TIER 01
Foundation
For smaller environments keeping a CMMC status current, year to year.
CORE COVERAGE
§01 · CONTINUOUS COMPLIANCE THROUGH APS
Remain CMMC Compliant, Year After Year
Advanced Persistent Security (APS) combines Certified Assessor-led CMMC compliance with ongoing security operations under one flexible plan, so your Affirming Official can affirm compliance with confidence.
Delivered by 1st Defense CMMC and Shadowscape for Level 1 and Level 2 organizations. One team and one plan cover your compliance obligations and the security work that keeps them true.
FILE 01-C · WHAT YOU WALK AWAY WITH
- 01Confidence that each annual affirmation reflects how your organization actually operates.
- 02Security controls that are operated and tested, not just documented.
- 03Documentation and evidence that stay current as your people, systems, and contracts change.
- 04One plan for compliance and security instead of separate vendors for each.
ONE TEAM, ONE PLAN, YEAR-ROUND COMPLIANCE
§02
FIELD NOTE
FIELD NOTE
You earned your CMMC status. The obligations didn’t end there. Staff change, systems get replaced, new threats appear, and the evidence that proved compliance slowly drifts from how you operate. Compliance holds up when the security behind it keeps running. When both only get attention at assessment time, your Affirming Official ends up affirming something no one has checked in a year.
§03
WHAT'S REQUIRED
WHAT'S REQUIRED
Know exactly what's required, and when.
CMMC is not a one-time event. Each CMMC status carries its own ongoing obligations.
SELFThe 15 Level 1 requirements
Level 1
- A new self-assessment every year, with results submitted in SPRS
- An affirmation of compliance by your Affirming Official with each self-assessment
- All requirements must be met; POA&Ms are not permitted
SELF
Level 2
- A new self-assessment every three years, with results submitted in SPRS
- An affirmation at the time of each assessment and annually thereafter
- Any POA&M items closed within 180 days
C3PAO
Level 2
- A new certification assessment within three years of your CMMC Status Date
- An affirmation at the time of each assessment and annually thereafter
- Any POA&M items closed within 180 days and verified through a POA&M closeout assessment by a C3PAO
Requirements are defined in 32 CFR §§ 170.15, 170.16, 170.17, and 170.22.
COMMON QUESTIONS
01How often do we need to reassess?
Level 1 requires a self-assessment every year. Level 2 requires a new assessment every three years, whether self or C3PAO, with annual affirmations in between.
02What is an affirmation?
A statement in SPRS by your organization’s Affirming Official, a senior representative, confirming that your organization continues to meet CMMC requirements. It’s required with each assessment and annually thereafter.
03What happens when our environment changes?
Changes to systems, facilities, staff, or scope can affect your compliance. We review changes for CMMC impact before they create gaps in your controls or documentation.
04Can we use APS only for CMMC compliance?
Yes. You decide how your APS plan is used. Some organizations focus mainly on CMMC compliance; others use more of it for security operations. Your plan can change from quarter to quarter.
05Can your CCAs also perform our C3PAO assessment?
No. To keep your assessment independent, CCAs who provide your readiness or ongoing compliance support will not serve on your C3PAO assessment team.
§04
WHAT APS COVERS
WHAT APS COVERS
Compliance and security, under one plan.
Cybersecurity is a continuous effort, and so is CMMC compliance. APS is Shadowscape’s Advanced Persistent Security offering. 1st Defense CMMC, a Shadowscape subsidiary, delivers the CMMC compliance side of APS through our CMMC Certified Assessors (CCAs). Shadowscape delivers the security operations that keep your controls working. We focus on what your business needs, not on selling you services you don’t need.
CMMC CONTINUOUS COMPLIANCE · LED BY 1ST DEFENSE CMMC CERTIFIED ASSESSORS
01
Annual Compliance Review
Control review, evidence validation, and documented results to support your Affirming Official's annual affirmation.
02
POA&M Management
Tracking and remediation support for open items, plus preparation for closeout within the 180-day window.
03
Documentation & Evidence Upkeep
Your SSP, policies, procedures, asset inventory, network diagrams, and CUI data flows kept current and assessment-ready.
