Subcontractor CMMC Tracker: send one link, see every subcontractor's SPRS score, CMMC level and expiry
Subcontractor CMMC Tracker gives a DoD prime one link to send to every subcontractor: each one enters its NIST SP 800-171 SPRS score and assessment date, CMMC level and affirmation date, whether it handles CUI, whether it can report incidents under DFARS 252.204-7012 and which frameworks it already holds, and you see a live list of every subcontractor with what expires next and what is missing.
Paste your subcontractor list, or send one link and let each subcontractor fill in its own line: SPRS score, assessment date, CMMC level and affirmation date, whether it handles CUI, whether it can report cyber incidents, and the frameworks it already holds.
You get one register: every subcontractor, what it declared, what is out of date or missing, and when each entry expires. It records what each subcontractor declares; it does not verify scores or assess anyone.
Every value is what the subcontractor reports, never read from SPRS, which a prime cannot see. A subcontractor opens the link, spends about five minutes, needs no account, and is asked nothing that is CUI. A pasted list stays in your browser unless you save it; saved registers and link answers are kept as the privacy page says.
Third-party CMMC certification was suspended on 13 July 2026 pending a review; the self-assessment, the SPRS score and the DFARS 252.204-7012 duties it rests on remain in force, and the register is built on those. As at 27 Sep 2026; what changed and what did not.
34 subcontractors on 36 lines, 6 with no current assessment declared, 2 with CUI involved and no incident-reporting capability declared.
11 of 12 finding types raised; 18 of 36 lines with none.
Paste the list, or send the link
One line per subcontractor system, as it leaves the supplier spreadsheet: subcontractor | CAGE or UEI | CMMC UID | SPRS score | SPRS assessment date | CMMC level | CMMC status | status date and on. A CMMC status belongs to an information system, so a subcontractor with two systems has two lines. Or create one collection link and send it however you already write to suppliers; each answer lands in the register, and a second answer for the same system updates its line.
Read every card against the rule and the date
Each line is one card: what the subcontractor declared, the SPRS score and the CMMC status kept apart, the date each entry stops being current by the rule behind it (three years for the SPRS assessment and a final Level 2 status, one year for Level 1 and for an affirmation, 180 days for a conditional status), and a signal at the month its next date falls.
Chase the dates, ask the questions
Twelve findings in a fixed order, each naming the subcontractors it covers, the rule sentence and its source. A finding is a date to chase or a question for the subcontracts lead; the chase list says who to ask for what, and a short email draft per finding is ready to send.
Why a register, and not another spreadsheet of emails
A prime cannot see a subcontractor's SPRS score; it has to ask. With a hundred subcontractors the answers arrive in a hundred formats, the dates are never compared with the rule, and nobody sees the affirmation that lapsed in March until the option exercise. This keeps one card per subcontractor, reads each declared date against the sentence of the rule that sets its period, and lists who to chase before the date passes. It does not verify a score, check that a clause was flowed down, or reach lower tiers; those stay with the subcontracts lead, who can mark each line reviewed or accepted in the register.