What you get4 things, handed over
- A written report, ranked by what would actually stop a shipment
- A gap list with a fix order
- Compliance evidence a reviewer can quote
- A straight answer on whether you are ready
The findings sort. Real artifacts go in on the left — the procedures, the records, the running system, not a summary of them — and every finding lands in one of three bins: it stops a shipment, it blocks a user, or it only fails a rule. A scanner counts all three the same and reports a number. The bins are the deliverable, because the fix order comes straight off them and the third bin is frequently the one to accept in writing and move on from.
How it runsprove5 steps · 2 decisions
Define the question
Most first calls are three questions wearing one coat. Separating them is half the work.
Look at the real artifacts
The actual procedures, the actual records, the actual system. Not a summary of them.
DecisionWhat actually blocks a shipment, a user, or a contract, as opposed to what merely fails a rule?
Test it the way the reviewer will
The same checklist, the same keyboard-only pass, the same control mapping. No surprises later.
Rank by consequence
Findings ordered by what happens if they are ignored, not by how many rule violations a scanner counted.
DecisionFix, accept in writing, or walk away. If the honest answer is that you do not need me, that is the answer and it is free.
Write it down
Something a procurement file can hold and an engineer can act on.
What this covers6 areas, and where each one bites
- Supplier auditsPreparing to be audited and auditing someone you are about to depend on are the same skill pointed in opposite directions.
- Security complianceMapping a real setup to the controls, then writing the plan in a form you can update instead of redo.
- AccessibilityAdvisory scoping: an honest read of where you stand and what a first slice costs. Not a remediation factory.
- First articleSource inspection and first-article checks at the point where being wrong stops being cheap.
- ReadinessA straight answer on whether you are ready, early enough that the answer is still useful.
- Second opinionAn hour with someone who has built the thing you are asking about. Sometimes the finding is that you do not need me.
Assessment work here is advisory. Nothing on this sheet is a certification, an accreditation, or a registrar audit, and none is claimed.
The opinion behind it
A finding that blocks nobody matters less than a passing page that no one can use. Scanners cannot tell those apart. People can.
What holds this workstandards we know, not certifications we hold
- CMMC Level 2The defense contracting maturity model. Level 2 is the one most subcontracts actually invoke.Defense supply chain
- NIST SP 800-171The 110 controls underneath CMMC. The system security plan is a document about how you meet them.Controlled information
- WCAG 2.1 AAThe measurable half of accessibility. Keyboard and screen reader passes find what the scanner cannot.Digital delivery
- Section 508The federal procurement rule that points at WCAG. Scoped here as advice, never as volume remediation.Advisory only
- First articleSource and first-article inspection against the drawing and the purchase order, before the run.Hardware supply
Where it stopsan empty row is work this firm does not take
What that covers
- Supplier auditsGet ready for the audit, or run the audit on someone else.
- CMMC readiness paperworkSystem security plan, control map, and POA&M for a defense buyer — written once, yours to maintain. Not a certification we hold.
- AssessmentsA defined look at one problem, with a written answer at the end.
Capacity
Findings are ranked by consequence, which is a judgement and stays with a person. The reading that gets to those findings — the control mapping, the record sampling, the first pass over a document set — is machine work and is done as machine work.
The report says who decided what. A finding you cannot trace to a person is a finding nobody will defend in a procurement file.
How the work gets doneevery engagement, every page
Bots read the portals
SAM, the state portals and the subcontracting boards, every day, so no opportunity depends on someone remembering to look.
Models do the first pass
The reading, the mapping and the first draft of document-heavy work, where a machine is fast and tireless.
A person decides and signs
Every judgement call, every commitment and every signature is human, and the record says who.
One engineer, fixed scope
You get the person you evaluated, on a scope agreed before the work starts, and no invented follow-on.
How you can hire mescope is agreed first; price is a conversation — the scope sheet
On retainer
A senior quality lead a few days a month, holding the program and reachable when something goes sideways.
Fixed scope
A defined look at one problem, a defined amount of time, a written answer. No obligation after.
By the hour
An hour with someone who has built the thing you are asking about. Straight answers, no deck.
Start a conversationStraight answer, no deck. What it takes to start.
One standard, more than one verbwhy these are four sheets and not four firms
- NQA-1NQA-1 — Build: we write toNQA-1 — Prove: we write toNQA-1 — Automate: does not applyNQA-1 — Win: does not apply
- 10 CFR 50 App. B10 CFR 50 App. B — Build: we write to10 CFR 50 App. B — Prove: we write to10 CFR 50 App. B — Automate: does not apply10 CFR 50 App. B — Win: we write to
- ISO 9001ISO 9001 — Build: we write toISO 9001 — Prove: we write toISO 9001 — Automate: does not applyISO 9001 — Win: does not apply
- CMMC Level 2CMMC Level 2 — Build: we write toCMMC Level 2 — Prove: we write toCMMC Level 2 — Automate: does not applyCMMC Level 2 — Win: we write to
- NIST SP 800-171NIST SP 800-171 — Build: we write toNIST SP 800-171 — Prove: we write toNIST SP 800-171 — Automate: we write toNIST SP 800-171 — Win: does not apply
- WCAG 2.1 AAWCAG 2.1 AA — Build: does not applyWCAG 2.1 AA — Prove: we write toWCAG 2.1 AA — Automate: does not applyWCAG 2.1 AA — Win: we write to
- Section 508Section 508 — Build: does not applySection 508 — Prove: we write toSection 508 — Automate: does not applySection 508 — Win: we write to
- FARFAR — Build: does not applyFAR — Prove: does not applyFAR — Automate: does not applyFAR — Win: we write to
- Audit trailAudit trail — Build: we write toAudit trail — Prove: we write toAudit trail — Automate: we write toAudit trail — Win: we write to
Audit trailThe one line that crosses all four. Every practice here ends in a record of who decided what, because none of the others survive without it.