Governance, Risk & Compliance
A CMMC readiness consultant prepares a defence supplier for an assessment that somebody else performs. That sentence is the whole basis on which we take this work. Certification at Level 2 is carried out by a CMMC Third-Party Assessment Organisation authorised by the Cyber AB, and Aphelion Cyber is not one. Anybody who tells you they can both prepare and certify you has misunderstood the scheme or is hoping you have.
What we do is the work either side of that assessment. Level 1 covers fifteen basic safeguarding requirements from FAR 52.204-21 and is self-assessed annually. Level 2 covers the one hundred and ten security requirements of NIST SP 800-171, and for most contracts is assessed by a C3PAO every three years with an annual affirmation in between. Level 3 adds selected requirements from SP 800-172 and is assessed by DCMA DIBCAC.
The single decision that determines cost is scope: which systems store, process or transmit Controlled Unclassified Information, and whether you can pull that boundary tight, often into an enclave, rather than dragging your whole estate into assessment. It is the same argument as PCI DSS scoping, and it is worth making properly before a single control is written.
Why you need it
01 / 06One hundred and ten requirements applied to an entire corporate estate is a different programme from the same requirements applied to a defined enclave holding CUI. Most of the saving available to you is made in the first month, on a whiteboard, before anybody buys anything.
Self-assessment scores are posted to the Supplier Performance Risk System and affirmed by a named senior official. In the United States those affirmations have been the basis of False Claims Act settlements. This is not paperwork; it is an assertion with consequences.
The System Security Plan describes how each requirement is met in your environment. Assessors test the description against the system. A plan written from a template rather than from the estate is the most common reason an assessment goes badly.
If you pass CUI to subcontractors, the requirement travels with it. Managing that flow-down, and knowing which of your suppliers can actually meet it, is part of readiness, not an afterthought once your own assessment is booked.
Instrument
02 / 06The one hundred and ten requirements against the frameworks you may already hold, so the overlap is funded once.
What we deliver
03 / 06What CUI you actually hold, where it flows, and which assets are in scope as CUI assets, security protection assets, contractor risk managed assets or specialised assets. Categorised the way an assessor will categorise them.
Where it makes sense, a bounded environment that holds CUI and keeps the rest of the estate out of assessment, with the segmentation, identity and data-flow controls that make the boundary defensible rather than asserted.
Each requirement assessed with evidence, scored on the DoD methodology, and recorded honestly. Where something is not met, it is listed as not met rather than rounded up.
A System Security Plan that describes your environment as it is, and a Plan of Action and Milestones that is a real schedule with owners and dates. These two documents carry the engagement.
Hands-on closure of the gaps: access control and MFA, audit and accountability, configuration management, incident response, media protection, and the FIPS-validated cryptography requirement that catches people late.
Evidence organised against each requirement, a mock assessment run the way a C3PAO runs one, and the awkward questions asked while there is still time to fix the answers.
How we run it
04 / 06Read the contracts, find the clauses, and establish what CUI is actually in play and at which level you need to be.
Weeks 1-2Asset categorisation and, where it is the right answer, enclave design. Agreed before control work begins, because it changes the size of everything after it.
Weeks 2-4All one hundred and ten requirements assessed against evidence, scored, and written into the SSP as it stands today.
Weeks 4-8Work the POA&M with your teams. FIPS-validated cryptography, audit logging and identity usually set the critical path.
Months 3-8Run the assessment internally the way a C3PAO would, against the evidence you have, and fix what it exposes.
Month 9Support you through the certification assessment performed by an authorised third party, then set the annual affirmation rhythm.
Month 10, then annuallyKey benefits
05 / 06As the rule phases into contracts, the certificate stops being a differentiator and becomes a gate, and readiness done early means an assessment slot booked on your schedule rather than against a deadline.
An enclave that contains CUI means one hundred and ten requirements apply to a defined boundary rather than to everything you own, which is cheaper to build and materially cheaper to keep.
An SSP written from the estate rather than from a template stays useful after the assessment, for onboarding, for incidents, and for the next assessment three years later.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Standards
Assessment
Technical validation
Evidence
Mapping
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.