Talk to our CMMC experts

CMMC Level 2 requires organizations to implement 110 security practices from NIST SP 800-171 to protect Controlled Unclassified Information (CUI). It is mandatory for defense contractors handling CUI and, for most contracts, requires an assessment by an accredited third-party organization rather than a self-attestation alone.

Timelines vary based on your current posture, but most organizations reach CMMC Level 2 readiness in three to six months with HoundShield. The platform identifies gaps across all 110 controls instantly, provides a prioritized remediation roadmap, and tracks your SPRS score as each practice is closed.

Yes — CMMC Level 2 certification for contracts involving CUI requires an assessment by a CMMC Third-Party Assessment Organization (C3PAO). HoundShield prepares you for that assessment by running continuous self-assessments aligned to the official scoring methodology and packaging the evidence an assessor will ask to see.

The free tier includes the full 110-control CMMC self-assessment in read-only mode, a live SPRS score calculator, scanning for up to 1,000 prompts per month, and community support. Upgrading to Pro adds the AI gateway at scale, editable assessments, and SSP and POA&M generation.

Yes. Growth and Enterprise plans export audit-ready PDF reports — your System Security Plan (SSP), Plan of Action & Milestones (POA&M), and C3PAO evidence packages — while every paid plan exports JSON compliance reports. All artifacts are formatted for assessor review and carry SHA-256-signed evidence.

Prompt content never leaves your network. HoundShield scans locally: in the self-hosted Docker mode (Mode B), the CUI-safe deployment, nothing you scan is transmitted to us. The hosted trial runs on Vercel, which is not FedRAMP-authorized, so it is for non-CUI evaluation only. Audit logs are immutable and SHA-256 hash-chained, and we never train AI models on your data.