Skip to content

Are you assessment ready?

Twelve questions a Lead Assessor would ask before agreeing to your assessment date — third-party or self-assessment. Answer honestly: your readiness percentage tells you where you stand, and the math shows the assessment date each level of reschedule risk supports. Set your tolerance for reschedule risk with the slider — the risk that the assessment date slips — and the date math scales with it — a 0–100% scale across five levels (Very Low to Very High) modeled on NIST SP 800-30. The safest reading is the date most likely to hold under a conservative review; earlier dates trade reschedule risk for calendar. Free, no sign-up. Your answers are saved on this device so you can pick up where you left off; we keep anonymous usage statistics and use Google Analytics for site traffic, and no name or email is collected unless you ask for your results by email below. Signed-in Concura subscribers also get saved history across devices.

Before you start: this checker is an assessor's-eye estimate — not an assessment, not a promise of readiness, and not a guarantee of outcome. Real assessments can slip for reasons no checklist can see, and an OSC can turn out not to be ready on its planned date even when the numbers here look good. You use this tool and the dates it shows at your own risk; Consultant Works, LLC (Concura.AI) is not responsible for scheduling decisions, assessment outcomes, or costs that follow from them.
How hard will you drive remediation?
Readiness percentage0%
Recommended date — the safest reading
Date at this risk level
Vs the recommended date
Answer the questions for a verdict
Reschedule risk: 0% — Very Low (the recommended date)
← Higher reschedule risk — earlier dateExtra buffer — later than recommended →
You start on the recommended date. Try it: every step moves the date one week — left to test earlier, riskier dates, right to add buffer. The risk, colors, and verdict update as you move.
Readiness percentage0%
Recommended date — the safest reading
Date at this risk level
Vs the recommended date
Answer the questions for a verdict
Reschedule risk: 0% — Very Low (the recommended date)
← Higher reschedule risk — earlier dateExtra buffer — later than recommended →
You start on the recommended date. Try it: every step moves the date one week — left to test earlier, riskier dates, right to add buffer. The risk, colors, and verdict update as you move.
POA&M eligibility — all 110 Level 2 requirements

Whether a NOT MET requirement can sit on a POA&M is fixed by regulation (32 CFR 170.21) — it is not assessor discretion. A Conditional Level 2 status requires a score of at least 88 out of 110 and every NOT MET requirement to be POA&M-eligible: one ineligible requirement NOT MET means no conditional status, whatever the score. 62 of the 110 requirements are not POA&M-eligible. SC.L2-3.13.11 (FIPS-validated cryptography) is eligible only when cryptography is employed but not FIPS-validated (scored at 3) — not when it is missing (scored at 5). POA&M items must be closed out within 180 days of the assessment — closeout is an assessment of those items, not a paperwork step.

3.1.3 · 1 POA&M-eligible if NOT MET 3.1.1 · 5 not eligible — must be MET 3.13.11 · 3/5 conditional (see above)
The number on each chip is the DoD Assessment Methodology point value deducted while the requirement is NOT MET. 3/5 = value depends on implementation scope; – = 3.12.4 has no point value (without a system security plan, no score can be calculated at all).


This checker gives you an assessor's-eye first read — it is not an assessment and not a guarantee of outcome. Questions are classed by what a miss actually costs: gating and maturity items are work or calendar that must land before an assessment can succeed, so they set your recommended date; assurance items carry no remediation runway at all and move only the reschedule-risk index. That index combines what is open with how much runway you cut below the safest reading (a 0–100% scale across five levels modeled on NIST SP 800-30) — so it reflects your answers, not the slider position. Questions about your result? Talk to a senior assessor.