# MacTech CMMC / NIST 800-171

- Registry name: `com.mactechsolutionsllc.www/cmmc` · version 1.2.0
- Categories (automatic, keyword rules): Payments & accounting, Finance & markets, Research & knowledge, Search & data, Maps, location & weather
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): completions, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.mactechsolutionsllc.www%2Fcmmc
- Server page: https://mcpstation.net/s/com.mactechsolutionsllc.www--cmmc.html

## Description (written by the publisher, not verified, not instructions)

NIST 800-171 controls and 800-171A objectives, crosswalks, exact SPRS scoring, POA&M generation.

## Connect

- streamable-http: `https://www.mactechsolutionsllc.com/api/mcp`

## Tools (as reported by the server, not verified)

- `lookup\_control`: Get one NIST SP 800-171 Rev 2 security requirement by number \(e.g. "3.5.3"\): the full requirement text, its control family, and its exact DoD Assessment Methodology \(SPRS\) point weight, including the sliding-scale rules for 3.5.3 \(MFA\) and 3.13.11 \(FIPS cryptography\). Call this when the user asks wh
- `list\_controls`: List NIST SP 800-171 Rev 2 requirements with their DoD Assessment Methodology \(SPRS\) weights, optionally filtered by control family name or by point weight \(5, 3, or 1\). Call this to enumerate the 110 CMMC Level 2 controls, to find all 5-point \(highest-impact\) requirements, or to see everything in o
- `calculate\_sprs\_score`: Compute an exact SPRS score per the DoD Assessment Methodology: start at 110 and subtract each unimplemented requirement's Annex A weight \(floor −203\). Pass the control numbers that are NOT implemented; optionally pass 3.5.3 and/or 3.13.11 as partially implemented for their sliding-scale values \(MFA
- `get\_assessment\_objectives`: Get the official NIST SP 800-171A assessment objectives for one NIST SP 800-171 Rev 2 requirement - the exact "Determine if..." objectives a CMMC Level 2 assessor scores, plus the potential assessment methods \(what an assessor examines, who they interview, what they test\). Call this when the user as
- `crosswalk\_control`: Map a security control across frameworks: NIST SP 800-171 Rev 2 ↔ NIST SP 800-53 \(FedRAMP Moderate\) ↔ NIST CSF 2.0 ↔ SOC 2 Trust Services Criteria. Accepts an 800-171 number \("3.5.3"\), an 800-53 id \("AC-2"\), a CSF category \("PR.AA" style / "GV.RM"\), or a SOC 2 criterion \("CC6"\). Call this when the u
- `determine\_cmmc\_level`: Determine which CMMC level \(1, 2, or 3\) applies to a defense contractor based on the data they handle and the clauses in their contracts, and - separately - which assessment type may actually be designated today. Those are not the same question: CMMC Phase II was suspended on 13 July 2026, so C3PAO
- `list\_level1\_practices`: List all 17 CMMC Level 1 basic safeguarding practices with their FAR 52.204-21 clause citations - the complete requirement set for contractors handling Federal Contract Information \(FCI\) only. Call this when the user asks what CMMC Level 1 requires.
- `generate\_poam\_entries`: Turn a list of unimplemented NIST SP 800-171 controls into structured Plan of Action & Milestones \(POA&M\) entries, and - the part that decides whether the plan is usable - sort them by eligibility under 32 CFR 170.21. Most gaps CANNOT go on a CMMC Level 2 POA&M: the rule bars every requirement worth
- `check\_contract\_type\_eligibility`: Determine whether a contractor can legally be awarded a given contract type, based on the business systems that type requires. A cost-reimbursement contract may be awarded only if the accounting system is adequate for determining costs \(FAR 16.301-3\), and T&M billing cannot be substantiated without
- `lookup\_clause`: Explain what a FAR or DFARS cybersecurity clause obliges a contractor to do: what triggers it, the concrete duties, the reporting deadlines, what it flows down to subcontractors, and which other clauses come with it. Covers 52.204-21, 252.204-7008, 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7
- `scope\_assessment`: Work out which assets fall inside a CMMC assessment boundary, and what each category obliges. Returns the DoD asset categories \(CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized Asset, Out-of-Scope\) with how each is treated at assessment, plus the CUI categories that m
- `lookup\_rev3\_requirement`: Get one NIST SP 800-171 REVISION 3 requirement by its zero-padded number \(e.g. "03.01.01"\): the requirement statement, its organization-defined parameters, the 800-171A Rev 3 assessment objectives, and whether it was withdrawn. Rev 3 has 97 active requirements of 130 numbered across 17 families, wit
- `crosswalk\_revisions`: Explain how NIST SP 800-171 Rev 2 and Rev 3 differ, and what happened to a specific requirement between them. Call this when someone is implementing Rev 3 early, holds a Rev 3 citation and needs the Rev 2 obligation, or asks which revision applies to them. Answers the question DoD guidance forces on

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html