LFCLEATHERNECKFEDERAL CONSULTING

OUR PROPRIETARY METHODOLOGY

The LFC OORAH Framework

From gap assessment to audit-ready. Oorah. A disciplined, five-phase system for taking defense contractors from first gap assessment to a CMMC Level 2 certification that survives a C3PAO — and holds up afterward.

OORIENTScope & BaselineOORGANIZEPlan & ArchitectRREMEDIATEImplement & DocumentAASSESSValidate & RehearseHHOLDCertify & Sustain

WHY OORAH

Most assessments fail on Day 1. Ours don't.

The most common failure in a CMMC Level 2 assessment isn't a missing control — it's a structurally perfect SSP with nothing implemented, documented, or evidenced behind it. Assessors pause those engagements before kickoff.

The LFC OORAH Framework exists to prevent that. It sequences the work the way assessors actually evaluate it — orient on an honest scope, organize a credible plan, remediate and document, assess yourself against the official process, then hold the certification. No improvisation, no blank templates, no Day-1 surprises.

GROUNDED IN THE AUTHORITATIVE SOURCES

NIST SP 800-171 Rev 2/3
110 controls, 14 families — the substance of Level 2
NIST SP 800-171A
Assessment objectives & procedures the C3PAO actually uses
32 CFR Part 170
The CMMC Program final rule — levels, assessment, affirmation
DFARS 252.204-7019/7020/7021
The contract clauses that make it mandatory
CMMC CAP & Scoping Guide v2.13
How the assessment is conducted and what's in scope
SPRS scoring (−203 → +110)
The DoD's own supplier-risk scoring methodology

THE FIVE PHASES

How OORAH takes you to audit-ready.

O
PHASE 01
ORIENT
Scope & Baseline

Define the assessment boundary and establish an honest, evidence-based baseline before a single dollar is spent on remediation. Most failed assessments are lost here — to over-scoped enclaves and undocumented CUI flows.

KEY ACTIVITIES
  • ▸CUI scoping & assessment-boundary determination (per CMMC L2 Scoping Guide)
  • ▸CUI data-flow mapping — entry, processing, storage, transmission, destruction
  • ▸Asset & External Service Provider (ESP/CSP) inventory
  • ▸Gap assessment against all 110 NIST SP 800-171 controls using 800-171A assessment objectives
  • ▸SPRS baseline score calculation (the −203 to +110 DoD scoring methodology)
DELIVERABLES
Scope Determination documentCUI Data-Flow RegisterAsset / ESP inventoryGap Assessment report (control-by-control, 800-171A-referenced)SPRS baseline score & submission-ready summary
OUTCOME — A defensible scope, a true SPRS baseline, and a prioritized gap register — no surprises downstream.
▼
O
PHASE 02
ORGANIZE
Plan & Architect

Turn the gap register into a costed, sequenced remediation program and an enclave architecture sized to your operation — not a template. This is where compliance becomes a project with an owner, a budget, and a date.

KEY ACTIVITIES
  • ▸POA&M construction — severity, owner, due date, remediation plan per open control
  • ▸Remediation roadmap & milestone sequencing (cost + timeline)
  • ▸Enclave architecture design (GCC High / on-prem / hybrid) & shared-responsibility allocation
  • ▸SSP skeleton — system description, boundary, and control narrative structure
  • ▸Control Implementation Matrix baseline
DELIVERABLES
POA&M (live tracker)Remediation roadmap with cost & scheduleEnclave architecture & Shared-Responsibility MatrixSSP skeleton + Control Implementation Matrix
OUTCOME — A funded, scheduled remediation program and an enclave design that closes gaps by construction.
▼
R
PHASE 03
REMEDIATE
Implement & Document

Execute the POA&M — implement controls and write the documentation that proves them. The single most common Day-1 failure is a structurally perfect SSP with zero implemented, documented controls. Remediation is where compliance actually gets built.

KEY ACTIVITIES
  • ▸Control implementation across all 14 families (AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC, SI)
  • ▸Policy & SOP authoring per control family
  • ▸SSP section-by-section control implementation narratives (no placeholders)
  • ▸Evidence collection mapped to each control (Evidence Collection Matrix)
  • ▸POA&M burn-down and SPRS score uplift tracking
DELIVERABLES
Completed SSP (all 110 control narratives)14 control-family SOPsEvidence repository (control-mapped)POA&M closed to assessable threshold (≥88 / 110, no open high-severity items >180 days)Updated SPRS score
OUTCOME — An implemented, documented, evidence-backed posture — the difference between a blank template and an assessable system.
▼
A
PHASE 04
ASSESS
Validate & Rehearse

Prove readiness before the C3PAO does. A mock assessment against the official CMMC Assessment Process (CAP) finds the gaps your team can't see — while there's still time and budget to fix them.

KEY ACTIVITIES
  • ▸Mock assessment / readiness review against the CMMC CAP (Level 2 v2.13)
  • ▸Evidence walk-through & artifact validation
  • ▸Tabletop exercises (incident response, insider threat)
  • ▸Residual POA&M adjudication — confirm each open item is POA&M-eligible
  • ▸Pre-assessment package assembly (SSP, POA&M, evidence index)
DELIVERABLES
Readiness / mock-assessment report (findings + corrective actions)Corrective Action Program closure evidenceTabletop exercise recordsC3PAO-ready pre-assessment package
OUTCOME — Confidence — and the evidence — that the system will survive a C3PAO assessment on the first attempt.
▼
H
PHASE 05
HOLD
Certify & Sustain

Pass the assessment and hold the objective. Certification is a milestone, not the finish line — CMMC is a continuous obligation with annual affirmations, SPRS upkeep, and POA&M discipline. You don't just win it; you hold it.

KEY ACTIVITIES
  • ▸C3PAO assessment support (kickoff, evidence presentation, assessor Q&A)
  • ▸Findings response & limited POA&M closeout (180-day window)
  • ▸Certification & SPRS final reporting
  • ▸Annual affirmation & continuous-monitoring program
  • ▸Change control, periodic reassessment, and sustainment
DELIVERABLES
Assessment-day support & findings responsesCMMC L2 certification (via C3PAO)Annual affirmation package (per 32 CFR §170.22)Continuous-monitoring / ConMon plan
OUTCOME — CMMC Level 2 certification — and a compliance posture that holds up year after year, not just on assessment day.

START WITH PHASE 01

Get your OORAH gap assessment.

Every engagement begins with Orient — a scoped, evidence-based baseline and a prioritized roadmap with cost and timeline. Request your capabilities brief to begin.

REQUEST AN OORAH ASSESSMENT