The CUI Enclave, SSP, POAM, SPRS, and DFARS 7012 stack we deploy for defense contractors

A documented network perimeter, a separated identity tenant (Microsoft 365 GCC High or equivalent FedRAMP-authorized cloud), a hardened endpoint baseline for the U.S.-person CUI handlers, conditional access policies enforcing the boundary at sign-in, sensitivity labels classifying CUI automatically, DLP policies blocking egress, centralized logging into a SIEM, and the SSP/POAM documentation describing all of the above. The enclave is what minimizes CMMC assessment scope and keeps commercial workloads out of audit.

Usually no. The SSP describes a specific information system with a specific boundary. Two programs with different CUI types, different authorized users, or different cloud tenants need either two SSPs or one SSP with explicit subsystem partitioning. We tend to recommend separate SSPs because shared SSPs make POAMs harder to manage and break the assessment narrative.

For each of the 110 NIST SP 800-171 Rev 2 requirements, we evaluate the implementation against the DoD Assessment Methodology and assign one of three values: implemented (no deduction), partially implemented (counts as not implemented for SPRS scoring), or not implemented (subtracts the assigned weight: 1, 3, or 5 points). The starting score is 110; deductions can drive it negative. We do not round up. The score we post matches the evidence, which matches the SSP, which matches what a C3PAO will see.

The SSP describes how every required control is implemented. The POAM describes how partially-implemented or not-implemented controls will be brought to full implementation. Every "not implemented" line in the SSP needs a corresponding POAM entry with an owner, a milestone date, and a resource estimate. The POAM is the bridge between current-state and assessment-ready state.

We author. SSPs written by IT teams without compliance authoring experience usually fail the C3PAO read-through because the implementation statements are too vague, too marketing-flavored, or too disconnected from the evidence. Our SSP authoring service produces 110 implementation statements written to the format C3PAO assessors expect, with explicit pointers to evidence artifacts.

FedRAMP is the federal program that authorizes commercial cloud services for government use. Defense contractors do not typically need their own FedRAMP authorization unless they are providing a cloud service back to a government customer. What you do need is to use FedRAMP-authorized cloud services (Microsoft 365 GCC High, Azure Government, AWS GovCloud, Google for Government) for your CUI workloads. The customer-side configuration of those services still falls under your CMMC scope; FedRAMP covers the underlying platform.

Honestly. A negative SPRS score with a credible POAM showing realistic remediation milestones is better than a fabricated 110 that cannot survive pre-award due diligence. We help contractors post the honest score, build the POAM that primes will accept as a path forward, and prioritize the technical remediation that closes the highest-value gaps first.

Level 3 sits on top of Level 2 and adds a subset of NIST SP 800-172 enhanced security requirements: advanced threat hunting, intrusion deception controls, cyber resiliency testing, and supply chain risk management documentation. The assessment is government-led (DIBCAC) rather than commercial C3PAO. Level 3 is reserved for the most sensitive programs and most contractors will never need it. We support the readiness work for the small but growing number of clients who do.

Yes. Most clients keep us on for ongoing operations: SOC monitoring, SIEM management, continuous control monitoring, quarterly drift reporting, monthly POAM review, annual SSP refresh, and incident response on-call. This is the work that turns a one-time CMMC certification into a year-over-year defensible compliance posture.