COMPLIANCE & AUDIT READINESS
Your Defense Contract Requires Security Evidence. Start With the Contract and Boundary.
A solicitation asks for a CMMC status. Your system security plan no longer matches the environment. Evidence owners cannot support a self-assessment. We provide scoped readiness support connecting contractual requirements, information flows, controls and remediation evidence.
Free 30-minute CMMC readiness strategy call. No obligation.
01
EXPERTISE. LED BY TEMI.
Every engagement is led by Temi. Over two decades of security, audit and governance experience, applied to your business.
02
Agree the engagement boundary
The CMMC Level 2 Gap Assessment below has one agreed assessment boundary and defined inclusions and exclusions. It reviews existing evidence and the SSP, prepares a draft SPRS worksheet and remediation/POA&M register, and includes a management walkthrough. New SSP or policy creation, technical remediation, additional assessment boundaries and certification fees are excluded. No fixed turnaround is promised. Wider readiness activities described on this page require a separate agreed scope.
03
Read the current requirement before scheduling an assessment
Current review: 14 October 2026 UTC. The Department's July 2026 memorandum suspended the planned November 2026 Phase II transition and directed Level 1(Self) or Level 2(Self) requirements during the suspension. It retained baseline security duties, including DFARS 252.204-7012, and described Level 2 alignment with NIST SP 800-171 Revision 2. The current solicitation, contract, modifications and official guidance need review before deciding the required status or assessment route.
Confirm the current contract and required status before scheduling an assessment.
04
Establish where FCI and CUI are handled
The proposed review documents the relevant Federal Contract Information and Controlled Unclassified Information flows, system boundary, external service dependencies and responsible owners. Systems outside the proposed boundary need defensible treatment; exclusions do not follow from wishful scope reduction.
We review the contract and applicable assessment criteria before choosing a requirement set. Publishing a newer NIST revision does not automatically change the criteria incorporated into a specific program or contract.
05
When readiness support is useful
The review can help a contractor entering a new solicitation, a supplier responding to a prime's evidence request, or a team reconciling a previous self-assessment with the controls now operating. It can also help management plan after a deferred or unsuccessful assessment, establish its first SSP, or understand what changed after a new system, site or service provider was introduced.
Bring the actual request and any prior findings. We record which decision is needed, who can make it and what evidence is missing before proposing the work.
06
NIST SP 800-171 readiness within the same evidence plan
NIST SP 800-171 addresses protection of CUI in nonfederal systems and organizations. CMMC concerns assessment of the applicable protections. The work starts by identifying the governing revision and assessment route, then connects each selected requirement to the same boundary, implementation description, evidence and remediation record. Where both reviews apply, this creates a consistent working record without treating the two processes as interchangeable.
NIST has published Revision 3. That publication does not, by itself, settle which revision governs your contract. A proposed review records the cited edition, relevant contract clauses and modifications, applicable deviations, and questions that need resolution by the contracting or legal owner. References to NIST SP 800-172 or ITAR/EAR are investigated separately when relevant; they are not assumed to be included in a Level 2 readiness engagement.
07
Trace the information before drawing the boundary
Start with the information your organization receives, creates, stores, processes and shares for the relevant work. Record its origin, contract context, markings and handling instructions. Engineering files, specifications, research records, personal information or export-controlled material need classification review in context; a filename or category label alone is not enough to settle the treatment.
The boundary record follows information through people, endpoints, servers, cloud services, external connections, facilities and suppliers. It identifies responsible owners, security dependencies, proposed exclusions and unanswered questions. Client-approved evidence-sharing arrangements are agreed before any controlled information is requested or transferred.
08
What we assess
| Workstream | Evidence focus |
|---|---|
| Requirement and boundary | Contract clauses, required status, scope, information flows and external dependencies |
| System security plan | Current implementation descriptions, system facts and requirement references |
| Practice/evidence review | Operating records, interviews and scoped walkthroughs against applicable criteria |
| Deficiencies and plans | Missing implementations, unsupported assertions, actions and permitted treatment |
| Management affirmation readiness | Evidence supporting the organization's own status and affirmation decisions |
09
Review coverage across the applicable control families
When Revision 2 is the agreed reference, the review matrix uses its fourteen security requirement families. The examples below describe evidence topics to scope, rather than a claim that we have implemented or tested every requirement.
| Family | Readiness evidence to discuss |
|---|---|
| Access Control | Account permissions, privileged access, access reviews and information-flow restrictions |
| Awareness and Training | Role-specific learning, attendance records and staff responsibilities |
| Audit and Accountability | Logging coverage, review ownership, record protection and retention decisions |
| Configuration Management | Baselines, inventories, change approvals and configuration records |
| Identification and Authentication | Identity lifecycle, authentication arrangements and evidence of MFA use |
| Incident Response | Response plans, escalation contacts, exercise records and reporting responsibilities |
| Maintenance | Maintenance activities, authorized personnel and remote support arrangements |
| Media Protection | Storage, transfer, handling and disposal records |
| Personnel Security | Screening and joiner, mover and leaver responsibilities |
| Physical Protection | Facility access, visitor records and protection of work areas |
| Risk Assessment | Risk review, vulnerability information and treatment decisions |
| Security Assessment | Assessment evidence, action plans, review cadence and SSP currency |
| System and Communications Protection | Boundary protection, communications safeguards and encryption evidence |
| System and Information Integrity | Flaw handling, malicious-code safeguards and security-alert follow-through |
The contract/scope memo identifies the exact criteria used; the family list does not replace requirement-level review.
