Compliance and security readiness
CMMC, NIST SP 800-171, CJIS, HIPAA and StateRAMP. We start from the clause in your contract, scope the boundary before touching a control, and score the result the way an assessor would rather than the way you would prefer.
Bought under NAICS 541611 and 541618.
What this service does
Compliance work goes wrong in two predictable ways. Organizations apply a control set to the wrong scope, which costs a fortune and protects nothing in particular. Or they self-score optimistically, submit it, and discover the gap during an assessment when remediation is most expensive and the contract is closest.
We start from the clause that actually binds you, define where regulated data lives, and score each requirement as met, not met, or not applicable with the evidence recorded against it. An honest score that is lower than you hoped is worth considerably more than a flattering one.
What we assess and protect
- NIST SP 800-171 for Controlled Unclassified Information
- CMMC Level 1 and Level 2 readiness and assessment support
- DFARS 252.204-7012 obligations flowed down from a prime
- CJIS Security Policy for criminal justice information
- The HIPAA Security Rule for protected health information
- StateRAMP and state-level cloud security requirements
- Supplier Performance Risk System (SPRS) score preparation
How the work runs
Select any stage in the diagram to see what happens there. The same model drives the engagement plan you receive.
Select any stage to see what happens there. Scoping comes before control work in every engagement, without exception.
Applicability determination
A written statement of which standard binds you and why, citing the contract clause or agreement. This is the deliverable most firms skip, and it is the one that prevents you from buying the wrong program.
Scope and boundary definition
Where does regulated data live, move, and rest? Can it be moved into an enclave? This decision drives every cost downstream and is worth getting right before anything else happens.
Gap assessment
Each requirement assessed against evidence, scored the way an assessor would score it. You receive the score, the evidence, and the reasoning for every determination.
System Security Plan and POA&M
An SSP that describes the system as it actually is, and a Plan of Action and Milestones with owners and dates that are achievable. Both are written to survive review by someone looking for problems.
Remediation
Prioritized by score impact and by real risk. Where you have no internal capacity, our managed service can carry the monitoring, logging, and incident response requirements directly.
Assessment support
Evidence packaging, interview preparation, and support through a third-party assessment. We cannot certify you, and we will explain why no honest firm can do both.
What you receive
- Written applicability determination citing the governing clause
- Documented scope and boundary definition
- Requirement-by-requirement gap assessment with evidence
- System Security Plan
- Plan of Action and Milestones with owners and dates
- Prioritized remediation roadmap
- SPRS score preparation and submission support
What we will not do
We will not certify you. CMMC Level 2 certification is issued by an authorized third-party assessment organization that must be independent of whoever prepared you. A firm selling both is selling you a problem.
We will not give you a templated checklist and call it a System Security Plan. Assessors have seen the templates, and a plan that does not describe your actual system fails at the first interview.
We will not guess at a regulatory date to make a sales conversation easier. Where the authoritative sources conflict, the table below says so instead of picking the version that reads better.
Where the rules actually stand
Dates and document numbers, with nothing stated that we cannot point at. If a figure is missing below it is because the sources conflict, and we would rather say so.
| Instrument | Status | What it means for you |
|---|---|---|
| 32 CFR Part 170 | Effective 16 Dec 2024 | The CMMC Program rule. Establishes the levels, the assessment types, and the ecosystem. |
| 48 CFR / DFARS | Effective 10 Nov 2025 | The acquisition rule. Lets DoD put CMMC requirements into solicitations, which started Phase 1. |
| CMMC Phase 1 | In force | Level 1 and Level 2 self-assessment requirements appear in new solicitations carrying the clause. |
| NIST SP 800-171 Rev 2 | Operative for CMMC | Remains the baseline used for CMMC scoring and SPRS submission today. |
| NIST SP 800-171 Rev 3 | Finalized May 2024 | Reorganizes into 17 families with organization-defined parameters. Not yet the CMMC assessment baseline. |
| DFARS 252.204-7012 | In force | The safeguarding and incident-reporting clause that flows 800-171 obligations down to subcontractors. |
We do not publish a date for CMMC phases after Phase 1. Reporting on later-phase timing comes from trade press rather than from a confirmable Department of Defense source, and we will not put a procurement decision on a number we cannot stand behind. Ask us about your specific solicitation and we will tell you what is confirmable and what is not.
