112Cyber

112Cyber is a cyber compliance firm that helps defense contractors meet CMMC rules. It is an authorized C3PAO, which means it can run the formal third-party CMMC assessment. It is authorized to carry out CMMC Level 2 assessments.

The firm says its assessors and professionals have more than 15 years of experience with frameworks such as NIST 800-171, CMMC and DFARS. It serves small defense contractors and international corporations that handle controlled unclassified information in Department of Defense contracts.

In a C3PAO assessment, 112Cyber starts with a scoping call and sends a statement of work with the scope, cost and timeline. After the contract is signed, it sets a start date to suit the client. Assessments usually take six to eight weeks, with daily progress updates. The firm gives a final report within one week. If the client passes, it issues a certificate and reports it to the governing body. Findings that can go on a plan of action have 180 days to fix, and the reassessment of those items is included in the fee.

CMMC advisory services help companies prepare. CUI data mapping traces how controlled information enters, moves through and leaves the organization, in order to shrink the scope of the assessment. It includes a data-flow diagram, an asset list, a system boundary diagram and a draft system security plan. Security gap assessments compare current controls with NIST 800-171 and build a plan to fix gaps.

Remediation services carry out that plan and update the system security plan and SPRS score. Pre-assessment mock assessments give a practice run at the same level as the real one. C3PAO assessment support helps with choosing an assessor, collecting evidence, interview readiness and follow-up plans. A compliance as a service package keeps CMMC, DFARS and CUI compliance up to date each year.

The firm also lists CPCSC support, webinars, case studies and office hours. In one case study, it removed five satellite offices and more than 400 employees from a client's CUI scope, which cut the cost of compliance.

Services

• C3PAO assessments
• CUI data mapping
• Security gap assessments
• CMMC remediation services
• C3PAO assessment support
• Pre-assessment mock assessments
• Compliance as a service
• CPCSC support