Compliance / CMMC
CMMC readinessWe prepare defense contractors for CMMC Level 1 and Level 2: gap assessments, remediation, System Security Plans and assessment readiness, led by a Lead Certified CMMC Assessor who knows what assessors look for.
If you hold or bid on Department of Defense contracts, almost certainly. Your level depends on the information you handle.
Our CMMC self-assessment walks you through the requirements and gives you a readiness picture you can take to leadership.
Protects FCI. 15 basic safeguarding requirements from FAR 52.204-21, with an annual self-assessment and affirmation in SPRS.
Protects CUI. The 110 requirements of NIST SP 800-171, assessed by a C3PAO every three years, or by self-assessment where the contract allows.
Protects critical CUI. Level 2 plus selected NIST SP 800-172 requirements, assessed by DCMA DIBCAC.
Your contract and the data you handle set your level. We confirm it with you before any work starts.
Gap assessment against all 110 NIST SP 800-171 requirements, with an updated SPRS score.
A prioritized POA&M with owners, plus hands-on help with GCC High, enclaves and technical fixes.
A System Security Plan, policies and procedures that match how you actually operate.
A mock assessment and evidence review, so assessment day holds no surprises.
Managed compliance that keeps evidence current and annual affirmations on time.
Scope depends on your size, your CUI boundary and where you are today.
What assessors expect to see, and how to organize it before they ask.
Download →Level 1 if you only handle FCI; Level 2 if you handle CUI. Your contract’s CMMC clause states the level required.
For most Level 2 contracts, yes. Level 1 is a self-assessment, and some Level 2 contracts allow self-assessment.
A System Security Plan describes your environment and how you meet each requirement. Assessors start with it, so it has to match reality.
Cloud services that store CUI must meet FedRAMP Moderate or equivalent. Many contractors use Microsoft GCC High, especially with export-controlled data. We help you choose.
It depends on your gaps and how clearly your CUI is contained. A gap assessment gives you a realistic timeline before you commit.
Book a 30-minute call. We’ll confirm your level, your likely gaps and a realistic path to assessment.