How does the gap analysis relate to CMMC certification audits/assessments?
You analyze and remediate gaps before an assessment, not during one.
DoD suspended third-party assessments on July 13, 2026, so there’s no C3PAO date to work back from. The near-term goal is a self-assessment score you can defend — accurate, documented, and supported by evidence. That’s the same work an assessment would have required, and it’s what has to hold up if anyone challenges the score you filed.
Can the gap analysis be tailored to unique business needs or compliance concerns?
Yes. This is why we want you to be deeply involved in the gap analysis process. You know your business, and you’ll be doing 75% of the work so that the analysis is tailored to you. We provide 25% of the work in the form of scoping guidance, knowledge of the security controls under review, and experience.
How can I get up to speed on CMMC?
Like many government initiatives, CMMC is complicated and confusing. You can find answers to common questions about CMMC in our Learning Center. Here are some of them: