Define a CMMC readiness engagement before requesting a quote

Begin with the contract and system boundary

Identify the requirement that prompted the work and the information the environment handles. Use the actual contract terms and current official scoping guidance. Under 32 CFR 170.19, the assessment scope must be specified before the assessment. A list of purchased security products is not a system boundary.

Describe locations, people, technology and relevant external providers using nonsensitive categories here. Keep network diagrams, CUI and detailed configuration evidence in an approved project environment.

Buy a defined preparation output

A discovery record, a gap analysis, a remediation plan, implementation support and evidence organization are separate outputs. Ask which ones are included, what inputs each requires and how the client will accept the handoff. A report that identifies gaps does not itself close them.

• Who confirms the boundary and resolves scope questions?
• Who implements each agreed change?
• Who owns the evidence and checks that it matches actual practice?
• What is outside the provider’s engagement?

Distinguish readiness work from an assessment

A readiness provider can help organize preparation, but preparation is not an assessment result. The applicable level and assessment route depend on the requirement. Ask separately who performs the required assessment, what their role permits and which official process produces the result.

Do not treat the purchase of software, a policy template or consulting hours as certification. Keep provider responsibilities, organizational responsibilities and formal assessment responsibilities distinct in the written scope.

Use the fictional scope to test the handoff

The sample separates boundary discovery, implementation planning and assessment coordination. The last item stays “Not agreed” because no assessment provider or formal route has been agreed. That unresolved item should remain visible in the proposal.

Compare quotes only after you have checked whether they include implementation and evidence review or simply advice. No worksheet total can establish compliance or a passing result.

Agree completion and change control

Set an acceptance check for each output, a review role and a route for new systems or changed assumptions. A useful handoff lets the organization identify what was completed, what remains and who owns the next action.

Discuss a Level 1 or Level 2 preparation scope with FBP using the appropriate service link below. Share detailed working evidence only through a separately agreed secure route.