Your CMMC command center.

The most common reason clients call us, and usually the fastest to resolve.

1. Confirm which contracts carry DFARS 252.204-7019/7020 and what your prime is actually asking for.
2. Run the Level 2 self-assessment against NIST SP 800-171 and calculate the score honestly, including partials.
3. Draft the SSP and POA&M that have to sit behind the number.
4. Support the SPRS submission and the affirmation that goes with it.

We prepare and support the submission. The affirming official inside your company is the one who signs it.

Raise it with the support desk

A clause landed in a solicitation or a flowdown and you need to know what it commits you to.

1. Read the actual clause and identify the level and assessment type it requires.
2. Map it against the data that contract will have you handling.
3. Establish whether you can meet it now, or what has to be built first.
4. Plan the work against the award timeline, not a generic roadmap.

We read clauses to determine technical scope. Contract interpretation questions belong with your counsel or contracting officer.

Send us the clause language

Unsure is the most common honest answer, and getting it wrong is expensive in both directions.

1. Inventory what your primes actually send you and how it arrives.
2. Check markings, contract clauses and any flowdown guidance you were given.
3. Where markings are missing or inconsistent, confirm in writing with the prime.
4. Set the level from the outcome and scope the environment around it.

We do not unilaterally designate data as CUI. The determination follows your contract and the government or prime that owns the data.

Work through the determination

Federal Contract Information only — no controlled technical data in your environment.

1. Confirm the FCI-only determination holds across every active contract.
2. Implement the 15 basic safeguarding requirements of FAR 52.204-21.
3. Assemble the evidence behind each one.
4. Support the annual self-assessment and affirmation.

Level 1 is a self-assessment. One controlled drawing changes the answer, so we re-check the determination each year.

See the Level 1 track

Controlled Unclassified Information is in play, so the full NIST SP 800-171 set applies.

1. Scope the environment — often an enclave rather than the whole company.
2. Implement across all 110 requirements and 14 families.
3. Build the SSP and POA&M, and calculate the SPRS score.
4. Maintain evidence and monitoring so the position holds up over time.

We prepare you for assessment. We are not a C3PAO and cannot assess or certify you.

See the Level 2 track

If covered defense information may be affected, the reporting clock is short.

1. Contain first — isolate affected systems and preserve logs and images.
2. Establish whether covered defense information was involved.
3. Report to DoD within 72 hours of discovery if DFARS 252.204-7012 applies.
4. Capture the timeline and evidence you will need afterwards.

The reporting obligation sits with your company, not with us. We support containment, evidence and documentation for clients; we are not a 24/7 emergency response retainer.

Open an urgent ticket