CMMC, SOC 2 & COMPLIANCE SERVICES

Willis Security is a CyberAB Registered Practitioner Organization (RPO), the ONLY accreditation body of the Department of Defense / War (DoD/W) for CMMC. Listed on the CyberAB Marketplace, a Managed Service Provider (MSP) and a Managed Security Service Provider (MSSP). 

https://cyberab.org/Member/RPO-66202-Willis-Security-Llc)

We take Defense Contractors from the first Gap Assessment to an affirmed SPRS score, then keep them compliant. We bring the same program approach to SOC 2, HIPAA, the FTC Safeguards Rule, SEC cybersecurity rules and privacy requirements for financial services, healthcare and other regulated organizations.

Most firms make you hire two vendors: an advisor who writes a report, and an IT Provider who has to implement it. Willis Security is both, under one contract. When an Assessor asks for evidence, we show the dashboards and telemetry from the actual security tools we run for you, not just a binder.

A note on independence: we prepare you for Assessment; we DO NOT certify you. CMMC certification assessments are performed by an authorized third-party C3PAO, and the firm that helped build your program CANNOT also certify it.

Overview:

The Cybersecurity Maturity Model Certification (CMMC) program is how the Department of Defense / War (DoD/W) verifies that its contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). If a contract or solicitation includes DFARS clause 252.204-7021 and your company will handle FCI or CUI, you MUST meet the CMMC level it specifies. Prime contractors flow the requirement down to their subcontractors.

The Levels:

• Level 1 protects FCI: the basic safeguarding requirements of FAR 52.204-21, verified by an annual Self-Assessment and Affirmation in the Supplier Performance Risk System (SPRS)
• Level 2 protects CUI: all 110 requirements of NIST SP 800-171 Rev. 2, verified by a Self-Assessment or a third-party (C3PAO) Assessment as the contract specifies, every three years, with an annual Affirmation
• Level 3 protects CUI in critical programs: Level 2 plus selected NIST SP 800-172 requirements, assessed by the government (DIBCAC)

Timeline:

• November 10, 2025: Phase 1 began. The CMMC clause started appearing in new DoD/W solicitations. Level 1 and Level 2 Self-Assessments are REQUIRED where the contract specifies them.
• July 13, 2026: Phase 2 suspended. DoD/W suspended the third-party (C3PAO) certification requirement that was scheduled for November 10, 2026, and opened a 60-day CMMC Reform Task Force review.
• September 3, 2026: Class Deviation 2026-O0025 Revision 3 made the suspension binding. Contracting officers are removing third-party assessment requirements from solicitations and contracts, and Level 1 and Level 2 may be satisfied by Self-Assessment while the deviation is in effect.
• September 11, 2026: The Task Force review period closed. Its report has not been published, and no new phase dates have been set.

What Has Not Changed:

• DFARS 252.204-7012 still requires you to safeguard covered defense information and report cyber incidents to the DoD/W within 72 hours
• NIST SP 800-171 is still the standard, and your Self-Assessment Score MUST be accurate and current in SPRS, affirmed annually by a senior company official
• The Department of Justice continues to pursue False Claims Act cases against contractors whose reported scores do not match their actual security
• Voluntary Level 2 certification by an authorized C3PAO remains available for organizations that want a head start or whose primes request it

Our Take:

The pause changed who checks your work, NOT WHAT YOU ARE REQUIRED TO DO! 

Use this window to close gaps, correct your SPRS score and be ready when third-party assessments return. 

Overview:

For companies that handle Federal Contract Information (FCI) and need a defensible Level 1 Self-Assessment, delivered as a right-sized program that scales to Level 2, when your contracts do.

What We Deliver:

• Gap Assessment against the Level 1 requirements
• Endpoint, Cloud and Microsoft 365 review and hardening
• System Security Plan and supporting Policies
• Self-Assessment, SPRS submission and annual Affirmation support
• Ongoing monitoring to keep you compliant between affirmations

Benefits:

• A Level 1 record that holds up to your Prime's or Assessor's questions
• Managed Security for CMMC Level 1 available as a Monthly Service
• A clear path to Level 2, as your contracts grow

Overview:

For companies that handle Controlled Unclassified Information (CUI) and must meet all 110 NIST SP 800-171 requirements, whether the contract calls for a Self-Assessment or a C3PAO Assessment.

What We Deliver:

• Scoping and Boundary Definition: which Users, Systems and Providers touch CUI
• Gap Assessment against all 320 Assessment Objectives
• Implementation and Remediation, including Microsoft 365 GCC High, Intune and secure CUI enclaves 
• Documentation: System Security Plan, POA&M, Policies and Procedures, Shared Responsibility Matrix (SRM) and Evidence package
• SPRS Score calculation and Affirmation Support
• Targeted User Training, Monthly Risk Reporting and Compliance Reviews
• Mock Assessment to prepare for a C3PAO when your contract requires certification

Benefits:

• Every document and artifact built to the CMMC Assessment objectives your Assessor will test
• One Team from Scoping through Documentation, Implementation, Training and Ongoing Support
• Evidence collected and kept current through the year, not rebuilt before an Assessment

Overview:

Many small contractors do not have the staff to run the controls after the documents are written. Willis Security operates your security as your Managed Service Provider (MSP) and Managed Security Service Provider (MSSP), or runs all of your IT as your Managed IT Provider, and maintains your CMMC program, so the controls in your SSP are the controls running in your environment.

