Does CIS Controls work count toward CMMC?
CIS Controls work supports CMMC Level 2 readiness, but it does not count as a CMMC assessment. Consider a defense supplier with a subcontract that requires CMMC and a team that already runs the CIS Controls. The CIS Controls Navigator maps v8.1 to CMMC v2.0, so the Safeguards your team has implemented can shorten the path to Level 2. A CMMC Level 2 assessment is still run against the 110 requirements of NIST SP 800-171 Rev. 2 and the assessment objectives in NIST SP 800-171A, and a requirement is MET only when every applicable objective is satisfied with evidence in final form. A mapping is not a certification. The CMMC level required by your contract and the assessor who performs it decide the outcome.
If a contract or solicitation already requires CMMC, pursue CMMC first and use the CIS Controls as the technical base beneath it. Confirm with your contracting officer which level applies and whether a self-assessment or a third-party certification is required, because the Department of War's 13 July 2026 release suspended Phase II, which had scheduled Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings and DFARS 252.204-7012 obligations remain in place, so confirm the current status before planning around any date. Check the current phase on the DoW CIO About CMMC page and in the eCFR text, which still shows the original schedule.
If you are not yet in scope, CIS usually makes sense first. Implementation Group 1 is a minimum standard for every enterprise and gives a supplier a prioritized starting set of Safeguards for devices, accounts and backups. Once the subcontract requires CMMC, map your evidence to the 800-171 requirement IDs, such as AC.L2-3.1.1, and collect final-form evidence for each objective, because CIS Safeguard evidence is not automatically accepted. Ask your assessor or CMMC consultant how they will treat CIS evidence, and do not assume a Safeguard score transfers to a CMMC score. Doing both is reasonable when CIS hardens the environment and the CMMC evidence file is built alongside it.
How CIS Controls and CMMC differ on scope and structure
This table sets the CIS Controls v8.1 beside CMMC on who requires each, how it is structured, what it is built from and how it is organized internally. Read it first to see why CIS work can support CMMC preparation without satisfying it.
| Dimension | CIS Controls v8.1 | CMMC (32 CFR Part 170) |
|---|---|---|
| Who requires it | Voluntary. CIS states the Controls do not replace any regulatory, compliance or authorization scheme. | Mandatory for DoD contracts that flow down the CMMC clauses, set by the contract's required level. |
| Structure | 18 Controls, 153 Safeguards, grouped into Implementation Groups IG1 (56), IG2 (130 in total) and IG3 (all 153). | Three levels. Level 1 has 15 requirements, Level 2 has 110 requirements from NIST SP 800-171 Rev. 2, and Level 3 adds 24 selected SP 800-172 requirements. |
| Source documents | CIS-authored Safeguards, mapped by CIS to frameworks including NIST CSF 2.0, NIST SP 800-53 Rev. 5 and CMMC v2.0. | Built on FAR 52.204-21 (Level 1), NIST SP 800-171 Rev. 2 (Level 2) and NIST SP 800-172 (Level 3), with assessment objectives from SP 800-171A. |
| Organizing attributes | Each Safeguard carries one asset class (Devices, Software, Data, Users, Network or Documentation) and one security function (Govern, Identify, Protect, Detect, Respond or Recover). | 14 domains mapped to the security requirement families of NIST SP 800-171 Rev. 2, with no asset class or CSF function attached to each requirement. |
| Requirement ID format | Safeguards are numbered by Control and Safeguard, with the Implementation Group shown against each one. | Each ID uses DD.L#-REQ (domain, level, source requirement number), for example AC.L2-3.1.1. |
| Scoring and proof | The CIS Controls Assessment Specification defines measures and metrics for each Safeguard, covering what to measure but not how. | Requirements are MET or NOT MET against assessment objectives, with partial scoring for some requirements. Evidence must be in final form, not drafts. |
| Who verifies | No certification body. Assessment is performed by the organization or by a party it engages, using the CIS Controls Assessment Specification as a reference. | Level 2 certification assessments by C3PAOs authorized or accredited by The Cyber AB. Level 3 by DCMA DIBCAC. |
| What to confirm | Which Implementation Group your contract and risk profile call for, and whether your assessor will accept CIS measures as evidence for 800-171 requirements. | The current phase and level your contract requires, and whether it is self-assessment or C3PAO certification under the latest DoD guidance. |
Where CIS safeguards overlap with CMMC requirements
The CIS mapping to CMMC v2.0 and NIST SP 800-171 Rev. 2 points to shared technical areas, but a matching safeguard rarely closes a CMMC requirement on its own. Each area below shows what the CIS Safeguard covers, what CMMC still asks for, and what to confirm in the Navigator before you rely on the link.
