A readiness engagement becomes easier to manage when both sides can describe what will exist at the end. “Help us with CMMC” leaves important choices open: which environment is involved, who changes systems, what the adviser reviews, and who decides that an output is usable. A short deliverable table can make those choices visible before time and money are committed.
This is an editorial planning framework, not a legal contract form or a prescribed CMMC document. Have the people responsible for contracts and security review the actual engagement. A well-organized readiness project does not itself confer status. For Level 1, the organization performs its self-assessment and its authorized senior official makes the required affirmation.
Start with a decision the business needs to make
Describe the business question in ordinary language. One company may need to understand an information flow before choosing systems. Another may already have a defined environment and need help organizing internal verification. Those are different assignments. Include the relevant work package, the intended participants and the unresolved questions instead of assuming a generic package fits both situations.
The scoping regulation requires an assessment scope to be specified before assessment. That is a reason to make boundary assumptions visible in an engagement, not a reason to let a sales call settle every scoping question. Record what information the customer will supply and who must confirm its accuracy. Any material uncertainty needs an owner and a review step.
A fictional deliverable and acceptance table
Fictional Alder Components wants an adviser to help prepare an internal Level 1 readiness review. It already has an IT provider. The following example separates the planning outputs from implementation and assessment responsibilities. The example names no actual client and reports no result.
| Output | Customer input | Acceptance check | Boundary |
|---|---|---|---|
| Information-flow discussion record | Contract question and high-level workflow | Operations and IT confirm known facts and unresolved branches | Not a final determination from a questionnaire alone |
| Readiness action register | Responsible owners and approved internal references | Each action has an owner, next check and dependency | Task completion does not declare a requirement MET |
| Review meeting and handoff | People able to explain implementation | Questions and decisions are recorded for management | Does not enter or affirm an official result for the customer |
Define how an output will be checked
“Deliver a report” describes a file, but says little about usefulness. Specify whether the report must connect each recommendation to a question, identify the source used, distinguish confirmed facts from assumptions and identify who can resolve an issue. The acceptance owner should be able to explain what needs correction without inventing a new project after delivery.
Agree how comments will be collected. A single consolidated review can prevent contradictory instructions from three managers. State what happens when a newly discovered system or contract changes the assignment. A change record can describe the new fact, its effect on scope and the revised decision needed. It should not silently convert an initial estimate into unlimited work.
Keep implementation, evidence and assessment separate
A provider may explain a gap while another provider must change the configuration. Identify that dependency explicitly. Ask who checks the actual change and where the supporting record will remain. A readiness adviser receiving a summary does not automatically have the access, authority or technical context to verify every safeguard in the environment.
Set safe information-handling arrangements before exchanging material. A general inquiry form is not the place for CUI, credentials, vulnerability details or a full security package. Begin with nonsensitive references and use an appropriately approved channel if more detail is necessary. Access limits, record return and retention responsibilities belong in the actual agreement.
Choose clarity over a broad promise
Before accepting a scope, ask each party to describe its next action and its completion check. If the answers differ, revise the table. Good communication is observable in a specific owner, a clear question and an agreed follow-up, rather than a slogan about handling everything.
Federal Bid Partners offers Level 1 readiness support. If considering that or another service, use the same deliverable questions and ask how its scope fits your actual situation. Read the feedback FBP currently publishes as feedback about the service provider, alongside your own assessment of the proposed work.
Primary sources & limits
- 32 CFR 170.19 — CMMC scoping
- 32 CFR 170.15 — Level 1 self-assessment and affirmation
- 32 CFR 170.22 — Affirmation
- FAR 52.204-21 — Basic safeguarding
This is educational decision support. Worked cases are fictional; suggested internal records are not government-prescribed forms. Verify current policy, applicable deviations and your actual documents. Source research used automated assistance; no individual assessor or legal review is claimed.