What the engagement produces

DELIVERABLE 01

Your real SPRS score

Scored against the DoD Assessment Methodology across all 110 NIST SP 800-171 Rev. 2 controls — at the assessment-objective level, the way a C3PAO will score you.

DELIVERABLE 02

CUI boundary documentation

Data-flow mapping and boundary definition — the document every architecture and budget decision hangs on.

DELIVERABLE 03

Sequenced gap register

Every gap with its point weight, remediation approach, and effort class — ordered so five-point deductions and long-lead items go first.

DELIVERABLE 04

Executive briefing

A straight read-out for leadership: score, exposure, remediation cost class, and the certification path — no slideware padding.

How it runs

Fixed scope, typically 4–6 weeks — a defined production run on the Factory runbook, not an open-ended discovery meter.
Practitioner-led — the people who scored inDirectIT's own environment run yours.
Feeds directly into remediation — the gap register is written as the input to Factory stations 02–04, so nothing is re-discovered later.

Path 01

Request your assessment.

Tell us where the program stands and we'll come back with scope, timeline, and a fixed price. Reviewed by a practitioner, answered with specifics. Or email rj@indirectit.com directly.