Cybersecurity Maturity Model Certification (CMMC)

1. Engage LBMC for a CMMC Readiness Consultation

Start by partnering with LBMC Cybersecurity. The path to achieving CMMC compliance can be overwhelming, but we are here to guide you with clarity and confidence. Our priority is to help you understand your unique compliance scope:

• Determine your required CMMC level (1, 2, or 3) based on your contract type and data sensitivity.
• Clarify whether you handle FCI or CUI and what that means for your obligations.
  • Federal Contract Information (FCI) is data not intended for public release, provided by or generated for the government under a contract.
  • Controlled Unclassified Information (CUI) is information requiring safeguarding or dissemination controls under federal laws, regulations, or policies.
• Identify your assessment type – whether a self-assessment (level 1) or a formal C3PAO assessment (level 2+).

This discovery phase typically includes stakeholder interviews, contract reviews, and scoping sessions. It sets the foundation for your compliance journey.

2. CMMC Readiness Assessment & Gap Analysis

Once your scope is defined, LBMC will conduct a formal readiness assessment to:

• Map your existing cybersecurity controls to CMMC 2.0 requirements
• Identify compliance gaps between your current posture and required controls
• Prioritize remediation activities based on risk and deadlines

We take a hands-on, collaborative approach, reviewing existing policies, procedures, and technical controls, gathering documentation, and interviewing your internal teams. Our delivery is a clear, actionable Gap Analysis Report that lays out what needs to be done and why.

3. Remediation Support and Advisory Services

Knowing your gaps is one thing. Closing them is where LBMC truly becomes your partner. Based on your assessment, we can provide remediation assistance in the following areas:

• Remediation Planning & Project Management – We develop a practical roadmap that outlines what needs to be done, by whom, and by when.
• Policy & Procedure Development or Enhancement – Need an updated Incident Response Plan or Configuration Management Policy? We help draft or enhance the documentation to meet CMMC expectations.
• System Security Plan (SSP) & POA&M Development – We help build or update your SSP and Plan of Actions and Milestones (POA&M) to reflect your environment and track remediation progress.
• Interim Assessments or Spot Checks – Think of these as course corrections to validate progress before your formal audit.
• Internal Mock Audit / Readiness Validation – We simulate a C3PAO assessment to ensure your team, documentation, and controls are truly audit-ready.

4. Support for Official CMMC Certification

When it comes time to certify, LBMC is in your corner – advising, coordinating, and advocating every step of the way.

For Level 1 (Self-assessment):

We help complete the NIST 800-171 Basic Assessment and guide your SPRS (Supplier Performance Risk System) submission

For Level 2 (C3PAO Assessment):

We assist in selecting and coordinating with a certified Third-Party Assessment Organization (C3PAO) from the CyberAB Marketplace, coach your team through the audit, and support evidence collection and interviews

For Level 3 (DIBCAC Assessment):

Although Level 3 requirements are evolving, LBMC can help identify and map the advanced controls and prepare you for a DIBCAC-led assessment.

5. Ongoing Compliance Management & Monitoring

CMMC compliance is a continuous commitment, and LBMC provides long-term support to help you stay audit-ready year-round.

• Policy and Procedure Maintenance – Our team helps keep your documentation aligned with operational and regulatory changes.
• Security Incident Management Support – We help test incident response plans, log incidents, and conduct lessons-learned reviews.
• Documentation Updates (SSP, POA&M, etc.) – LBMC ensures key documents reflect your live environment and control changes.
• Internal Self-Assessments or Mock Audits – We routinely test your posture to avoid surprises and maintain readiness.
• SPRS & Affirmation Support – We support the maintenance of SPRS scores and preparation for annual self-assessments.