CMMC Level 2 Readiness Assessment
All 110 NIST SP 800-171 requirements assessed across your AWS and AWS GovCloud (US) environment, delivering the SSP outline, POA&M, and remediation roadmap a C3PAO expects to see.
- Duration
- 6 weeks
- Requirements
- 110 assessed
- Environments
- AWS + GovCloud (US)
- Investment
- $28,500
Built for a specific situation
- Defense contractors and subcontractors handling CUI who must reach Level 2 for current or upcoming contracts
- Organizations that ran a self-assessment and want an independent check before committing to a C3PAO
- Companies moving CUI workloads into AWS GovCloud (US) who need to know what the move actually satisfies
- Suppliers who just received a flow-down requirement from a prime and need a defensible plan quickly
AWS services in scope
AWS GovCloud (US)
Regions supporting DoD Cloud Computing SRG Impact Levels 2, 4, and 5, plus ITAR and FIPS 140-2 requirements
AWS Audit Manager
Evidence collection and control mapping against the NIST SP 800-171 framework
AWS Security Hub and AWS Config
Continuous control monitoring and configuration drift detection
AWS CloudTrail and Security Lake
Audit logging, retention, and review requirements
AWS IAM and IAM Identity Center
Access control, least privilege, and separation of duties
AWS KMS and AWS Artifact
FIPS-validated encryption for CUI, and inherited compliance evidence from AWS
How the engagement runs
1 · Scoping
We define the CUI boundary and confirm which accounts, Regions, and services are in scope. This single decision moves assessment cost more than any other.
2 · Evidence review
Read-only access through a scoped IAM role, plus review of existing policies, procedures, and prior self-assessment work.
3 · Control assessment
All 110 requirements evaluated against both your AWS environment and your organizational practices, with evidence gaps recorded.
4 · Delivery
Findings walked through with your team, followed by the written package within six weeks of kickoff.
What you receive
- Environment scoping memo defining your CUI boundary
- Control-by-control gap analysis across all 110 requirements, scored with evidence gaps identified
- System Security Plan outline, structured the way an assessor reads it
- POA&M with owners, target dates, and effort estimates
- Remediation roadmap sequenced by assessment risk rather than by ease
- Executive readout your leadership can use to fund remediation
Sample gap analysis and POA&M
A redacted excerpt showing scoring, evidence notes, and milestone structure.
Delivered by
- CISSP with a governance, risk, and compliance specialization
- Active U.S. SECRET clearance
- 18 years leading engineering, product, and security at global communications providers
- Built a complete security and IT program for ~275 employees across four countries after an acquisition
- Hands-on ISO/IEC 27001, ISO/IEC 42001, NIST AI RMF, and CMMC 2.0 implementation experience
- AWS practitioner since 2011 and former AWS Partner Program administrator
A readiness assessment, not a certification
This engagement prepares you for assessment. Certification itself must be performed by an authorized C3PAO. The deliverables are built so that the assessor’s work, and yours, starts from evidence rather than from scratch.
Contact
Every engagement is delivered personally by Brian Govanlu, CISSP.
Readiness and advisory, not certification
Engagements are readiness and advisory services; they do not constitute certification, which must be performed by an accredited body.
Any AWS infrastructure costs you incur remain your responsibility and are separate from the engagement fee.
Professional services are separate from the CMDash auditor and assessor directory. How that directory stays neutral is set out in the Independence Covenant.