Access control and least privilege
CIS Safeguards on account management and access granting cover how accounts are created, reviewed and removed. CMMC's access control requirements, drawn from the AC domain of NIST SP 800-171 Rev. 2, go further: you must define which users and processes may reach systems that handle CUI, limit functions to authorized activity, and record those decisions in your System Security Plan. Assessors test each requirement against the objectives in NIST SP 800-171A, so a general account review policy may not satisfy them. Fix the scope of CUI systems first, then confirm each AC.L2 mapping in the CIS Controls Navigator.
Multifactor authentication
CIS Safeguards on MFA for remote, administrative and externally exposed access map closely to the identification and authentication requirements in CMMC. The scoring rule matters, though. Under 32 CFR 170.24, IA.L2-3.5.3 loses 5 points if MFA is not implemented for any users and 3 points if it covers only remote and privileged users. Either value exceeds 1 point, so the requirement cannot be carried on a POA&M. Check coverage against every user population in scope, then confirm the IA.L2-3.5.3 mapping in the Navigator.
Audit logging and review
CIS logging Safeguards ask you to collect, retain and review event logs across enterprise assets, which gives you the raw material for CMMC's audit and accountability requirements. CMMC adds content and protection expectations on top: records must trace activity to individual users, reviews must happen on a defined basis, and the logs must be protected from unauthorized change. Assessors look for records of review, and a log server alone does not show that review took place. Define which CUI-handling systems emit logs, then confirm the AU.L2 mappings in the Navigator.
Secure configuration and change control
CIS secure configuration Safeguards call for documented, hardened baselines on enterprise assets and software, which is a sound starting point for CMMC's configuration management requirements. CMMC also expects the baseline to be documented, changes to be controlled and reviewed, and only the functions and services a system needs to run on in-scope systems. A baseline counts as evidence only when it is tied to the specific systems named in the System Security Plan. Confirm the CM.L2 mappings in the Navigator before you count a CIS benchmark as coverage.
Incident handling and reporting
CIS Safeguards in the Respond function cover incident management, response planning and reporting procedures, and they align with the incident response family in CMMC. For defense suppliers, DFARS 252.204-7012 obligations remain in place during the current pause in CMMC phases, so a CIS-based incident plan must be checked against those clauses directly. Test the plan with tabletop exercises and keep records of each exercise and each incident for assessors. Confirm the IR.L2 mappings in the Navigator.
Asset inventory and CUI scope
CIS's Devices and Software asset Safeguards require you to inventory enterprise assets and authorized software, and each v8.1 Safeguard carries one asset class and one security function. An inventory shows what exists, but CMMC asks which of those assets store, process or transmit CUI and sit inside the assessment boundary. Treat the inventory as an input to scoping, and document the resulting boundary in the System Security Plan. Confirm which CIS asset Safeguards map to CMMC requirements in the Navigator.
Who assesses each framework and what it issues
This table compares who performs the assessment, what each approach produces and how often it has to be repeated for CIS Controls and CMMC. Read it to see which outputs a defense supplier can show a contracting officer and which are internal records only. The main takeaway is that CIS work produces no certificate, while CMMC Level 2 and Level 3 require third-party or government assessment.
