Offer · NIST 800-171 Readiness Sprint
$7,500 · Fixed fee · 3 weeks
Delivered by Jorden Britto, CISSP, CCSP, CompTIA SecurityX. 8 years of NIST 800-53/171, DFARS, and CMMC compliance in the General Dynamics Electric Boat supply chain.
- CISSP
- CCSP
- CompTIA SecurityX
- CompTIA CySA+
Who it is for
Defense suppliers with 10 to 200 employees who have DFARS 252.204-7012 flowdown, receive or generate CUI, and have no full-time compliance staff.
What you get
- 1
Gap assessment across all 110 controls.
Every control marked Met, Not Met, or Partially Met, with the evidence reviewed and the reasoning recorded. Not a checkbox spreadsheet. An assessor's-eye view of where you stand.
- 2
System Security Plan.
Documented authorization boundary, CUI data flows, and implementation narratives describing your real environment. Written to survive questions, not just to exist.
- 3
POA&M.
Every gap with a remediation approach, an owner, a date, and a cost estimate, sequenced so the cheap high-impact items land first.
- 4
Defensible SPRS score.
Calculated per DoD methodology with the arithmetic shown, so you can explain any number to a prime or an assessor without calling me.
- 5
Executive readout.
Sixty minutes with whoever needs to understand the risk and approve the budget.
Timeline
| Week | Work |
|---|---|
| 1 | Kickoff, scoping, boundary definition, evidence request |
| 2 | Control-by-control assessment, interviews, artifact review |
| 3 | SSP and POA&M drafting, SPRS calculation, executive readout |
What this is not
This is readiness preparation, not a certification assessment. Formal CMMC certification is performed only by an authorized C3PAO. This sprint gets you ready for that assessment, or gets your self-assessment somewhere you can defend it.
Why three weeks is real
Because I built the tooling. POA&M Tracker and SecBaseline encode the frameworks directly, so the analysis that consumes most of a traditional engagement is largely automated. You are paying for eight years of judgment, not for typing.
$7,500 flat
50% at kickoff, 50% on delivery. No hourly billing, no change orders unless you change scope.
For context: a C3PAO assessment runs $30,000 to $150,000, and organizations at low maturity typically spend three to four times as much on preparation as on the assessment itself. This sprint exists so you do not walk into that blind.