CMMC Level 1 and Level 2 readiness and fractional vCISO leadership for Defense Industrial Base contractors. Gap assessment, NIST SP 800-171 alignment, SSP and POA&M development, SPRS scoring, and assessment preparation — delivered by a former DoD Information System Security Manager, not a reseller.
CMMC is an evidence exercise. The certificate follows the documentation, and the documentation follows an honest assessment of where you actually stand. That is the order we work in.
We inventory where Federal Contract Information and Controlled Unclassified Information actually live in your environment, assess each applicable control, and produce your current NIST SP 800-171 self-assessment score for SPRS. You finish this step knowing your real number rather than an optimistic one.
The System Security Plan documents how your environment implements each control. The Plan of Action & Milestones records what is not yet met and how it closes, with owners and dates. These are the two artifacts an assessor asks for first, and the two most contractors do not have in defensible shape.
Closing gaps against the 110 controls — access control, audit and accountability, configuration management, incident response, media protection. Prioritised by assessment weight and by what your contract vehicle actually requires, so effort goes where it moves the score.
Executive-level security leadership without a full-time hire: security roadmap, policy ownership, vendor and supply-chain review, continuous SSP and POA&M maintenance, and assessment preparation when the C3PAO date lands. Compliance is a posture, not a project that ends.
If your company holds or pursues DoD contracts that involve FCI or CUI, CMMC applies to you. That includes small subcontractors several tiers down from the prime, who often carry the same control obligations with none of the compliance staff. Those are the engagements this practice is built around.
Open SecuAudit Toolkit from O Williams Consulting. Sign in or create an account to continue.
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense's framework for verifying that contractors protect Federal Contract Information and Controlled Unclassified Information. If your company holds or pursues DoD contracts that involve FCI or CUI, CMMC requirements apply to you — including small subcontractors in the Defense Industrial Base.
Level 1 covers 17 basic safeguarding practices for Federal Contract Information and allows annual self-assessment. Level 2 aligns with the 110 controls of NIST SP 800-171 for protecting Controlled Unclassified Information. The CMMC rule requires a third-party (C3PAO) assessment for most Level 2 contracts; DoD paused that Phase 2 rollout in July 2026 pending a reform review, while Level 2 self-assessment and SPRS reporting continue.
No. On July 13, 2026 the Department of Defense suspended CMMC Phase 2, which would have made C3PAO-certified Level 2 a condition of award starting in November 2026, and opened a 60-day reform review. DFARS 252.204-7012 still contractually requires NIST SP 800-171, Phase 1 self-assessments and SPRS scores still apply, and the clauses already in your contracts did not change. The suspension moved the certification date, not the requirements. Contractors who keep closing POA&M items now will be ready whenever the task force's recommendations land.
A virtual CISO gives you executive-level security leadership without a full-time hire: risk assessments, security roadmaps, policy development, NIST 800-171 alignment, SSP and POA&M ownership, vendor review, and audit preparation — scaled to a fraction of the cost of a salaried CISO.
The System Security Plan (SSP) documents how your environment implements each NIST 800-171 control. The Plan of Action & Milestones (POA&M) tracks the controls you haven't fully met and how you'll close them. Both are foundational evidence for CMMC assessment and SPRS scoring.
We serve Maryland, Washington DC, and Virginia in person — including residential technology services for DMV homeowners — and work with defense contractors and growing businesses remotely nationwide.
Start with a gap assessment and a real SPRS number. No sales layer, straight to the operator.
Book a CMMC Consult — oliver@gratus1.io