About CMMCAssessment.ai
CMMCAssessment.ai is Hatty AI’s resource for defense contractors working through CMMC and NIST SP 800-171. It exists because the obligations are spread across contract clauses, federal regulations, NIST publications and a program that changed several times in two years, and most small and mid-sized contractors do not have someone whose job is to translate all of that into a plan.
The site is operated by Hatty AI (Hatty Tech LLC). Everything published here, from the guides to the SPRS calculator and templates, is free to use and ungated.
What we do
Our work is readiness. We help contractors work out which clauses apply to them, where their FCI and CUI actually live, how they score against the 110 NIST SP 800-171 requirements, and what to fix first. The engagements that follow from that are:
- CMMC readiness assessments, which scope the boundary and produce an SSP, POA&M and evidence package.
- CMMC gap assessments, which score all 110 requirements at objective level and order the remediation.
- CMMC managed services, which keep the documentation, evidence and score accurate after the project ends.
What we do not claim
We are not a C3PAO and we do not perform certification assessments. We do not present credentials we do not hold, and we do not sell certification. The third-party Level 2 assessment layer was suspended in July 2026, so anyone offering to certify you today is selling something that does not currently exist. The program status page explains what changed and what still applies.
That distinction is deliberate. A readiness provider that also certified would be marking its own work. We would rather tell you plainly where you stand and leave the formal judgment to the people authorized to make it.
How we approach compliance
- Contracts before controls. Scope is decided by the clauses in your contracts and the information you receive, not by your industry. We read the clauses first.
- Boundary before budget. Where CUI enters and comes to rest decides what everything else costs. A boundary drawn too wide makes compliance unaffordable; one drawn too narrow leaves CUI outside your controls.
- Objectives, not headlines. Assessors test the 320 objectives in NIST SP 800-171A, not the 110 requirement titles. We score at that level, which is why our numbers usually come in lower than a self-assessment, and why they hold up.
- Points per unit of effort. Remediation is ordered by how much each fix moves the score against what it costs, so the first work you do matters most.
How the guidance is written
Every page on this site is built from primary sources: the DFARS clauses, 32 CFR Part 170, 32 CFR Part 2002, the NARA CUI Registry, NIST SP 800-171, 800-171A and 800-172, and the DoD Assessment Methodology. Where the program is changing, the dated detail lives on the program status page so the evergreen guides stay stable.
Pages are written to answer one question each, with facts that appear nowhere else on the site. If you find something wrong or out of date, tell us and we will correct it.
Why a dedicated site
Hatty AI works across marketing, analytics and AI for a range of clients. CMMC is different enough to deserve its own home: the audience is specific, the stakes are contractual, and the guidance has to be precise. Keeping it on a dedicated site lets us publish reference material that is narrow and accurate, rather than general content written to suit everyone.
It also lets us keep the free resources genuinely free. The calculator, templates and guides are not lead magnets with the useful part held back. If they answer your question without a conversation, that is a good outcome.
Who we work with
Most of the organizations we help are small and mid-sized defense suppliers: manufacturers, engineering and construction firms, IT providers, and subcontractors who have received a flow-down clause or a supplier questionnaire for the first time. If that sounds like you, the clause-by-clause test is a good first step, and the SPRS score calculator will give you a rough number in about ten minutes.
Contact
You can reach us through the contact page or by phone at 877-428-8924. We reply to every enquiry within one business day. Please do not send controlled information through the web form or by unencrypted email.
Frequently asked questions
Who operates CMMCAssessment.ai?
Hatty AI, operated by Hatty Tech LLC. The site is Hatty AI’s dedicated resource for CMMC and NIST SP 800-171 readiness.
Are you a C3PAO?
No. We do not conduct certification assessments and we do not claim assessor credentials. Our work is readiness: scoping, scoring, documentation, evidence and remediation planning before a customer or assessor reviews you.
Can you certify my company?
No one can at the moment for Level 2 third-party certification, because that layer was suspended in July 2026. Even when it resumes, certification is performed by an authorized C3PAO, not by a readiness provider.