Flagship · For defense contractors
Level 2 Readiness Assessment
For contractors with known or likely CUI who need an honest picture before assessment pressure, platform decisions or major remediation spend. We confirm the boundary, review every one of the 110 NIST SP 800-171 Rev. 2 requirements behind CMMC Level 2 against the evidence you actually have, and give leadership a prioritized roadmap they can act on. It's platform-neutral, so it's also the first paid step on GCC High, Google Workspace, AWS or Google Cloud.
Starting price
from $12,500
$2,500 credited if booked within 60 days of a Microsoft 365 Hardening readout.
Final scope and price are confirmed in a written SOW after discovery.
After Microsoft 365 Hardening
The Assessment re-uses your snapshot, fix list, change log and evidence checklist, so it starts at the boundary rather than at discovery. Book it within the credit window after your hardening readout and the credit applies, once per Assessment.
Who it's for
- You hold, or are likely to hold, CUI under a defense contract.
- A prime, customer or solicitation expects CMMC Level 2.
- You need to know where you stand against NIST SP 800-171 Revision 2, which your DFARS 252.204-7012 clause already requires, before your self-assessment and affirmation.
- An MSP, MSSP, cloud provider or other vendor runs part of the environment.
- Leadership wants a roadmap with costs and owners, not a stack of findings.
- You've finished Microsoft 365 Hardening, or your CUI lives on a platform it doesn't cover yet.
Questions it answers
- Where does CUI live, and which people, systems, workflows and providers are in scope?
- For each of the 110 requirements: implemented, partially implemented, missing or unverified?
- Which documentation is missing, thin or inaccurate?
- What does the MSP own, what do you own, and what do other providers own?
- Which gaps matter most, and what is the order of work?
- What should leadership decide next?
Deliverables
What you receive
- 01
Confirmed boundary
The CUI boundary, in-scope assets and information flows, confirmed with your team and providers. - 02
110-requirement register
Every NIST SP 800-171 Rev. 2 requirement with its evidence status and the evidence reviewed. We only call a control "reviewed" when we've seen the evidence. - 03
Responsibility map
Who implements and who evidences each requirement: you, your MSP, or a cloud or security provider. - 04
SSP and POA&M readiness review
Whether your system security plan (SSP) and plan of action and milestones (POA&M) describe what actually operates. - 05
Prioritized roadmap
Gaps ordered by risk and dependency, with owners and realistic sequencing. - 06
Executive brief
Decisions, risks and unknowns for leadership, and a proposal for ongoing Program Lead support. - 07
Your score, calculated with you
We calculate your score with the official DoD method (32 CFR 170.24) from the register, and guide your affirming official through entering it in SPRS. Your affirming official is responsible for what's submitted, and a false affirmation carries legal risk.
How it runs
The engagement, step by step
- 01
Kickoff
Confirm the drivers, stakeholders, systems and providers involved, and agree a safe route for evidence. - 02
Structured intake
FCI/CUI assumptions, environment context, documentation maturity and provider responsibilities. - 03
Review and interviews
We review documents and evidence through the approved route and talk with the people who run the environment. - 04
Findings and brief
The register, roadmap and executive brief, walked through with leadership.
Typical timeline
3–5 weeks
Depends on environment size, complexity and how quickly evidence can be shared.
Not included
- A certification decision, a guaranteed assessment result or an official assessment. ForgePoint is a readiness advisor, not a C3PAO.
- Legal interpretation of contracts, DFARS clauses or CUI markings.
- Remediation or tool deployment. These can be scoped separately.
- Unlimited advisory access, helpdesk support or incident response.
Watch: 5 minutes
The Level 2 Readiness Assessment, explained.
Free tools
Start with a free tool
Free · runs in your browser
Level 2 Self-Check
Free · runs in your browser
CUI Boundary Sketcher
Free · runs in your browser
Cloud Provider Check
The next step
Next: the Fractional CMMC Program Lead
Every Assessment ends with a Program Lead proposal: someone to own the roadmap, keep the POA&M current, coordinate your MSP and prepare the annual affirmation, without a full-time hire.