CMMC Services

Scoping

• Assist with determining the CMMC level based on current contractual obligations.
• Identify enclave boundaries and in-scope assets
• Document asset applicability for each practice

Scoping is the first step. Get started with a with a scoping exercise.

Gap Analysis

• Document practice implementations for each in-scope asset
• Identify gaps
• Gaps are unimplemented CMMC practice requirements or assessment objectives not implemented and/or with insufficient evidence
• Document Plan of Action and Milestones (POA&Ms)

Documentation

• For each practice and in-scope system, document CMMC practice owners, practice operators, evidence description, and evidence location.
• Document your System Security Plan (SSP).
• Calculate your CMMC and DFARS scoring.
• As required, create or update policies, procedures, plans, diagrams, practice documentation templates and more.

Assessment Preparation

• Review and organize initial body of evidence. Obtain final approvals on all documentation from management.
• Ensure staff understand the overall CMMC regulatory landscape and the importance of compliance, are trained on critical organization policies and procedures, and understand expectations regarding the assessment process.

Assessment Support

• Gather the body of evidence to support self-certifications and affirmations.
• Coordinate with assessor regarding interview requests, gathering assessment documentation, participating in assessment interviews/walkthroughs, responding to and addressing assessor questions/concerns.

Ongoing Project Support and Compliance Maintenance Activities

• Even the simplest organizations will have THOUSANDS of individual requirements.
• Success requires a data driven approach during the readiness and throughout the process of maintaining compliance.