CMMC and NIST SP 800-171 training · self-paced

Sort your CUI. Draw the boundary. Score all 110 the way an assessor does.

Taught by Will Trikha, third-party registrar auditor.

Sort FCI from CUI, read the clauses your contracts carry, scope a tight enclave and grade yourself against the 320 assessment objectives. Then post an SPRS score your evidence backs, with Coach Q beside you.

Quality managers, compliance officers and IT leads at defense manufacturers that hold FCI or CUI, including the person who just got handed CMMC.

See everything you get ↓ Lessons for life · coach included, no renewal fee

About 7.5 hours
Self-paced
Private AI coach
Certificate of completion

Lesson 1 of CMMC and NIST 800-171, a real screen from the course — Real screen from this courseLesson 1 is free

Sound familiar?

Somebody still has to sign the score.

Do we even hold CUI?

If nobody knows, nobody can scope, score or price the work. A missing CUI banner doesn't settle it: a drawing with military application can be CTI even with no marking on it. The course sorts public, FCI and CUI first, because FCI alone means 15 requirements and any CUI means all 110.

Phase 2 got suspended. Can we stop?

No. Phase 1 is still in force: NIST SP 800-171, your SPRS score, the annual affirmation and DFARS 252.204-7012 all still apply. The suspension changed who checks the work on new awards, not the work.

IT marked everything MET in one afternoon.

A perfect score in an afternoon is a finding waiting to happen. One failed objective fails the whole requirement, and there's no partial credit. You'll grade the 320 objectives the way an assessor does: examine the record, interview the people, test the control.

Just have the AI fill in the self-assessment.

It will, and it'll sound sure, even on a requirement with no evidence behind it. CUI and technical data never go into an AI tool, Coach Q included. Your Affirming Official signs for the score, so a person has to check every line.

What it does for you

Be the person who can stand behind the score.

The one leadership trusts with CUI

When a prime asks for your score in writing, you'll know what it rests on and what it doesn't.

A plan, not a panic

You'll turn 110 requirements into a scoped boundary, a ranked list of gaps and an SSP you started. That's how a compliance owner earns trust.

Proof on your record

A certificate of completion anyone can verify, for your training record and your LinkedIn.

No course can promise you a raise or a title. What you'll have is the skill, the work to show for it and a certificate anyone can verify. That's what those conversations run on.

Why it matters

The risk isn't a low score. It's one you can't back up.

$4.6M

In March 2025, defense contractor MORSECORP agreed to pay $4.6M to resolve False Claims Act allegations; it had reported a NIST SP 800-171 score of 104, and a consultant later told it the score was actually minus 142.

Source: U.S. Department of Justice, March 26, 2025

Your SPRS score is a statement of fact to the government, and a senior official affirms it every year. In that case, the score wasn't updated in DoD's system until three months after a subpoena. An honest low score is a project plan. An inflated one is a signed liability.

Phase 2 was suspended on July 13, 2026. Phase 1 wasn't, and DFARS 252.204-7012, the score and the annual affirmation all still apply. Your prime can't open your SPRS record, so it asks for the score and status in writing, and what you send has to match what's posted.

What you'll learn

All 110 requirements, the way an assessor reads them.

In the order the work happens: sort the data, read the contract, learn the requirements, draw the boundary, score it, sign it, then decide on an assessment. Every control is explained in quality terms: travelers, ECOs, gage lists and CAPA.

01Module 1 · The mandate

Know what you hold and what each contract requires

Start where an assessor starts, with the information and the contract. You sort every item into public, FCI or CUI, search a solicitation for the clauses that set your duties, and find the level each contract demands. Then you see exactly what the Phase 2 suspension changed, and what it didn't.

Content and contract, not the stamp: an unmarked military drawing is still CTI
The clause search: 52.204-21 or 52.240-93, 7012, 7019, 7020 or 252.240-7997, 7021
The 60-second level test, run contract by contract, not company-wide

02Modules 2 and 3 · 100 of 110

Read the requirements in quality language

Fourteen families, 110 requirements and the 320 objectives under them. You work through access control, MFA, training, physical and media protection, configuration, encryption, patching, logging and maintenance, each tied to a system you already run: stamp control, the ECO, incoming inspection, the traveler.

A quarterly access review that ends shared logins and stale accounts (3.1.1, 3.1.2)
The MFA grid under 3.5.3: privileged and ordinary accounts, local and network
FIPS-validated encryption (3.13.11): a CMVP certificate, not a vendor saying AES-256

03Module 4 · 3.6, 3.11, 3.12

Write the SSP and run the 72-hour incident clock

The last ten requirements cover risk, security assessment and incident response. You learn why the System Security Plan is the first document an assessor reads, how to report an incident inside the 7012 clock, and what implemented means when there's no partial credit.

