Defense suppliers · CMMC 2.0 · NIST SP 800-171
CMMC is in your contract. The clock is already running.
I do fixed-scope 800-171 readiness for small defense suppliers around Hill AFB: gap assessment, SSP, POA&M, and a remediation plan you can actually execute. Readiness and advisory only; the certification assessment itself comes from a C3PAO, and I get you ready for it. This is home turf. Defending Air Force systems is my day job.
What you walk away with
The documents an assessor asks for, built properly.
Gap assessment
Your current state measured against the NIST SP 800-171 control set, control by control, with evidence of what passes and what does not.
System Security Plan (SSP)
The document that describes how your environment implements each requirement. Assessors ask for it first; most small shops do not have one.
Plan of Action & Milestones (POA&M)
The honest list of what is not done yet, with owners and dates. A real POA&M is credible; a padded one is a liability.
Remediation roadmap
The gap-closing work, ordered by what an assessor weighs most and what your shop can actually absorb.
If you also want an independent read on your broader control posture, the NIST RMF Controls Assessment covers the SP 800-53 catalog these requirements descend from.
Common questions
Asked by every shop that calls.
Do you certify us?
No, and be wary of anyone who says they can. Certification assessments come from a C3PAO. I do the readiness and advisory work that gets you through one.
Is this classified work?
No. Everything JBeck Cyber does is unclassified. CUI and FCI handling is exactly the territory 800-171 covers, and that is the ceiling of this work.
What does it cost?
Readiness scope depends on your environment and how much of the SSP already exists, so I put the price in writing after the Security Gap Review, before any work begins. Related assessment work is published on the services page.
Why you?
Defending Air Force systems is my day job, and 800-171 descends from the same control catalog I work in daily. You are not paying someone to learn the framework on your clock.
Find out where your shop stands.
Thirty minutes on your contracts, your environment, and your timeline. I will tell you plainly what readiness would take.