Deliverables built to survive audit day.
Every tier ships the Grade-1 cryptographic vault, hash-chained audit log, and continuous monitoring. The tier sets how much we drive.
Fractional vCISO, strategic advisory, and federal subcontracting are custom-scoped, not priced here. Start with a discovery call to confirm fit and scope.
Fortress
CMMC 2.0 Level 2 (Advanced) on NIST SP 800-171 Rev. 2.
CMMC 2.0 Level 2 starting block — NIST 800-171 Rev. 2 task library (110 controls, 14 families), SPRS calculator + submission, SSP template, POA&M tracker. Foundation tier — upgrade path delivers full practitioner-signed deliverables.
- ✓NIST 800-171 Rev. 2 task library (110 controls, 14 families)
- ✓SPRS score calculator and submission guidance
- ✓System Security Plan (SSP) template and drafting support
- ✓Plan of Action and Milestones (POA&M) tracker
- ✓Quarterly readiness reports
Full CMMC L2 SSP management with practitioner sign-off. C3PAO pre-audit readiness assessment, POA&M management, C3PAO-handoff-ready bundle. Your practitioner owns the SSP — not a template.
- ✓Everything in Fortress Guided
- ✓Full System Security Plan management (drafting, review, updates)
- ✓C3PAO pre-audit readiness assessment
- ✓Practitioner review and sign-off
- ✓C3PAO-handoff-ready bundle
DoD-assessor-grade CMMC deliverables. Practitioner sign-off, RFC 3161 TSA anchor on every SSP / POA&M / SPRS revision, public C3PAO verification page on every assessor-facing PDF. The assessor verifies you without asking us anything.
- ✓Everything in Fortress Managed
- ✓Recipient-verifiable SSP, POA&M, and Master Audit Report
- ✓SHA-256 + Report ID on every PDF; public verify endpoint
- ✓RFC 3161 TSA anchor on every report — DoD assessor-grade proof
- ✓Practitioner Sign & Seal embedded in tier
- ✓C3PAO-direct verification page on every assessor-facing PDF
Start with a discovery call
A free scoping conversation with a practitioner, with no commitment. We map what is in scope, walk through where your current evidence stands against the framework, and tell you what the engagement would involve.
Three levels of practitioner involvement.
2 Consultant Review hours/month, Tammie AI advisor tuned to your framework, quarterly readiness reports with practitioner sign-off. You execute; we validate.
Concierge engagement: monthly assessments, direct regulator liaison, priority queue (24-hour SLA). We operate the framework; you attest.
Managed delivery plus recipient-verifiable PDFs. Every Master Audit Report, SSP, and SPRS carries a SHA-256 + Report ID resolvable at Key 102's public verify endpoint — no link, email, or trust in our database required. See it live at portal.key102consulting.com/verify/sprs/SPRS-L1-2026-512PCZ.