110 requirements stand between your company and its next defense contract.
Ready Room shows you where you stand on every one of them, then gets you ready for your assessment.
Ten minutes, no cost. Scored with the DoD’s own point values. We never ask for CUI, passwords or system details.
The rollout has reached the part that decides contracts.
From November 10, 2026, Level 2 certification by an authorized third-party assessor (a C3PAO) can be written into new defense contracts as a condition of award. Most small companies need several months to get ready, and assessor calendars fill early. Primes are already asking suppliers for their plan.
Phase 1
Self-assessments for Level 1 and Level 2 can be required.
Phase 2
Third-party Level 2 certification can be required for award.
Phase 3
Level 3 assessments begin, and Level 2 certification extends to option periods.
Phase 4
Full implementation across applicable contracts.
Your results, the way a pilot reads a display.
One status you can’t misread, how far you are from the certification line, and a warning light for each of the 14 security families. This is a sample for a typical 30-person machine shop. Yours takes ten minutes.
From “where do we start?” to ready for assessment.
The same path every time, priced up front.
- 1
Take the free score check
About 25 plain-English questions. Your estimate uses the DoD Assessment Methodology: start at 110, subtract 1, 3 or 5 points for each gap. You get a range, because ten minutes can’t verify evidence.
- 2
Read your report
In under a minute: your score range, Level 1 or Level 2, your requirement map, your top five gaps in business language, and fixes you can make this week.
- 3
Close the gaps with an engineer
A fixed-price Readiness Snapshot, then the full plan: System Security Plan, plan of action, policies and evidence, built alongside your IT provider.
Fixed scope. Published prices.
Every engagement starts with the free check and moves one step at a time. Founding Clients, the first 10 companies, keep founding rates for a year and get priority scheduling.
Readiness SnapshotFounding Client price
Five-day review of all 110 requirements with your team, a gap report and a prioritized plan with timeline and budget. The fee is credited toward your Readiness Project.
Readiness Project
Full gap assessment, System Security Plan, plan of action and milestones, policies, procedures and evidence.
Mock assessment
A full practice run, the way your C3PAO will run it, before the real thing.
Ongoing compliance
Monitoring, evidence upkeep, policy updates and support for your annual affirmation.
The same discipline, for any office that holds sensitive data.
Defense subcontractors
CMMC Level 1 and Level 2, NIST SP 800-171, System Security Plans, SPRS scores and DFARS 7012 incident reporting.
Tax, CPA and mortgage offices
The FTC Safeguards Rule requires a written information security plan, and the IRS asks preparers to confirm they have one. A complete plan in one week, about $1,500.
Medical and dental practices
The HIPAA Security Rule requires a documented risk analysis. We do the analysis and the plan that follows, from about $2,500.
Sean McDonald
Founder. Systems and security engineer, Melbourne, Florida. In naval aviation, the ready room is where a crew is briefed before a mission. That’s the job here: brief you, prepare you, and send you into your assessment ready.
Book a 15-minute call- ProgramMore than ten years in defense cybersecurity and compliance on the F-35, including sustainment and ALIS logistics systems.
- CompaniesLockheed Martin and BAE Systems.
- ComplianceScrum Master for the BAE Systems–Lockheed Martin compliance project. Hands-on STIG compliance and classified systems security engineering.
- ClearanceActive Secret clearance.
- How he worksPlain English, fixed prices, and side by side with your IT provider rather than in place of them.
This site follows its own advice.
A compliance firm should pass its own test. Here is what we built in, and what we left out.
Straight answers.
Do I need Level 1 or Level 2?
If you only handle basic contract information (FCI), usually Level 1: an annual self-assessment of 17 practices. If you receive or create Controlled Unclassified Information (CUI), usually Level 2: all 110 NIST SP 800-171 requirements, most often with a third-party assessment. The score check asks this first.
Is the score check an official score?
No. It’s a planning estimate using the DoD’s point values, shown as a range. Your official SPRS score comes from a full self-assessment against your System Security Plan, and certification comes from an authorized assessor.
Do you certify companies?
No. Certification is done by an authorized third-party assessor (C3PAO). We prepare you for that assessment. The program keeps preparation and assessment separate on purpose.
Can we pass with a few gaps?
Sometimes. Some requirements can sit on a plan of action for up to 180 days, but only with a score of at least 88 and the highest-value requirements in place. The Snapshot tells you exactly which gaps qualify.
We already have an IT provider. Do we still need you?
Usually. IT providers keep systems running. CMMC also needs documentation, policies, evidence and a plan an assessor will accept. We work with your provider and give them a precise list of what to change.