Engagements
Fixed-Scope Engagements
Four engagements with a defined scope, named deliverables and a fixed price, so a program office or contractor can buy without a long procurement cycle. Each is quoted after a 30-minute scoping call and delivered by the principal, not handed to junior staff.
ATO Readiness Review
An independent review of your package and evidence before the assessor sees it, with every gap ranked by assessment risk.
- Who it is for
- Program offices and system owners preparing for a security control assessment.
- The problem it solves
- Findings discovered during assessment cost weeks of schedule and can delay the authorization decision.
- Price
- Fixed price, quoted after a 30-minute scoping call.
Scope
- Review of the system security plan, control implementation statements and supporting artifacts against the system’s baseline
- Sampling of evidence for the controls assessors test most heavily
- POA&M review for completeness, milestones and risk ratings
Deliverables
- Findings brief ranked by assessment risk
- Remediation plan with owners and sequence
- Read-out session with the system owner and ISSM
You provide
- Current package and artifacts
- A point of contact for evidence questions
Outcome: You enter the assessment knowing where you stand and what was fixed.
Discuss this engagement (ATO Readiness Review)About the service behind ATO Readiness Review
800-171 Gap Assessment & SPRS Score
A complete assessment of all 110 NIST SP 800-171 requirements with a defensible SPRS score and a path to CMMC Level 2.
- Who it is for
- Defense contractors that handle Controlled Unclassified Information (CUI).
- The problem it solves
- Contracts require a current SPRS score and a CMMC path; an unsupported score is a contractual and legal exposure.
- Price
- Fixed price, quoted after a 30-minute scoping call.
Scope
- Assessment of all 110 requirements using the DoD Assessment Methodology
- Interviews with IT and security staff, and review of policies and configurations
- Scoping of the CUI environment and its boundary
Deliverables
- SPRS score with the scoring worksheet behind every deduction
- System security plan outline mapped to the 110 requirements
- POA&M for every requirement not yet met
- CMMC Level 2 roadmap in priority order
You provide
- Network and system documentation
- Access to IT and security staff for interviews
Outcome: A score you can defend and a roadmap your team can execute.
Discuss this engagement (800-171 Gap Assessment & SPRS Score)About the service behind 800-171 Gap Assessment & SPRS Score
RMF Authorization Package Build
A complete, eMASS-ready authorization package built by practitioners who have carried packages through to authorization.
- Who it is for
- Systems entering authorization for the first time or renewing an expiring ATO.
- The problem it solves
- Incomplete control implementation statements and missing evidence are the most common reasons packages are returned.
- Price
- Fixed price, quoted after a 30-minute scoping call.
Scope
- Categorization and baseline tailoring support
- Control implementation statements written to the assessor’s test procedures
- Artifact and evidence collection, indexing and gap tracking
Deliverables
- System security plan with control implementation statements
- Artifact and evidence index
- POA&M with milestones and risk ratings
- Package prepared for entry in eMASS
You provide
- System owner and technical leads
- Access to configuration and scan data
Outcome: A package ready for assessment, built to be accepted on the first submission.
Discuss this engagement (RMF Authorization Package Build)About the service behind RMF Authorization Package Build
ISSO Continuous Monitoring (monthly)
A DoD 8140-qualified ISSO who keeps your authorization current month after month, so the ATO holds between assessments.
- Who it is for
- Authorized systems that must maintain their ATO under continuous monitoring.
- The problem it solves
- Unreviewed scans, aging POA&M items and lapsed reporting put an existing authorization at risk.
- Price
- Fixed price, quoted after a 30-minute scoping call.
Scope
- Monthly vulnerability scan review (ACAS/Nessus)
- STIG compliance checks on in-scope assets
- POA&M maintenance and milestone tracking
Deliverables
- Monthly continuous monitoring report to the ISSM and authorizing official
- Updated POA&M every month
- Escalation of significant changes that affect the authorization
You provide
- Scan and configuration data access
- A system owner contact
Outcome: Your authorization stays in good standing between assessments.
Discuss this engagement (ISSO Continuous Monitoring (monthly))About the service behind ISSO Continuous Monitoring (monthly)
Not sure which engagement fits?
Describe your system and timeline. You will hear back from the principal with a recommended scope.
Request a Consultation