Our Mission
We believe small defense contractors deserve access to CMMC compliance without breaking the bank. Our goal is to support small businesses and enable them to become compliant at a reasonable expense— so they can focus on what they do best: serving our nation's defense.
We Wrote the Book on CMMC — Both Levels
Literally. Two volumes, now on Amazon. The same methodology we walk clients through every week, in print.
CMMC Level 1: A Practical Guide for Small to Medium GovCon Contractors
A plain-English walkthrough of the Level 1 self-assessment for contractors without an IT department: the 15 practices from FAR 52.204-21, what actually counts as evidence, how to scope your environment honestly, and how to get a defensible self-assessment into SPRS.
CMMC Level 2: A Practical Guide for Small to Medium GovCon Contractors
The CUI volume. Covers the 110 NIST SP 800-171 practices, how to scope a dedicated CUI enclave without enterprise IT, building a System Security Plan and POAM that hold up, and running an annual Level 2 self-assessment end to end.
📚 Both volumes, one series
Start at Level 1 and step up to Level 2 as your CUI obligations grow — the scoping, evidence, and self-assessment methodology carries straight across.
Read the book, then put it to work — talk to the author in a free 30-minute session →
Which Level Do You Need?
We support both CMMC compliance tiers. Not sure where you land? Our free assessment will tell you in under 30 minutes, or read our breakdown of the L1/L2 self-assessment path.
Foundational Cyber Hygiene
For contractors who handle Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). 15 practices based on FAR Clause 52.204-21.
- 15 CMMC practices → 142 defined artifacts
- Annual self-assessment & SPRS submission
- Platform-specific templates (M365 or Google)
- Device & network configuration guides
- No third-party assessor required
- Covered start-to-finish in our published Level 1 guide
Advanced Cyber Hygiene — CUI Enclave
For small businesses with limited CUI needs handling Controlled Unclassified Information (CUI). Built on a dedicated, isolated enclave using Google Workspace or Microsoft 365 GCC High. No on-premise servers or enterprise IT required.
- 110 NIST SP 800-171 Rev 2 practices → 182 defined artifacts
- Optimized to utilize a dedicated CUI enclave on Google Workspace or M365 GCC High
- Designed for dedicated Windows laptops or Chromebooks (CUI-only devices) — we provide the templates & config guides, not the hardware
- No Active Directory, no SIEM, no on-premise servers needed
- Physical security: locked office/room with key-based access
- Managed by Owner/Manager + IT Point Person — no full-time security staff
- HTTPS/browser-only access; VPN optional
- SPRS scoring & annual self-assessment documentation
- Covered start-to-finish in our published Level 2 guide
Templates Built for Your Platform
Generic enterprise templates don't apply to your environment. We created specialized libraries for every setup—so everything actually fits how you work.
🏢 On-Premise / Active Directory
For businesses with local servers and traditional IT infrastructure:
- Active Directory user management
- Group Policy configuration
- Local file server security
- On-premise backup procedures
- Domain controller documentation
☁️ Microsoft 365 Cloud
For businesses using Microsoft's cloud ecosystem:
- Azure AD / Entra ID policies
- OneDrive & SharePoint controls
- Exchange Online protection
- Microsoft Defender configuration
- GCC High / CUI enclave configuration guide
🔷 Google Workspace
For businesses using Google's productivity suite:
- Admin Console security policies
- Drive sharing & DLP controls
- Gmail security documentation
- 2-Step Verification enforcement
- CUI enclave configuration
Step-by-Step Device & Network Guides
Templates tell you WHAT policies you need. Our configuration guides tell you HOW—with screenshots and exact steps for every device type. See why your device settings are the evidence.
Microsoft 365 Admin
Security configuration walkthrough
Google Workspace Admin
Admin Console setup guide
Home Office Network
Consumer router configuration
Small Office Network
Professional networking setup
Windows PC/Laptop
BitLocker, Defender, Group Policy
Mac Desktop/Laptop
FileVault, Gatekeeper, settings
Android Mobile
Security & work profile setup
iOS Mobile
iPhone/iPad configuration
Start With a Free 30-Minute Consultation
Not sure if you need Level 1 or Level 2? Unsure whether your program qualifies for self-assessment? Our CMMC experts will map your situation, identify your gaps, and outline a clear path to compliance—at no cost, with no obligation.
📅 Book Your Free Consultation
Choose Your Path to Compliance
Three options—from a free assessment to full turnkey L2 self-assessment. All packages include a free 30-minute consulting kickoff session. See what "free" self-assessment really costs.
CMMC Assessment Tool
No credit card required
Evaluate your current CMMC Level 1 status and identify your exact gaps before you invest a dollar.
- All 15 L1 practices evaluated
- Instant gap analysis report
- Prioritized remediation roadmap
- Identifies if L2 may apply
- Results in under 30 minutes
L1 Turnkey Package
$2,995 — Save $500
Complete Level 1 compliance with expert-guided implementation. Most clients are submission-ready in 2–4 weeks.
- 8 bi-weekly consulting sessions
- M365 or Google Workspace variant
- All 8 device & network guides
- 15 practices → 142 defined artifacts
- Evidence locker & SPRS report
- Free 30-min kickoff consultation
CMMC Level 2 — Enclave Self-Assessment
L2 CUI Enclave Package
Google Workspace or Microsoft 365
A complete, right-sized CUI Enclave compliance package for limited CUI needs. Built on Google Workspace or Microsoft 365 GCC High — no enterprise IT infrastructure required.
