CMMC Level 1 & Level 2 Readiness Services
CMMC Level 1 & Level 2 readiness
Protect your business.Prepare for what’s next.
Turn cybersecurity requirements into a practical plan. Tech N Toner helps defense contractors prepare for CMMC with hands-on implementation, clear documentation, and ongoing IT support.
Scoping · Gap assessment · Remediation · Assessment preparation
A plan your team can follow.
Start with the right scope
Two levels.
A clear path forward.
Your contract requirements and the information you handle determine the right starting point. We help identify the systems, people, locations, and providers that belong in your assessment scope.
Build your foundation.
Readiness support for organizations handling Federal Contract Information (FCI), aligned with the 15 safeguarding requirements in FAR 52.204-21.
- Review access, accounts, devices, and network safeguards.
- Address gaps in basic system and physical security.
- Document procedures and organize supporting evidence.
- Prepare for the annual self-assessment and affirmation.
Your outcome: A prioritized action plan and an organized foundation for your organization’s Level 1 self-assessment.
Discuss Level 1 readiness →Strengthen CUI protection.
Preparation aligned with the 110 requirements in NIST SP 800-171 Revision 2 for organizations handling Controlled Unclassified Information (CUI).
- Define the CUI environment and evaluate security gaps.
- Implement technical safeguards and operating procedures.
- Develop the System Security Plan and evidence collection.
- Prepare for the assessment route required by your contract.
Your outcome: A documented environment and a remediation roadmap to support Level 2 assessment readiness.
Discuss Level 2 preparation →What TnT helps you do
Move from requirements
to working safeguards.
A policy binder is only part of the work. We connect your security documentation with the systems your employees use and the responsibilities they carry.
Scope & gap assessment
Inventory systems, trace information flows, identify applicable requirements, and prioritize the gaps that need attention.
Technical remediation
Strengthen identity, access, endpoint protection, network configuration, patching, backups, and logging based on the agreed scope.
Policies & documentation
Build procedures that reflect your operations, with a System Security Plan and remediation tracking where applicable.
People & physical security
Clarify staff responsibilities, awareness training, visitor procedures, access reviews, and evidence of day-to-day controls.
Assessment preparation
Organize evidence, review implementation, rehearse interviews, and coordinate technical support for the assessment process.
Ongoing readiness
Maintain documentation, review changes, track recurring security tasks, and support the IT environment after the initial project.
A practical engagement
Know the work.
Know the next step.
We build the project around your environment, staff availability, and contract needs. Scope, deliverables, responsibilities, and estimated costs are defined before implementation begins.
Discover
Review your goals, contract obligations, data types, existing IT, and current documentation.
Plan
Define scope and gaps. Agree on priorities, owners, a budget, and a realistic schedule.
Implement
Remediate the environment, document processes, and train the people responsible for them.
Validate & maintain
Review evidence, prepare for assessment, and establish a recurring maintenance plan.
Useful deliverables
More clarity.
Less guesswork.
You need to see what is complete, what remains open, and who owns the next action. We define the deliverables for your engagement and keep them connected to the work.
Build your project scope →- Environment & scope overviewAssets, information flows, and system boundaries.
- Prioritized remediation roadmapIdentified gaps, assigned owners, and target dates.
- Documentation & evidence structurePolicies, procedures, and supporting records appropriate to the scope.
- Readiness reviewOpen items, staff preparation, and assessment support needs.
- Ongoing responsibility planRecurring tasks and ownership for keeping safeguards effective.
Common questions
Understand your next move.
Do I need Level 1 or Level 2?
Start with your solicitation, contract, and the information your organization handles. Level 1 addresses FCI safeguarding; Level 2 addresses CUI protection. TnT can help map your environment and clarify the technical scope with your contracting stakeholders.
Can TnT certify our organization?
TnT helps you prepare, implement safeguards, and organize evidence. Your organization performs its Level 1 self-assessment. Level 2 uses the assessment route specified by the applicable requirements; where independent certification is required, an authorized C3PAO performs that assessment.
Can we use our existing Microsoft 365 and IT systems?
We start by reviewing what you have. Product names or licenses alone do not establish compliance. Data types, configuration, service commitments, access, and assessment scope determine whether an existing platform is appropriate or needs changes.
How much does a readiness project cost?
Pricing depends on the number of systems and locations, the assessment scope, existing controls, documentation, and remediation needed. We begin with discovery and provide a defined proposal. Software, cloud changes, and independent assessment fees are identified separately when applicable.
How long will preparation take?
The schedule depends on your starting point, staff participation, purchasing needs, and the gaps to close. We set milestones after scoping and discovery rather than promising a certification date before evaluating the environment.
What does our staff need to contribute?
Your team identifies information and workflows, approves policies, completes training, follows procedures, and provides operational evidence. Leadership retains responsibility for the organization’s representations and affirmations.
Let’s define your starting point
Your next step
starts with a conversation.
Tell us which level you are considering, your business size, and any contract milestones. We’ll help outline the right discovery and readiness engagement.
Upland, CA 91786Please keep initial inquiries general. Do not include CUI, passwords, or sensitive contract documents in ordinary email or website forms.