CMMC.
Done before your next DoD contract lands.
We prep your business for CMMC Level 1 — 15 basic safeguarding practices under FAR 52.204-21, senior-officer self-attestation, and SPRS submission. We map your scope, write your System Security Plan, run the gap-close, and hand you the signed package. Typical engagement is 30 to 90 days.
Past Level 1? Level 2 readiness uses the same engine →
Not sure whether Level 1 or Level 2 is your right first step? Get a tailored recommendation →
CMMC Level 1 comprises 17 practices (32 CFR 170.14(c)(2)), derived from the 15 basic safeguarding requirements in FAR 52.204-21. Your affirmation covers all 17.
The CMMC clause is showing up in DoD awards.
DoD embeds CMMC Level 1 & Level 2 self-assessment as pre-award conditions in new contracts, and those requirements are unchanged — contractors handling Federal Contract Information (FCI) need their L1 self-attestation in SPRS now. On 2026-07-13 the Department of War suspended the transition to Phase II (the mandatory third-party C3PAO assessment that had been scheduled for 2026-11-10), pending a 60-day reform review. NIST SP 800-171 Rev 2, DFARS, and the Phase I self-assessment all remain in effect — the enduring requirement is the self-attestation you can complete today.
A senior officer signs the affirmation annually. False or careless attestation creates False Claims Act exposure — this is not a check-the-box exercise. Whoever signs is the one accountable, which is why an accountable practitioner on your side matters.
That's the DoD's estimate for the number of prime and subcontractors that touch FCI and fall under Level 1. Most haven't started. The window between contract award and the affirmation due date is not generous.
SPRS scores and senior-officer affirmations are annual. Once we set you up, the engagement renews — we don't disappear after the first sign-off. The same vault, audit chain, and reports carry forward.
For CMMC Level 1, your practitioner produces the whole package.
One diagnostic engagement with Tammie and a practitioner produces every artifact your senior officer needs to sign the annual affirmation — and that survives a future contract dispute or DoD spot-check. Renew each year for the next affirmation cycle, or move into a Fortress subscription if your scope grows to CUI/L2.
We identify which of your systems touch FCI, document the boundary, and produce a signed SSP that satisfies FAR 52.204-21. No template fill-in — the SSP reflects your actual environment.
Each practice you don't yet meet — access control, identification + authentication, media protection, physical protection, system + communications protection, system + information integrity — gets a written remediation step, owner, and target date. POAM-style tracker that satisfies DoD's evidence expectations.
The signature is your senior officer's, never ours. But the engagement produces the affirmation document end-to-end: all 17 practices × YES/NO/N/A, score math, supporting evidence package, and the affirmation PDF in your vault ready for SPRS submission. Hash-anchored to the same audit chain as every other Key 102 deliverable.
L1 affirmations are annual. Each cycle the engagement refreshes the SSP, re-verifies control coverage, and produces that year's affirmation packet — so the clock never lapses between submissions.
Level 2 readiness uses the same engine.
Level 2 covers the 110 practices under NIST SP 800-171 Rev. 2 and handles Controlled Unclassified Information (CUI). It requires a C3PAO assessment for high-priority programs and is the path Defense Industrial Base primes typically need. Typical Fortress L2 engagement runs 6 to 9 months and produces an assessment-ready package the C3PAO walks against.
Same vault, same audit chain, same practitioner. Different engagement depth.
The platform automates the 110-control scaffolding, evidence collection, and SPRS math; your practitioner spends their time on judgment, not busywork — so you get assessor-grade L2 deliverables (SSP, POA&M, SPRS) at a fraction of a bespoke consulting engagement.
The same backbone every Key 102 engagement runs on.
Every quarterly readiness report is signed by a named, accountable practitioner — name on the page, not an AI byline.
Every file fingerprinted at upload. If a byte changes, we can prove it.
Every action chains to the previous one. Nobody can rewrite history without breaking the chain.
Reports are sealed by an independent timestamping authority. Your assessor can verify the date themselves.
Get your Level 1 done.
For Level 1, your engagement is the package: the SSP, the 17-practice gap analysis, and your SPRS affirmation packet — signed by your senior officer, hash-anchored in your vault, ready for the file. Renew annually.