Find Your CMMC Level 2 Gaps
Before Your Assessor Does
A readiness assessment for Minnesota manufacturers that handle Controlled Unclassified Information or face a Level 2 requirement from a contract or prime. McNallan measures your controls against NIST SP 800-171, hands you a gap list with remediation proposals, walks leadership through it in plain terms, and can work alongside you during the C3PAO assessment. We prepare you for certification. We are not the certifier.
Readiness Is Not Certification. It Is What Makes Certification Go Smoothly.
Does CMMC Level 2 Actually Apply to You?
Not every government contract carries the same CMMC requirement. The requirement lives in your solicitation, your contract, or the flow-down from your prime, and it may call for Level 1, Level 2 self-assessment, Level 2 C3PAO assessment, or Level 3.
The quick test is Controlled Unclassified Information (CUI). If your systems store, process, or transmit CUI, such as drawings, specifications, or technical data tied to a defense contract, Level 2 is likely in play, and NIST SP 800-171 is the standard you will be measured against. Federal Contract Information (FCI) alone usually points to Level 1.
Not sure what your paperwork requires? Bring the clause or the prime's letter to the first conversation. McNallan will help you identify the right starting point before anyone commits to an assessment.
This Is for You If One of These Is True
A Prime or Contract Made It a Condition
- A prime or contracting officer made CMMC Level 2 or NIST 800-171 a condition of keeping the work
- A supplier questionnaire or purchase-order clause showed up and nobody told you what comes next
- You are bidding DoD or aerospace work and know Level 2 is the price of admission
- You want a starting point that is not a guess
You Handle CUI, or You Are Not Sure
- Drawings, specs, or technical data from a defense contract sit on your file server or shop-floor PCs
- You have a SPRS score, or need one, and you are not confident in it
- You would rather find the problems now, on your own schedule, than during the formal assessment
- You want proposals to fix each gap, not just a list of findings
You Want Support During Certification
- Leadership needs a plain-language picture of where things stand and what it will take
- Your team will have questions when the C3PAO assessor is in the room
- You want McNallan available to answer questions during certification
What You Walk Away With
Every Level 2 Requirement, Checked
A Gap Analysis You Can Act On
A Remediation Proposal for Every Gap
A Leadership Walkthrough in Plain Terms
The Raw Evidence, Not Just a Summary
A Partner in the Room During Certification
How the CMMC Readiness Assessment Works
Step 1: Assess
- Every CMMC Level 2 requirement, reviewed with the people who run your systems
- Performed in person and remote, around your production schedule
- Your current state, not a checklist filled in from a conference room
Step 2: Analyze and Propose
- Current-state gap analysis of every item needing remediation
- A remediation proposal for each gap, during and after the engagement
- All collected data handed over to you
Step 3: Walk Through and Support
- Plain-language walkthrough with your executive team
- McNallan alongside you and the C3PAO assessor during certification
- Questions answered, detail provided, no scrambling
Your Primes Are Already Asking
If you machine, fabricate, or assemble parts for a defense prime, you have probably already seen it: a supplier questionnaire, a request for your SPRS score, or a new clause in a purchase order. CMMC is how the Department of Defense verifies that suppliers handling CUI actually meet NIST SP 800-171, instead of taking their word for it.
Suppliers who find their gaps early fix them on their own schedule. Suppliers who wait fix them on a prime's schedule, with a contract on the line.
Questions Manufacturers Ask Before They Call
Is this the official CMMC assessment?
No. Certification comes from a C3PAO. This is the preparation that makes that assessment go smoothly: the gaps found and documented before the assessor arrives, with McNallan available to answer questions during the formal assessment.
How long does it take, and how much of our team's time?
Scope depends on your sites, your systems, and how much documentation you already have. After the first conversation, McNallan sets who needs to participate, the split between on-site and remote work, and the schedule, before any work begins.
Will it disrupt production?
The assessment is performed in person and remote, working with the people who run your systems and processes. It is planned around your schedule, not the other way around.
What does it cost?
Scope depends on how much of your environment touches CUI. A tight enclave and a whole-plant network are different engagements. McNallan confirms the scope and the price after the first conversation, before work starts.
Another provider manages our IT. Does that matter?
The assessment stands on its own. McNallan assesses the environment as it is and works with whoever runs your systems.
What if our score is bad?
Then you learned it from us, on your schedule, with a remediation proposal for each gap. That is the point of doing readiness first.
How is this different from scoring ourselves in SPRS?
A self-score is only as good as the honesty and expertise behind it. A readiness assessment checks every requirement against what is actually in place, with the evidence to back it up, so the number you report is one you can defend.
Ready to Find Out Where You Stand on CMMC Level 2?
This is right for you if:
- A contract or prime requires CMMC Level 2, or you expect one will
- Your systems handle CUI, or you are not sure whether they do
- You want the gaps found before the assessment, not during it
- You want a partner who can work alongside you during certification