Common questions

No. See what’s still required right now.

No. We don’t predict results, and we don’t certify anyone. Our fee never depends on your score.

Not necessarily. If you’re not sure your posted score matches your documents, it’s worth checking. We’ll show you the posted score next to what your documents support. If they don’t match, we’ll suggest you talk with your attorney.

Probably not. Our work is built around Level 2. One thing worth knowing either way: at Level 1, a plan of action isn’t allowed at any time. All 15 requirements need to be met before the yearly affirmation is signed.

No. AS9100 is a quality management standard: it shows how you control the quality of your work. CMMC Level 2 is about protecting controlled unclassified information, measured against the 110 requirements in NIST SP 800-171. One doesn’t count toward the other.

What AS9100 does give you is the habit of written procedures, document control and records. Documentation you already have is one of the things that can bring the price down: see what moves the price.

No. Equipment that can’t meet a requirement, like an older machine controller, can be documented as an enduring exception: isolated, and described in your System Security Plan with its mitigations. Age alone isn’t a barrier.

No. We look at where information goes, not at the information itself. We don’t open, copy, or take drawings or files.

All the technical work: installing, setting up, and running your systems. The plan of action we write gives them a list of what’s left to do.

That’s a decision for you and your IT provider. GCC High is Microsoft’s government cloud. An enclave keeps defense work on a separate, smaller set of computers.

The right choice depends on where your controlled information actually goes, and the scope map shows exactly that. Whichever setup you choose, we document it. We don’t sell either one.

The 15-minute call with Juan is free. The scope map is $2,000 to $3,500, and the full write-up is $7,500 to $15,000. Both are fixed fees; here’s what moves the price. The site visit takes two to four hours, and we agree on a schedule for the rest before we start.

These questions settle most of what you need to know:

• Which cybersecurity clauses are in our contracts and purchase orders?
• Will you send us controlled unclassified information (CUI), and how will it be marked?
• Which CMMC level will you require of us, and by when?
• Is any of the technical data export-controlled (ITAR or EAR)?
• How will drawings reach us: by email, through a portal, or some other way?

Bring the answers to the first call.

• Will you take our drawings or files? We don’t.
• Will you need our SPRS or PIEE logins? We don’t.
• Do you promise a score or a certification? We don’t, and no one can honestly promise either.
• Is the price fixed, and what’s included? Ours is fixed and published on our services and prices page.
• Do you also sell IT services, software or licenses? We don’t.
• Who checks the documents before we get them? A second person checks every one.
• Could you also be the one who certifies us later? Under the CMMC rule, anyone who helped prepare you can’t take part in your Level 2 certification assessment for three years. We don’t certify anyone.