CMMC Readiness Assessment Services

A readiness assessment answers three questions: where your CUI actually lives, what your SPRS score is today, and what it would take to raise it. Everything else depends on getting the first one right, because a boundary drawn too wide makes compliance unaffordable and one drawn too narrow leaves CUI-handling systems outside your controls.

We assess against all 110 requirements in NIST SP 800-171 Revision 2 — and specifically against the 320 assessment objectives in NIST SP 800-171A, which is the level at which assessors actually make determinations. “We use multi-factor authentication” is a requirement-level claim. It fails when the objectives underneath it are tested.

You finish with a scored gap analysis, a System Security Plan, a POA&M scoped to what may lawfully be deferred, and an evidence package mapped to objectives.

How it runs

1. Contracts first. We read the clauses to establish whether you hold FCI, CUI or both, and therefore what actually applies. See FCI vs CUI for the test we use.
2. Scoping. Tracing CUI through the four doors it arrives by and everywhere it comes to rest. This is the longest step and the one everything else depends on.
3. Assessment. All 110 requirements against the 320 objectives, with evidence identified as we go rather than reconstructed afterwards.
4. Documentation. SSP, POA&M and evidence package, written to be used rather than filed.
5. Handover. A prioritised remediation plan ordered by SPRS points per unit of effort, so the first work you do moves the number most.

Why we assess at objective level

NIST SP 800-171A decomposes the 110 requirements into 320 assessment objectives, and a requirement is satisfied only when every objective beneath it is. That is the level a C3PAO or DIBCAC assessor works at, so it is the level we work at.

The practical effect is that our scores come in lower than a self-assessment usually does, and the gap is the point. A client who scores 62 with us and 88 on their own has not been given bad news — they have been given the 26 points they were going to lose in front of someone with authority.

Timeline and what we need from you

For a contractor with a clear boundary and a single site, two to three weeks. For an organisation with several primes, multiple sites, and a long history of email attachments, scoping alone can take longer than everything after it. We will tell you which case you are in after the first conversation rather than after the engagement starts.

What we need:

• Your contracts, so we can identify the clauses that actually apply rather than assuming.
• A system inventory, however rough. We will find what is missing from it; we just need a starting point.
• Time with the people who run things. Most of the work is conversations with your IT and engineering staff. Documentation review alone produces a plan that describes the environment you think you have.

Readiness assessment vs a C3PAO assessment

A C3PAO conducts the formal third-party assessment that leads to certification — currently suspended under the July 2026 pause. A readiness assessment is preparatory. It produces a score, a plan and the documentation, with no certification outcome and no authority behind the result.

That distinction matters commercially: anyone offering to certify you right now is selling something that does not currently exist. See program status. Who we are, and what we do not claim, is on our about page.

If you want a rough figure before talking to anyone, the calculator will get you one in about ten minutes. For what changed in July and what still applies, see program status. If you only need the delta between where you are and where 800-171 expects you to be — without the remediation work that follows — that narrower engagement is a gap assessment.