03.1 · PREPARE
Prepare
Built with precision.
If an incident hit tomorrow, or an assessor arrived next month, most teams would be writing the plan as they went.
Gaps found, exposures tested, and the right policies, plans, and training in place and rehearsed before an attacker or an assessor tests them.
SUPPORTS CMMC AREAS INCLUDING
- All 14 domains (policies & gap assessments)
- Risk Assessment
- Security Assessment
- Awareness & Training
- Incident Response
- 01
Security Leadership & Roadmap
A vCISO who sets strategy, budget, and priorities, backed by gap assessments against CMMC, NIST SP 800-171 Rev 2, NIST CSF 2.0, HIPAA, ISO 27001, and other required frameworks.
- 02
Risk & Exposure Testing
MITRE ATT&CK-driven risk assessments and risk quantification, plus penetration testing and vulnerability assessments that show what an attacker could reach and how to shut it down.
- 03
Policies, SSP & Training
Policies, procedures, and a System Security Plan that match how the organization operates, plus awareness training that covers phishing and insider threats.
03.2 · ASSESS
Assess
Evaluated with confidence.
Most organizations believe they’re ready for CMMC. Few can prove it.
CMMC Certified Assessors measure controls and evidence against the same objectives a real assessment uses, whether for a self-assessment, a practice run, or certification.
Independence is built in. Organizations that Shadowscape or 1st Defense helped prepare are assessed through a partner C3PAO and a team with no advisory relationship to them.
COVERS
- Level 1 (Self)
- Level 2 (Self)
- Level 2 (C3PAO)
- All 14 domains
- 320 assessment objectives
- 01
Level 1 Self-Assessment
All 15 requirements checked the way an assessor checks them. Level 1 allows no POA&Ms, so every gap is closed before the SPRS entry and annual affirmation.
- 02
CMMC Mock Assessment
A penalty-free dry run against the same objectives and evidence standard as the real assessment. Gaps surface while there’s still time to fix them.
- 03
C3PAO Certification Assessment
The official Level 2 assessment through a trusted partner C3PAO. Lead CCAs assess under the C3PAO’s authority, and the C3PAO issues the certification.
03.3 · MAINTAIN
Maintain
Continuously improved.
Controls that passed last year can fail quietly this year, and no one is checking.
Systems, staff, and threats change every month. Continuous testing, threat intelligence, and quarterly reviews keep controls working and affirmations honest, and every finding feeds the next cycle.
SUPPORTS CMMC AREAS INCLUDING
- All 14 domains (compliance upkeep)
- Security Assessment
- Risk Assessment
- System & Information Integrity
- Configuration Management
- Incident Response
- 01
Continuous Security Testing
Penetration testing, vulnerability assessments, threat hunting, and adversary emulation every quarter, catching new exposures while they’re still small.
- 02
Threat & Risk Intelligence
Threat monitoring, real-time alerts, dark web and brand monitoring, and ongoing risk analysis, tuned to the threats targeting the organization’s industry and technology.
- 03
Quarterly Program Reviews
Every quarter, the vCISO reviews priorities and progress with leadership and refreshes policies, incident plans, and tabletop scenarios as people, systems, and contracts change.
- 04
Compliance Upkeep
Annual control and evidence reviews across all 14 CMMC domains, POA&M closeout within 180 days, SSP upkeep, and an impact review for every significant change, so the Affirming Official signs with confidence.
