Flagship · For defense contractors
Fractional CMMC Program Lead
CMMC readiness isn't a one-off project. The Fractional CMMC Program Lead gives you an accountable owner for keeping the 110 NIST SP 800-171 Rev. 2 requirements in place (monthly steering, POA&M tracking, evidence reviews, affirmation prep and coordination with your MSP) without a full-time hire.
Starting price
from $7,500/month, 6-month minimum
Microsoft 365 Hardening included, with no separate fee.
Final scope and price are confirmed in a written SOW after discovery.
Microsoft 365 Hardening included
If your CUI is in a Microsoft 365 commercial or GCC tenant, the hardening runs as a Program Lead workstream inside the monthly cadence, with no separate hardening fee.
Who it's for
- You have a known CUI environment and a readiness assessment, completed or underway.
- Remediation has stalled because nobody owns coordination across your team, MSP and vendors.
- Evidence collection is scattered and nobody is sure what the annual affirmation rests on.
- Leadership wants regular, decision-ready reporting without depending on technical staff.
Questions it answers
- Who owns CMMC readiness, month to month?
- Is remediation on the documented timeline, and is the POA&M current?
- What evidence is needed, who collects it, and is it current?
- What do our MSP and other providers owe us, and are they delivering it?
- Are we ready to affirm this year, and what would block it?
Deliverables
What you receive
- 01
One workbook, kept in your tenant
Scope and boundary, asset inventory, provider responsibilities, gap register, score, POA&M, program calendar, change log and evidence index in one workbook that lives only in your tenant. It's never emailed, we keep no copy, and it never holds CUI. - 02
Monthly session and status report
A working session with your team and a one-page report for leadership: progress, risks, decisions needed, your current score and the time left on any POA&M closeout clock. - 03
POA&M and SSP kept current
Open items kept current with owners, dates and status, the SSP updated as things change, and the change log flagging anything that might be a significant change to your boundary. - 04
Guided SPRS updates
When your score changes, your affirming official updates SPRS on a screen share while we guide them. We never log in. Your affirming official is responsible for what's submitted, and a false affirmation carries legal risk. - 05
Quarterly owner review and evidence review
A short deck and the next quarter's calendar (document updates, score updates, affirmation dates, certificate renewals), plus a check that the evidence behind each requirement still exists and still reflects reality. - 06
Incident response tabletop
A quarterly exercise so your people know who reports a cyber incident within the 72-hour window, how, and what to preserve. We advise; you report. - 07
Annual affirmation prep
Preparation for your affirming official: what's ready, what isn't, and what they're signing. Factual, not legal advice. - 08
MSP and vendor coordination
Working with your MSP and providers to close responsibility gaps and collect their evidence. They keep the hands-on work; we keep the program moving. - 09
Questions answered within two business days
Email us between sessions and we reply within two business days, usually sooner. Questions, yes; work, no: anything that's real work goes on the plan. - 10
Certification preparation, on request
If your contracts call for a C3PAO certification assessment: interview preparation, an evidence walkthrough and a dry run against the assessment objectives, scoped in your SOW. We never act as, or for, the C3PAO.
How it runs
The engagement, step by step
- 01
Days 1–30: baseline
Confirm remediation status, SSP and POA&M maturity, evidence gaps, provider responsibilities and reporting needs. Set the cadence. - 02
Days 31–90: active remediation
Drive milestones, coordinate providers, update the SSP and POA&M, and build the evidence routine. - 03
Month 4 onward: steady state
Keep the program current, close remaining gaps and prepare each annual affirmation.
Typical timeline
6-month minimum
Then month to month. The start date is set in your SOW.
Not included
- A certification decision, a guaranteed assessment result or an official assessment. ForgePoint is a readiness advisor, not a C3PAO.
- Legal interpretation of contracts, DFARS clauses or CUI markings.
- Hands-on remediation, tool administration or monitoring. Your IT team or MSP keeps those.
- Unlimited access, helpdesk support or incident response. Each month has a defined allowance.
Watch: 5 minutes
The Fractional CMMC Program Lead, explained.
Free tools
Plan the year before you sign
Free · runs in your browser
Level 2 Program Calendar
Free · runs in your browser
Affirming Official Brief
The next step
Not there yet? Start with the Readiness Assessment
The Program Lead works from a confirmed boundary and a current register of the 110 requirements. If you don't have those yet, the Level 2 Readiness Assessment is the right first step.