Fixed-scope packages with clear deliverables and timelines
Choose the package that matches your needs and compliance level. All services include direct access to me—no junior consultants, no hidden fees.
| Feature | Level 1 Assessment | Level 1 Full Compliance | Level 2 Readiness |
|---|---|---|---|
| Timeline | 2 weeks | 30 days | 90 days |
| Gap Analysis | ✓ (15 controls) | ✓ (15 controls) | ✓ (110 controls) |
| Self-Assessment Documentation | ✓ | ✓ | — |
| Remediation Roadmap | — | ✓ | ✓ |
| Policy & Procedure Templates | — | ✓ Customized | ✓ Comprehensive |
| Implementation Support | — | ✓ Phone/Email | ✓ Extensive |
| C3PAO Preparation | — | — | ✓ |
2 Weeks Delivery
Defense contractors handling Federal Contract Information (FCI) only who need to self-assess against the 15 basic safeguarding requirements and provide senior official attestation.
30 Days Delivery
Defense contractors who need complete CMMC Level 1 compliance—not just paperwork, but actual implementation guidance, policies, and ongoing support to get compliant and stay compliant.
90 Days
Defense contractors handling Controlled Unclassified Information (CUI) who need to meet all 110 NIST SP 800-171 requirements and prepare for third-party C3PAO assessment.
If you handle only FCI (Federal Contract Information), you need Level 1. If you handle CUI (Controlled Unclassified Information), you need Level 2. Not sure? Schedule a free consultation and I'll help you determine which applies to your contracts.
Yes. If you start with the Assessment package and decide you need full implementation support, we can discuss upgrading to the Full Compliance package.
I offer ongoing support packages for annual attestations, audits, and compliance maintenance. We can discuss your needs during the initial engagement.
Yes! I work with defense contractors nationwide. All work is conducted remotely via video calls, screen sharing, and documentation review.
While CMMC is my primary focus, I also provide comprehensive security and compliance services for organizations beyond defense contracting.
Achieve SOC 2 Type II compliance for your organization. Having successfully implemented SOC2 at multiple organizations, I understand the practical requirements and can guide you through the entire process.
Navigate European data protection requirements with confidence. I provide practical guidance for organizations handling EU customer data.
Proactive security assessments to identify vulnerabilities before attackers do. Comprehensive testing with actionable remediation guidance.
Navigate the Federal Risk and Authorization Management Program (FedRAMP) for cloud service providers serving federal agencies.
Comprehensive embedded systems development, security auditing, and compliance across multiple microcontroller platforms including STM32, AVR, ESP32, ARM Cortex, and RISC-V.
My experience spans multiple compliance frameworks and security domains. I've led SOC2, PCI, ISO, FDA, IEC, NIST, HIPAA, and industry body compliance efforts. I've also worked with government contractors and agencies on secure systems.
This breadth of experience means I understand how different frameworks overlap and can help you build a unified security and compliance program—not isolated checklists. When implemented correctly, these frameworks can help you truly secure your organization and not be just additioanl overhead.
Interested in any of these services?
Schedule a ConsultationSchedule a free 30-minute consultation to discuss your specific situation and compliance requirements.
Schedule Free Consultation