CMMC Readiness Assessment
A control-by-control evaluation of where you stand against the same rubric a C3PAO will apply on assessment day.
What this engagement is
A Readiness Assessment is the first move for most contractors who know CMMC is coming and want to find out — honestly — what shape they're in. We evaluate every applicable control against the NIST SP 800-171 Rev. 2 baseline (or FAR 52.240-93 for Level 1, or the NIST SP 800-172 overlay for Level 3) and score using the DoD Assessment Methodology v1.2.1 — the same rubric your eventual C3PAO will apply.
What comes back isn't a generic checklist. It's a control-by-control gap matrix, a prioritized remediation roadmap with rough effort estimates, and an SPRS-ready scoring worksheet you can post immediately. No assessor-day surprises.
Most clients run a Readiness Assessment before committing to a longer Full Implementation engagement. It de-risks the path forward and gives leadership a defensible budget figure for the remediation work that follows.
What you get
Deliverables included in the engagement
- Scoping interviews with IT, security, and compliance leads
- Control-by-control walkthroughs with evidence inspection
- Gap matrix across all in-scope NIST SP 800-171 controls
- SPRS-ready scoring worksheet (DoD AM v1.2.1)
- Prioritized remediation roadmap with effort estimates
- Executive read-out deck for leadership
How we work
The phases of this engagement
Scope confirmation
Define the assessment boundary. Identify CUI flows. Lock the in-scope asset inventory before scoring begins.
Evidence collection
Pull policy docs, configuration evidence, screenshots, ticket samples. Build the evidence repository the way an assessor will want to see it.
Control evaluation
Walk every control with the responsible owner. Score met / partial / not met. Document where the gap is and why.
Scoring & reporting
Produce the SPRS worksheet, the gap matrix, the remediation roadmap, and the executive read-out. Hand-off session with your team.
Right fit signals
When this engagement is the right call
- You've just received your first DoD contract requirement and need to know where you stand
- A prime contractor is asking for your SPRS score and you don't have one posted
- You've done a self-assessment but want an outside expert eye before you commit to an implementation budget
- You're evaluating consultants and want a fixed-scope first engagement before a bigger commitment
Engagement specs
Typical duration
6 – 10 weeks
Engagement model
Fixed-fee, milestone-based
Best precursor to
Full Implementation
— Ready to scope this