Level 1 covers basic safeguarding of FCI (15 requirements) with an annual self-assessment. Level 2 covers CUI using the 110 requirements of NIST SP 800-171, typically assessed by a C3PAO every three years. Level 3 adds selected NIST SP 800-172 requirements and is assessed by the government (DCMA DIBCAC).

It depends on where you are starting. Organizations with a mature NIST SP 800-171 program may only need to close gaps and organize evidence, while others need time to implement and document controls. A gap analysis or mock assessment is the fastest way to know your timeline.

A mock assessment is a practice run conducted the way a C3PAO conducts the real one. We examine your SSP and evidence, interview your team, and test configurations against each assessment objective, then deliver findings you can fix before the official assessment.

Yes. We perform vessel and facility cybersecurity assessments aligned with the U.S. Coast Guard cybersecurity final rule (33 CFR 101.650), including vulnerability identification and support for cybersecurity plans.

Fill out our Get a Quote form with a few details about your organization and what you need, and our team will follow up to discuss scope and pricing.