How we work
Scope first. Spend second.
ForgePoint Cyber is an engineering-first CMMC readiness advisory. We start with what your contracts actually require and where your information actually goes, then build findings and documents that describe what really operates.
The ForgePoint method
Scope → Map → Separate → Structure → Decide
- 01
Scope
Start from the actual contract, solicitation or customer request, not from an assumed level. Establish what information you receive and create (FCI, CUI or still unknown) and where it is stored, processed and sent. - 02
Map
Draw the working boundary: the users, systems, locations, cloud services and providers that handle the information. Label what is confirmed, what is assumed and what is still missing. - 03
Separate
Split responsibility between you, your MSP and each provider. Implementing a control and producing its evidence are often different jobs, and both need a named owner. - 04
Structure
Turn what was reviewed into a register, an SSP and a POA&M that describe what actually operates. A requirement is marked as met only when the evidence supports it. - 05
Decide
Give leadership the decisions, risks and unknowns in plain language, and recommend the smallest useful next step, with an owner and a date. You decide what happens next.
Known · assumed · missing
We show our working.
Every finding is labelled as known (we've seen the evidence), assumed (someone told us, not yet confirmed) or missing (nobody can show it yet). We call a requirement "reviewed" only when we've inspected the evidence, and an SSP never describes a control that the evidence doesn't support.
- Your IT person or MSP is welcome in every conversation.
- We recommend the smallest useful next step, not the largest.
- Each deliverable names its scope, its owner and what it can't establish.
- Statements about the CMMC program carry an as-of date and a source.
The no-access model
We guide. Your admin clicks.
- We hold no accounts of any kind in your systems: no admin roles, guest accounts or reader access.
- Your own admin, or your MSP on your instructions, makes every change, with a change window, a rollback step and your approval.
- Working sessions run in your own Teams, and nobody records them.
- You share one admin window at a time. Never mail, files or SharePoint.
- Fix lists and tool reports stay in your environment. We keep only a summary with no identifiers.
This is how Microsoft 365 Hardening runs, and the same rule applies everywhere we work: ForgePoint makes no changes in your environment and never handles CUI. What you pay for is judgment: the order of work, a defensible boundary, the requirements no tool checks, and evidence an assessor can follow.
Every playbook step, written five ways
So no session depends on discovering things live.
- 01
Pre-check
The licence, role and feature the step needs, confirmed before the session. - 02
Primary path
The portal click path, with the date it was checked. - 03
Fallback
The same change through PowerShell or Microsoft Graph, for when a portal page has moved. - 04
If it isn't there
The alternative for your licence or cloud, and which requirements move to the manual list. - 05
Rollback and evidence
How to undo the change, and what to export as evidence.
An engagement
From first call to a decision.
- 01
Conversation
A short call about what triggered the CMMC question and who runs your IT. No sensitive information needed. - 02
Fixed scope
We recommend the smallest useful engagement and confirm scope, deliverables, exclusions and price in a written SOW. - 03
Safe evidence route
Before any evidence changes hands, we agree a client-approved way to share it. Never a web form or general email. - 04
Delivery
Interviews and review against the evidence you share, with known, assumed and missing kept separate throughout. - 05
Close
Editable deliverables, a walkthrough with leadership, the evidence route closed and a clear next owner for each action.
Your information
What we never ask for through this site.
Please don't send CUI, contracts, credentials or security evidence through any form or email on this site. When an engagement needs evidence, we agree a client-approved route for it first and keep only what the work requires.
Plain terms
The terms you'll hear most.
- FCI: federal contract information
- Information provided by or generated for the government under a contract that isn't intended for public release (FAR 4.1901).
- CUI: controlled unclassified information
- Information that a law, regulation or government-wide policy requires or permits to be handled with safeguarding or dissemination controls (32 CFR 2002.4(h)).
- SSP: system security plan
- The document that describes your boundary and how each security requirement is met.
- POA&M: plan of action and milestones
- The list of requirements not yet met, with owners, milestones and dates.
- NIST SP 800-171 Rev. 2
- The 110 security requirements for protecting CUI in contractor systems, and the ones CMMC Level 2 checks. NIST has published Rev. 3, but DoD still requires Rev. 2.
- DFARS 252.204-7012
- The contract clause that requires contractors handling covered defense information to protect it under NIST SP 800-171, and to report cyber incidents to DoD within 72 hours of discovery.
AS OF NOV 4, 2026 · SOURCE: DoD CIO CMMC program page · DFARS Class Deviation 2026-O0025 Rev. 3
What we are, and aren't
A readiness advisor.
ForgePoint is
- An independent, practitioner-led CMMC readiness advisory.
- Focused on scope, responsibility, evidence and executive decisions.
- Vendor-neutral: we don't resell tools, platforms or licences.
ForgePoint is not
- A C3PAO or official CMMC assessor, and we don't issue certifications.
- A law firm. We don't give legal opinions on contracts or clauses.
- A managed IT provider, helpdesk or 24/7 security operations centre.