CA.L2-3.12.4: the SSP carries no points, yet no SSP means no completed assessment
7012 duties: DIBNet in 72 hours, images kept 90 days from the report, malware to DC3
Implementation statements that name the tool, the setting and where the evidence is

04Module 5 · Scoping

Draw the smallest boundary that holds

Scope decides what the whole program costs. You place every asset in a category from the CMMC Level 2 Scoping Guide, design an enclave that fences the CUI instead of the building, and pin down which requirements your MSP and cloud providers actually carry.

The five asset categories, each call backed by a written rationale
Enclave builds: a segmented network, separate systems or virtual desktops
An MSP responsibility matrix, and FedRAMP Moderate or equivalent for cloud CUI

05Module 6 · Score and SPRS

Compute the score, post it and sign it honestly

You compute the DoD score on the back of a traveler: start at 110 and subtract 1, 3 or 5 for every requirement not met, down to a floor of minus 203. Then the POA&M rules, posting in SPRS through PIEE, the annual affirmation and what the False Claims Act does to a careless one.

Conditional status: at least 88, only eligible items open, 180 days to close
The six requirements that can never sit on a POA&M, the SSP among them
The six SPRS entry fields and a pre-affirmation review before every signature

06Module 7 · The assessment

Decide on a C3PAO and stay audit-ready

With Phase 2 suspended, a C3PAO assessment is voluntary, so this module helps you decide. You see what assessors ask on the shop floor and what evidence they accept, how Conditional becomes Final, how to flow the clauses down to your suppliers, and where Level 3 and Rev 3 stand.

Vet a C3PAO like a registrar: the named team, a written lead time, closeout terms
Flow-down: clauses in the subcontract, supplier score and status on file in writing
Level 3: Final Level 2 (C3PAO) first, then 24 NIST SP 800-172 requirements

Who built it

Written from the auditor's chair and the supplier's side.

Will Trikha

Founder and CEO, QMS Learning · Third-party registrar auditor

Will Trikha is a third-party registrar auditor with more than 20 years in aerospace and quality. He wrote this course from NIST SP 800-171 Rev 2 and its assessment procedures, the CMMC rule at 32 CFR Part 170 and DFARS 252.204-7012, and teaches it through habits a quality manager already has.

He's COO of PTX Defense, an AS9100D-certified aerospace manufacturer, so he lives with these requirements from the supplier side too. He founded QMS Leader, a consulting firm that implements quality management systems for manufacturers. His own company, QMS Learning, is ISO 27001 certified.

What an assessor checks before trusting a score

The SSP, before anything elseAssessors read the System Security Plan first and test everything against it. It carries no point value, but an assessment can't be completed without one, and it's one of six requirements that can never sit on a POA&M.
Every objective, not the requirement sentenceNIST SP 800-171A splits the 110 requirements into 320 objectives. A requirement is MET only when every objective under it is met. Prove four of six and it still scores NOT MET, at full weight.
Dated records that show the control runningA stack of paper made last week doesn't prove a control works. Assessors want dated records over time: access reviews, log reviews, patch records. Operating history can't be bought later, and it can't be backdated.
Shop floor answers that match the paperInterviews reach the machinists: screen locks, a found USB stick, a visitor, who to tell about an incident. If three people give three answers, the procedure lives on paper only.

Check us before you pay

Take lesson 1 free. The real first lesson with Coach Q. No card.
Look Will up. His LinkedIn profile lists the work behind the course.
Check a certificate. Every certificate can be confirmed at academy.qmslearning.com/verify.
Keep your exit. 3 days after you buy to ask for a refund.

The usual way, and this course

Three shortcuts that look safe and aren't.

Each one sounds responsible. Here's what you'll do instead.

The usual way

This course

The boundary

Put the whole network in scope to be safe

Scope by asset category, fence the CUI, and document why the rest is out

The self-assessment

Read the 110 requirements and ask 'do we do that?'

Grade all 320 objectives by examine, interview and test, evidence recorded

The signature

Sign when it's due and fix a wrong score at the next anniversary

Review first, sign after, and correct a known wrong score right away

How it fits you

The same pace and the same examples for everyone

A study plan sized to your week, and a coach that works on your own job, never CUI or technical data

When you're stuck

Email the instructor and wait for a reply

Ask Coach Q on any screen, any hour

After you finish

Access often ends after a year

Lessons for life, kept up to date, and a coach that stays with you

Not like training used to be

Short, hands-on, built around you. And the coach stays.

Training used to mean days in a classroom or hours of video. Here are real screens from CMMC and NIST 800-171: short sessions where you make the call, a plan that fits your week, and an expert in your pocket.

Coach Q · your expert on call

Our IT provider says we have to redo everything for NIST 800-171 Rev 3. Do we?

COACH Q

No. The CMMC program rule, 32 CFR 170.2, still incorporates Revision 2. Rev 3 exists, but it isn't what your contracts or an assessment point at today.

Your time is better spent on the Rev 2 work that counts now: an honest self-assessment, the evidence behind each requirement, and a score in SPRS you can stand behind. Keep someone assigned to watch for any change to the rule.

