CMMC Phase 2 begins November 10, 2026: Level 2 certification starts appearing in DoD contracts Call (678) 437-1368 · Mon–Fri 9am–6pm ET
Sentry Cloud IT logoCMMC Compliance for Georgia Defense Contractors
CMMC gap assessment

Know your real CMMC score before an assessor does

A gap assessment tells you which CMMC level applies, where CUI actually lives in your business, how your current controls score and what it will take to close the difference.

Updated October 2026

Why start with an assessment

Most contractors who call us already have a number in SPRS. Very few can show the evidence behind it. Under CMMC, a senior official has to affirm that number every year. If it's wrong, the risk goes beyond losing a bid: the Department of Justice has used the False Claims Act against contractors who misrepresented their cybersecurity. An honest gap assessment replaces a guess with a score you can defend.

What we assess

  • Scope: where Federal Contract Information and CUI enter your business (email, portals, removable media, shop-floor equipment), where they are stored and who can reach them. Getting scope right is the biggest lever on cost, because everything inside the boundary has to meet all the requirements.
  • Every applicable requirement: the 15 Level 1 requirements, or all 110 NIST SP 800-171 Rev. 2 requirements for Level 2, tested against the assessment objectives the assessor will use, not just a yes or no.
  • Evidence: for each requirement, what already exists (configurations, logs, policies, records) and what's missing.
  • Cloud and email: whether your Microsoft 365, file sharing and other cloud services meet the FedRAMP Moderate or equivalent requirement in DFARS 252.204-7012.

What you get

  1. A scored result using the DoD assessment methodology, on the same -203 to 110 scale SPRS uses.
  2. A gap list ranked by risk and by how many points each item is worth.
  3. A scope diagram you can reuse in your System Security Plan.
  4. A recommended path: Level 1 self-assessment, Level 2 self-assessment or C3PAO certification, plus whether a CUI enclave or a full GCC High move makes more sense.
  5. A fixed-price remediation proposal and a realistic timeline.
Some requirements can't be left on a Plan of Action and Milestones at assessment time, and conditional status needs a score of at least 88. The assessment tells you which of your gaps fall into those categories, so you fix them first.

How it runs

Kickoff is a two-hour working session with your owner or operations lead and whoever manages IT today. We then collect configuration data from your systems (read-only, with your approval) and interview two or three staff members. Most assessments finish in two to three weeks and end with a walkthrough of the results, not just an emailed PDF.

Questions about gap assessment

Will the gap assessment change our SPRS score?

Not by itself. SPRS shows only what your company submits. The assessment gives you an accurate number. Whether and when to update SPRS is your decision, and we'll explain the trade-offs.

Do you need to be on site?

For metro Atlanta clients we usually do one on-site day to see the shop floor, the network closet and how people actually work. Elsewhere in Georgia most of it is remote, plus a site visit when it matters.

Phase 2 starts November 10, 2026

Don't find out from a contracting officer

Primes are already asking subcontractors for CMMC status. A gap assessment tells you where you stand in about two weeks, so you can answer with a plan instead of a guess.

Get a CMMC gap assessmentCall (678) 437-1368
Call nowGet a CMMC gap assessment