- 12 bi-weekly expert consulting sessions
- Google Workspace or M365 GCC High variant — your choice
- 110 practices → 182 defined artifacts
- Dedicated CUI enclave configuration guides (Google & M365)
- System Security Plan (SSP) — pre-filled template
- POAM framework, Risk Register & evidence checklist
- Time estimates for every task — implementable part-time
- SPRS scoring & self-assessment docs
- Free 30-min kickoff consultation
What Makes Us Different
Built specifically for small defense contractors by people who understand your challenges
📚 Published CMMC Author — Both Levels
Our methodology isn't a sales pitch — it's published. Two volumes on Amazon in Kindle, paperback, and hardcover: the Level 1 guide and the Level 2 CUI guide. Read them before you ever talk to us.
🎯 Platform-Specific, Not Generic
Choose templates for YOUR platform—Microsoft 365 or Google Workspace. No translating enterprise documents that reference IT departments you don't have.
🔒 Right-Sized L2 CUI Enclave
Our Level 2 package is purpose-built for small businesses with limited CUI needs, using Google Workspace or M365 GCC High. No Active Directory, no SIEM, no enterprise IT required — just a dedicated enclave on tools you already use.
📋 Every Artifact Defined
L1 maps 15 practices to 142 specific artifacts. L2 maps 110 practices to 182 artifacts — plus dedicated enclave configuration guides. You know exactly what's needed at every step, no guesswork.
👨💼 Expert Consulting Included
Bi-weekly sessions with compliance experts who've guided hundreds of contractors through L1 and L2. Never feel stuck or uncertain on the path.
🛠️ Built by GovCon Veterans
Founded by government contracting veterans with 25+ years of experience. We build for the contractor with no IT department, because that's who we've spent our careers supporting.
From Overwhelmed to Compliant
A clear four-step process whether you're pursuing Level 1 or Level 2 self-assessment
Free Consultation & Assessment
Book your free 30-minute session. We review your contracts, identify whether L1 or L2 applies, run a gap analysis, and map your fastest path to compliance. No cost, no commitment.
Platform-Specific Templates & Policies
You receive the complete template library for your platform (M365 or Google Workspace). Every policy, procedure, and artifact is pre-built and labeled—just customize with your company details.
Configure with Expert Guidance
Bi-weekly consulting sessions walk you through device configuration, CUI Enclave setup (L2), and technical controls. Our step-by-step configuration guides cover every device type with screenshots — you implement, we guide.
Evidence, SPRS Score & Submission
Upload completed artifacts to the Evidence Locker. Generate your SPRS score report with one click. Everything organized, date-stamped, and ready for your annual self-assessment. Annual updates take hours, not weeks. Could your self-assessment survive an audit?
CMMC Questions Small Contractors Actually Ask
Straight answers to the questions that come up in nearly every consultation.
Do I need CMMC Level 1 or Level 2?
It depends on what data your contracts require you to handle. If you handle Federal Contract Information (FCI) only, Level 1 applies. If your contract requires you to handle Controlled Unclassified Information (CUI), you're looking at Level 2. Check your contract clauses first — FAR 52.204-21 points to Level 1, while DFARS 252.204-7012 signals CUI obligations.
Read: L1 vs L2 — and why most CUI handlers need both →Does CMMC Level 1 produce a numeric SPRS score?
No — and this trips up a lot of contractors. Level 1 is assessed as MET or NOT MET for each of the 15 practices. There's no 110-point score at Level 1; that scoring model belongs to Level 2 and NIST SP 800-171. What Level 1 requires is an annual self-assessment and an affirmation submitted in SPRS.
Read: 15 practices, 142 artifacts — the anatomy of an L1 self-assessment →Can I self-assess for Level 2, or do I need a C3PAO?
Not every Level 2 program is the same. Some are eligible for annual self-assessment; others require a Certified Third-Party Assessment Organization. Which one applies is driven by your contract, not your preference. Our L2 CUI Enclave Package is scoped for self-assessment-eligible programs only — confirm your path before you invest in either direction.
Read: who qualifies for L2 self-assessment →What is a CUI enclave?
A CUI enclave is a deliberately narrow, separated environment where all your CUI lives — rather than letting CUI spread across every system you own. Shrinking the boundary shrinks the assessment. For a small business, that usually means a dedicated cloud tenant and a small set of dedicated devices, instead of hardening the entire company.
Read: what is a CUI enclave — and do you need one? →How long does CMMC Level 1 take?
Most of our clients are submission-ready in 2–4 weeks, though it varies with your existing infrastructure, your platform, and how quickly your team can turn work around. The documentation and evidence collection typically take longer than the technical configuration — which is the part most contractors underestimate.
Read: finishing your L1 in 2–4 weeks →Do I need GCC High for CMMC Level 1?
Generally no. GCC High and similar government-tier environments exist to address CUI handling requirements, and Level 1 covers FCI, not CUI. Commercial Microsoft 365 or Google Workspace can support Level 1 when configured correctly. The right move is to confirm your data type first — buying a government tenant you don't need is an expensive detour.
Read: GCC High vs Google Workspace — the platform decision →
Still unsure where you land? Book a free 30-minute consultation →
Or dig deeper — browse 60+ articles on CMMC compliance
See the CMMC Toolkit in Action
Our intuitive dashboard makes compliance manageable—whether you're tracking 15 L1 practices or 110 L2 controls. See a full inventory of what's in the box.
Click to enlarge
Stop Losing Contracts to Non-Compliance
Join hundreds of defense contractors who chose the fast, affordable path to CMMC compliance
🎯 Our Commitment
Follow our proven process with platform-specific templates and expert guidance, and you'll be submission-ready in weeks—not months. We've guided hundreds of contractors through CMMC Level 1 and Level 2 self-assessment compliance. No hidden fees, no surprise delays.
Prefer to read first? Get our CMMC Level 1 & Level 2 guides on Amazon →
Questions? [email protected]
Our CMMC experts are ready to help you start winning contracts again.