Compliance that is operated, not just advised
Advice is the easy half. This is the work that happens after the plan is written — the monthly operation, the assessment cycle itself, and the years after it, when most programs quietly go stale.
The practice does not publish client names, client posture, or client stories — the work is done under confidentiality obligations that do not expire when a project does.
What is not on this site
Your own records are governed by the same obligation that keeps client names, posture and stories off this site — a policy rather than an absence.
How long it takes
How long it takes has two sources of answer: published industry estimates, and dated engagement records. Both are below.
32 CFR Part 170 final rule, 89 FR 83092 (October 15, 2024) — small-entity cost estimates.
Huntress, CISPOINT, and Scrut published CMMC timeline guides — checked August 2026.
The CMMC program rule estimates the cost of a Level 2 self-assessment and its affirmations at $37,196 over the three-year cycle for a small business — an estimate that assumes the security requirements are already implemented.
Published implementation guides put self-managed Level 2 preparation at anywhere from six months to two years, depending on where the environment starts.
One GCC High build ran from kickoff to a scored SPRS self-assessment — SSP and POA&M delivered — in 6 calendar days (a clock that starts after GCC High licensing and provisioning).
One GCC High Level 2 engagement reached its SPRS self-attestation package — SSP, POA&M, and a scored SPRS self-assessment for the client — 10 days from the start of tenant work, 24 days from the signing of its statement of work.
Another GCC High Level 2 engagement went from statement-of-work signature to its SPRS self-attestation package — a scored SPRS self-assessment — in 21 days, with the GCC High tenant itself provisioned inside that window.
One Essentials engagement ran from day-one deploy to its Level 1 self-assessment attestation in under three weeks, built-in conditional-access soak window included.
How a control is operated
Your evidence comes from a control being run on a schedule, not from a document describing it — and the running is what produces the record an assessor asks to see.
-
The governance work too
We run incident-response tabletop exercises and boundary-monitoring, and record that they happened — the governance activities, not just the paperwork.
-
We operate the same platform, baselines, and SSP we deliver to clients.
Through the assessment
Your preparation gets tested in the assessment cycle: readiness review, then a full mock assessment, then the official one — with the same team in the room that did the work.
-
The assessor's lens first
Before the real assessment, we run a full mock assessment and readiness review — you see the assessor's lens first.
-
Readiness, mock, official
We take clients through the full C3PAO Level 2 assessment cycle — readiness, mock, and official assessment support.
-
In the room
Documented in your SSP, present in assessor interviews, answering evidence requests — we stand in the assessment room.
-
All the way through the assessment cycle — implemented, operated, and supported there, not staged and left.
After certification
Your records do not go stale the day after an assessment. They stay current and stay sealed, so the next cycle starts from where the last one finished.
-
A refresh, not a rebuild
Recertification is a refresh, not a rebuild — your controls and artifacts stay current between assessments, so year 3 never means starting over on the documentation work.
-
Timestamped by an outside authority
The time of sealing is attested by an independent third-party timestamp authority — the seal's clock is not ours to move.
How engagements are structured
You get the terms and the expectations before you sign, not in month three.
-
No multi-year lock-in
Streamlined contracting, upfront no-hassle pricing structure, flexible terms — no rigid multi-year lock-in.
-
Before you sign
Full operating maturity is not day one — we tell you what the baselining window looks like before you sign.
What happens next
Your step before any of this is a conversation about what your contracts require right now — a shorter conversation than most people expect.