Start Your CMMC Assessment

Step 01 of 06

Company

The basics about your organization. We use this to scope the engagement and tailor the deliverables.

Legal entity name *

DBA / commonly known as

Headquarters (state)

Primary industry

Employee count *

1–25 26–100 101–250 251–500 501–1000 1000+

Approximate full-time headcount including W-2 and 1099 personnel with system access.

Primary NAICS

CAGE code

UEI (SAM.gov)

Step 02 of 06

CMMC level & contracts

Your target certification level and where you stand on the contract side.

Target CMMC level *

Level 1 — Foundational FCI protection. 17 FAR 52.204-21 practices. Annual self-assessment. Level 2 — Advanced CUI protection. 110 NIST SP 800-171 R2 controls. C3PAO assessment every three years. Level 3 — Expert L2 + 24 enhanced 800-172 requirements. DCMA DIBCAC assessed. L2 prerequisite. Not sure Need help determining the right level from contract requirements.

Current posture

DFARS clauses present in your active contracts (check all that apply)

DFARS 252.204-7012 — Safeguarding CDI & Cyber Incident Reporting DFARS 252.204-7021 — CMMC Level Requirements DFARS 252.240-7997 (formerly -7020) — DoD Assessment Requirements DFARS 252.204-7025 — Notice of CMMC Level Requirements FAR 52.240-93 (formerly 52.204-21) — Basic Safeguarding Not sure / need help reviewing contracts

# of active DoD contracts

Primary primes / customers

Step 03 of 06

CUI & data profile

What kind of controlled information flows through your systems. This is the biggest scoping driver.

Do you handle CUI today?

Yes No Unsure

CUI categories present (check all that apply)

Defense Export Control (ITAR / EAR) Controlled Technical Information Privacy / PII Procurement & Acquisition Critical Infrastructure Nuclear Other / unsure

Export-controlled CUI (ITAR / EAR) typically requires GCC High and U.S.-persons-only access. We’ll dig into this on the kickoff call.

All personnel with system access are U.S. persons?

Yes No Unsure

CUI handled through an enclave (not your full environment)?

Yes No Planning

Network diagram available?

Yes No

CUI data-flow diagram available?

Yes No

Step 04 of 06

Environment

The infrastructure that will fall inside your CMMC scope.

Primary IT platform

Note: GCC High is the required tier for export-controlled CUI (ITAR / EAR). Standard GCC is acceptable for non-export-controlled CUI.

# in-scope users

# endpoints (laptops/desktops)

# servers

# network devices

# mobile devices

# physical sites in scope

Remote workforce

None Some Most All

BYOD permitted?

Yes No Limited

Current MSP / MSSP

Operational Technology (OT) / Industrial Control Systems in scope?

Yes No Unsure

OT/ICS handling CUI brings NIST SP 800-82 into scope and adds engagement complexity.

Step 05 of 06

Goals & engagement

What’s driving this, what your timeline looks like, and where you want Praedyn to plug in.

Primary motivator (check all that apply)

Contract requirement with deadline Prime contractor / supply chain pressure Growth into new DoD contract pipeline Internal governance / executive directive Recent incident or audit finding

Target assessment date

Current SPRS score (if posted)

Engagement type of interest *

Readiness Assessment Gap analysis against your target level. Prioritized remediation roadmap. SPRS-ready scoring. ~6–10 weeks. Full Implementation Readiness + remediation + SSP & POA&M authoring + mock pre-assessment. End-to-end to certification readiness. Mock Pre-Assessment Final dry run before your C3PAO engagement. Evidence drills, interview prep, gap closeout. SSP & POA&M Authoring Standalone documentation work. Production-grade SSP mapped to assessment objectives. Ongoing Compliance Retainer Continuous monitoring, control sustainment, annual affirmation support. Monthly engagement. Not sure Help me decide what fits.

Step 06 of 06

Contact & submit

How to reach you. We’ll respond within one business day with a scoped proposal.

Your name *

Title

Work email *

Phone

Anything else we should know?

I confirm I have authority to engage Praedyn on behalf of my organization and that no CUI has been included in this intake. *

Tell us about your environment.

Company

CMMC level & contracts

CUI & data profile

Environment

Goals & engagement

Contact & submit

Thank you. Here’s where we’d start.

Engagement estimate

Your responses