WHAT YOU GET
10
What you receive
| Deliverable | Contents | Purpose |
|---|---|---|
| Contract/scope memo | Applicable requirement set, assessment route, assumptions and unresolved issues | Prevent planning against an obsolete deadline or wrong standard |
| Information-flow/boundary record | FCI/CUI handling, systems, dependencies and owners | Confirm what needs evidence |
| Readiness gap register | Criteria, implementation/evidence status and limitations | Separate demonstrated controls from unsupported answers |
| SSP improvement record | Inconsistent descriptions and missing facts | Align documentation with the actual environment |
| Remediation/evidence plan | Priorities, owners, dependencies and closure criteria | Support a responsible self-assessment or later required assessment |
| Management readout | Material gaps and required decisions | Determine the next readiness milestone |
11
See how evidence and open actions are recorded
Fictional sample — no customer information
Review a fictional Governance Blueprint assessment to see how findings, evidence references, owners and closure conditions can be organized. This sample is not a CMMC assessment, an SPRS score or a certification result. The approved Level 2 gap-assessment scope and exclusions below define this offer.
The sample illustrates presentation. Your engagement scope defines the work.
12
Build documents that reflect the environment
If documentation development is included in the agreed scope, the SSP working draft brings together the boundary, operating environment, external relationships and implementation descriptions. An evidence matrix links each reviewed criterion to its owner, artifact, collection period, location, review result and unresolved limitation. Missing evidence remains visible rather than becoming an unsupported statement of compliance.
A policy and procedure index records what already exists, what needs updating, the responsible owner, approval status and supporting operating record. The document set is sized to the environment and requirements; a fixed document count is not used as a substitute for coverage. The client reviews and approves statements about its systems and practices.
13
Give each gap a responsible next step
The remediation register identifies the issue, affected criterion, supporting observation, proposed action, interim mitigation where appropriate, owner, dependencies, target date and closure evidence. Where a Plan of Action and Milestones (POA&M) is appropriate, those details support its preparation and review.
Placing a gap in a plan does not make it resolved or establish that a particular assessment permits it. The review records which treatment rules need checking and which decisions remain with the client and the relevant assessment or contracting authority. Closure requires evidence that the agreed action has been completed, with any required verification separately scoped.
14
Reconcile assessment evidence before an official submission
Where score preparation is agreed, a working assessment record ties each scoring decision to the applicable published methodology, system boundary, evidence and unresolved assumptions. We can help reconcile a previous score with the available implementation record and prepare a discrepancy list for management review. The draft is clearly dated and distinguished from a submitted result.
The client designates the authorized organizational owner for the official portal, representations and affirmation. Any submission support needs an agreed scope, approved data and a verified route. Readiness documentation does not authorize us to submit, affirm, change an official score or access a client's government account.
15
How the work proceeds
Review the contractual requirement and boundary first. Request the SSP and existing assessment evidence. Interview owners and review scoped evidence. Reconcile gaps and documentation. Present the remediation plan and remaining decision requirements.
Technical implementation, an official score submission, affirmation, handling CUI in our systems and later third-party assessment support require separate authorization and defined safeguards. The client approves its own representations and official submissions.
16
Coordinate remediation with the people who operate the systems
The handoff separates the security outcome from the work needed to achieve it. For access restrictions, MFA, encryption, logging, configuration changes, training or incident-response procedures, the plan records the responsible technical or business owner, prerequisites, change approval, planned evidence and follow-up decision.
Our proposed readiness scope can organize that work and review the evidence returned. System configuration, deployment, live testing, security monitoring, incident response and operation of controls require a separately agreed delivery scope and confirmed capability. Implementation and test results are never inferred from a policy document or a planned task.
17
Prepare people and evidence for the next review
An evidence walkthrough can identify missing artifacts, inconsistent SSP descriptions, questions for control owners and material that is difficult to retrieve. Interview preparation helps owners explain the implementation they are responsible for and distinguish demonstrated operation from planned improvements.
If the client's required route involves an external assessor, the readiness plan can record questions, evidence requests, handoff responsibilities and scheduling dependencies for client review. Assessor selection, eligibility, appointment and any full mock or official assessment remain separate decisions. No assessment slot, result or certification is promised.
18
Include prime, subcontractor and service-provider dependencies
The supplier register connects each relevant provider to the information it handles, systems or safeguards it supports, contractual requests, available evidence and internal owner. It helps a prime or subcontractor identify missing assurances and prepare questions about possible flowdown obligations before relying on another party's statement.
Contract language and information flows determine the review. The client retains responsibility for its contract decisions, supplier communications and representations. A supplier questionnaire or an external certificate is recorded with its scope and limitations rather than treated as proof that the entire boundary is ready.