Includes:

• Managed Security for CMMC Level 2: XDR Endpoint Protection, Vulnerability Management, Secure Email and Files for CUI, and Security Awareness Training
• Managed IT and Security for CMMC Level 2: adds full Managed IT, Microsoft 365 and Intune management, Google Workspace, Backup and Patching
• RPO Advisory: the Compliance Program on its own when your existing IT team or MSP handles the technical fixes
• Continuous Monitoring with Monthly Compliance and Risk Reporting
• Built for Defense Contractors of every size; no client / user count is too small

Benefits:

• Compliance Advisory and Managed Security under one contract: no handoffs, no finger-pointing
• Assessment Evidence comes from the tools we operate & manage for you
• One partner that builds the program, runs it and stands behind it

Overview:

AI tools are entering Defense Contractors' Workflows whether or not anyone approved them, and a prompt that contains CUI is a CUI transfer. Microsoft 365 Copilot is available in GCC High and operates inside your Government Cloud Tenant, but it surfaces whatever a user already has access to, so Permissions Cleanup, Sensitivity Labels and an Acceptable Use Policy have to come first. Willis Security helps you get the business benefit of AI without putting CUI where it does not belong.

What We Deliver:

• AI Readiness Assessment for CUI environments: where AI pays off first, and what has to be fixed before it does
• Microsoft 365 Copilot deployment in GCC High, with the permissions cleanup so Copilot only surfaces what each user should see
• Data Classification and Sensitivity Labels that keep CUI inside your boundary
• AI Acceptable Use Policy and Staff Training that keep CUI out of consumer AI tools
• Shadow AI Discovery and Monitoring
• Governance aligned to the NIST AI Risk Management Framework and documented in your System Security Plan

Benefits:

• Productivity gains from AI without a new CUI exposure
• AI use that your Assessor, your Primes and your Insurer can see is governed
• A governed path to add new AI tools as they arrive

Overview:

SOC 2 Type 2 is an independent CPA attestation that your controls were designed well and operated effectively over time, measured against the AICPA Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy. Enterprise Customers, Investors and Cyber Insurers increasingly expect it, especially from SaaS, Financial Services, Healthcare and MSP Vendors.

Proven Experience:

William Knight, Willis Security's founder and CEO, owned the SOC 2 Type 2 program at InfoArmor through consecutive audit cycles, maturing control design and evidence operations across security, IT, engineering, product and legal. That program helped support InfoArmor's acquisition by Allstate in 2018. "Will is a smart, resourceful problem solver... I worked with Will and his team over the last two audit cycles and could not be more impressed with his leadership and mentoring style." (Ben Duguay, Allstate Identity Protection, LinkedIn recommendation, May 2021)

What We Deliver:

• Readiness Assessment and Compliance Roadmap
• Policies and Controls aligned to the Trust Services Criteria
• Technical Remediation, Tool Configuration and Control Owner Assignment
• Help selecting the right CPA firm
• Audit Management: Evidence Packaging, Auditor Communication and Responses
• Post-Audit Monitoring, Evidence Checks and Monthly Reporting

Typical Timeline:

• Discovery and Scoping: choose Criteria, Assess Gaps, Map Readiness (first 30 days)
• Remediation: Implement Controls, Write Policies, Align Tooling (days 30 to 90)
• Observation Period: Controls Operate and Generate Evidence (3 to 12 months)
• Audit and Renewal: CPA Review and Report, then Annual upkeep

Overview:

The same Assess, Remediate and Maintain approach applies to the other rules our clients answer to. We build the Policies, Controls and Evidence that Regulators, Customers and Insurers ask for, and we keep them current year to year.

What We Deliver:

• HIPAA Security Rule Risk Analysis, Policies and Safeguards for Healthcare Clinics, Medical Practices & Facilities
• FTC Safeguards Rule and SEC cybersecurity rules programs for Financial Services, Wealth Advisors and RIA firms
• GDPR and U.S. Privacy Programs: Data Flow Mapping and Records of Processing Activities (ROPA), Data Processing Agreements (DPA), Data Protection Impact Assessments (DPIA) and Privacy Control Configuration across Microsoft 365 and cloud environments
• NIST CSF 2.0 and CIS Controls v8 programs for organizations without a named regulation

Proven Experience:

William Knight served as Data Protection Officer at InfoArmor, aligning operations with GDPR, CCPA and emerging U.S. privacy laws and working with internal and outside counsel on data governance and privacy by design. Several of our engineers hold the Certified Data Privacy Solutions Engineer (CDPSE) credential.

Why:

• CyberAB Registered Practitioner Organization (RPO), listed on the CyberAB Marketplace - https://cyberab.org/Member/RPO-66202-Willis-Security-Llc)

• Certified CMMC professionals: our team includes CMMC LCCA, CCA, CCP and RP credential holders, backed by CISSP, CISA, CISM, CRISC, CDPSE and ISO 27001 Lead Implementer certifications

• 25+ years in regulated security: Compliance and Security Program Leadership across Federal Agencies, SaaS, MSPs, Finance and Healthcare

• End to End: One Team from the initial Gap Assessment through Documentation, Implementation, Training and Ongoing Support

• Built to the Assessment Objectives: every Document and Artifact is built to the CMMC Assessment Objectives your Assessor will test

• Entirely U.S. based Team: your engagement is led by our Vetted Engineers, Analysts and Leadership, all located in the United States

                                         Flexible Federal Contracting Options
                                              UEI SAM:  PE7HUTN95ZE3

                                                           CAGE: 15MH8