Question 1

Do you work with subcontractors, not just primes?

Accepted Answer

Yes — most of our CMMC work is with subcontractors flowed-down CUI from primes. The scoping conversation is different but the playbook is the same.

Question 2

What about CMMC Level 3?

Accepted Answer

Level 3 (NIST 800-172 enhanced) is a small subset of contracts and gets assessed by the DoD directly. We can prepare you but the path is rarer.

Question 3

Do we need to be in GCC High?

Accepted Answer

If you handle CUI in M365: yes, almost always. Commercial M365 isn't FedRAMP Moderate authorized for CUI. AWS GovCloud and Azure Government are the equivalents for compute.