The 800-171 Workbench: Every Feature

Why This Software Exists

Roughly 80,000 DoD contractors — most of them small machine shops, engineering firms, and subcontractors — now face CMMC requirements flowing into their contracts. The standard tooling for a self-assessment is a NIST Excel spreadsheet; the alternative is an enterprise GRC platform that costs thousands per year, requires accounts, and puts your compliance data on someone else's servers.

That data deserves more caution than that. An SSP and POA&M are literally a map of your security weaknesses. This tool takes a third path: an assessor-grade workflow that runs entirely on your device — no cloud, no account, no telemetry.

It exists because Neal Fennimore, a Lead Certified CMMC Assessor, needed it himself. He has gotten companies ready for assessments, and nothing on the market matched his criteria: he did not want to live in spreadsheets, and he did not want someone else owning the data. So he built the tool that did — and this is it.

Framework Coverage

• Full NIST SP 800-171 Rev 2 and Rev 3 support — all 14 families and 110 requirements, with a one-click revision toggle in the nav that smart-jumps to the matching control in the other revision
• Rev 2 → Rev 3 transition built in — withdrawn Rev 2 controls render with "Withdrawn Into…" alerts linking to their Rev 3 replacements, so you can document against today's CMMC baseline while getting ahead of the Rev 3 move
• Authoritative sourcing — framework data comes from NIST's own CPRT export, and every requirement links back to its CPRT entry

Implementation Tracking & Scoring

• Per-requirement status — Implemented / Partially Implemented / Not Implemented / N/A / Not Started, with free-form markdown notes on every control
• Live SPRS score — updates as you work, including an estimated Rev 3 score that maps withdrawn Rev 2 control point values into their Rev 3 replacements — a genuinely uncommon capability
• POA&M-ability flags per control — know which unmet requirements can be deferred to a POA&M and which are hard blockers for Level 2 certification
• At-a-glance rollups — status and evidence icons cascade from control to requirement to family, plus a collapsible overview tree of the entire framework

Assessment Guidance (Rev 2)

See your controls the way an assessor will. Every Rev 2 requirement includes the official assessment guidance from the current CMMC Assessment Guide – Level 2 (Version 2.13) — the same document C3PAO assessors apply under today's CMMC Assessment Process.

• Built-in per-requirement guidance — the assessor's discussion and worked examples, the three assessment methods (Examine / Interview / Test) with definitions, the questions an assessor is likely to ask, and key NIST and FAR citations
• The exact evidence types assessors examine — each requirement lists the artifacts an assessor will look to examine, with an interactive checklist to track what you've collected: an "Examine 3/15" progress badge per requirement, and evidence you tag auto-checks the matching checklist items
• Verifiable sourcing — each guidance panel cites and links its source, so you can check it against the DoD publication itself

Evidence Management

• Attach evidence to any requirement — drag-and-drop file upload, clipboard paste, and URL attachments
• Rich previews — hover previews for images, multi-page PDFs, CSV and XLSX rendered as tables, plus text, JSON, and code
• Tag once, attach everywhere — one policy document often satisfies dozens of controls; tag an artifact as a shared evidence type (like your System Security Plan or access-control policy) and it's instantly attached to every control whose assessment guidance calls for that document — no repetitive per-control uploading
• Shared evidence — link one artifact to multiple requirements; rename, replace, or delete with sensible prompts when the artifact is shared
• Painless version updates — when a policy or document gets a new version, replace the artifact once and every control it supports is current; keeping your SSP up to date means updating only the evidence that actually changed
• SHA-256 content hashing — every artifact is hashed for integrity — the same way an assessor verifies evidence — with deduplication of identical files
• Evidence table — one screen showing every artifact across the whole assessment, with filtering by type, search by filename or hash, and sorting
• Evidence map export (JSON) — a two-way index of artifacts and the requirements they support, with hashes, ready to hand to an assessor
• Bulk evidence export — folder-based export on desktop

Reporting & Data Portability

• System Security Plan generation — a markdown SSP covering every status and note, with optional embedded evidence
• POA&M generation — a spreadsheet-ready CSV gap list with standard POA&M columns
• Full database export/import — versioned JSON for backup, archival, or moving between web and desktop
• Nothing is ever gated on export — SSP, POA&M, evidence, and database exports are complete on both the free and desktop tiers; your data is never trapped

Privacy & Deployment

• 100% client-side — all data lives in IndexedDB on your device; no servers, no accounts, no analytics, no tracking, no cloud. The desktop app's only external calls are an occasional license-status check and a check for new updates, which install only with your permission — your assessment data is never part of either
• Works fully offline — an installable PWA in the browser, or a native desktop app for macOS (Intel + Apple Silicon), Windows, and Linux with installers, native file dialogs, system-browser link handling, and updates that install only with your permission
• Guided tour — an interactive walkthrough on first visit, restartable anytime
• Air-gap-ready licensing — desktop licensing supports offline verification, and machines that can never go online activate with a signed license certificate file (see how); on an air-gapped machine, the app makes no external calls at all
• Open source — inspect the code on GitHub

Who It's For

• Small DoD contractors and subcontractors doing CMMC Level 1 self-assessments — all 17 practices completely free in the browser, including full reports
• Contractors pursuing Level 2 — the desktop app covers all 110 requirements with SPRS scoring and assessment guidance, priced for small businesses rather than enterprise GRC budgets
• Consultants, Registered Practitioners (RPs), and Registered Provider Organizations (RPOs) who want a portable, private workspace per client — each engagement is a single JSON file, and every client gets a consistent, easily updatable SSP refreshed by replacing only the evidence that changed
• Security-conscious and air-gapped shops that categorically can't put compliance data in a SaaS tool

Frequently Asked Questions