CMMC readiness assessmentLevel 1 · Level 2
Find which CMMC type your contract is talking about
Level 1 vs Level 2 — a free talk-and-show first look. No FCI. No CUI.
CMMC type discovery is a conversation. We ask what the contract language points to — Level 1 for Federal Contract Information (FCI) or Level 2 for Controlled Unclassified Information (CUI). You may show a clause or an SPRS number. We do not look at FCI or CUI files. You leave with overall posture from this first look, brief recommendations, and whether a hole needs a deep dive. Call (631) 557-0440.
Technology partners
What we review on this assessment
CMMC type discovery is a talk-and-show first look. We do not take full access. We do not look at FCI or CUI.
Which CMMC type the contract points to
Level 1 or Level 2 — from the clause, not from a guess.
What FCI and CUI mean
Plain words for Federal Contract Information and Controlled Unclassified Information. We do not open either.
Who in the firm would likely be in scope
People and systems the contract is talking about — as a conversation, not a file dump.
An SPRS number you can show
The number or affirmation screen, not the files behind it. SPRS is the Supplier Performance Risk System.
Whether a paid deep dive even makes sense
Only if this first look found a glaring hole — or you ask for one.
Where to read next
EvidenceVault on the stack you have, or EnclaveBox when isolation comes up — as next reading, not this call’s deliverable.
What you leave with
Every free assessment ends the same way: posture, brief recommendations, and whether a hole needs a deeper look.
Overall posture
A plain-language read of how things look from this first pass — not a score and not a certification.
Brief recommendations
A short list of what to fix or tighten next. Not a 40-page report.
Glaring holes
Whether anything is so open it needs a deep-dive look. If nothing glaring shows, we say that too.
How the free call runs
We talk, we ask, you show. Examples: a contract clause, an SPRS number, who might be in scope. If FCI or CUI files start to open, we stop.
Read the contract language — not the work product
You may show the clause that names CMMC or DFARS 252.204-7021. That tells us which type to talk about. Do not send the files the contract protects.
- A screenshot of the clause is enough.
- We stop the call if CUI or FCI files start to open.
Two kinds of information, two kinds of work
Information the government gives you — or you make — under a contract, that is not meant for public release. Level 1 is the basic safeguarding of FCI.
Information that needs more protection than FCI. Level 2 is the CMMC type that protects CUI. We still do not look at CUI on this call.
Type discovery — which CMMC you are even talking about
Fifteen requirements in FAR 52.204-21. Annual self-assessment and affirmation in SPRS. Built for FCI. No Plan of Action & Milestones (POA&M) at Level 1.
NIST SP 800-171 practices for CUI. Often a C3PAO later. Written plans (SSP / POA&M) show up here. This call does not score 110 practices.
People and systems — as a conversation
You may show an org chart of who would likely be in scope. We do not need full access to systems to have that talk.
Same outcome as our other assessments
You leave knowing overall CMMC posture from this conversation, a short next list, and whether a hole — wrong type assumed, no SPRS, scope that cannot work — needs a paid deep dive.
- Still no FCI. Still no CUI.
- Longer program work: vCISO CMMC, Enclave Box, EvidenceVault vs EnclaveBox.
Longer CMMC work lives on vCISO CMMC compliance, CMMC Enclave Box, and EvidenceVault vs EnclaveBox. This page stays the assessment.
Questions about CMMC type discovery
Do we look at FCI or CUI? Do we need system access? Is this a C3PAO exam? Straight answers before you book.
Yes. The first look is free. We talk, ask questions, and you may show a screen. We review overall CMMC posture from that conversation, make brief recommendations, and say if a hole needs a deep dive. Call (631) 557-0440.
No. This is a conversation. We ask questions. You may show us a screen — for example a contract clause or an SPRS number. We do not scan your network for this assessment.
No. Do not email those files. Do not open them on the call. Type discovery is about which kind of information your contract is talking about — Federal Contract Information (FCI) versus Controlled Unclassified Information (CUI) — not reading the information itself.
No. If something needs a picture, you share your screen. You stay signed in.
A read on overall posture, brief recommendations, and a clear yes or no on whether any glaring holes need a deep-dive look. Not a full audit and not a certification.
Not for the free assessment. There is no contract yet, so we do not take password handoff.
That is a separate, small agreement. Then you give us passwords only for named devices and portals so we can go further. Use this only when the first look found a hole that needs it — or when you ask for it.
No. We are a Cyber AB CMMC Registered Practitioner Advanced firm. This call is type discovery and a first look. Formal certification assessments belong to authorized C3PAOs.