Welcome to Concura.AI
A product of Consultant Works, LLC
We are preparing to enter our beta testing phase where the regular pricing will be significantly reduced for those who opt in as beta testers. We are also looking for Assessors who can contribute to our content library.
Limited Beta Tester Spots Available - Inquire NowTwelve questions a Lead Assessor would ask before agreeing to your assessment date. Get your readiness score and a realistic recommended date — free, no sign-up.
Check your readiness →Under 32 CFR Part 170, a CMMC Level 2 self-assessment means assessing all 320 objectives by the NIST SP 800-171A methods, posting a defensible score to SPRS, closing any POA&M within 180 days, and retaining the evidence for six years. Our Lead Assessors recommend going one step further than the rule requires: hash and seal your artifacts the way certification assessments must — it's the strongest defense a self-attested score can have.
The Concura Level 2 Self-Assessment is that event in a tool: objective-level determinations with Lead Assessor guidance, SPRS scoring, POA&M tracking, and evidence hashing — built by assessors with 100+ assessments behind them.
Free guide: how to conduct your self-assessment → See the Self-Assessment tool →Concura.AI offers practical and expert level explanations of CMMC controls, built so you can be confident in your compliance posture.
Why Concura.AI?
- Controls explained from the point of view of our experienced CMMC assessors
- Evidence & artifact templates
- Constantly updated to help your SSP and documentation stay correct.
A 25-slide transition briefing from our Lead Assessors: what actually changed between Rev 2 and Rev 3, what it means for how assessments are conducted, and what organizations should build first. Every numbered claim traces to NIST primary sources. Free, no sign-up.
Quick brief — the whole Rev 2 → Rev 3 story on one page (click to expand)
Two clocks — where things stand
- NIST: Rev 3 + 800-171A Rev 3 final 2024-05-14; Rev 2 and the 2018 800-171A withdrawn the same day.
- DoD: Class Deviation 2024-O0013 pins DFARS 252.204-7012 to Rev 2; the CMMC rules (32 CFR 170 + 48 CFR) incorporate Rev 2; still in effect.
- 2026-07-13: CMMC Phases 2–4 suspended pending a task-force review (RFI due 2026-08-14). Phase 1 + the 7012 obligation continue.
- SPRS: still the 110-point Rev 2 methodology. No Rev 3 scoring methodology exists.
- Bottom line: nobody is CMMC-assessed on Rev 3 today — but Rev 3 is arriving via the civilian FAR first (proposed FAR Part 40 CUI rule requires Rev 3 + DoD's parameter values), and DoD published its Rev 3 parameter values in April 2025.
The shape of the standard
- 110 → 97 requirements (19 new; 33 withdrawn slots keep their numbers); 14 → 17 families (+ Planning, System & Services Acquisition, Supply Chain Risk Management); IDs gain leading zeros (3.1.1 → 03.01.01).
- Basic/derived distinction gone; NFO tailoring gone — former NFO controls became real, assessable requirements.
- ~320 → ~422 determination statements: fewer requirements, roughly 30% more determinations.
ODPs — the biggest conceptual change
- Roughly 50 of 97 requirements are completed by organization-defined parameters — and once specified, the values become part of the requirement. Assessment step zero: “show me your ODP register.”
| 03.01.08 lockout | at most 5 consecutive invalid attempts |
| 03.01.10 device lock | at most 15 minutes of inactivity |
| 03.05.07 passwords | 16-character minimum |
| 03.11.02 remediation | 30d high / 90d moderate / 180d low |
| 03.13.11 cryptography | FIPS-validated cryptography |
Hardened floors
- MFA on all accounts including local non-privileged (03.05.03); software allowlisting mandatory (03.04.08); cryptography for CUI in transmission AND storage (03.13.08); backup encryption explicit for the first time (03.08.09); wiring closets in scope (03.10.08); termination gets a defined disablement clock (03.09.02).
- 03.13.11 moves FIPS into the parameter — not a relaxation for the DIB: DoD re-pins FIPS-validated.
What got lighter (don’t mark down modernity)
- Password reuse and temporary-password rules: gone, no successor (modern 800-63 alignment; screening against compromised-password lists replaces rotation). Identifier-inactivity disable, the VoIP control, and standalone split tunneling: gone.
Three new families + new evidence
- Planning: policies/procedures now assessable; a prescriptive SSP content spec; rules of behavior with signed acknowledgement before access.
- Acquisition: unsupported-component replacement; external services — flow requirements to providers, document shared responsibility, monitor ongoing compliance.
- Supply chain: a real SCRM plan, SCRM-aware procurement, a weakness process — procurement joins the assessment for the first time.
- New artifact classes throughout: component inventory, CUI location documentation, incident response plan and training records, information-exchange agreements, retention schedule, EOL register, shared-responsibility matrix, the ODP register.
Pick any of the 320 CMMC Level 2 assessment objectives and read what our Lead Assessors look for. One objective per day, free — there are 320 of them.