Self-attestation moved the liability rather than removing it. A score you submitted and cannot reproduce is not an administrative gap - it is a False Claims Act exposure, and enforcement has already started.
actions have already been brought against contractors whose SPRS scores were found inaccurate, including the first against a subcontractor. IBSS Corp
CMMC Phase 1 took effect, putting Level 1 and Level 2 self-assessment requirements into DoD solicitations. It is unaffected by what happened next. Crowell & Moring, client alert
Phase 2 - the third-party C3PAO certification that was to enter contracts on Nov 10, 2026 - was suspended on July 13, 2026, pending a 60-day reform review. Self-assessment, and DFARS 252.204-7012, are what you are held to in the meantime. Crowell & Moring, client alert
many solicitations already require a submitted SPRS score for eligibility, especially at Level 2. IBSS Corp
The suspension of mandatory certification is not relief. It leaves you attesting to your own score under DoD enforcement and government-led checks, which means the arithmetic behind that number has to be reproducible on demand by someone other than the person who produced it.
Six that close the biggest gaps. 5 in the full compliance and risk library.
The gap it closes. Applies the exact DoD weights per control so the submitted score can be reproduced, control by control, by someone who did not compute it.
See it run in your browser →The gap it closes. Structuring detection is threshold arithmetic over a window. Getting the window wrong is how a pattern is missed or a false report is filed.
See it run in your browser →The gap it closes. Sample size follows from population, control frequency and tolerable deviation. A number chosen by habit is the finding an inspector writes up.
See it run in your browser →The gap it closes. A first-digit screen over figures you already hold, which flags where to look without accusing anyone of anything.
See it run in your browser →The gap it closes. Retention is per lawful basis and per category, so one organisation-wide period is almost always wrong in both directions at once.
See it run in your browser →Not legal, audit or compliance advice, and no substitute for your assessor, counsel, or a C3PAO. These compute published scoring rules and sampling methods over inputs you supply and show every intermediate figure, which is what makes a submitted number defensible. Confirming that a rule version is current for your obligation remains yours.
Every tool above runs entirely in this browser tab. Nothing is uploaded, nothing is sent to a model, and each result cites the rule it applied.
Free tier, no card, no install. An account saves your work and lets you export a citable record of a run. See all 5 compliance and risk tools.