OUR PROPRIETARY METHODOLOGY
The LFC OORAH Framework
A controlled route from intake to evidence-backed decision. Five disciplined phases that take a small or mid-sized business from “can we do federal work?” to a posture it can defend with evidence.
THE OPERATING THESIS
OORAH is not a larger checklist.
OORAH is not a larger checklist. It is a controlled route from first contact to an evidence-backed decision: qualify the firm, identify what is actually missing, and choose the right starting point. Scope and data are protected, and the work moves to the next phase only when the current one is accepted.
Small and medium businesses entering or growing in federal work often do not fail for lack of capability. They fail because they pursue or scale federal work before understanding what it actually demands: market and NAICS fit, set-aside path and eligibility, accounting, bonding, insurance, working capital, and wage and safety requirements. Cyber and export obligations add to that: export controls, CUI and FCI handling, execution maturity from need to closeout, and the evidence required to defend the posture.
OORAH creates an honest baseline before the client spends proposal dollars or commits to remediation. It also prevents the opposite failure: selling a broad assessment that is not bounded, not evidence-backed, and not priced for the actual work.
OORAH is built for firms without a dedicated compliance department: an owner-operator decision path, bounded starting points, evidence-backed gateways, and cost-conscious domains that scale only when the target work justifies them.
WHAT EVERY ENGAGEMENT OBEYS
Six disciplines that hold the method together.
No finding without evidence.
No downstream phase without an accepted upstream deliverable.
No client-specific exception without a documented route, scope impact, and commercial decision.
No certification, accounting, safety, or legal guarantee from a diagnostic engagement.
No cross-client reuse of raw documents, prompts, embeddings, or context.
No export-control, CUI-marking, access-control, or execution-process paper trail without the operating control behind it.
THE FIVE-PHASE CORE
One universal sequence. Configured layers on top.
The phase order never changes. Sector content (Construction/EPC is the first sector built out) and the program-build domains are configurable layers onto the core. They do not rename or reorder the phases.
HOW YOU ENTER
Bounded starting points, not one big assessment.
A firm should not buy program depth the next pursuit does not require. The ladder steps up only as the burden and the target contract justify it.
ENTRY & ROUTING →Bounded intake, entity and SAM scan, federal exposure scan, a routing and scoping memo, and a 90-minute session.
A market-entry and bounded readiness baseline covering only the workstreams the situation requires.
All standard ORIENT workstreams, at defined depth.
ORGANIZE, REMEDIATE, ASSESS, HOLD/ConMon, any program-build domain, or a status-contingent C3PAO module.
PROGRAM-BUILD DOMAINS
Five domains that thread all five phases.
Screened in ORIENT, designed in ORGANIZE, implemented in REMEDIATE, rehearsed in ASSESS, sustained in HOLD, but each separately scoped, with its own acceptance gate and handoff. No base phase silently absorbs domain work.
The scoping rule
Domains fire only when the route, the target contract, or an evidence gap justifies the spend.
ALL DOMAINS →GROUNDED IN THE AUTHORITATIVE SOURCES
Every claim traces to a public authority.
WHAT OORAH DOES NOT CLAIM
The limits are part of the method.
A framework that promises everything is worth nothing. These are the boundaries every OORAH engagement operates inside.
No phase guarantees an award, a certification, an accounting approval, a safety certification, a legal outcome, revenue, or margin. Evidence, scope, and acceptance determine the next route.
The Department of War suspended CMMC Phase II third-party assessments on 2026-07-13 and stood up a CMMC Reform Task Force. On 2026-09-03 a class deviation memorandum directed contracting officers to remove Phase II third-party assessment requirements from active solicitations and existing contracts.
Phase I requirements remain in force: Level 1 (Self) or Level 2 (Self) may still be required as conditions of award. Baseline NIST SP 800-171 Revision 2 compliance, the DFARS 252.204-7012 safeguarding obligation, the SPRS posting, and the annual affirmation are unaffected by the suspension. We do not market a C3PAO or DIBCAC designation, because third-party assessment is not currently the operative requirement. CMMC and certification-adjacent work is quoted only after a current-posture check.
CMMC Level 2 is built on NIST SP 800-171 Rev.2 (110 requirements and 320 assessment objectives) under 32 CFR Part 170. Rev.3 is a separate modernization track and is not a CMMC basis today. 110 is a requirement count, not a SPRS score.
The DCAA pre-screen is diagnostic only, run against SF 1408 Section II and the DFARS 252.242-7006(c)(1)–(18) criteria. It is not an accounting approval, a CAS determination, an accounting opinion, or legal or tax advice.
EM 385-1-1, OSHA, Activity Hazard Analysis, and Site Safety and Health Officer work is a diagnostic, not an audit and not a certification.
Service-disabled veteran-owned small business, SBA-certified under 13 CFR Part 128 (VOSB and SDVOSB; certification effective September 2026).
Under FAR 15.305(a)(2)(iv), an offeror without relevant past performance may not be evaluated favorably or unfavorably on past performance. Individual principal experience is not the contracting entity's past performance, and we label the two separately.
ITAR and EAR work is screened, never certified. Registration, licensing, jurisdiction and classification determinations, and legal opinions remain the client's and counsel's responsibility. There is no "ITAR certification."
No client CUI is stored in LFC systems by default. Engagements work from sanitized data or a client- or prime-controlled environment, under a dedicated workspace, source register, and access list. Active clearances or site status do not equal an entity-level DFARS or NIST posture.
LFC OORAH is Leatherneck Federal Consulting's independent methodology and intellectual property (trademark pending).
The LFC OORAH Framework: LFC OORAH is our own method, applied to your situation, not a template.
START WITH PHASE 01
Start with an honest baseline.
Every engagement begins with ORIENT: a scoped, evidence-backed baseline and a prioritized route with a timeline and a budget. We price to the work, so the number follows the scope conversation.
A 30-minute introductory call. Bring the target solicitation and what you already know about your gaps.
VOSB + SDVOSB CERTIFIED (SBA VETCERT) · UEI VU2HV8458J93 · CAGE 21BA0