02 / Build / CMMC readiness
CMMCReadiness Consulting
Get ready for CMMC, and stay ready.
If you handle controlled unclassified information for the Department of Defense or its primes, CMMC decides whether you keep the work. We take you from scope to evidence, then operate the controls so you stay compliant between assessments.
New for defense suppliers
Brilliant at the Basics. The Department of War’s IT and OT Top 10 cybersecurity practices for small suppliers, and how our services help you meet each one.
Current status, October 15, 2026
DoD suspended CMMC Phase 2 on July 13, 2026, so third-party (C3PAO) assessments are not being required in new or existing contracts while a reform task force reviews the program. Level 1 and Level 2 self-assessments, SPRS scores, annual affirmations, and DFARS 7012 with NIST SP 800-171 still apply, and voluntary C3PAO assessments remain available. Readiness work still matters: your self-assessment score, evidence and affirmations depend on the same practices. See the details.
What you get
- Scoping of your CUI environment and the requirements flowing down from your customers
- A gap assessment against the required practices
- A system security plan, policies and a plan of action
- Remediation support and evidence preparation for assessment
- Ongoing monitoring and operation of the controls
- Secure enclave design and build for your CUI, or integration of FedRAMP-authorized cloud solutions
- A shared responsibility matrix showing which controls we cover for you
CMMC is a puzzle sized to you: a 10-piece set for a small enclave, a 100-piece program for a complex environment, built around the tools you already own. See how we fit security to you.
Which level do you need?
| Level | Applies to | Practices |
|---|---|---|
| Level 1 | Federal contract information | 15 |
| Level 2 | Controlled unclassified information | 110, aligned to NIST SP 800-171 |
| Level 3 | Highest-priority programs | Level 2 plus a subset of NIST SP 800-172 |
Results
Multiple Logos clients have passed their CMMC Level 2 C3PAO assessment with no plan of action and milestones (POA&M). Assessments are performed by independent C3PAOs.
Typical timelines
| Level | Typical timeline | Notes |
|---|---|---|
| Level 1 | 30 to 90 days | Self-assessment for federal contract information |
| Level 2 | 6 to 12 months | The most common path for organizations that handle CUI |
| Level 3 | Scoped individually | Highest-priority programs |
Timelines vary with your scope, your starting point and assessment scheduling.
How an engagement runs
- Scope. Define the CUI boundary, because it drives cost and effort.
- Assess. Measure your environment against the requirements.
- Design and build. Close gaps, including a secure enclave where it makes sense.
- Document. System security plan, policies, shared responsibility matrix and plan of action.
- Prepare and operate. Evidence, readiness check and ongoing monitoring of the controls.
Credentials
Our team is CCP-trained or better. William Birchett holds Cyber AB Lead CCA, CCA and CCP credentials, along with CISSP, CISM and CISA. We prepare you for the assessment; an independent assessor performs it.
Build once. Comply many.
We run compliance on the Secure Controls Framework (SCF): one control set mapped to the frameworks you need, so the work is connected instead of repeated. See how we use SCF.
Check where you stand
Take a short readiness check for CMMC Level 1, CMMC Level 2, HIPAA and HITECH, or Texas SB 2610. Not sure what applies? Book a scoping call. It works for any framework.