Why we ran it on ourselves first
Most firms selling CMMC readiness have never been assessed under it. We didn’t think we should ask a client to survive something we hadn’t survived ourselves. So before we sold the method, we ran it end to end on inDirectIT’s own environment: our SSP, our POA&M, our evidence package, and our GCC High tenant, assessed under CMMC Level 2 (32 CFR Part 170) the same way yours will be.
The certification covers the operating environment this firm runs in every day, and we keep it current under our own managed-compliance discipline.
What that means for your engagement
- Every station in the Factory model was tested against a real assessment before it met a client environment.
- We know what assessors ask because they asked us. Evidence is built to the objective level from day one, so nothing has to be reorganized after the first finding.
- Our environment was built natively in GCC High, and we work in the federal cloud every day, constraints included. Consultants who work in commercial tenants tend to discover those constraints late.
- As a CMMC Level 2 certified external service provider, we operate controls on your behalf that you can inherit, with the evidence attached. See managed compliance.
The same standard we hold you to
We write documentation from the environment once it exists, index evidence to assessment objectives instead of policy titles, and treat the mock assessment as a hard gate. Those practices got our own environment through its assessment, and for that reason we require them in client work.
See how the same runbook produced Allyon’s certification, or start with a gap assessment.
Put a certification on this page.
Tell us where your program stands and a practitioner will map the path from your current state to a defensible certification. Or email rj@indirectit.com directly.