CMMC Level I self-assessment is now a requirement for small businesses handling Federal Contract Information under DoD contracts — no third-party certification needed, but getting the scope and evidence right on your own is harder than it looks. We specialize in exactly this: small businesses on standard tools like Google Workspace, with no in-house compliance team, who need it done right without an enterprise-scale engagement.

What's included:

• FCI boundary scoping — identifying exactly which systems, accounts, and data are in scope (and confirming what isn't)

• Gap assessment against all 15 required practices under FAR 52.204-21

• Evidence collection guidance — what actually counts as adequate documentation, and how to build a retention-ready file

• A final assessment report and methodology memo for your records

• Direct support for your senior official through the SPRS affirmation process

• Optional annual re-affirmation retainer

Who this is for:

• Small businesses newly encountering CMMC in a contract or solicitation

• Organizations handling FCI only — not Controlled Unclassified Information (CUI)

• Businesses running on standard commercial IT (Google Workspace, Microsoft 365) with no dedicated security or compliance staff

• Prime contractors who need their subcontractors to demonstrate compliance

What this isn't:

• CMMC Level II certification, which requires assessment by an accredited C3PAO — if your environment involves CUI, we'll tell you directly and point you toward the right path rather than take on work outside our scope

• A guarantee of any specific outcome — no advisor can promise a passing assessment, only a properly scoped and evidenced one

Generic policy libraries and templated risk assessments look complete on paper but rarely hold up under real scrutiny, because they were never built around your actual operations. We assess your organization's real risk landscape and obligations first, then build governance and policy practices that fit what you actually do — the same discipline applied to enterprise programs, scaled to your size, and built to be sustained rather than shelved after one audit.

What's included:

• Company-wide or targeted security risk assessments, scoped to your environment

• Policy library development and review, coordinated with legal/compliance stakeholders

• Regulatory and framework alignment (ISO 27001, NIST 800-53, SOC 2, and others as relevant)

• Pre-audit readiness support (e.g., ahead of FINRA, SOC 2, or similar reviews)

• Security program design and ongoing governance advisory

Who this is for:

• Organizations that need a security program grounded in their actual operations, not a generic checklist

• Businesses preparing for a specific regulatory or client-driven audit

• Leadership teams that need buy-in and documentation across departments, not just a technical fix

• Organizations whose risk profile doesn't fit neatly into a single off-the-shelf framework

What this isn't:

• A templated policy package dropped in with no customization to your environment

• A substitute for legal advice — policy work is coordinated with, not a replacement for, your legal counsel

• A one-time engagement with no path to sustaining the program afterward (an ongoing advisory relationship is available if useful)

Annual Compliance Retainer

Level I status isn't a one-time achievement — it requires annual re-affirmation, and evidence that was accurate last year can quietly go stale as accounts change, staff turn over, or tools get swapped out. The retainer exists so re-affirmation is a quick check-in each year, not a full re-assessment from scratch.

What's included:

• Annual review of your evidence file against current practices

• Confirmation that scope hasn't changed (new systems, accounts, or vendors)

• Support for your senior official through the yearly SPRS re-affirmation

• Priority access if a gap needs quick remediation before re-affirmation is due

Who this is for:

• Existing Level I Advisory clients who want ongoing coverage rather than starting over each year

• Organizations whose environment changes enough year to year that evidence needs active upkeep