No cybersecurity background required. Plain English questions, plain English answers. Verdiex turns what you know about your business into a complete CMMC Level 2 System Security Plan.
Verdiex prepares you for CMMC assessment. Formal certification is performed by a C3PAO (Certified Third Party Assessment Organization). We do not certify anyone.
A five-screen setup wizard captures your company profile: what you do, how many employees you have, the types of DoD contracts you hold, which categories of Controlled Unclassified Information (CUI) you handle, and how many information systems are in scope.
Based on your answers, Verdiex flags whether you need Level 1 self attestation (17 controls) or Level 2 third party assessment (all 110 controls, C3PAO required). If you already know your level, the scoping just confirms it and you move on.
70 to 90 plain English questions covering all 14 NIST SP 800-171 control families. Each question maps directly to one or more of the 110 controls. You are never asked a question that does not have a clear purpose.
The questionnaire saves automatically after every answer. Close the browser and pick up where you left off. Most small contractors complete the questionnaire in two to four focused work sessions. You do not need to finish in one sitting.
As you answer the questionnaire, Verdiex builds your System Security Plan in the background. Your answers become implementation statements for each of the 110 controls. The SSP is structured in the format DoD expects from a System Security Plan document.
Every control is editable. The automatically generated text is a starting point; add specifics about your environment, attach evidence, and refine the language until it accurately reflects your actual implementation. When you are done, export to Word or PDF for your C3PAO.
Your Supplier Performance Risk System (SPRS) score is calculated automatically from your control responses, using the DoD methodology. The score runs from negative 203 to positive 110. You are required to submit this score to the DoD SPRS system.
The score is broken down by control family so you can see exactly which domains are driving gaps. A "projected score after POA&M completion" view shows you what your score would be once planned remediation is done.
The evidence vault organizes your supporting documentation by control family. Attach policies, screenshots, configuration exports, or any other artifacts that demonstrate a control is implemented. Your C3PAO will want to see this evidence during assessment.
Any control that is not fully implemented generates a POA&M (Plan of Action and Milestones) entry automatically. Assign due dates, owners, and remediation steps. As gaps close, your SPRS score updates in real time.
Join the early access list. We will email you when the product opens and walk you through your first SSP draft.
Free trial on every plan. No card required.