| Element | CIS Controls | CMMC |
|---|---|---|
| Who performs the assessment | Your own team, unless you engage an outside provider | C3PAOs for Level 2 certification, DCMA DIBCAC for Level 3, or self-assessment where the rule allows |
| Accreditation of assessors | CIS Controls Accreditation applies only to CIS SecureSuite member organizations offering implementation, auditing or assessment services | C3PAOs are authorized or accredited by The Cyber AB, the CMMC Accreditation Body |
| Application fee for accreditation | $1,500 for CREST members and $2,500 for non-members (CIS Controls Accreditation) | Not applicable to the assessed organization; confirm assessment costs directly with the C3PAO |
| What the output is | No CIS certificate exists; evidence is your own internal record of Safeguard implementation | A certification result from a C3PAO or DIBCAC, or a self-assessment score posted to SPRS |
| Current Level 1 and 2 requirement | Not applicable; CIS Controls are voluntary | As of 17 October 2026, the DoW CIO page says self-assessments only at Levels 1 and 2 while Phase 1 is paused; confirm with your contracting officer |
| Suspended milestone | Not applicable | Phase II, with Level 2 C3PAO certification for applicable contracts, was suspended on 13 July 2026 pending a 60-day review |
| Assessment cycle | No fixed cycle is set by CIS; you set your own review schedule | Set by the CMMC rule and contract terms; confirm the current assessment validity period in 32 CFR Part 170 and your contract |
| Where CIS helps | Provides the prioritized Safeguard set and the CIS Controls Assessment Specification to structure your internal evidence | CIS does not replace the CMMC assessment; use CIS work only as supporting evidence for NIST SP 800-171A objectives |
What the suspended CMMC Phase II means for planning
The main planning point is that Phase II is suspended, but Phase I obligations are still in force. The CMMC Program rule (32 CFR Part 170) took effect on 16 December 2024, and the DFARS rule that puts CMMC into contracts through clause 252.204-7021 and provision 252.204-7025 took effect on 10 November 2025. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. The Department also started a 60-day review by a CMMC Reform Task Force. Planning should treat that review as open. This section does not predict its outcome or its timing for later phases.
Several obligations remain in place during the review. Phase I self-assessments, SPRS postings, annual affirmations and the DFARS 252.204-7012 obligations continue to apply. For a supplier, that means a current, accurate self-assessment score and the evidence behind it must be ready now, whatever happens to Phase II. A CIS Controls program can support that evidence, but CIS mappings do not replace the assessment objectives of NIST SP 800-171A that a self-assessment is scored against. Check which of your controls the 800-171 requirements depend on, and keep that evidence in final form.
Official sources disagree on the schedule. The DoW CIO 'About CMMC' page, as of 17 October 2026, says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still contains the original four-phase schedule. Do not plan from either source alone. Ask the contracting officer which CMMC level and assessment type each solicitation and contract requires, which clauses are included, and whether a certification requirement applies before award. Get the answer in writing and record it in the contract file, since the review may change the requirement during the life of a contract.
Where CIS work stops short of a CMMC score
Level 1 covers the 15 safeguarding requirements of FAR 52.204-21 for Federal contract information (FCI). CIS helps because the basic hygiene in the IG1 Safeguard set overlaps with much of what these requirements ask for, such as controlling access and keeping systems updated. Confirm the line-by-line overlap in the CIS Navigator's CMMC v2.0 mapping before you rely on it, because a mapping shows where two frameworks relate and does not show that your environment meets either one.
- What CIS helps with: IG1 sets out essential cyber hygiene, which is a practical starting point for the 15 FAR basics.
- What it does not prove: A Safeguard that is documented but not operating in your systems gives an assessor no evidence for the matching FAR requirement.
- Scoring point of view: The supplied material does not describe a Level 1 point model, so confirm with your contracting office how Level 1 results are recorded.
- Reporting obligations: Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place after the July 2026 suspension of Phase II, so Level 1 evidence should be ready now.
Check that each of the 15 requirements that applies to your contract has a named owner, a current artifact and a date that matches your self-assessment record.
Level 2 uses 110 security requirements that are identical to NIST SP 800-171 Rev. 2, as stated in 32 CFR 170.14(c)(3) and counted in 32 CFR 170.4. Assessors score each requirement against the assessment objectives in NIST SP 800-171A, and a requirement counts as MET only when every applicable objective is satisfied with evidence in final form. The eCFR text of 32 CFR Part 170 sets these rules. A CIS Safeguard that is in place is useful input, but it does not satisfy an objective that asks for a specific artifact.
- Requirement basis: Read the Navigator's Rev. 2 mapping for Level 2 work, because Level 2 is scored against Rev. 2 text even though CIS also maps to Rev. 3.
- Objective-level proof: Each applicable 800-171A objective needs its own evidence, and drafts do not count.
- IA.L2-3.5.3 deductions: Under 32 CFR 170.24, 5 points are subtracted if multifactor authentication is not implemented for any users, and 3 points if it covers only remote and privileged users.
- No POA&M for that requirement: Either deduction exceeds 1 point, so 32 CFR 170.21(a)(2) does not allow IA.L2-3.5.3 on a plan of action and milestones.
- Certification status: Phase II, which would have required C3PAO certification for applicable contracts, was suspended on 13 July 2026, and Rev. 2 is enforced in the interim.
