What you need to pass your CMMC assessment and keep your contracts.
Fixed-scope CMMC Level 2 readiness assessments for defense contractors requiring a documented path to certification, remediation prioritization, and contract continuity. ITAR/EAR and sanctions review integrated where required.
For defense contractors, biotech firms, advanced technology companies, and outside counsel facing cybersecurity, export-control, or sanctions compliance requirements.
CMMC Level 2 Is Now Contract-Gating
Contractors without demonstrable readiness face elevated risk of bid exclusion beginning in the 2026–2027 acquisition cycle. Phase 1 enforcement is active. C3PAO assessments become mandatory for applicable contracts in November 2026.
- SPRS score below 88 → no conditional certification path
- No System Security Plan → assessment cannot proceed
- Missing MFA or centralized logging → high-probability failure condition
See recent analysis: CMMC Level 2 Readiness Risk in the U.S. Defense Industrial Base →
What I deliver
Structured readiness, remediation, and advisory engagements for organizations preparing for near-term C3PAO assessment, export-control review, or sanctions program development. Typical CMMC readiness engagements: 4–6 weeks.
CMMC Level 2 Readiness Assessment
Full assessment against NIST SP 800-171 Rev 2. Gap matrix, SSP outline, POA&M, priority remediation roadmap. Integrated with ITAR handling controls where applicable.
ITAR/EAR Classification & Compliance
ECCN and USML commodity jurisdiction determinations. Deemed export risk assessments. Technology Control Plans. Voluntary Self-Disclosure preparation.
Sanctions Compliance Program Design
OFAC compliance frameworks aligned with the 2019 Framework for Compliance Commitments. Counterparty risk mapping. Screening program architecture and testing.
CFIUS Cybersecurity Risk Assessment
Pre-filing cybersecurity risk assessments for transactions subject to CFIUS review. Network architecture analysis, data flow mapping, mitigation agreement compliance.
Virtual CISO
Part-time security leadership. Risk assessment, policy development, incident response planning, board-level reporting, and regulatory engagement. 15–25 hours/month.
Technical Advisory for Counsel
Technical analysis supporting litigation teams on cybersecurity standards of care, export control matters, sanctions compliance disputes, and digital forensics.
What this looks like in practice
Anonymized engagement patterns illustrating typical scope, deliverables, and outcomes. No client-identifying information is disclosed.
Defense subcontractor preparing for Level 2 certification while handling export-controlled technical data
Small electronics manufacturer (under 200 employees) with active DoD subcontracts required CMMC Level 2 readiness while also handling ITAR-controlled design files shared by the prime contractor. Assessment identified 34 control gaps, three ITAR handling deficiencies, and an undocumented CUI data flow to a cloud environment.
Biotech firm with foreign national research staff requiring deemed export analysis
Mid-market biotech company (300+ employees) with R&D staff holding citizenship in countries subject to EAR restrictions. Required deemed export analysis for controlled technology access, controlled technology segmentation, and a Technology Control Plan satisfying BIS requirements.
Transaction counsel requiring cybersecurity risk analysis for foreign acquisition review
Outside counsel retained for CFIUS filing needed technical cybersecurity risk analysis for a cross-border acquisition involving a company with access to controlled unclassified information. Required network architecture review, data flow assessment, and a concise risk memo suitable for inclusion in the filing.
Technology firm with international counterparty exposure requiring OFAC screening program
Software company expanding into markets with sanctions-adjacent counterparty risk. Required a compliance framework aligned with OFAC guidance, including screening architecture, escalation protocols, and a control matrix covering nine counterparty risk categories.
Published risk assessment
CMMC Level 2 Readiness Risk in the U.S. Defense Industrial Base
Typical clients
Organizations where cybersecurity compliance intersects with export controls, sanctions law, or foreign investment requirements.
Small defense contractors
Machine shops, electronics manufacturers, and software subcontractors (50–500 employees) facing CMMC Level 2 deadlines with no dedicated compliance staff. Typical pain: a contract-gating CMMC requirement with no clear path to assessment readiness.
Biotech and technology firms
Companies with international operations, foreign national R&D employees, or dual-use products requiring ITAR/EAR classification, deemed export analysis, and sanctions screening programs.
Outside counsel and PE/VC funds
Law firms needing technical cybersecurity analysis for CFIUS filings or export control matters. Investment funds requiring cybersecurity due diligence on acquisition targets in defense, biotech, or technology sectors.
SSP & POA&M Package
System Security Plan and Plan of Action and Milestones for C3PAO assessment readiness.
Classification Memo
ECCN/USML jurisdiction and classification determination with supporting rationale.
Technology Control Plan
Deemed export controls for foreign national employees accessing controlled technology.
Sanctions Control Framework
OFAC compliance architecture with screening, escalation, and audit procedures.
Transaction Risk Memo
CFIUS cybersecurity risk assessment and mitigation recommendation for M&A transactions.
Board Security Briefing
Executive-level risk assessment and compliance status report for retainer clients.
What fails CMMC assessments
Based on publicly available C3PAO guidance and practitioner reporting, the following conditions are assessed as likely to produce assessment failure or conditional denial.
- No current, tailored System Security Plan (SSP) — assessment cannot proceed without one
- No multi-factor authentication for remote or privileged access — critical 5-point control deficiency
- No centralized audit logging or evidence of log review — Audit and Accountability controls cannot be demonstrated
- Evidence not collected, organized, or retrievable — implemented controls treated as not implemented for scoring
- CUI boundary not defined or documented — assessment scope cannot be established
- SPRS score below 88 with no viable POA&M path — no route to conditional certification
Presence of any single condition above is consistent with elevated risk of assessment failure. Presence of multiple conditions simultaneously is consistent with high probability of assessment failure.
