Compliance readiness

A customer asks about CMMC. You need to know your scope, gaps and cost first.

A typical situation

“A customer wants CMMC and we don’t know our scope, gaps or cost.”

Where we draw the line

T&K helps companies get ready for a compliance assessment. An independent assessor certifies them.

We do not certify, audit or assess anyone, and this page is not legal advice. Requirements depend on your contracts, so confirm them with your customer or prime contractor and an independent assessor.

In my view, compliance cost is largely a scoping decision. Where data lives and which systems touch it determine how much of your environment carries the full burden.

Start here

The Two-Week Assessment for compliance readiness.

We focus the assessment on:

Your scope and boundary: what data you hold and which systems touch it
A gap assessment: where you stand today
A costed roadmap to close the gaps before the assessor arrives

You get a written plan you can act on, whether or not you work with us again: an ownership map, a risk register with dates and costs, and a 90-day plan with decisions and owners, presented to your leadership team. The plan names the next step: a compliance readiness project, an advisory seat, or fractional IT leadership.

Scope is one site or entity and up to six interviews, for one fixed fee quoted before we start.

Experience

Why I can speak to this

At a company I worked at, I led the integration after an acquisition. Files had to be labeled by hand, and I re-architected the company’s systems around what data goes where, so only the systems that touch controlled data carried the full compliance burden. I also took part in vendor conversations to buy compliant versions of products the company already used.

That is the scoping layer of readiness. I don’t hold a compliance certification and I don’t assess or certify anyone.

Experience reflects my previous roles, not T&K client engagements. — Emily Roy, Founder & Fractional IT Director

Questions

Are you a compliance auditor or assessor?

No. We help you get ready for a compliance assessment. An independent assessor certifies you.

How do we know what our customer requires?

Your contract and your customer’s or prime contractor’s requirements say what applies. We help turn them into a scope, a gap list and a plan. Confirm the requirements themselves with your customer and an independent assessor.

Where should we start?

With the Two-Week Assessment, for one fixed fee quoted before we start. It ends in a 90-day plan that names the next step.

Do you replace our MSP?

No. We work alongside your MSP and IT team.

Not sure where to start? Book a conversation.

Book a conversation hello@thruxtonkendall.com