A step by step series for CEOs, CFOs, and owners of defense contractors. Not control-by-control technical guidance, but the decisions and actions that only leadership can take: choosing a level, assigning ownership, telling the company, setting the budget, and leading the program to a successful assessment. Written in the order you will actually face them.
Most CMMC guidance is written for the people who will implement the controls. Very little is written for the person who has to decide, fund, announce, and answer for the program. This series is for that person. Each installment covers one leadership decision or action, explains what depends on getting it right, and where useful, provides working samples you can adapt.
What the program is, where it came from, what it demands of a contractor, and why the obligation is contractual rather than optional. The foundation for every decision that follows.
Level 1 or Level 2 is the decision that sets the cost, the timeline, and the scope of everything else. It turns on whether your company handles CUI or only FCI, and many executives are surprised by the answer.
The step where most programs stall. How to assign ownership, brief your leadership team, and announce the program to your workforce, with sample memos, an employee FAQ, and a kickoff agenda you can adapt.
What DoD's official cost estimates cover and quietly exclude, what actually drives your Level 2 cost, and the calendar math behind a realistic assessment date. With a budget worksheet and a backward timeline you can adapt.
What your own team can carry, where outside help earns its cost, the middle path between doing it alone and handing it all off, and how to evaluate a practitioner before you sign anything. With an evaluation checklist you can bring to any first call.
What a C3PAO certification assessment examines, why readiness comes first, and why most contractors call a Registered Practitioner before they call an assessor.
Prefer to talk it through? If you are working through these decisions now and want an experienced second set of eyes, the first conversation costs nothing and comes with no pitch.
Start CMMC Readiness →