Answer a guided interview. Walk away with a readiness score, a prioritized list of gaps, and a draft System Security Plan. Built for small defense contractors.
Most options cost too much or do too little. Here's how Baseline fits.
A Registered Practitioner drafts your SSP. Quality varies. You wait three to six months.
Download the NIST template. Stare at 110 blank narratives. Hope you got it right.
Enterprise software built for primes with security teams. Overbuilt for the small end.
A guided interview. A readiness score. A ranked gap list. An SSP draft based on your environment.
A structured interview, a clear diagnostic, and the documentation your team needs to move forward.
A guided interview walks you through your tools, team, and processes. Plain English, no jargon, with hover-definitions for any term you don't know.
~60 min totalThe moment you finish, your answers are scored against the framework. You see exactly which controls you meet, where you fall short, and what to focus on first.
Generated in minutesThe drafts your assessor will ask for, generated from your answers and traceable back to them. Ready for your team to review, refine, and submit.
Same-day outputA look at the actual interview interface — what your team will fill out, in plain English. Three real moments from the flow, in sequence.
Multiple-choice questions handle the structured parts of your environment — tools, platforms, configurations. With descriptions on every option so you don't need to be a security expert.
Open-ended questions capture the things only you know — your processes, your roles, your edge cases. Plain English, with example answers shown to guide you.
A summary screen lets you review and edit before generation. Nothing is locked — change anything that doesn't reflect your environment, then continue.
The interview takes about an hour. Auto-saves as you go. Pause and resume anytime.
Try the interview →A score against all 110 controls based on your answers, with a ranked list of gaps to address. The first thing you want before you talk to an assessor.
110 control narratives drafted from your answers. Designed for review by you or your RP before submission.
A POA&M scaffold populated with your identified gaps. You add the remediation owners, timelines, and resources that fit your team.
A starting visual of your CUI environment scope, generated from your interview answers.
A worksheet for your SPRS submission, plus a checklist of artifacts assessors typically request.
Every narrative is structured around NIST 800-171 expectations and tagged back to the interview answers that produced it — so you know what to verify before submission.
There's no tool — and no consultant — that can guarantee an assessment outcome. Your assessor is evaluating your actual environment, not just your document. What Baseline does is tell you, before you ever meet an assessor, where you're strong and where you're exposed. The readiness report scores all 110 controls and flags assessment risk; the SSP narratives are tagged with confidence flags so you know which sections need human review.
Those platforms are priced for mid-market and enterprise — typically $15–30k/year. We're built for the small end. Diagnostic, SSP, and remediation roadmap from a single guided interview, not a platform you configure for months before it produces output.
You'd get generic narratives that don't match assessor expectations. The work isn't "write me an SSP" — it's the structured interview, the diagnostic scoring, the mapping to all 110 controls, and the orchestration that keeps your output internally consistent and traceable. The IRS publishes every tax form for free; TurboTax charges $100 because someone figured out the right questions to ask.
No — intentionally. The interview captures descriptions of how you handle CUI, never CUI itself. You can use Baseline without bringing us into your CMMC assessment boundary.
Baseline is currently optimized for small defense contractors with relatively standard cloud-based environments — typically 10 to 50 employees, primarily working in Microsoft 365 GCC High, providing software or professional services to DoD customers. If your environment fits that profile, the generated documentation will closely match how your business actually operates.
If your environment is substantially different — heavy on-premises infrastructure, manufacturing or industrial control systems, classified networks, or specialized regulated workloads — the generated draft will need more revision to reflect your reality. The interview will still produce useful starting documentation, but you'll likely want a Registered Practitioner to refine sections that fall outside the standard archetype. We're working to expand support for more environment types over time.
One hour of questions. A readiness report in minutes. An SSP draft the same day, ready for your review.