CMMC readiness assessment
Before you pay for a certification assessment, find out what it would actually find. We scope the boundary, score every requirement against evidence, and tell you honestly where you stand.
Bought under NAICS 541611 and 541618.
What this answers
The single most expensive mistake in CMMC is an optimistic self-score submitted to SPRS and discovered during an assessment. The second is applying a control set to your whole corporate network when an enclave would have done.
This engagement addresses both. We define where Controlled Unclassified Information lives, score each requirement as met, not met, or not applicable with the evidence recorded, and give you a realistic view of the distance to certification.
CMMC Level 2 certification is issued by an authorized third-party assessment organization that must be independent of whoever did the readiness work. Treat any provider offering both as a red flag.
What is in scope
- Identification of the contract clause that creates the obligation
- Where CUI is received, stored, processed and transmitted
- Whether an enclave would reduce scope and cost
- All Level 2 practices assessed against evidence
- Existing SSP and POA&M, if you have them, reviewed as an assessor would
- Shared responsibility with cloud service providers and managed providers
- External service providers in scope through flowdown
How it runs
A short, fixed-scope engagement. We tell you the duration before you commit.
Clause review
We read the contract and the flowdown, not just the framework, and write down which requirement set binds you and why.
Boundary workshop
A working session to map CUI flows and test whether an enclave is practical. This is where the cost of the whole program is decided.
Evidence-based scoring
Each practice assessed against artifacts and configuration, not against an interview answer. You see the evidence behind every score.
SSP and POA&M
Produced or revised so they describe the system as it is, with milestones that are achievable.
Readout
A session with the people who will do the remediation, covering what to fix first and what it will take.
What you receive
- Scope and boundary definition with CUI data-flow map
- Practice-by-practice score with evidence references
- System Security Plan
- Plan of Action and Milestones with owners and dates
- Prioritized remediation roadmap
- A realistic view of the distance to a certification assessment
Where the rules stand
The CMMC Program rule at 32 CFR Part 170 took effect on 16 December 2024. The acquisition rule allowing the Department of Defense to place CMMC requirements in contracts took effect on 10 November 2025, which began Phase 1. Under Phase 1, Level 1 and Level 2 self-assessment requirements appear in new solicitations that carry the clause.
For scoring, NIST SP 800-171 Revision 2 remains the operative baseline. Revision 3 was finalized in May 2024 but is not the CMMC assessment baseline.
We do not publish a date for CMMC phases beyond the one in force. Reporting on later-phase timing comes from trade press rather than a confirmable Department of Defense source. Ask us about your specific solicitation and we will separate what is confirmable from what is not.
Scope it before you budget it
Tell us the environment and the obligation. We come back with the approach, the duration, and what drives the price.