For IA.L2-3.5.3, confirm MFA coverage against the full list of users in scope, not a sample, before your self-assessment.
Level 3 adds 24 selected NIST SP 800-172 requirements on top of the Level 2 set, and several of them carry DoD-assigned parameters. CIS Implementation Group 3 is written for regulated, sensitive assets facing sophisticated, targeted attacks, so its intent overlaps with the enhanced requirements. DCMA DIBCAC performs Level 3 certification assessments under 32 CFR 170.18. CIS can inform how you design those controls, but it cannot supply the parameters or the evidence an assessor will review.
- Where CIS aligns: IG3 Safeguards give a planning structure for enhanced controls on sensitive assets, and that structure is a sound place to start.
- DoD-assigned parameters: The parameter values come from DoD. Ask the contracting office to confirm the values that apply to your contract.
- Assessor and evidence: DCMA DIBCAC, not a C3PAO, carries out the Level 3 assessment. Ask early which artifacts the assessor expects for each selected requirement.
- Scoring and POA&M: The supplied material does not set out Level 3 point values, so confirm the scoring rule and POA&M eligibility for each of the 24 requirements in 32 CFR Part 170.
- Scope of the claim: Passing a CIS assessment of IG3 Safeguards does not establish Level 3 status on its own.
Before planning Level 3 work, confirm which 24 requirements apply, which parameter values DoD has assigned, and the evidence the assessor will accept.
How to sequence CIS and CMMC work without duplicating evidence
The sequence starts with contract scope and the assessment boundary, then uses the CIS mapping as a starting inventory so each CMMC Level 2 objective is backed by one set of final-form evidence. It keeps the CIS work and the CMMC work from being documented twice.
Confirm contract requirements and CUI scope
The contracts and task orders set which CMMC level applies, and the program office or contracting officer confirms it in writing. Your contracts team and the owners of the CUI data flows identify where Federal contract information and CUI live, including subcontractor and cloud hosting paths. Done means a signed-off list of contracts, the applicable CMMC level, and a data flow map that names every system that stores, processes or transmits CUI. Confirm the current status of Phase I and Phase II with the contracting office before you commit scope, because the DoW has changed the schedule in 2026.
Define the assessment boundary
Security, IT and the business owners of the in-scope systems decide which assets fall inside the CMMC boundary, including enclaves, identity services, endpoints, and the people with access. Systems that touch CUI or provide security protection for those systems are typically in scope, so document the reasoning for each exclusion. Done means a boundary diagram and an asset inventory that CIS asset classes (Devices, Software, Data, Users, Network, Documentation) can be mapped onto. Keeping one inventory for both programs prevents two teams from maintaining conflicting lists.
Run a gap analysis using the CIS mapping
Use the CIS Controls Navigator for v8.1, which maps Safeguards to NIST SP 800-171 Rev. 2, as the starting inventory. The CMMC Level 2 requirements are identical to Rev. 2, so each Safeguard mapped to a 800-171 requirement shows where a CMMC requirement is partially covered. Assessors score against NIST SP 800-171A assessment objectives, not against the CIS Safeguard text, so each requirement must be checked against its objectives. Done means a gap register that lists each of the 110 CMMC Level 2 requirements as met, partly met or not met, with the CIS Safeguard that supports it and the objective it does not yet satisfy.
Implement IG1 and IG2 Safeguards that close gaps
Prioritize the Safeguards that close gaps in the register, starting with IG1 because CIS defines it as essential cyber hygiene, then add IG2 Safeguards where the CMMC requirement needs more operational depth. Engineering and system owners implement the controls, while the GRC lead approves each change. Note that the CIS Controls Assessment Specification defines what to measure but not how, so your team must design its own test procedures and evidence format. Done means each closed gap has a change record, a configuration baseline and a named owner. Scoring deductions for missing multifactor authentication under 32 CFR 170.24 make identity controls an early priority, and POA&M entries cannot cover them.
Build final-form evidence for each assessment objective
For each requirement, define the evidence that satisfies every applicable NIST SP 800-171A objective, such as configuration exports, access reviews, logs and signed policies. One evidence item should serve both the CIS Safeguard measurement and the CMMC objective, with a cross-reference table linking them, so nothing is collected twice. A requirement is MET only when all applicable objectives are satisfied with evidence in final form, not drafts, so the review owner signs off on each artifact and its date. Done means an evidence index where every CMMC objective points to at least one final artifact and every CIS measure links to the same artifact.
