Eagle Ridge Advisory
GRC Readiness

Eagle Ridge Advisory · CMMC Level 2

The path to 88

Every defense contractor handling CUI is required to have an SPRS score. It runs from 110 down to −203, and a conditional CMMC certification requires at least 88. Score yourself honestly for the first time and you will probably land far below it — often below zero.

This page shows what an eight-week Eagle Ridge engagement does to that number, using a representative eight-person machine shop.

Fig. 01 · The scale you are scored on

−203 worst case 110 perfect score 88 −12 a typical first score
The DoD scores all 110 NIST 800-171 controls. Each gap subtracts 1, 3, or 5 points. Miss every one and you lose 313 — from 110 all the way down to −203.

One engagement, one number

Everything in the engagement moves one number. First we find out where you actually stand — no sugarcoating, because the assessor won’t sugarcoat either. Then the rest of the engagement climbs the score back over the line, with the few small items left over on a formal remediation plan the rule recognizes (a POA&M).

Fig. 02 · A representative engagement, start to submission

88 · conditional-pass line 0 Every contractor starts at 110 110 start 17 five-point gaps: MFA, FIPS encryption, logging −85 −85 5-pt gaps MFA, FIPS, logging 6 three-point gaps −18 −18 3-pt gaps 19 one-point gaps −19 −19 1-pt gaps Score after an honest gap assessment: −12 −12 week 2: the truth Remediation (weeks 2–4) closes the gaps: +103. SSP writing and review then prove the score holds. +103 remediation weeks 2–4 Submitted score: 91, with 19 small items on a POA&M 91 submitted 19 pts on POA&M
Representative eight-person shop: seventeen 5-point gaps, six 3-point, nineteen 1-point. Weights come from the official DoD Assessment Methodology; the submitted score keeps 19 points of one-point items on a POA&M, under the 22 points the 88 threshold leaves you.

All 110 controls, accounted for

An assessor marks each control met or not met — only two controls (MFA and FIPS encryption) carry partial credit. We assess all 110 in the first two weeks, fix what moves the score, and put the rest on the POA&M.

Fig. 03 · Where the 110 controls stand

week 2 68 controls met 42 controls not met 68 met 42 not met week 7 91 controls met 19 one-point items on the POA&M, each with a 180-day deadline 91 met 19 on POA&M
Hatched items are open but accepted: a POA&M is the DoD’s formal way to let you certify now and close the small gaps inside 180 days. Close them and the certification goes Final; miss the 180 days and it lapses. Most one-point controls qualify, a few are excluded outright, and one five-point control qualifies only at partial credit — we verify eligibility item by item.

Eight weeks, start to assessor

The work overlaps on purpose. While you and your IT support close technical gaps, we write the System Security Plan — the document the assessor reads first. Then we review it the way an assessor will, and keep reviewing until there are no critical findings left.

Fig. 04 · The engagement, week by week

wk 1wk 2 wk 3wk 4 wk 5wk 6 wk 7wk 8+ discovery gap assessment remediation SSP writing assessor-style review evidence & prep C3PAO assessment Week 1: intake, CUI determination, system boundary Week 2: all 110 controls assessed, honest score Weeks 2–4: the score-moving fixes Weeks 3–5: 110 control narratives Weeks 5–6: iterate until zero critical findings Weeks 6–7: evidence binder, interview prep, score submission Week 8+: the certified third-party assessment their exam, our prep
Remediation (weeks 2–4) is the heaviest lift; the dashed bar at the end is the assessment itself, run by an independent certified assessor — a C3PAO. The seven weeks before it exist to make that week boring.

Your hours vs. ours

You run a shop, not a security team. The engagement keeps your part short and specific. We do the document-heavy work.

What you do

  • Answer the intake questionnaire and one structured call
  • Gather the evidence we list — screenshots, invoices, settings
  • Approve tool purchases and let IT apply the config changes
  • Sign policies and sit for a practice interview

What Eagle Ridge does

  • Assess all 110 controls and score you the way the DoD will
  • Prioritize fixes by points-per-dollar for a small-shop budget
  • Draft the SSP’s 110 control narratives and the POA&M
  • Review it assessor-style, package evidence, prep your people

Figures show a representative engagement, not a quote — your starting score and timeline depend on your systems. Scoring follows the DoD Assessment Methodology; a Registered Provider reviews every deliverable before it reaches you. The SSP is delivered gap-documented and becomes assessment-ready once policies are signed and tools are deployed.
Sources: DoD NIST SP 800-171 Assessment Methodology v1.2.1 (2020) · 32 CFR Part 170 (CMMC Program, §170.21) · NIST SP 800-171 Rev 2.
Eagle Ridge Advisory · chris@eagleridge.io · eagleridge.io