Who performs the work
Swif7Edge is small on purpose. The people who scope your engagement are the people who run it.
Our practice was founded by U.S. Army veterans. The security side is led by a combat veteran and former NSA contractor with 26 years in security engineering, who has built and led teams of more than 130 engineers, stood up global security operations centers, and directed offensive security work for the Defense Intelligence Agency, the FBI, and the U.S. Marine Corps.
That background is company-stated. Specific engagements are covered by non-disclosure terms and in most cases by the sensitivity of the work itself, so we do not detail them publicly. We will substantiate it directly during a procurement, with references and whatever contract detail can be released.
The strategy side brings more than 20 years across the Intelligence Community, the Department of Defense, and Fortune 500 operations, managing portfolios above $150 million and cross-functional teams of up to 2,500 personnel.
Credentials held on the team
- Offensive Security Certified Professional (OSCP)
- Certified Information Systems Security Professional (CISSP)
- GIAC Penetration Tester (GPEN)
- GIAC Certified Incident Handler (GCIH)
- GIAC Assessing and Auditing Wireless Networks (GAWN)
For readiness work the relevant depth is the control set itself: NIST SP 800-171 and its 800-171A assessment objectives, the CMMC practice set, the CJIS Security Policy and the HIPAA Security Rule. Our offensive certifications matter here only because they are why our control recommendations are tested rather than asserted.
We do not publish client names, logos, or case studies. The work is mostly covered by non-disclosure terms, and a small firm that lists logos it cannot substantiate is making a claim it cannot stand behind. The certifications and registrations above are independently checkable, and the methodologies on each service page are named rather than described. Everything we say about our own history is company-stated and we label it that way.
Scope it before you budget it
Tell us the environment and the obligation. We will come back with the approach, the duration, and what drives the price — before anyone asks you for a number.
Common questions
If what you need is not here, ask us directly rather than filling in a form.
That depends on the clause in your contract, not on which framework is most discussed. DFARS 252.204-7012 flows down NIST SP 800-171 obligations to defense contractors handling Controlled Unclassified Information. A CJIS agreement, a HIPAA business associate agreement, or a StateRAMP requirement each bring their own control set. Our first deliverable is a written applicability determination that cites the clause.
The CMMC Program rule at 32 CFR Part 170 took effect on 16 December 2024. The acquisition rule that lets the Department of Defense put CMMC requirements into contracts was published in the Federal Register on 10 September 2025 and took effect on 10 November 2025, which started Phase 1. Under Phase 1, Level 1 and Level 2 self-assessment requirements appear in new solicitations carrying the clause. We do not publish a date for later phases, because the authoritative sources on timing currently conflict; we will tell you what we can confirm for your specific solicitation.
Revision 3 was finalized in May 2024 and reorganizes the requirements. For CMMC assessment and SPRS scoring, Revision 2 remains the operative baseline. Anyone who tells you otherwise without pointing at a current Department of Defense memo is guessing, and acting on that guess is expensive.
Scope, overwhelmingly. An enclave that holds CUI and nothing else is dramatically cheaper to assess, remediate, and keep compliant than an undifferentiated corporate network where CUI might be anywhere. The second driver is how much of the remediation you can do in-house. We scope first and quote second, and we will tell you when a scoping change saves you more than our fee.
No, and neither can any consultancy that also prepares you. CMMC Level 2 certification is issued by an authorized third-party assessment organization, which must be independent of the party that did the readiness work. We prepare you for that assessment and support you through it. Treat any firm offering both as a serious red flag.