Coaching, not decisions. You make the call. Comes with your course, no renewal fee.

Study plan: a real screen from CMMC and NIST 800-171

Study plan · Your personal trainer

Tell it your goal date. It builds sessions around your week and shows each day whether you're on plan, so the course actually gets finished.

Focus timer: a real screen from CMMC and NIST 800-171

Focus timer · 25 minutes, no tab-hopping

One click starts a focused session, and it follows you from lesson to lesson. Short sessions are how busy people finish.

Course Hub: a real screen from CMMC and NIST 800-171

Course Hub · Security documents drafted with you

Pick a template, give Coach Q facts you're allowed to share, never CUI, and get a working draft you edit and keep: SSP builder, scoping worksheet, SPRS score worksheet, POA&M template.

Apply at work: a real screen from CMMC and NIST 800-171

Apply at work · Proof your boss can see

Log what you tried, what happened and how you know. Record your manager's sign-off with their name and date, and export the log for your performance review.

Today view: a real screen from CMMC and NIST 800-171

Today view · One look and you know what's next

Your goal, days left, lessons done, your streak and today's session.

Built around you

Give the study plan your goal date and it sizes each session to your week. Coach Q works on the facts you bring from your own job, never CUI or technical data, so the examples are yours, not a textbook's.

Hands-on, not hours of video

Lessons are built around calls you make: read the record, sort the evidence, catch the mistake. Checks and labs score you on the spot, and your first win comes in the first few minutes of lesson 1.

Stays with you. Stays current.

Coach Q doesn't leave when you finish. It comes with your course, no subscription and no renewal fee, so it's there for the next affirmation, and the one after that. When the rules behind this course change, we update the lessons and the coach's setup, and we move the coach to newer AI models as we test them.

What you walk out with

You don't just read the requirements. You prepare the documents.

A five-job data inventory

Your last five DoD jobs: what came in, what you generated, where it lives now and which bucket it belongs in.

Asset categories and a one-page enclave

Every system in your shop placed in an asset category, then an enclave sized to the people who actually handle CUI.

A System Security Plan outline

Boundary, environment, connections, roles and how each requirement is implemented. The document an assessor reads first.

A 72-hour incident report skeleton

The report fields filled in ahead of time, so the clock isn't spent hunting for your own contract numbers.

A sample score and POA&M sort

A score computed step by step, then your open gaps sorted into what can and can't sit on a POA&M.

A pre-affirmation review

A 15-minute agenda with the five questions your Affirming Official asks before every SPRS signature, and the evidence to check for each.

Inside the course

The course, step by step.

About 7.5 hours, self-paced, in short sessions that fit your week.

The Mandate

Why CMMC exists, who must comply, and what your contracts can require of you today. 5 lessons.

The 110 Requirements, Part I

Controlling people and access: the families where most points live. 5 lessons.

The 110 Requirements, Part II

Controlling systems and data: configuration, encryption, logging, and patching. 5 lessons.

The 110 Requirements, Part III

Managing risk and response: assessments, incidents, and the System Security Plan. 4 lessons.

Scoping

Shrink the problem before you solve it: asset categories, enclaves, MSPs, and cloud. 4 lessons.

Scoring, SPRS, and Self-Assessment

The scoring math, the POA&M rules, and the affirmation that carries legal weight. 5 lessons.

The Certification Assessment and Life After

C3PAOs, assessment week, Conditional to Final, flow-down, and staying audit-ready. 5 lessons.

The itemized list

Everything you get.

Each priced line shows what a comparable item costs from another provider, with the source, so you can check it yourself. The included lines are what get the course finished. Checked October 12, 2026.

CMMC and NIST 800-171 · itemAdding up: $1,949

The CMMC and NIST 800-171 course

$999

FCI and CUI, all 110 requirements explained in quality language, scoping, the scoring math, SPRS and the affirmation, then the certification assessment and life after. 33 real-world scenarios, 15 exercises with explained answers and an AI checkpoint in every lesson.

COMPARABLE · Core Business Solutions, NIST 800-171/CMMC Prep Fundamentals Series, 8 hours of online training, per seat (thecoresolution.com, Oct 2026): $999

Course Hub with AI-drafted security documents

$950

An SSP builder, a scoping worksheet, an SPRS score worksheet and a POA&M template. Coach Q drafts each from facts you're allowed to share, never CUI or technical data. You edit, save and download.

COMPARABLE · ComplianceForge, NIST 800-171 System Security Plan (SSP) Template, an SSP template with a POA&M template included, single-entity license (complianceforge.com, Oct 2026): $950

Coach Q, your expert in your pocket

Included

Ask the question you'd ask an assessor, any hour. It points you to the requirement, the evidence to look for and the next step, and marks what's missing. You decide what goes in your SSP and what gets signed. Comes with your course. No subscription or renewal fee. It stays with you after the course, and we keep its setup current when the rules change.