Services / CUI Scope & SPRS Defensibility Sprint

Start Here · Flagship

A C3PAO-reviewable scope decision and SPRS baseline in one week

For contractors without a current SSP — or unsure where their CUI (Controlled Unclassified Information) actually lives.

Lumos accepts a maximum of 2 Sprint engagements per month. Slots are scheduled in writing, first committed, first served.

$6,500

Fixed fee — no hourly meter

5 business days

Monday to Friday, one week

$2,000 credit

Toward Module A or B within 90 days

Everything downstream depends on scope

Scope is the first decision in CMMC and the most expensive one to get wrong. Too broad, and you’ll spend remediation money protecting systems that never needed it. Too narrow, and a C3PAO assessor finds CUI outside your boundary — under scrutiny, mid-assessment, when it’s hardest to fix.

The Sprint settles it in one week: where your CUI lives, where your boundary is, what your SPRS baseline is, and what that means for your path. The centerpiece is a Scope Boundary Decision Document written to be put in front of your C3PAO.

What you get in 5 days

Scope Boundary Decision Document

The artifact your C3PAO can review: which systems, users, and providers are in scope, and the documented reasoning for every exclusion.

CUI flow mapping

Where CUI enters, moves, and rests in your environment — contracts to inboxes to file shares — so the boundary reflects reality.

SPRS baseline score

Your starting number against the official methodology, honest enough to defend and specific enough to improve.

Evidence gap list + 90-day roadmap

Every practice that couldn't be verified, ranked into a 90-day roadmap by what moves your score and what blocks assessment.

Monday to Friday

Gate

Your clock starts here

SOW signed + payment + document checklist complete = your clock starts. Until then, nothing is counting against you.

Monday

CUI scoping workshop

A facilitated 150-minute working session with your owner and your IT or MSP lead: contract drivers clause by clause, then your boundary canvas built live — CUI traced from where it enters to where it exits.

Tuesday

Asset inventory

Every asset tagged into one of the five CMMC categories from your RMM, MDM, or tenant export — and a written separation justification for anything left out of scope.

Wednesday

Boundary drafting

At least two boundary options drafted with tradeoffs, every exclusion backed by a written rationale an assessor could read — the decision itself stays open until Friday.

Thursday

SPRS baseline scoring

The 110 practices scored against the boundary as drawn — your real starting number, not an aspiration.

Friday

Recorded debrief

A recorded walkthrough of every finding — and the scope decision itself, made by you on this call and captured in the signed decision document, plus a one-page executive summary your team can replay.

What we need from you

This checklist is how your timeline stays protected — the clock starts when it's complete, so nothing stalls mid-engagement.

✓ Your active DoD contracts (or the DFARS/CUI clauses from them)

✓ A system inventory — even an informal one; I'll work with what exists

✓ Your owner and whoever manages your IT or MSP relationship confirmed for the Day-1 scoping workshop (150 minutes)

✓ A decision-maker available for the Friday debrief

Is the Sprint the right entry point?

The Sprint works well for:

✓ Contractors with no SSP, or one too old to trust
✓ Teams that can’t say with confidence where CUI lives in their environment
✓ MSP-supported environments where responsibility boundaries were never written down
✓ Owners who want a solid starting point before spending on remediation or documentation

Not the right fit:

✗ You already have a current SSP and a settled scope — the 48-Hour Snapshot is faster and cheaper
✗ You want all 110 practices examined in depth — that’s the Full Gap Analysis
✗ Organizations wanting Lumos to perform the formal assessment — a C3PAO must do that
✗ Looking for hands-on technical implementation — your IT staff or MSP performs that work

Lumos is a solo practice led by a Cyber AB Registered Practitioner providing readiness advisory and documentation only — formal CMMC assessments are conducted by certified C3PAOs, and technical implementation is performed by your IT staff or MSP. CMMC readiness consulting is generally an allowable cost under FAR 31.205-33; confirm with your contracts team.

CISSP · ISSEP · CCSP · CSSLP · CISA · CISM · PMP Cyber AB Registered Practitioner 28 NIST engagements since 2017 Veteran & Native Hawaiian-Owned

Where this leads

The Sprint already produces Module A's deliverables (the Scope & Boundary Package) — you'd never buy it. Instead, $2,000 of your Sprint fee credits toward your SSP build (Module B) if you proceed within 90 days. The usual path: Sprint → Module B → Module C → Readiness Review.

Sprint / Snapshot Gap Analysis Module A Module B Module C Readiness Review Retainer

← Previous step: 48-Hour Snapshot Next step: Full Gap Analysis →

Questions about this engagement

Why only 2 slots per month? +

Because the Sprint is one practitioner, five consecutive days, with no hand-offs — the person who scopes your environment is the person who scores it. Two per month is what one practitioner can do without the quality dropping. It's a capacity fact, not a marketing device.

What makes the scope document "C3PAO-reviewable"? +

It's structured around the CMMC scoping guidance assessors actually use: asset categories, boundary justifications, and a written rationale for every exclusion. Scopes that show their reasoning are far harder to challenge than scopes that don't.

Can the Sprint run remotely? +

Yes — every Sprint is remote by default. Interviews are scheduled video calls, and document exchange happens through a shared secure folder. Nationwide, from Greene County, Ohio — the Dayton defense corridor.

What if we discover mid-week that our environment is messier than expected? +

The Sprint still finishes on Friday with every deliverable. A messier environment changes the findings, not the timeline — and the evidence gap list will tell you exactly how much work is ahead.