Not sure which CMMC requirements apply to you yet?

Send us a message and ask about a Balancelogic CMMC Readiness Review.

Three phases, each with a fixed scope

For defense contractors and subcontractors in Maryland, Virginia and DC working toward Cybersecurity Maturity Model Certification (CMMC). The Balancelogic CMMC Readiness Review runs in three phases. Each phase has a fixed scope and clear deliverables, so you can start with Phase 1 and decide on the next step with real information.

The review works against National Institute of Standards and Technology (NIST) SP 800-171, the requirements for protecting controlled unclassified information (CUI). Phase 3 helps you prepare the Supplier Performance Risk System (SPRS) score that you submit.

What each phase delivers

Phase 1: Assessment & Roadmap. We review your environment against NIST SP 800-171, define your CUI boundary, and identify the gaps. You get a prioritized roadmap: what to fix, in what order.
Phase 2: Documentation. We develop your System Security Plan (SSP), policies and procedures, and your Plan of Action and Milestones (POA&M), tailored to how your business actually works.
Phase 3: Validation & SPRS. After remediation is complete, we run a readiness checkpoint and a final pre-assessment review, and help you prepare the SPRS score that you submit.

Bill Campbell, CEO, CISSP, CSCP.

Winner of CompTIA's 2023 North American Cybersecurity Leadership Spotlight Award.

Send us a message

We'll reply to set up a short call. We'll only use your details to respond to this request.

Frequently asked questions

Will the Balancelogic CMMC Readiness Review get us certified?

Certification assessments are conducted by an authorized third party, such as a C3PAO. The Balancelogic CMMC Readiness Review prepares you for it. A C3PAO is a CMMC Third-Party Assessment Organization.

Who submits our SPRS score?

You submit your SPRS score. We help you prepare the score and the supporting documentation. SPRS is the Supplier Performance Risk System, where contractors post their NIST SP 800-171 assessment results.

Who fixes the gaps the review finds?

Fixing the gaps is a separate project, sold and delivered under its own agreement.

Can we start with Phase 1 only?

Yes. Each phase has a fixed scope and clear deliverables, so you can start with Phase 1 and decide on the next step with real information. Optional add-ons include an incident response tabletop exercise, onboarding and offboarding simulations, business continuity and disaster recovery reviews, and an additional readiness checkpoint.

Our work supports your compliance program. It doesn't guarantee compliance, certification, or assessment results.