Rehearse the assessment with an internal review
An internal reviewer who did not build the controls walks through each requirement against the evidence index and the assessment objectives. The reviewer records the gaps they find and returns each to the responsible owner. Where the team wants external support, confirm with the candidate assessor which evidence forms it expects, since certification assessments are performed by C3PAOs for Level 2 and DCMA DIBCAC for Level 3. Done means a rehearsal report that lists each unresolved item, its owner and the evidence needed to close it. DeployOpen can help prepare evidence, but it does not perform or certify the CMMC assessment.
Set up recurring affirmation and monitoring tasks
Assign owners to the recurring work that keeps the evidence current: annual affirmations, SPRS postings, DFARS 252.204-7012 obligations, and periodic reviews of each Safeguard's measures. Configure the CIS measures and the CMMC evidence to be collected on the same schedule so that a control change updates both records together. Done means a calendar of recurring tasks, a named owner for each, and an evidence index that is reviewed after every system or contract change. Confirm the affirmation and posting obligations in the current DFARS clauses, since the rules and schedules have changed.
What drives the cost and effort of each path
The cost of a CMMC path depends first on who is paid for what. Your own staff carry most of the internal time: scoping the contract boundary, writing and updating the System Security Plan, collecting evidence in final form, and handling the SPRS posting. Licensed tools add a cost only where you buy them, such as a logging platform, an MFA service or a configuration management product. A CIS Controls program can reuse much of the same work, but it does not remove the external assessment. Where a Level 2 certification applies, a C3PAO performs it, and Level 3 certification assessments are performed by DCMA DIBCAC under 32 CFR 170.17 and 170.18. Outside readiness support is optional, and its cost depends on how much of the gap work you hand off. Before you commit, confirm the current status of the assessment requirement with your contracting officer, because the Department of War suspended Phase II on 13 July 2026.
Most of the spend is one-time: scoping the CUI environment, remediating gaps, and building documentation. Recurring costs follow the contract: continuing monitoring, annual affirmations, periodic reassessment and the upkeep of logs and access reviews. The main drivers are the size of the assessment scope, the number of systems that store, process or transmit CUI, the number of existing SP 800-171 gaps, and the number of MFA and logging gaps. The rule treats some of these gaps differently. IA.L2-3.5.3 is scored for partial credit: 5 points are subtracted if MFA is not implemented for any users and 3 points if it covers only remote and privileged users. Because either value exceeds 1 point, that requirement cannot sit on a POA&M under 32 CFR 170.21(a)(2), so an MFA gap must be closed before assessment. Shrinking the enclave that holds CUI is often the cheapest lever you have.
DeployOpen does not publish prices. A quote follows from a written, fixed scope that is agreed before work starts. When you request one, ask for the systems and boundaries in scope, the deliverables for each phase, which tasks are one-time and which are recurring, what evidence will be produced and in what form, and which third-party costs (licenses, assessment fees, retainers) are excluded. Ask how the plan maps to the NIST SP 800-171 Rev. 2 requirements and the 110 Level 2 requirements, and which items are assumed to be done by your team. Also ask what happens if the rule or the assessment schedule changes during the engagement, since the reform review may alter timing. DeployOpen prepares systems, controls and evidence but does not issue assessment results or certifications.
Questions suppliers ask before choosing CIS, CMMC or both
Does CIS Controls v8.1 count toward CMMC Level 2?
No. CIS Controls work does not by itself satisfy CMMC Level 2, because Level 2 certification is assessed against the 110 requirements of NIST SP 800-171 Revision 2 using the assessment objectives in NIST SP 800-171A. The CIS Controls Navigator maps v8.1 to CMMC v2.0, so CIS work can supply much of the technical evidence for those requirements, but a mapping shows where overlap exists, not that a requirement is met. Each requirement is MET only when all applicable objectives are satisfied with evidence in final form. Confirm with your contracting officer which level applies to your contract and with the assessor how they will accept evidence.
Is there a CIS Controls certificate I can give a prime contractor?
No. CIS does not issue a certificate that proves CIS Controls implementation for a contract. The CIS Controls are voluntary and CIS states they do not replace any regulatory, compliance or authorization scheme. CIS Controls Accreditation, run with CREST, accredits CIS SecureSuite member organizations that provide implementation, auditing or assessment services, which is a different thing from certifying your organization. For CMMC, the proof is a certification assessment by a C3PAO for Level 2 or DCMA DIBCAC for Level 3, or a self-assessment where the rule allows it. Ask the prime which of these they require before you spend effort on any proof format.
