CMMC LEVEL 1 COMPLIANCE SOLUTIONS

CMMC Level 1 Compliance,
Handled End to End

DivIHN holds Cybersecurity Maturity Model Certification (CMMC) Level 2 certification. The same standard governing your assessment governs how DivIHN operates. Every engagement covers scoping, gap assessment, remediation support, Supplier Performance Risk System (SPRS) submission, and annual affirmation.

THE SERVICE GAP

Where Most Providers Fall Short

THE REALITY

A Department of Defense (DoD) subcontractor hired a compliance firm to handle their Level 1 assessment. The firm delivered a checklist and a quote for additional remediation work. Six months passed with no SPRS submission and no designated affirming official. The contract renewal window opened three weeks later.

Compliance frameworks define a floor, not a ceiling. PCI DSS covers your cardholder environment. HIPAA covers ePHI safeguards. CMMC covers your CUI enclave. Each operates within a defined boundary. AI integrations, cloud identity paths, and third-party connections sit outside that boundary and represent real attacker opportunity. The most defensible posture addresses both.

-SERVICE COVERAGE

What Every Engagement
Covers

Every Level 1 engagement is scoped to your contracts, your systems, and your deadline. Every step below is built into every engagement from day one, regardless of which service path you choose.

STEP 01 / SCOPING Scoping

ALL COMPANY SIZES / ALL SECTORS

Initial Scoping Call

The first session confirms which contracts are in scope, identifies every system and device touching Federal Contract Information (FCI), establishes your deadline based on contract action dates, and selects the service path that fits your timeline and internal capacity.

Identifies in-scope contracts across all active DoD primes and subs

Maps FCI boundary against systems, devices, and locations

Confirms deadline against contract renewal and recompete dates

Selects service path based on timeline and internal capacity

STEP 02 / ASSESSMENT

ALL COMPANY SIZES / ALL SECTORS

Gap Assessment

Every in-scope system and process is evaluated against all 15 Federal Acquisition Regulation (FAR) 52.204-21 requirements. DivIHN identifies, documents, and prioritizes gaps by remediation urgency. The assessment output is a working document your team can act on directly.

Evaluates all 15 requirements across all 6 FAR 52.204-21 domains

Documents and prioritizes gaps by remediation urgency

Identifies evidence requirements before remediation begins

Structures assessment output for direct SPRS submission use

STEP 03 / REMEDIATION

ALL COMPANY SIZES / ALL SECTORS

Remediation Support

DivIHN provides direct support through the remediation of identified gaps. For Guided engagements, this means structured working sessions with your team. For Full-Service engagements, DivIHN manages the remediation process and documentation directly.

Completes policy and procedure documentation for every gap

Provides configuration guidance across all 6 domains

Collects and formats evidence to documentation standards

Verifies remediation before initiating SPRS submission

STEP 04 / SUBMISSION

ALL COMPANY SIZES / ALL SECTORS

SPRS Submission Support

SPRS submission involves more steps than most first-time assessors encounter in standard compliance work. DivIHN supports the affirming official through every step, from Procurement Integrated Enterprise Environment (PIEE) login access through the formal affirmation. DivIHN closes the engagement only after confirming the SPRS score active.

Confirms and sets up PIEE access for the affirming official

Completes and reviews self-assessment scoring before submission

Supports the affirming official through formal affirmation

Confirms SPRS score active before engagement closes

STEP 05 / ANNUAL SUPPORT

ALL COMPANY SIZES / ALL SECTORS

Annual Affirmation and Renewal

Level 1 compliance renews annually. The affirming official reaffirms each year and DivIHN updates the assessment whenever your scope changes materially. DivIHN tracks your renewal date and initiates the annual process with enough lead time to complete before the renewal deadline.

Tracks annual renewal date from initial submission

Initiates reassessment when scope changes mid-year

Supports the affirming official through each annual cycle

Confirms SPRS score active after every reaffirmation

-SERVICE COVERAGE

What Every Engagement
Covers

Every Level 1 engagement is scoped to your contracts, your systems, and your deadline. Every step below is built into every engagement from day one, regardless of which service path you choose.

STEP 01 / SCOPING Scoping

ALL COMPANY SIZES / ALL SECTORS

Initial Scoping Call

The first session confirms which contracts are in scope, identifies every system and device touching Federal Contract Information (FCI), establishes your deadline based on contract action dates, and selects the service path that fits your timeline and internal capacity.

Identifies in-scope contracts across all active DoD primes and subs

Maps FCI boundary against systems, devices, and locations

Confirms deadline against contract renewal and recompete dates

Selects service path based on timeline and internal capacity

STEP 02 / ASSESSMENT

ALL COMPANY SIZES / ALL SECTORS

Gap Assessment

Every in-scope system and process is evaluated against all 15 Federal Acquisition Regulation (FAR) 52.204-21 requirements. DivIHN identifies, documents, and prioritizes gaps by remediation urgency. The assessment output is a working document your team can act on directly.

Evaluates all 15 requirements across all 6 FAR 52.204-21 domains

Documents and prioritizes gaps by remediation urgency

Identifies evidence requirements before remediation begins

Structures assessment output for direct SPRS submission use

STEP 03 / REMEDIATION

ALL COMPANY SIZES / ALL SECTORS

Remediation Support

DivIHN provides direct support through the remediation of identified gaps. For Guided engagements, this means structured working sessions with your team. For Full-Service engagements, DivIHN manages the remediation process and documentation directly.

