically runs $50K–$200Kand 6–18 months, and every change after that is billed by the hour.

Garde1 gives you a structured software workflow that stays active continuously, before, during, and after your assessment. Only handle FCI? Level 1 is $150 a month.

Start a 14-day trial (no credit card required)

FeatureTrial
Free · 14 days
Level 1
$150/mo, billed yearly
Starter
$1,999/mo
Professional
$3,499/mo
Enterprise
Custom
Users23325Unlimited
Connectors1113Unlimited
Assessment boundaries1111Unlimited
Mock assessments / month1As evidence lands520Unlimited
DocumentsUnlimitedUnlimitedUnlimitedUnlimitedUnlimited
System Security Plan (SSP)—Not required✓✓✓
Status page you can share with primes✓✓✓✓✓
Remediation workflow———✓✓
C3PAO handoff portal—Not required—✓✓
SSO———✓✓
SCIM provisioning————✓
Audit logs✓✓✓✓✓

Starter and Professional are an annual contract, billed monthly.

Buying through your cloud commitment? Ask about Azure and AWS Marketplace.

MSP, RPO or Prime? See the partner program.

Demo

See your SPRS score this week.

Give us 30 minutes. We'll show you where you stand against all 110 requirements, what's missing, and what it costs to close the gap, using your own environment instead of a slide deck.

Book a demoSee how it works

Only handle FCI? See Level 1, $150 a monthOr start a 14-day trial

HOSTED ON FEDRAMP MODERATE AWS · ITAR-AWARE
readiness · illustrative previewsample data
61%
Ready
Pass67
Partial5
Fail19
None19
SPRS SCORE
39
CONNECTED
3
CADENCE
4 days a week
TREND
↑ improving