How the work gets done
Published open-source analytical work supporting the sanctions, export-control, and risk-assessment methodology used in client engagements. Available for review before the first call.
Every compliance assessment, classification review, and risk analysis delivered by this practice follows the same analytical methodology documented in the WP-2026 research series: dual-axis probability and confidence labeling, explicit statement of limits and unknowns, structured evidence tiers, and prohibition on advocacy language.
The series was produced between January 15 and March 28, 2026. Full provenance is available via GitHub commit history.
374 georeferenced enforcement nodes
Interactive global enforcement map
Three documented red-team audit passes
Structured using ODNI analytic tradecraft principles
Licensed under CC BY 4.0
Collin George
Independent cybersecurity and compliance consultant. Founder, Center for Competitive Statecraft and Strategic Policy—an independent research initiative producing open-source policy analysis on sanctions enforcement, financial intelligence, and competitive statecraft.
Professional background in cybersecurity engineering and international trade compliance across biotech and technology sectors. Graduate coursework in intelligence analysis (Johns Hopkins University) and security studies (University of Central Florida, 3.875 graduate GPA). Clinical Laboratory Technician at the University of Washington Medical Center, Department of Laboratory Medicine and Pathology.
The analytical methodology documented in the WP-2026 series is applied directly in client engagements. Compliance assessments, classification reviews, and risk analyses follow the same structured evidence standards, confidence labeling, and explicit limits that govern the published research.
Certifications
- CISSP — (ISC)²
- BS Cybersecurity, Summa Cum Laude
Columbia Basin College, 2019
Graduate Coursework
- Intelligence Analysis — Johns Hopkins University
- Security Studies — University of Central Florida (3.875 GPA)
Research Identifiers
Regulatory Domains
- CMMC / NIST 800-171
- ITAR / EAR / BIS Entity List
- OFAC / Sanctions / AML-BSA
- CFIUS / FIRRMA
- IEEPA / CAATSA / ECRA
Initial readiness diagnostic
Structured 10–15 minute diagnostic
Estimate your current readiness posture and identify primary failure risks before committing to a full engagement. Designed for organizations preparing for near-term CMMC assessment.
- Estimated SPRS range
- Key control gaps
- Assessment readiness risk level
- Recommended next steps
Gap Assessment
Control Remediation
Documentation & Evidence
Assessment Readiness
Typical engagements: 4–6 weeks. Structured around gap assessment, remediation prioritization, and evidence readiness. Designed for organizations preparing for near-term C3PAO assessment.
Assess your CMMC readiness
Engagement inquiry
Use the form below to request a structured readiness diagnostic or scoped assessment discussion. Response within two business days. Initial scoping call at no charge.
Response time
Initial response within two business days. Scoping proposals typically delivered within one week of discovery call.
Engagement format
Fixed-fee project engagements and monthly retainers. Fully remote with nationwide availability. Initial scoping call at no charge.
Secure communication
Encrypted communication is available for sensitive inquiries. Contact via the form to initiate.
Direct email
Scope of services
Services are advisory in nature and do not constitute legal advice. Where regulatory interpretation or legal determinations are required, coordination with qualified legal counsel is recommended.
Privacy Notice
Last updated: March 2026
Information collected
This site collects only information you voluntarily submit through the contact form: name, organization, email address, engagement type, and description of inquiry. No cookies, tracking pixels, analytics scripts, or third-party advertising tools are used on this site.
Use of information
Information submitted through the contact form is used solely to respond to your inquiry and, if mutually agreed, to scope a potential engagement. Information is not sold, shared with third parties for marketing purposes, or used for any purpose other than responding to your inquiry.
Data handling
Form submissions are processed through a third-party form handler (currently Formspree). Submissions are retained only as long as necessary to respond to your inquiry. You may request deletion of your submitted information at any time by contacting cgeorge [at] collinbgeorge.com.
External dependencies
This site loads no external fonts, analytics, or tracking scripts. All styling is self-contained. The only external request initiated by this site is the form submission handler.
Contact
For privacy-related questions: cgeorge [at] collinbgeorge.com.
Terms & Disclaimer
Last updated: March 2026
Nature of services
Services provided by Collin George Consulting are advisory in nature and do not constitute legal advice, operational guidance, or a recommendation to any government authority. Where regulatory interpretation or legal determinations are required, coordination with qualified legal counsel is recommended.
No guarantee of regulatory outcome
Advisory services are designed to reduce the risk of compliance deficiencies but do not guarantee any specific regulatory outcome, certification result, or enforcement disposition. All engagement deliverables include explicit scope limitations.
Confidentiality
Submission of the contact form does not create a consulting engagement, confidentiality obligation, or attorney-client relationship absent a signed engagement agreement. Do not submit classified, export-controlled, privileged, or otherwise restricted information through the contact form.
Published research
The WP-2026 research series is independent academic and policy research licensed under CC BY 4.0. It does not constitute legal advice, operational guidance, or a recommendation to any government authority. No inference should be made regarding classified capabilities, intelligence sources, or non-public operational methods.
Professional liability
The practice intends to maintain professional liability (errors and omissions) insurance appropriate to the scope of services offered. Insurance status and coverage details are available upon request during engagement scoping.
Affiliation
Collin George Consulting is an independent practice. It is not affiliated with any government agency, academic institution, or defense contractor. The Center for Competitive Statecraft and Strategic Policy is an independent research initiative founded by Collin George.
Contact
For questions about these terms: cgeorge [at] collinbgeorge.com.