Subcontractor CMMC Tracker: send one link, see every subcontractor's SPRS score, CMMC level and expiry
Subcontractor CMMC Tracker gives a DoD prime one link to send to every subcontractor: each one enters its NIST SP 800-171 SPRS score and assessment date, CMMC level and affirmation date, whether it handles CUI, whether it can report incidents under DFARS 252.204-7012 and which frameworks it already holds, and you see a live list of every subcontractor with what expires next and what is missing.
Paste your subcontractor list, or send one link and let each subcontractor fill in its own line: SPRS score, assessment date, CMMC level and affirmation date, whether it handles CUI, whether it can report cyber incidents, and the frameworks it already holds.
You get one register: every subcontractor, what it declared, what is out of date or missing, and when each entry expires. It records what each subcontractor declares; it does not verify scores or assess anyone.
Every value is what the subcontractor reports, never read from SPRS, which a prime cannot see. A subcontractor opens the link, spends about five minutes, needs no account, and is asked nothing that is CUI. A pasted list stays in your browser unless you save it; saved registers and link answers are kept as the privacy page says.
Third-party CMMC certification was suspended on 13 July 2026 pending a review; the self-assessment, the SPRS score and the DFARS 252.204-7012 duties it rests on remain in force, and the register is built on those. As at 27 Sep 2026; what changed and what did not.
36 subcontractors, 5 with no current assessment declared, 2 handling CUI with no incident-reporting capability declared.
10 of 11 finding types raised; 18 of 36 subcontractors with none.
Paste the list, or send the link
One subcontractor per row, as it leaves the supplier spreadsheet: subcontractor | CAGE or UEI | SPRS score | assessment date | CMMC level | affirmation date and on. Or create one collection link and send it however you already write to suppliers; each answer lands in the register, and a second answer from the same subcontractor updates its line.
Read every card against the rule and the date
Each subcontractor is one card: what it declared, the date each entry stops being current by the rule behind it (three years for a Level 2 assessment, one year for Level 1 and for an affirmation, 180 days for a conditional status), and a signal at the month its next date falls.
Chase the dates, ask the questions
Eleven findings in a fixed order, each naming the subcontractors it covers, the rule sentence and its source. A finding is a date to chase or a question for the subcontracts lead; the chase list says who to ask for what.
Why a register, and not another spreadsheet of emails
A prime cannot see a subcontractor's SPRS score; it has to ask. With a hundred subcontractors the answers arrive in a hundred formats, the dates are never compared with the rule, and nobody sees the affirmation that lapsed in March until the option exercise. This keeps one card per subcontractor, reads each declared date against the sentence of the rule that sets its period, and lists who to chase before the date passes. It does not verify a score, check that a clause was flowed down, or reach lower tiers; those stay with the subcontracts lead.