Services / Full Gap Analysis

Baseline · Fixed-Tier Pricing

All 110 practices and 320 objectives — scored, prioritized, and honest

For contractors who want the complete picture before spending a dollar on remediation or documentation.

Map Every Gap

From $8,500

Three fixed tiers — see below

3 weeks

From complete document checklist

320 objectives

Every assessment objective, individually scored

You can’t prioritize what you haven’t measured

Remediation without a baseline is how small contractors overspend: the loudest gap gets fixed first, not the one blocking assessment. NIST SP 800-171 has 110 practices, but assessors test 320 individual objectives — and partial credit doesn’t exist at the objective level.

The Gap Analysis scores every objective, separates POA&M-eligible gaps from show-stoppers, and hands you a remediation sequence ordered by what actually moves your score and your assessment date.

What you get in 3 weeks

Objective-level scorecard

All 320 assessment objectives marked Implemented or Not Implemented — the same granularity a C3PAO uses, so nothing surprises you later.

Submission-ready SPRS score

Your score computed from the objective evidence, not from optimism — with the worksheet to defend it.

Prioritized remediation roadmap

Gaps sequenced by score impact and assessment risk, written so your IT staff or MSP can execute without translation.

POA&M eligibility analysis

Which gaps you may legally carry into assessment on your POA&M (gap-closure plan) and which are show-stoppers that must close first.

Three fixed tiers — set by headcount at signing; the top tier applies only with two or more complexity factors

$8,500 Up to 25 employees

$11,500 26–50 employees

$14,500 Two or more complexity factors — multiple sites, multiple enclaves or tenants, co-managed IT (your team plus an MSP), or an OT/shop-floor network. An MSP alone doesn't move you here.

Three weeks, week by week

Gate

Your clock starts here

SOW signed + payment + document checklist complete = your clock starts. Until then, nothing is counting against you.

Week 1

Document review and interviews

Your submitted documents reviewed, scoring underway, and the first of your three 90-minute interview blocks run with the people whose roles touch the objectives.

Week 2

Objective-by-objective scoring

Each of the 320 objectives scored against the evidence provided. Items not provided within 5 business days are scored Not Implemented — honest scoring is what protects your SPRS number.

Week 3

Roadmap and report

Findings consolidated, remediation sequence built, POA&M eligibility determined for every open gap.

Week 3 · close

Recorded debrief

A 90-minute recorded walkthrough of every finding and deliverable, within 5 business days of the findings report — so your team can replay it, and nothing lives only in one person's head.

What we need from you

This checklist is how your timeline stays protected — the clock starts when it's complete, so nothing stalls mid-engagement.

✓ Your SSP if one exists (the Sprint’s scope document also works)

✓ Policies, procedures, and network diagrams — whatever exists, in whatever state

✓ Responsive evidence turnaround: items not provided within 5 business days are scored Not Implemented

✓ Access to your IT lead or MSP for technical walkthroughs

Is the Gap Analysis the right move now?

The Gap Analysis works well for:

✓ Contractors with scope settled who want the full objective-level picture
✓ Teams planning a remediation budget and needing it sequenced by evidence
✓ Organizations burned before by remediation that didn’t move their score
✓ Contractors heading toward a C3PAO assessment within 6–12 months

Not the right fit:

✗ Scope still unsettled — do the Sprint first; a gap analysis against the wrong scope measures the wrong thing
✗ You only need a quick verdict on an existing SSP — that’s the 48-Hour Snapshot
✗ Organizations wanting Lumos to perform the formal assessment — a C3PAO must do that
✗ Looking for hands-on technical implementation — your IT staff or MSP performs that work

Lumos is a solo practice led by a Cyber AB Registered Practitioner providing readiness advisory and documentation only — formal CMMC assessments are conducted by certified C3PAOs, and technical implementation is performed by your IT staff or MSP. CMMC readiness consulting is generally an allowable cost under FAR 31.205-33; confirm with your contracts team.

CISSP · ISSEP · CCSP · CSSLP · CISA · CISM · PMP Cyber AB Registered Practitioner 28 NIST engagements since 2017 Veteran & Native Hawaiian-Owned

Where this leads

Gap Analysis findings feed directly into Module A (scope documents), Module B (the SSP build), and your POA&M. Snapshot clients: your $1,000 credit applies here when the Gap Analysis is booked within 90 days.

Sprint / Snapshot Gap Analysis Module A Module B Module C Readiness Review Retainer

← Previous step: Scoping Sprint Next step: Module A: Scope Package →

Questions about this engagement

Why are unprovided items scored Not Implemented? +

Because that’s how a C3PAO will score them. An assessor can’t give credit for evidence that doesn’t appear, and a gap analysis that scores more generously than your assessor produces a number you can’t defend. The 5-business-day evidence rule keeps the engagement honest and on schedule.

Which tier are we? +

Headcount sets it at signing: up to 25 employees is $8,500; 26–50 is $11,500. The $14,500 tier applies only when at least two of these are true — multiple sites, multiple enclaves or tenants, co-managed IT (your internal team plus an MSP), or an OT/shop-floor network. An MSP alone doesn't move you up a tier.

Do we need this if we already did the Sprint? +

Not always. The Sprint gives you a baseline score and gap themes; the Gap Analysis gives you all 320 objectives individually. Skip it if budget is tight and your environment is simple — go straight to Module B and let the SSP build surface the detail.

Is three weeks firm? +

Yes, from checklist completion — with one dependency: the 5-day evidence rule. Clients who turn evidence around quickly finish on schedule; the rule exists so one slow document doesn’t stall the whole engagement.