Which CIS Implementation Group should a defense supplier start with?
Most defense suppliers that handle CUI will need more than IG1 because CMMC Level 2 covers far more than the essential hygiene set. CIS defines IG1 as essential cyber hygiene and a minimum standard for every enterprise, IG2 adds Safeguards for enterprises with more operational complexity that often hold sensitive information, and IG3 targets regulated, sensitive assets facing sophisticated attacks. A practical starting point is to inventory your systems and data flows, implement IG1 across them, then use the Navigator to see which CMMC v2.0 requirements your IG2 Safeguards cover. Confirm your scope boundary, since the CUI environment is what the assessor will examine.
How long does a CMMC readiness effort take, and what drives it?
The duration depends on your current state and scope, and no supplied figure gives a reliable average, so treat any number you hear with caution. The main drivers are how many systems hold CUI, whether your enclave is already segregated, how mature your documentation is, how many of the 110 Level 2 requirements already have evidence in final form, and whether you have an assessor's schedule to work around. Ask for a written gap assessment first, with the scope, deliverables and timeline agreed before work starts. Confirm with your assessor whether they will review draft policies or only final artifacts.
Can our internal IT team do the CMMC and CIS work ourselves?
Often partly, and the answer depends on whether your team can produce evidence in final form that an assessor will accept. The work splits into technical controls, such as MFA, logging, configuration and access reviews, and documentation that ties each requirement to an owner, procedure and recurring record. Internal teams usually handle the technical changes well when they have the time, while the documentation and independent review are harder to do objectively from inside. Ask yourself who will maintain the evidence after the first assessment, because the recurring work, not the first pass, drives long-term staffing. Verify your readiness against the NIST SP 800-171A objectives before deciding.
What does DeployOpen provide for CIS and CMMC readiness, and what does it not provide?
DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. It runs security testing and can provide private cyber ranges and training. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support is available as a retainer. DeployOpen does not issue CMMC certifications, audit reports or attestations, and it is not a C3PAO or DCMA DIBCAC. Those assessments are performed by the independent bodies named in the rule, so confirm assessor availability and independence with them directly.
Should we pursue CMMC now that Phase II is suspended?
Yes, you should keep preparing, because the suspension does not remove your existing obligations. On 13 July 2026 the Department of War suspended CMMC Phase II and started a 60-day review by a CMMC Reform Task Force, but Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The Department also said it will enforce NIST SP 800-171 Rev. 2 in the interim, even though NIST withdrew Rev. 2 on 14 May 2024. Check the DoW CIO page and the eCFR text together, because the eCFR still shows the original four-phase schedule. Confirm with your contracting officer which requirements apply to your current contracts.
How DeployOpen prepares teams for CIS and CMMC readiness
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For CIS Controls and CMMC readiness, we help teams scope the work, build the technical controls and collect the evidence, while the CMMC assessment itself stays with the assessors named in the rule.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope lists which systems, enclaves and CUI or Federal contract information flows fall inside the boundary.
- We confirm which CMMC level and which CIS Implementation Group the contract actually requires before any build begins.
- Scope also records which CMMC phase applies to the contract, confirmed against current DoD guidance at the time of signing.
How we build
- We map CIS Safeguards and NIST SP 800-171 requirements to the systems you run, showing where one control covers both.
- Technical controls are implemented in your own cloud accounts, data centers or air-gapped networks, not in a DeployOpen-hosted environment.
- Security testing of the implemented controls can be scoped alongside the build to check the controls work as documented.
- Configuration, access and logging changes are recorded so each requirement has a traceable artifact an assessor can review.
How we hand over
- Deliverables include system documentation, control implementation statements and an evidence index keyed to requirement IDs.
- We document gaps as open items with owners, so your team can decide what to close before an assessment and what to record on a POA&M.
- Handover includes runbooks for the controls your staff must operate, such as access reviews, backups and log review.
- We do not issue audit reports, attestations or certifications. Your assessor or the certification body makes that determination.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
- A retainer can cover re-checking evidence when contract requirements or DoD guidance change, which has happened repeatedly for CMMC.
- Ask us to confirm in writing which CMMC and CIS version your scope references, and what a change in scope would cost.
- Quotes follow from the written scope, so the questions to bring are the boundary, the level, the phase and the evidence owner.
