A defined, five-step assessment

Typical timeline: 4–10 weeks from kickoff to final report, depending on scope and readiness.

1. 01

   Scoping call

   A short call to confirm the assessment boundary, in-scope assets, CUI flows, and stakeholders.

2. 02

   Readiness / mock review

   Independent review of your System Security Plan, policies, and supporting documentation against NIST SP 800-171.

3. 03

   Assessment

   Examine evidence, interview personnel, and test controls against all 110 NIST SP 800-171 requirements (320 objectives).

4. 04

   Findings & report

   Each objective documented as MET, NOT MET or not applicable — with traceable evidence and SPRS-aligned scoring.

5. 05

   Certification path

   Final assessment record and supporting artifacts ready for the official CMMC Level 2 certification engagement.