1. Intake
Who touches CUI, where it lives (email, file shares, shop-floor PCs), and whether you already have an SSP, POA&M, or a number in SPRS.
Defense contractor compliance
Know where you stand before the assessor does.
CMMC Level 2 and NIST SP 800-171 still demand documented controls — and a SPRS score you can stand behind. We work the local small-subcontractor niche the national SaaS tools cannot sit in a conference room for.
Avery Parker · principal
Support since the early 1990s
Networks & security since the late 1990s
Linux since ~2000
Johnson City office · you talk to the same person
Start free, then scope the real work
Run the non-CUI SPRS Defensibility Check at DefensibleScore.com. That product is ours. It captures a rough posture and hands off to a readiness engagement.
We do not pretend to be a C3PAO. We get you ready so the assessor is not the first adult to read your SSP.
What a readiness engagement looks like
2. 110-control gap
NIST 800-171 families against how the shop actually runs — not a spreadsheet of “yes” that an assessor will laugh at.
3. SSP and POA&M
Written system security plan and a plan of action you can put dates on. We write with your admin, not around them.
4. Remediation
Identity, logging, backups, and the network changes the gap list demanded. Scoped as project work or layered on MSSP.
Typical small-subcontractor gap work is a two-to-four week engagement after intake. Remediation is its own quote. If you are already mid-incident, start at incident response — do not polish an SSP on a burning tenant.
Who this is for
Machine shops, fabricators, and professional firms in Kingsport, Johnson City, Bristol, and the I-81 corridor that suddenly have a flow-down clause. You have an overworked admin or an out-of-town MSP. You do not have a GRC department.
If you need a C3PAO assessment, we stay as the people who know the environment. If you need a monthly security lead after the score is honest, that is fractional CISO.
What we will not do
We will not invent a SPRS score. We will not sell you a “CMMC in a box” SaaS that still leaves the shop-floor PC on a shared login. We will not start an SSP while ransomware is live — that is incident response first.
The 110 NIST 800-171 controls are families: access, audit, configuration, identification, incident response, maintenance, media, personnel, physical, risk, security assessment, system communications, and system integrity. A small fabricator does not implement them the way a prime does. We write the SSP for how you actually run, then the POA&M for what is still open, with dates you can defend.
Questions we get
Are you a C3PAO?
No. We get a small contractor ready so the assessor is not the first adult to read the SSP. If you need a certified assessor, we will say so and stay in the room as the people who know the stack.
Where do we start if we have never scored SPRS?
Run the free non-CUI SPRS Defensibility Check at DefensibleScore.com — that tool is ours — then book a 110-control gap conversation. Do not guess a score into SPRS.
How long does a gap assessment take?
A focused 110-control review for a small subcontractor is typically a two-to-four week engagement after intake: interviews, evidence pull, written gap list, and a POA&M you can defend. Remediation is scoped separately.
We are a 20-person machine shop in Kingsport. Is this for us?
Yes. That is the niche. National CMMC SaaS will not sit in your conference room. We will.
Start with the free SPRS check, then call.
East Tennessee contractors. Remote document work nationwide.