CMMC / Gap assessment
All 110 controls, scored the way an assessor scores them.
A gap assessment is only useful if it distinguishes between a control you have implemented but cannot prove, and one you have not implemented at all. Those two look identical on most reports and they need completely different work.
What you get back
Control-by-control scoring
All 110 controls against the NIST SP 800-171A assessment objectives, not a summarized family-level rating.
Implemented vs unevidenced
Split explicitly. A control you are already meeting but cannot prove needs an artifact, not a project.
Your SPRS score
Calculated with the DoD methodology, with the arithmetic shown so you can reproduce it.
A populated POA&M
Every open item with an owner, a date and a source, ready to drive the remediation.
Scope findings
Which assets are CUI Assets, Security Protection Assets, Contractor Risk Managed or Specialized. Scope errors are expensive later.
An honest timeline
Including which items have a real clock on them, because scan history and log retention cannot be created retroactively.
Why the split matters more than the score
In practice a large share of what a first assessment flags is already being done. The endpoint protection is deployed, the passwords are complex, the backups run. What is missing is the artifact that proves it on the day somebody asks.
Treating those as equivalent to genuine gaps inflates the apparent size of the program, frightens people, and sends effort at problems that do not exist. We separate them because the remediation is different: one needs a screenshot and a schedule, the other needs a project.
Know where you actually stand.
Most companies are further along than the first report suggests, and behind on the two or three items that take real elapsed time. We will tell you which is which.
If you are a defense supplier under 25 people, start with the grant. Cyber Grants Alliance, a nonprofit, awards a fully funded gap assessment. It costs you nothing and you are under no obligation to buy anything afterwards, from us or from anyone.