— CMMC 2.0 readiness · NIST SP 800-171 · scored the way the DoD scores it

Your SPRS score, before the assessor arrives.

CMMC 2.0 Level 2 is 110 security requirements across 14 control families. TITAN connects read-only to your Microsoft 365 tenant, proves what it can prove from the tenant itself, asks you only for what a tenant cannot show, and calculates your score with the DoD Assessment Methodology: 110 points, minus 5, 3 or 1 for every requirement not met. You get the number, the gap list, the Plan of Action & Milestones and the System Security Plan outline, in one run.

— The question that decides everything

GCC High, GCC, or Commercial? It checks first.

Contractors on GCC High often assume the platform's authorization makes them compliant, and that a portal compliance score is their SPRS score. Neither is true. The platform is the biggest input to your score; it is not the score. TITAN detects which Microsoft cloud your tenant runs on, tells you plainly whether it can legally hold Controlled Unclassified Information, and only then assesses the 110 requirements across your identities, devices, logging, labelling and monitoring.

— How it works

Examine, interview, test. Automated where it can be, honest where it cannot.

01
Connect read-onlyAn app registration with read-only permissions. Nothing is written to the tenant. Works on Commercial, GCC, GCC High and DoD clouds.
02
Prove what the tenant showsMultifactor authentication and Conditional Access, privileged roles, stale and guest accounts, audit and sign-in logs, Intune baselines, device compliance and encryption, Defender alerting, Purview sensitivity labels. Each observation is mapped to the requirement it satisfies.
03
Ask only for the restPolicies, training, physical access, media handling and incident response cannot be read from a tenant. The agent writes an attestation template listing exactly those items, with the evidence an assessor will want for each.
04
Score it three waysAutomated-only, attested, and the floor if nothing else is proven. Partial-credit rules for multifactor authentication and FIPS-validated encryption are applied exactly as the methodology states. No System Security Plan on record is called out, because without one an assessment cannot be completed at all.
05
Hand over the packageReadiness report, POA&M with owners and target dates, SSP outline organised by the 14 families with a Customer Responsibility Matrix section, and a findings file the TITAN dashboards render under their CMMC 2.0 tab.

— What you get

Everything the assessor asks for, already written.

Score

SPRS number you can defend

Calculated with the DoD methodology, requirement by requirement, with the evidence behind every point kept or lost.

Gap list

Plan of Action & Milestones

Every requirement not met or not yet proven, with what was observed, what to do, and columns for owner and target date.

Document

System Security Plan outline

All 14 families, all 110 requirements, current implementation statement per requirement, and the inherited-from-Microsoft section to complete.

Dashboards

CMMC 2.0 tab, live

The same findings appear in the Command Center and in any CANVAS dashboard, grouped by the 14 control families, critical first.

Re-run

Watch the score move

Close a gap, run again, see the points come back. Monthly runs keep the SPRS entry current, as the DFARS clauses require.

Straight talk

Readiness, not certification

This takes you to a strong, defensible self-assessment posture. The formal Level 2 certification is performed by a C3PAO; you arrive prepared.