Project Spectrum: free CMMC help for movers
A plain-English guide for owners with no IT staff: what Project Spectrum is, what you get, and how to spend your first hour on it. CMMC applies to every company in the moving and storage industry that handles DP3 shipment information, whatever its size.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
What it is
Project Spectrum is a free program that the Department of War's Office of Industrial Base Growth started to give small and medium businesses that supply the Department (the Defense Industrial Base, or DIB) cybersecurity training, tools and expert support.
Source: Department of War, business.defense.gov/cmmc
You use it through one website, projectspectrum.io. Its accounts run on LYNX, a platform operated by Eccalon, LLC, which is why signing up starts with LYNX's terms of use.
Sources: LYNX Terms of Use, Project Spectrum FAQ
What it costs
Project Spectrum's core resources are free. The Department lists the account, tools and training as free, and Project Spectrum says its advisor sessions are available at no cost.
The site also promotes other services, such as cloud hosting, through a sales team. Some of these may cost money. This guide covers only the free program.
Sources: Department of War, business.defense.gov/cmmc, Project Spectrum FAQ, projectspectrum.io
What you get
- Self-assessments for CMMC Level 1 and Level 2. Level 1 has 15 requirements. Project Spectrum may show 17 practices, an older count that split one requirement into three. Level 2 has 110. Project Spectrum says Level 1 typically takes under an hour, and Level 2 several hours to a few days.
- A report after each assessment: a summary of your results, the requirements you meet and miss (your gaps), and what to fix first.
- Training, from phishing and access control to CMMC and NIST SP 800-171.
- Templates, including a System Security Plan (SSP) and a Plan of Action and Milestones (POA&M).
- Free advisor sessions to help you read your results and build a plan.
Sources: Project Spectrum FAQ, projectspectrum.io, 32 CFR 170.14, CMMC Level 1 Assessment Guide
If you support DoD household goods shipments (DP3)
The DP3 Tender of Service, the rules a TSP agrees to for DoD household goods shipments, requires CMMC self-assessments from the TSP and from any subcontractor that holds the government's shipment information (CUI or FCI): Level 1, then Level 2. Each is posted in SPRS with a senior official's affirmation. A TSP that has not posted them by the dates in the Tender of Service cannot be awarded shipments. Section A.2 of the Tender of Service gives the current dates.
The TSP must also make sure its subcontractors and suppliers do the same before it gives them work.
Source: DP3 Household Goods Tender of Service, 2026 Change 3 (effective 15 May 2026), section A.2
IAM says this reaches agents, storage facilities, hauling agents, crating companies, freight forwarders, claims service providers, IT vendors and any other company with access to DP3 shipment information: “If you touch DP3 shipment information, you are part of the cybersecurity chain of custody.”
Source: IAM CMMC Resource Center
If you work for a TSP, ask the TSP which level it needs from you, and by when.
Get started on Project Spectrum
- Create your free account at projectspectrum.io and confirm your email.
- Take the Level 1 self-assessment. Take Level 2 next if you are a TSP, or if a TSP shares DoD shipment information with you. Not sure? Ask your TSP.
- Book a free advisor session and bring your results and questions.
These are the Project Spectrum steps. For the whole path to a Level 2 self-assessment, see Start here. Know your NAICS code? Find resources by NAICS code. Want to know what each of the 110 Level 2 requirements means for a moving and storage business? See the Level 2 guide.
Common questions
Is Project Spectrum really free?
Project Spectrum's core resources are free: the Department of War lists the account, tools and training as free, and Project Spectrum says its advisor sessions are available at no cost. Other services promoted on the site, such as hosting, go through a sales team and may cost money, so ask first.
Is it meant for the moving and storage industry?
Project Spectrum is built for small and medium businesses in the Defense Industrial Base (DIB), and its FAQ says it is also useful for any business strengthening its cybersecurity. IAM says CMMC reaches TSPs, agents, storage facilities, haulers, crating companies, freight forwarders, claims service providers and IT vendors that touch DP3 shipment information. Size does not change the requirement. It changes how much work it takes.
How long does it take?
Project Spectrum says a Level 1 self-assessment typically takes under an hour, and a Level 2 self-assessment several hours to a few days, depending on your company's size and complexity. These times are for the self-assessment itself, not for fixing what it finds.
Does Project Spectrum post my score to SPRS?
Project Spectrum is separate from SPRS (the Supplier Performance Risk System), the Department's system where your official self-assessment and affirmation are posted. Use Project Spectrum to prepare. Posting in SPRS is your company's job: see how to post in SPRS.
Who wrote this guide?
Movegistics, a software company serving the moving and storage industry, wrote it as a free resource. We are not affiliated with Project Spectrum or the Department of War, and neither has endorsed this guide.
Need a term explained? See the glossary. Want to check our work? See how we checked this guide.