CMMC Level 2 Readiness

We help you prepare. We don’t certify. White Pine Labs is not a C3PAO (Certified Third-Party Assessment Organization) and does not conduct CMMC certification assessments. Our work gets you ready for the assessment; a C3PAO performs it.

What it is

A gap assessment of your environment against the 110 security requirements in NIST SP 800-171, which CMMC Level 2 is built on. We look at what you have in place, what’s missing, and what’s documented, then turn it into a prioritized remediation roadmap.

Who it’s for

• Defense suppliers handling Controlled Unclassified Information (CUI)
• Companies that received a DFARS 252.204-7012 flow-down from a prime
• Companies that need an honest SPRS self-assessment score before they submit one

What’s included

1. Scoping. Where CUI lives, who touches it, and which systems are in scope. Getting this right can shrink the work considerably.
2. Requirement-by-requirement review. Interviews, configuration review, and document review against each NIST SP 800-171 requirement.
3. Documentation review. Your System Security Plan (SSP) and policies, or what’s needed if you don’t have them yet.
4. Remediation roadmap. Gaps in priority order, with effort estimates and a draft Plan of Action and Milestones (POA&M).

What’s not included

• A CMMC certification assessment or any certification decision
• A guarantee that you will pass a certification assessment
• Implementing the fixes. Hands-on implementation help is available as a separate, follow-on engagement.

What you get

• A gap report with the status of each requirement and the evidence we looked at
• An estimated SPRS score with the reasoning behind it
• A prioritized remediation roadmap and draft POA&M
• A walkthrough with your leadership and IT

What we need from you

• A signed agreement
• Time with your IT lead and whoever owns contracts and CUI
• Any existing SSP, policies, network diagrams, and prior assessments