An assessment against the 110 controls protecting controlled unclassified information, with a defensible scoring position and a plan of action an assessor will accept.
The most common and most expensive problem in the defense supply chain is a System Security Plan describing a network that does not exist.
We start by establishing where controlled unclassified information actually lives and what can reach it, then compare that to the boundary you have asserted. Getting this wrong invalidates everything downstream of it.
Self-assessment scores are frequently generous, and an assessor will test the ones that matter.
We assess each of the 110 controls against evidence rather than assertion, producing a defensible score you can stand behind rather than one that collapses under examination.
Not every gap has to be closed immediately, but the plan to close it has to be credible.
We produce a plan of action and milestones with realistic dates and owners, sequenced by risk, in the form assessors expect to receive it.
An assessment against the 110 controls that protect controlled unclassified information in non-federal systems, flowed down to defense contractors through DFARS clauses. It establishes your real position, produces a defensible score, and gives you a plan of action and milestones for the gaps.
CMMC assesses conformance to NIST SP 800-171 for most contractors, with the assessment level depending on the information you handle. Readiness work is the same underlying exercise; the difference is that CMMC adds a formal third-party assessment for higher levels.
Because everything else depends on it. If controlled unclassified information exists outside the boundary you described, your controls do not cover it and your score is wrong. Suppliers routinely discover during assessment that CUI has spread into shared drives, email and engineering systems nobody scoped.
Often yes, provided the gaps are documented in a credible plan of action with realistic dates. What causes problems is a score that cannot be substantiated, or a plan that has clearly not moved since it was written.
Scope this with a senior operator. Fixed scope, fixed price, no obligation.
No obligation, no sales pressure. A senior operator replies within one business day.
