CxO™ DELIVERABLE
CMMC Readiness Assessment
A CMMC readiness assessment is a review of how well your controls meet the Cybersecurity Maturity Model Certification level your DoD contracts require. DAG Tech's vCCO scopes your FCI and CUI environment, tests each requirement, scores you for SPRS and builds the plan to pass your self-assessment or C3PAO assessment.
Custom proposal · Last updated October 2026
The Short Answer
What Is a CMMC Readiness Assessment?
A CMMC readiness assessment measures your environment against the CMMC level your DoD contracts require, so you can fix gaps before you submit a self-assessment or face a certification assessment. CMMC is the DoD program set out in 32 CFR Part 170, with contract rules in 48 CFR (DFARS 252.204-7021). Level 1 covers Federal Contract Information and requires the 15 basic safeguarding requirements in FAR 52.204-21, with an annual self-assessment. Level 2 covers Controlled Unclassified Information and requires the 110 security requirements in NIST SP 800-171 Rev. 2. Depending on the contract, Level 2 is met by a self-assessment or by a certification assessment from an authorized C3PAO, both on a three-year cycle with annual affirmations by a senior official. Level 3 adds 24 requirements from NIST SP 800-172 and is assessed by the government's DIBCAC. CMMC requirements are phasing into DoD contracts now, so the level your contracts require determines your timeline.
DAG Tech is not a C3PAO and does not certify organizations. We get you ready for the assessment. The vCCO defines your assessment scope, so CUI stays in as small an enclave as practical, then writes or updates your System Security Plan and Plan of Action and Milestones. POA&M items are limited under CMMC: not every requirement can be deferred, and open items must close within 180 days. Readiness work is how you avoid relying on them. After the readout, the vCCO recommends who should close each gap: your team, another provider or DAG Tech when it is the best fit.
At a glance
SPEC SHEET- DELIVERABLE TYPE
- Framework readiness assessment
- ALSO KNOWN AS
- CMMC gap assessment, CMMC pre-assessment, NIST 800-171 assessment
- PRACTICE AREA
- IT Compliance (CxO™)
- BEST FOR
- Defense contractors and subcontractors that handle FCI or CUI
- WHAT WE NEED
- DoD contracts and flowdowns, CUI data flows, current SSP and SPRS score if you have one
- NEXT STEP
- Request a CMMC readiness proposal
Scope
What We Evaluate
We test your environment against every requirement at your target CMMC level.
Level and scope
Which CMMC level your contracts require and which people, systems and facilities handle FCI or CUI.
CUI enclave design
Whether CUI can be contained, for example in a GCC High or similar environment, to shrink assessment scope.
Access control and identification
Least privilege, MFA, session controls and account management.
Audit and accountability
Whether logs are generated, protected, reviewed and retained.
Configuration and system integrity
Baselines, patching, malware protection and vulnerability scanning.
Media, physical and personnel security
How CUI is marked, stored, transported, destroyed and accessed on site.
Incident response
Your plan, testing and the DFARS reporting duties for cyber incidents.
External service providers
Whether cloud and managed service providers that touch CUI meet the required standards.
SSP and documentation
Whether your System Security Plan and policies match what is actually in place.
The Deliverable
What You Receive
- CMMC level determination and assessment scope diagram
- Requirement-by-requirement gap report
- Estimated SPRS score under the DoD assessment methodology
- New or updated System Security Plan
- POA&M with POA&M-eligible items identified
- Remediation roadmap with owners, dates and scoped hours
How It Works
How It Runs
- STEP 01
Kickoff
We review your contracts, flowdown clauses and how FCI and CUI enter and leave your business.
- STEP 02
Scoping
The vCCO defines the assessment boundary and categorizes in-scope assets.
- STEP 03
Requirement Testing
We test each requirement the way an assessor would, using interviews, documents and system checks.
- STEP 04
Readout
You get the gap report, SPRS estimate, SSP, POA&M and a dated plan.
When to Start
Signs You Need a CMMC Readiness Assessment
- A DoD solicitation or prime contractor now requires a CMMC level.
- Your SPRS score was estimated years ago and never revisited.
- You are not sure where CUI lives in your environment.
- Your System Security Plan does not match your current systems.
- Your prime is asking for proof before the next option period.
- You need a C3PAO assessment and want to pass the first time.
Compare
CMMC Readiness Assessment vs. C3PAO Certification Assessment
| CMMC Readiness Assessment | C3PAO Certification Assessment | |
|---|---|---|
| Question it answers | Are we ready to meet our CMMC level? | Does our environment meet CMMC Level 2? |
| Output | Scope, gap report, SPRS estimate, SSP, POA&M and roadmap | Official assessment result recorded with the DoD |
| When | Before your self-assessment or certification assessment | When your contract requires Level 2 certification |
| Led by | DAG Tech virtual compliance officer (CxO™) | An authorized C3PAO with certified assessors |
Related
Often Paired With
FAQ
CMMC Readiness Assessment Questions
What is a CMMC readiness assessment?
It is a review of your controls against the CMMC level your DoD contracts require. It finds gaps, estimates your SPRS score and produces the SSP and POA&M you need before a self-assessment or C3PAO assessment.
Is DAG Tech a C3PAO?
No. DAG Tech does not certify organizations. Level 2 certification assessments are performed by authorized C3PAOs, and Level 3 by the DoD's DIBCAC. We prepare you and support you during the assessment.
Which CMMC level do we need?
It depends on the data in your contracts. If you handle only Federal Contract Information, Level 1 usually applies. If you handle Controlled Unclassified Information, expect Level 2. Level 3 is reserved for select high-priority programs. The vCCO confirms your level from your contracts and flowdowns.
Can we use a POA&M to pass?
Only in a limited way. Level 1 does not allow POA&Ms. At Level 2, certain requirements cannot be on a POA&M, you must meet a minimum score, and open items must be closed within 180 days. Readiness work reduces what you need to defer.
How much does a CMMC readiness assessment cost?
Every deliverable is scoped in hours at the CxO rate, based on your target level and the size of your CUI environment. Your proposal shows the total before work starts.
Get Started
Request a CMMC readiness assessment
Tell us what you need. We scope the hours and send a CxO proposal.
Sent with your request: CxO: vCCO: CMMC Readiness Assessment
- 01A scoping call with a fractional executive
- 02Every task, deliverable, hour and cost in one proposal
- 03A roadmap with start date
The CxO™ Program
Explore Every Practice Area
About DAG Tech CMMC Readiness Assessment
A CMMC readiness assessment is a review of how well your controls meet the Cybersecurity Maturity Model Certification level your DoD contracts require. DAG Tech’s vCCO scopes your FCI and CUI environment, tests each requirement, scores you for SPRS and builds the plan to pass your self-assessment or C3PAO assessment.
A CMMC readiness assessment measures your environment against the CMMC level your DoD contracts require, so you can fix gaps before you submit a self-assessment or face a certification assessment. CMMC is the DoD program set out in 32 CFR Part 170, with contract rules in 48 CFR (DFARS 252.204-7021). Level 1 covers Federal Contract Information and requires the 15 basic safeguarding requirements in FAR 52.204-21, with an annual self-assessment. Level 2 covers Controlled Unclassified Information and requires the 110 security requirements in NIST SP 800-171 Rev. 2. Depending on the contract, Level 2 is met by a self-assessment or by a certification assessment from an authorized C3PAO, both on a three-year cycle with annual affirmations by a senior official. Level 3 adds 24 requirements from NIST SP 800-172 and is assessed by the government’s DIBCAC. CMMC requirements are phasing into DoD contracts now, so the level your contracts require determines your timeline.