Assessment Only

Best for organizations with solid documentation

​

DIY compliance with expert validation
Ideal for those who prefer a self-guided approach while still gaining the benefit of an objective third-party compliance review and reporting.

​

 

Included:

• Comprehensive intake and categorization meeting to assess current compliance status

• Confirmation of scoping to ensure the proper system boundaries are defined

• Confirmation of CMMC categorization based on contracts and data sensitivity

• Assessment covering all relevant CMMC controls

• Simplified control explanations to assist with understanding

• Detailed compliance report with references to existing documentation

• Objective gap analysis highlighting areas needing improvement

• Executive summary highlighting compliance strengths and risks

• SPRS score calculated and captured in the assessment report, which can be submitted to the SPRS portal to prove self-certification​​

Assessment + POA&M

Best for organizations needing more guidance

​

Hands-on expertise and implementation planning
Our team helps identify documentation and compliance gaps, prioritize remediation steps, and provide the actionable roadmap needed to move from assessment to compliance.

 

Included (everything in the Core Offering plus):

• Recommendations on required documentation and identified gaps

• Implementation plan for deficient controls, including remediation steps and prioritization guidance

• Plan of Actions and Milestones (POA&M) documenting all deficient controls and providing a remediation roadmap designed to meet the 180-day requirement under the CMMC final rule

• Detailed outbrief with a cybersecurity engineer to review findings and next steps

• Option to purchase a discounted POA&M close-out reassessment once remediation is completed to validate compliance and update reporting in SPRS

​

​​​

​

​

​

​

Documentation + Assessment + POA&M

Best for organizations starting from scratch

​

Comprehensive compliance solution
We create all the necessary materials, conduct the assessment, and deliver a tailored report that positions your organization for immediate alignment with CMMC requirements.

 

Included (everything in the Core Offering plus):

• Documentation package created using A3PO’s standard templates and supported CMMC practices

• Compliance assessment performed after documentation is established to ensure alignment with CMMC requirements

• Documentation set that supports compliance when fully implemented in accordance with templates and guidance

• Tailored compliance report with references to the newly created documentation

• Plan of Actions and Milestones (POA&M) documenting all deficient controls and providing a remediation roadmap designed to meet the 180-day requirement under the CMMC final rule

• Option to purchase a discounted POA&M close-out reassessment once remediation is completed to validate compliance and update reporting in SPRS​

​

​​