Advisory: turning your findings into a plan
Your report says which cryptographic components in your estate have an active FIPS 140-3 certificate in the NIST record, which do not, and why. Deciding what to do about that for your own contracts is different work, and it depends on things only you and your contracting officer know. That work is advisory.
Why a second pair of eyes still matters
A third-party CMMC assessment was due to start appearing in contracts from 10 November 2026. That is no longer the plan. DoD suspended it on 13 July 2026, and Class Deviation 2026-O0025 (3 September 2026) directs contracting officers to remove or revise CMMC requirements, keeping self-assessment. Existing contracts change at their next option or modification.
That makes your own signed assessment the main evidence — and DoD can still check it. Nothing requires you to use an outside adviser. What an adviser gives you is someone who has read the record behind each finding before your signature goes on it.
What advisory covers
- Interpreting your findings for a specific assessment. Which findings matter for the assessment in front of you, and which do not.
- Drafting POA&M wording for your situation. A POA&M — plan of action and milestones — is the document that says how and by when each gap will be closed. We help you word the cryptography entries.
- Joining a call with your assessor or contracting officer, to explain what the report shows and how it was produced.
- Reviewing vendor replies and advising what to do next, when a supplier answers a question about a module’s certificate.
What it does not cover
- It is not legal advice, and we are not your lawyers.
- We are not a C3PAO, and we do not tell you whether you are compliant. That decision belongs to your assessor and your contracting officer.
- We are not a testing laboratory, and we do not certify cryptographic modules.
Advisory or support?
Support is about the tool and the report: it will not run, a finding looks wrong, a column is unclear. That is included with every license, and Premium support adds faster attention. Advisory is about your contract position: what the findings mean for you and what to do next. It is quoted separately because every engagement is different.
How it works
- Email us what you need. The assessment or contract it is for, your date, and your report reference if you have one. Please do not send configuration files, keys, credentials or machine names — we do not need them.
- We scope it with you, at no charge, by email or a short call, so the quote matches the work.
- You get a written quote: what is included, the price, and when we can do it. If we cannot meet your date, the quote says so.
- Nothing is chargeable without your written agreement. Advisory work is covered by our terms, including the mutual non-disclosure agreement inside them.
Price
A findings session: $1,250 for 90 minutes. We go through your report with you — which findings matter for the assessment in front of you, and what to do about each.
- If you book more advisory work within 60 days, the $1,250 counts towards it.
- Anything larger — POA&M drafting, a call with your assessor, reviewing vendor replies — is quoted for the job, in writing, before it starts.
- The first conversation to scope it is free.
Not the same as Premium support ($1,000 a year), which is faster help using the tool and understanding the report. Advisory is help deciding what to do about your contract position.