Level 1
The 15 basic safeguarding requirements from FAR 52.204-21. A self-assessment and an affirmation every year.
CMMC Compliance Software
CMMC compliance software
for the years between assessments.
Your assessment proves where you stood on one day. CMMC then asks you to affirm, every year, that it is still true. Fettle keeps the training, recurring reviews, signed policies, and evidence behind each practice current, and shows you what was on file on any date.
Levels 1, 2 & 3Mapped out of the box
800-171A objectivesCoverage per objective
Any past dateWhat was on file
What CMMC asks of you
Passing is the start of the cycle, not the end.
Every level carries obligations that recur after the assessor leaves. These are the ones Fettle is built around.
Level 2
The 110 requirements of NIST SP 800-171 Rev 2. A self-assessment or C3PAO assessment every three years, an affirmation every year, and 180 days to close any open POA&M items.
Level 3
24 more requirements from NIST SP 800-172, assessed by DIBCAC every three years, on top of a Level 2 certification.
Where Fettle fits
Each piece on a schedule, with its proof.
The work that keeps a CMMC status true is mostly recurring, mostly owned by people, and easy to let slip. Fettle puts each piece on a schedule and keeps the proof with it.
Training that expires
Awareness, role-based, and insider threat training tracked per person, with alerts to them and their manager before anything lapses.
Periodic practices on a fixed schedule
Risk assessments, control assessments, access reviews, SSP updates: each one a recurring review with an owner, a due date, and its evidence on file. Finishing one late doesn’t push the next one back.
Policies and procedures, signed
Controlled documents approved and signed in Fettle, with every approved version kept exactly as it was signed.
Evidence mapped to practices
Link each review and document to the practices and 800-171A objectives it supports. Coverage shows, family by family, which ones have an artifact behind them.
Shared responsibility, written down
Mark an objective as inherited or shared and name who carries it (your MSP, your cloud provider), so the practices you own are the ones on your list.
Your record on the affirmation date
Report on any past date: which reviews were done on schedule, which training was current, and which documents were signed, as of the day your official affirms.
The annual affirmation
Someone signs that you’re still compliant. Every year.
Each year a senior official at your company affirms in SPRS that you continue to meet the requirements of your level. That is a statement about today, not about the day you passed.
Fettle doesn’t file the affirmation. It gives the person who does a dated record to sign against: what was done, by whom, and when, with the evidence attached.
What Fettle doesn’t do
Fettle is the evidence and personnel layer underneath your other compliance tools, not a replacement for them.
- Fettle does not write your System Security Plan, manage your POA&M, or calculate or submit a SPRS score.
- It does not scan your systems or test technical controls.
- It is not FedRAMP authorized and does not accept CUI. Your CUI stays in the enclave you built for it.
- It never says a requirement is met. It shows whether an artifact is on file; whether that satisfies the requirement is your assessor’s call.
FAQ
Common questions
What Fettle does for CMMC, and where it stops.
Still have a question? Get in touch or book a demo.
Does Fettle make us CMMC compliant?
No software can. You become compliant by implementing the practices, and an assessor decides whether you have. Fettle keeps the recurring work behind those practices on schedule, keeps the evidence on file, and shows which practices and objectives have an artifact behind them, so nothing quietly lapses between assessments.
Which CMMC levels does Fettle cover?
Levels 1, 2, and 3. Level 2 coverage goes down to the NIST SP 800-171A assessment objectives, and you can mark each objective as owned, shared, inherited from a provider, or not applicable. You can also define custom frameworks for anything CMMC does not cover.
Does Fettle file our annual affirmation?
No. Your affirming official submits the affirmation in SPRS. Fettle gives that person a dated record to affirm against: which reviews were completed on schedule, which training was current, and which documents were signed, as of the date they affirm.
Does Fettle replace our SSP or POA&M tool?
No. Fettle does not author a System Security Plan, manage a POA&M, or calculate and submit a SPRS score. It is the evidence and personnel layer underneath those tools: who holds what training, which reviews are on schedule, which documents are signed, and what all of that looked like on any date.
Can Fettle store CUI?
No. Fettle is not FedRAMP authorized and does not accept Controlled Unclassified Information. What it holds is the compliance record itself: training completions, review cycles, signed procedures, and coverage, which is almost never CUI.
Can we check where we stand before signing up?
Yes. The free Drift Check reads your CMMC Level 2 evidence register and shows what is overdue, coming due, unowned, or missing proof against your own intervals. It runs entirely in your browser; nothing is uploaded.
See where your Level 2 evidence stands today.
The free Drift Check compares your evidence register to your own intervals and shows what has gone stale. It runs in your browser; nothing is uploaded.