ISO 27001:2022 Readiness Assessment

⚠️ Important: This tool is for internal gap analysis only — not a substitute for a formal CMMC C3PAO assessment. Rev 2 SPRS weights reflect the DoD Assessment Methodology; verify against the current NIST SP 800-171 DoD Assessment Methodology before SPRS submission. Rev 3 controls are based on NIST SP 800-171r3 (finalized May 2024); DoD has not yet adopted Rev 3 for CMMC — Rev 2 applies to all DFARS/CMMC contracts as of 2026. Rev 3 ODP values (marked ODP) must be defined by your organization.