CMMC Level 2 · Defense suppliers of 1 to 5 people
CMMC In A Container™
Jenna runs a one-person shop. She is going through CMMC Level 2 right now. Watch her say what it actually took. We did not write her script and we did not edit out the hard parts. Then decide whether you want the same thing.
Sound familiar?
We do not want to build our own CUI environment.
A full GCC High migration typically runs six to eighteen months, with real disruption to the business while it happens.
Somebody told us to just move the whole company to GCC High.
GCC High licenses run about three times a standard Microsoft 365 seat, and most of a shop floor never touches CUI.
We cannot be a compliance department and a shop at the same time.
Keeping policies and evidence current after the assessment is its own ongoing job, every month, not a one-time project.
One of us would have to become the ISSO.
Every requirement needs an owner. In a five-person company, that is whoever is left once everything else is covered.
We are not sure who explains the plan to an assessor.
Somebody has to be able to speak to it, not just have it on file.
We do not want a new project. We want it handled.
An environment already built, the paperwork that proves it, and someone who owns it with you.
What you get
3 PARTS, PLUS ONE DISTINCTIONAn environment, the paperwork that proves it, and someone who owns it with you.
The container
A FedRAMP Moderate Authorized cloud environment holding all of your CUI. Email, file sharing, an isolated browser for prime portals, logging and training records. CUI never lands on your laptop, which is what keeps your assessment small.
Authorized, not Equivalent
Our environment is FedRAMP Moderate Authorized, so its accreditation already exists. It is not a body of evidence you have to build and defend yourself.
The paperwork
System Security Plan. Plan of Action and Milestones. Asset inventory. Authorized User List. CUI flow, network boundary and physical site diagrams. The full policy set. These are the artifacts an assessor asks for first, and a missing one is the most common finding there is.
The program
Your SPRS score, calculated honestly and posted. Quarterly review. Evidence collected on a schedule so it exists with real dates rather than being manufactured the week before an assessment. Annual affirmation preparation. We are your Managed Compliance Provider and your MSSP, and we stay after go-live.
How it runs
Then it keeps running.
Stand it up
Scoping call, intake, environment built, your data migrated.
Write it
Documentation drafted against your actual environment, not a template.
Deliver and score
SSP, POA&M and diagrams delivered. SPRS score calculated with you.
Keep it alive
Training, then quarterly review, evidence, POA&M closure, affirmation prep.
Pricing
PUBLISHED, CALL US TO GET STARTEDPublished, because you should not need a sales call to learn a number.
The term is 36 months. After that it is month to month with 60 days notice, and on exit you keep every document we produced in editable form.
Solo · 1 user
Five · up to 5 users
The Department of Defense's own CMMC 2.0 Regulatory Impact Analysis puts a small entity's Level 2 assessment by a C3PAO at $104,670 over three years, assuming the security requirements are already in place. That is the assessor's cost, separate from ours. Our 36-month Solo total is $42,000, for the build and the managed program, C3PAO fee not included. Five's 36-month total is $123,000, more than that estimate, not less. The two are not the same purchase: theirs is the assessment, ours is the environment and the work that gets you ready for it.
Platform licensing is included at cost, no separate line, no markup. Your term is a commitment to us, not to a vendor we picked, so if a better environment appears we move you inside your term at no charge. Prices hold for 30 days.
Questions
THE ONES WORTH ASKING FIRSTDoes this certify me?
No, and be careful with anyone who says otherwise. This is readiness. Only an authorized C3PAO can certify you and only the Department of Defense can accept a score.
Who signs the annual affirmation?
Your Affirming Official does, in SPRS. We prepare it and tell you plainly what is and is not implemented. Signing an inflated score is a False Claims Act matter and it stays with you, which is exactly why we will not put a number in front of you that we cannot defend.
Why a 36 month term?
Compliance is not a project with an end date. Evidence has to keep accumulating with real dates on it and the affirmation is annual, so the term matches the obligation rather than the build. After 36 months it is month to month with 60 days notice, and on exit you keep every document we produced in editable form.
Do you take custody of our CUI?
No. Our administrative access is limited and logged. Any privileged access is requested, approved by you in writing, time limited and recorded.
Where is this the wrong answer?
Once more than a handful of people touch CUI, or a large existing network has to come into scope, the container stops being the cheap answer. Tell us on the call and we will say so rather than sell it to you.
What is excluded?
C3PAO assessment fees, hardware, third-party licensing outside the container, legal advice, and remediation of your existing endpoints, servers or networks. That last one is quoted separately once we have seen it.
Book a 30-minute call.
BOOK A CALLThirty minutes usually settles whether the container is right for your shop. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Let us draw the boundary with you.
A scoping call is a conversation, not a pitch. Thirty minutes usually settles whether the container is right for your shop. If it is not, we will say so.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.