Movegistics home pageResources

Resources / Project Spectrum / First hour

Your first hour on Project Spectrum

Four steps for an owner with no IT staff. Steps 1 and 2 fit in about an hour. This page prints as a checklist.

This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.

Facts last checked: .

Before you start

  • An email address you check.
  • About an hour without interruptions.
  • For Level 2: the person who knows how your company handles its computers, email and phones.

  1. Create your free account

    • Go to projectspectrum.io and choose Register.
    • Read and accept the Terms of Use for LYNX. LYNX is the account platform Project Spectrum uses, and Eccalon, LLC operates it.
    • Create your account, then confirm your email. If the email does not arrive, the sign-in box has a “Didn't receive confirmation email?” link.
    • Most of the tools appear only after you sign in.

    Sources: LYNX Terms of Use, projectspectrum.io

  2. Take the Level 1 self-assessment

    • Project Spectrum suggests starting here if your company is new to cybersecurity. It covers 17 basic practices, which the CMMC rule counts as 15 requirements, and typically takes under an hour.
    • When you finish, you get a report with your SPRS score, the controls you met or missed, and a prioritized list of actions. You can download it.

    Sources: Project Spectrum FAQ, 32 CFR 170.14

  3. If you handle DoD shipments, take the Level 2 self-assessment

    • Level 2 covers 110 controls and may take several hours to a few days. Plan more than one sitting, with the person who knows your systems.
    • Use the templates, including a System Security Plan (SSP) and a Plan of Action and Milestones (POA&M).

    Source: Project Spectrum FAQ

  4. Book a free advisor session

    • Book it through the Project Spectrum platform, or email support@projectspectrum.io to reach a Cyber Advisor.
    • Bring your report and ask:
      1. What should we fix first?
      2. Which templates do we need, and who in our company should fill them in?
      3. How does our score get into SPRS, and who in our company posts it?
    • If you work as an agent for a TSP, also ask the TSP what it will need from you, and by when.

    Sources: Project Spectrum FAQ, Department of War, business.defense.gov/cmmc

Back to the Project Spectrum guide. Unsure of a term? See the glossary.