CMMC Self-Assessment and NIST 800-171 Readiness on Florida's Treasure Coast

Who This Is For

This service is a good fit for Florida companies that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), including:

• Manufacturers and machine shops building parts for defense primes
• Engineering and design firms working with drawings, specs or technical data
• Marine and aerospace suppliers along the Treasure Coast
• Construction firms with federal or military facility work
• Mid-sized subcontractors who have been asked by a prime to confirm their CMMC status or SPRS score

If you are in Stuart, Port St. Lucie, Vero Beach, Okeechobee or anywhere in Martin, St. Lucie, Indian River or Okeechobee County, we can meet you in person.

What a CMMC Self-Assessment Covers

A self-assessment is not just a checklist. Done right, it gives you an honest picture of where you stand and a plan to close the gaps. Here is what we help you work through:

• Scoping your FCI and CUI. We figure out where contract information lives, who touches it, and which systems are in scope. Good scoping often makes the rest of the work smaller.
• Level 1 versus Level 2. Level 1 covers the 15 basic safeguarding requirements for FCI, with an annual self-assessment and affirmation. Level 2 covers the 110 requirements in NIST SP 800-171 Rev. 2 for CUI, with a self-assessment every three years and an annual affirmation. We help you confirm which level your contracts call for.
• Gap review against NIST 800-171. We walk through the controls with your team and document what is in place, what is partly in place, and what is missing.
• Your SPRS score. We help you calculate your score using the DoD assessment methodology so you can enter it in the Supplier Performance Risk System (SPRS) with documentation to back it up.
• System Security Plan (SSP) and POA&M. We help you write or update your SSP and build a Plan of Action and Milestones for items that still need work, within the limits CMMC sets on what can stay open.
• Remediation support. Because Titan is a full MSP and MSSP, we can actually fix the gaps, from MFA and email security to backups, logging and firewall changes.

Your company performs and signs its own affirmation. Our job is to make sure you have the facts, the documents and the fixes in place before you do.

How It Works

1. 1

   Discovery call.

   A short conversation about your contracts, what you have been asked for, and where your data lives. No cost and no pressure.

2. 2

   Scoping and gap review.

   We map your FCI and CUI, review your environment against the required controls, and give you a plain-language report with priorities.

3. 3

   Remediation and documentation.

   We close gaps with you, update your SSP and POA&M, and help you calculate your SPRS score.

4. 4

   Affirmation and ongoing support.

   You complete your self-assessment and affirmation with confidence. We stay on to help you keep it current year after year.

Why Titan IT Management

• Veteran-owned and family-run. We understand the mission behind defense work and take protecting that information seriously.
• Local to the Treasure Coast. Our office is at 900 SE Ocean Blvd in Stuart. When you need someone on site, we are close by.
• MSP plus MSSP under one roof. Many readiness consultants hand you a report and leave. We can do the remediation work in-house and keep it maintained.
• Microsoft CSP. We help you choose between GCC High and standard Microsoft 365 based on what your contracts actually require, so you are not paying for more than you need. When GCC High is the right fit, we work with a partner to deliver it.
• We have done this work before. Read how we helped a defense subcontractor prepare for CMMC and align with NIST 800-171.
• Part of a broader compliance practice. CMMC readiness sits alongside our HIPAA, PCI DSS and cyber insurance work on our Compliance Services page.
• Tools we already run every day. Our managed stack includes Datto RMM, Autotask PSA, ConnectWise ScreenConnect, INKY email security, Datto BCDR backup, and SonicWall and Meraki firewalls. That gives us a head start on many of the technical controls.