Completes policy and procedure documentation for every gap

Provides configuration guidance across all 6 domains

Collects and formats evidence to documentation standards

Verifies remediation before initiating SPRS submission

STEP 04 / SUBMISSION

ALL COMPANY SIZES / ALL SECTORS

SPRS Submission Support

SPRS submission involves more steps than most first-time assessors encounter in standard compliance work. DivIHN supports the affirming official through every step, from Procurement Integrated Enterprise Environment (PIEE) login access through the formal affirmation. DivIHN closes the engagement only after confirming the SPRS score active.

Confirms and sets up PIEE access for the affirming official

Completes and reviews self-assessment scoring before submission

Supports the affirming official through formal affirmation

Confirms SPRS score active before engagement closes

STEP 05 / ANNUAL SUPPORT

ALL COMPANY SIZES / ALL SECTORS

Annual Affirmation and Renewal

Level 1 compliance renews annually. The affirming official reaffirms each year and DivIHN updates the assessment whenever your scope changes materially. DivIHN tracks your renewal date and initiates the annual process with enough lead time to complete before the renewal deadline.

Tracks annual renewal date from initial submission

Initiates reassessment when scope changes mid-year

Supports the affirming official through each annual cycle

Confirms SPRS score active after every reaffirmation

-ENGAGEMENT TIMELINE

Your Deadline Drives
Every Engagement Timeline

Most Level 1 engagements complete in 4 to 12 weeks depending on starting posture and service path. Every timeline builds backward from your contract deadline.

Compressed timelines available for companies with near-term recompetes or solicitations.

T MINUS 8 TO 12 WEEKS

Scoping session

Our team maps your contract portfolio, confirms which systems touch FCI, establishes your deadline, and locks the service path before work begins.

T MINUS 6 TO 10 WEEKS

Gap assessment

Your team and ours evaluate every in-scope system against all 15 FAR 52.204-21 requirements. Gaps land in a prioritized remediation plan with evidence requirements identified before work begins.

T MINUS 4 TO 8 WEEKS

Remediation and documentation

Policy documentation, configuration guidance, and evidence collection close each gap. Our team verifies all 15 requirements before submission begins.

T MINUS 2 TO 4 WEEKS

SPRS submission

Our team designates your affirming official, confirms PIEE access, and completes self-assessment scoring. Our team supports the formal affirmation and confirms the SPRS score active.

T MINUS 0 TO 2 WEEKS

Annual support activated

Our team logs your renewal date, initiates the annual reassessment cycle, and documents scope change triggers for the year ahead.

T = 0

Contract deadline met

Your SPRS score stands current and active. Your affirming official has affirmed by name. Your contracts carry full award eligibility.

-THE DELIVERABLES

What Every Engagement Delivers

Every deliverable maps to the specific requirement your assessor checks. We structure gap documentation, evidence packages, and submission records so your affirming official can affirm accurately and your SPRS score reflects your actual posture.

Every deliverable and every step comes included from the first call. The scope of work is fixed before engagement begins.

DivIHN Gap Assessment Report

A documented evaluation of your current posture against all 15 FAR 52.204-21 requirements. Every gap is identified, prioritized by remediation urgency, and documented so your team can act on each finding directly.

Gap Assessment Report FAR 52.204-21 15 Requirements

SPRS PACKAGE Ready

Complete self-assessment scoring documentation with affirming official support, covering PIEE access, formal affirmation, and SPRS score confirmation.

PIEE Access SPRS Submission Affirmation

ANNUAL SUPPORT Active

Annual renewal tracking, reassessment when scope changes, and confirmation that your SPRS score remains active after every reaffirmation.

Annual Renewal Reaffirmation SPRS Active

01 Gap Assessment Report

A documented evaluation of your current posture against all 15 FAR 52.204-21 requirements. We identify and prioritize every gap by remediation urgency, written so your team can act on each finding directly.

02 SPRS Submission Package

Complete self-assessment scoring documentation and submission support for the affirming official. Our team covers every step of the SPRS process from PIEE access through formal affirmation and score confirmation.

03 Annual Renewal Support

Ongoing affirmation support for every annual renewal cycle. We track your renewal date, initiate reassessment when scope changes, and confirm your SPRS score active after every reaffirmation.

BEYOND THE ENGAGEMENT

What Makes Your SPRS Submission Defensible

A submitted score and a defensible position are two different things. Assessors and contracting officers check the documentation behind the score as closely as the score itself. DivIHN structures every engagement so both hold up equally.

AFFIRMATION ACCURACY

Can the affirming official defend what they signed?

The affirmation is a legal attestation. We review all 15 requirements against documented evidence and confirm full implementation before the affirming official affirms.

SCOPE DOCUMENTATION

Can you prove the right systems were in scope?

Every DivIHN engagement produces a written scope record identifying every system, device, and location included in the self-assessment. The scope documentation travels with the score.

ANNUAL CURRENCY

Does your SPRS score reflect current posture?

A score reaffirmed on schedule reflects current posture. Our team tracks renewal dates and initiates the annual process with enough lead time so the score on file stays current and defensible.