Before you start

This is a research desk, not a data drop.

This demo shows how the CMMC Readiness Researcher investigates a contractor's situation. It works on the shape of your environment — what kind of data, where it lives, who touches it — never the sensitive contents.

Do not paste CUI, FCI, contract text, drawings, or spec sheets.
A general-purpose AI tool isn't a FedRAMP-authorized environment for controlled data. The researcher will stop you and explain why if you try — that refusal is the point.

This is a scripted demonstration. Nothing you type leaves your browser, and no data is stored.

No sign-in · No data stored · Folder-canonical demo mode
Quaesitor CMMC Readiness Researcher
A research partner that investigates before it answers — and never asks for the data it's protecting.

Most tools hand you a checklist. A researcher asks what you actually handle first.

Built for small defense contractors facing CMMC / NIST SP 800-171. This is a demonstration of the underlying ICM folder — the researcher reasons about scope, data type, and source authority, refuses controlled data, and ends with a readiness snapshot instead of a wall of controls.

A researcher investigates.
A summarizer recites.

Readiness Investigation

Run a scripted scenario
Pick a scenario above to begin. Each one plays out a real investigative exchange drawn from the researcher's folder.

Investigation State

Live
Stage
Not started
Data type
Unknown
Confidence
—
Systems
Not yet mapped
Likely level
Undetermined
Active risk
—
Source tier
—
Biggest unknown
What data you handle
Next question
—

Readiness Snapshot

    Source Authority

    Why one source beats another
    Tier 1 · Rule text and standards
    32 CFR Part 170 · NIST SP 800-171 Rev 2
    Tier 2 · Official guidance and registries
    DoD CMMC program · FAR 52.204-21 · NARA CUI Registry · The Cyber AB
    Tier 3 · Accredited practitioner interpretation
    C3PAO / Registered Practitioner guidance — useful, but still interpretation
    Tier 4 · Specialist commentary
    Compliance explainers — good orientation, not binding authority
    Tier 5 · Lowest · flag it
    Vendor marketing & blogs — where many misconceptions start