19
Keep the evidence record useful after the first review
A separately scoped recurring review can track remediation progress, changed systems or information flows, policy approvals, evidence refresh dates and decisions needed before the next self-assessment, affirmation or external review. Management receives an updated action list with overdue items, accountable owners and material changes to assumptions.
The cadence is agreed around the client's obligations and operating needs. Incident-response planning can include escalation ownership and reporting-route checks, while any response operation or official report remains separately authorized. Recurring readiness review does not imply continuous technical monitoring or emergency-response coverage.
20
CMMC Level 2 Gap Assessment
| Scope | Details |
|---|---|
| Starting price | From US$5,000. Final fee confirmed after scoping. |
| Boundary | One agreed assessment boundary |
| Included | Existing-evidence and SSP review; draft SPRS worksheet; remediation/POA&M register; management walkthrough |
| Excluded | New SSP or policy creation; technical remediation; additional assessment boundaries; certification fees |
| Delivery | Confirmed after delivery effort and scope are validated. No fixed turnaround promised. |
Start with one agreed assessment boundary. We review existing evidence and your system security plan, prepare a draft SPRS worksheet and remediation/POA&M register, and walk through the findings with management. The final fee is confirmed after scoping.
New SSP or policy creation, technical remediation, additional assessment boundaries and certification fees are excluded. Any wider readiness work below requires a separate agreed scope. Delivery is confirmed after effort is validated; this offer does not promise a fixed turnaround.
Choose a scope before committing to the wider programme
| Proposed scope | What the proposal can cover | Decision it supports |
|---|---|---|
| Initial readiness review | Requirement and boundary review, evidence gaps and remediation priorities | What needs attention before the next contract or assessment milestone |
| Documentation and evidence development | Agreed SSP drafting, policy/procedure updates, POA&M support and evidence indexing | Who must complete, review and approve the working record |
| Review preparation | Owner interviews, evidence walkthroughs and an open-question list | Whether evidence and responsibilities are ready for the planned review |
| Recurring readiness governance | Agreed progress reviews, document refresh and change tracking | What management needs to address as the environment changes |
The written proposal identifies deliverables, review depth, assumptions, client inputs, responsibilities, acceptance criteria, fees and timing. Any technical implementation, assessor charges or third-party tools are identified separately if relevant. Payment terms and any ongoing commitment are agreed in writing; no source-site package, price or payment model is carried into this proposal.
Existing ISO 27001 or SOC 2 work can be reviewed for reusable evidence. The comparison checks the actual boundary, requirement, evidence period and implementation rather than assuming that a certificate, report or matching control label removes work. Any reduction in effort follows verified reuse and the agreed scope.
Questions before readiness work
Are all defense suppliers in the same CMMC scope?
No. The contract, information handled, system boundary and current official requirements determine the review.
Is the Phase II deadline still an appropriate sales claim?
No. The official suspension is reflected above. Requirements need another current-source check at engagement and publication.
Do you issue CMMC certification?
No. Our proposed service supports readiness. An official assessment or status follows the applicable program requirements and authorized process.
Will you submit our score or affirmation?
Submission is an organizational action requiring explicit authorization and a verified official route. It is excluded from the default readiness scope.
What does the service cost?
A written scoped proposal confirms the fee, depth and schedule.
How is NIST SP 800-171 different from NIST SP 800-53?
Does handling CUI automatically settle the assessment route?
No. It is a reason to investigate the applicable protections and contract requirements. The required CMMC status and assessment route must be confirmed against the actual solicitation or contract and current official guidance, including the programme note above.
What if our previous score or SSP does not match today's environment?
Start by recording the discrepancies and the evidence needed to resolve them. The proposed review can reconcile scope, implementation descriptions and draft assessment decisions before the authorized organizational owner decides how to address official records.
Can a POA&M guarantee a successful assessment?
No. A remediation plan documents work to do. Whether a gap is permitted, what must be closed and the applicable assessment outcome require review under the governing rules. We do not promise that an open item will be accepted.
How long does readiness take?
The schedule depends on the boundary, evidence quality, implementation gaps, owner availability and external dependencies. An initial review supports a realistic sequence of milestones. No universal completion period or assessor availability is promised.
What if a previous assessment was unsuccessful or a contract milestone is at risk?
Bring the findings and the relevant contractual request. We can help organize the evidence and corrective actions for the next decision. The client should resolve contract eligibility, legal consequences and any representation concerns with its contracting and legal advisers; readiness work does not guarantee an award, renewal or assessment result.
Will an ISO 27001 certificate or SOC 2 report replace this work?
We review potentially reusable evidence against the selected criteria and boundary. Reuse is documented where it is supported. The existence of another report or certificate does not by itself establish the result of this readiness review.
Are assessor fees included?
Any external assessor engagement is separate unless the written proposal expressly says otherwise. The proposal identifies our agreed work and any dependencies so the client can plan the overall budget.
Make the next contract decision with supporting evidence
Bring the solicitation or contract requirement, your information-flow view and current SSP. We will discuss the review boundary and evidence needs.
Free 30-minute CMMC readiness strategy call. No obligation.