04
Change Advisory
CMMC impact reviews for new systems, applications, business processes, contracts, and subsidiaries, plus guidance on program changes such as NIST SP 800-171 Rev 3.
05
Self-Assessment & Reassessment Preparation
Facilitated annual Level 1 self-assessments and Level 2 reassessment preparation, including mock assessments led by experienced CCAs. Our CCAs review your controls and evidence the way an assessor would, so your results accurately represent your compliance.
SECURITY OPERATIONS · DELIVERED BY SHADOWSCAPE
06
GRC/CISO-as-a-Service
Framework compliance assessments, security policy creation, incident response planning and support, security awareness training program configuration, and strategic advisory. Supports CMMC requirements in areas including Incident Response and Awareness and Training.
07
Security Assessment-as-a-Service
Perpetual penetration testing, vulnerability assessments, SOC monitoring rule creation, active threat hunting, and adversary emulation. Supports CMMC requirements in areas including Risk Assessment, Security Assessment, and System and Information Integrity.
08
Cyber Risk Intelligence-as-a-Service
MITRE ATT&CK-driven risk assessments, ongoing vulnerability analysis, and cyber risk quantification through Threatsphere, Shadowscape's cyber risk intelligence platform. Supports CMMC requirements in areas including Risk Assessment.
09
Threat Intelligence-as-a-Service
Threat intelligence collection and analysis, contextual threat monitoring, real-time threat alerts, and dark web and brand monitoring. Supports CMMC requirements in areas including System and Information Integrity.
APS includes 24+ security services and tools. Some deliverables are available as optional add-ons.
§05
THE CYCLE
THE CYCLE
A clear rhythm for Level 2 compliance.
Security operations run throughout the cycle, so your controls stay in place between reviews.
01
Assessment and initial affirmation
Your CMMC status is set, and any POA&M items move toward closeout within 180 days.
02
First annual affirmation
We review your controls and evidence so your Affirming Official can affirm with confidence.
03
Second annual affirmation
We repeat the review and begin planning for reassessment.
04
Reassessment
Your next assessment is completed within three years, with a mock assessment beforehand if you're pursuing C3PAO certification.
For Level 1, the self-assessment and affirmation happen every year.
§06
HOW APS WORKS
HOW APS WORKS
One plan that scales with your workload.
Each APS plan gives you a set amount of support at the start of every three-month period, usable across both compliance and security services.
TIER 02
Enhanced
For more systems, more change, or open POA&M items to close out.
EXPANDED COVERAGE
TIER 03
Premier
For complex environments, reassessment years, or a fuller security program.
FULL COVERAGE
LONGER TERMS SAVE MORE10% off a 1-year term15% off a 2-year term20% off a 3-year term
Higher tiers are available on request.
Your full quarter of support is available on day one, so you can front-load work when you need it and keep the same monthly payment. You can also change plans from one quarter to the next. For example, you might use more while preparing for reassessment and less in a steady year.
APS also supports organizations before assessment. If you’re still becoming compliant, see Readiness & Advisory.
§07
THE PLAN
THE PLAN
Three steps to ongoing confidence.
01
Schedule a free consultation
Tell us your CMMC status, open POA&M items, upcoming affirmation dates, and current security coverage.
02
Get your APS plan
Receive a plan that maps your affirmations, reviews, and reassessment date to the security work that supports them, sized to your workload.
03
Affirm with confidence
Keep your status current each year, knowing your controls have been operated, tested, and reviewed by a Certified Assessor.
§08
THE LEDGER
THE LEDGER
That experience is what’s now working for your certification.
AS OF SEPTEMBER 2026
SWORN STATEMENT · 01 / 04
200+
ASSESSMENTS
20+
OSCs GUIDED TO READINESS
25+
CCAs
75+
CCPs/CCAs TRAINED
§09
NEXT STEP
NEXT STEP
Know where you stand before your next affirmation.
Talk to a Certified Assessor before your next affirmation date.
Thirty minutes. No obligation.
CONSULTATION REQUEST · FORM 01A