CUI boundary definition
Trace where CUI enters, is stored, is processed, is transmitted and leaves before hardening systems that may not belong in scope.
Orlando, Florida
CMMC and NIST 800-171 consulting for Orlando-area defense contractors.
Cyberneza is an Orlando-based, SBA-Certified Veteran-Owned Small Business providing CMMC readiness and NIST SP 800-171 implementation support nationwide. Orlando-area organizations can work directly with a Cyber AB Registered Practitioner on CUI scoping, Level 1 or Level 2 Self readiness, SSP/POA&M, SPRS preparation and secure enclave architecture.
Current status: CMMC remains paused in Phase 1.
Mandatory Phase II Level 2 C3PAO requirements were suspended July 13, 2026. Current Department guidance says the program is paused in Phase 1, where Level 1 Self and Level 2 Self may be required. Current readiness work should therefore begin with the procurement requirement, NIST SP 800-171 Rev. 2 implementation, evidence and the applicable self-assessment process.
Level 2 Self readiness
Evaluate the 110 Rev. 2 requirements, SSP, evidence, SPRS submission requirements and annual affirmation process for the active Phase 1 path.
Level 1 readiness
For FCI-only contractors: evaluate and implement the 15 FAR safeguarding requirements and prepare for the annual self-assessment and affirmation.
Secure CUI enclave planning
Compare a constrained enclave approach such as PreVeil with broader platform changes when only a subset of users needs CUI.
SPRS and documentation
Develop the SSP, POA&M where allowed, diagrams, evidence and applicable SPRS submission information.
Operational security
Establish and maintain logging, identity, endpoint protection, vulnerability management, awareness and incident-response practices that produce recurring evidence.
Orlando-based delivery with nationwide support.
Cyberneza can provide direct local support to Orlando-area contractors and remote support to organizations elsewhere in the United States. Engagements are based on the applicable contract clauses, information flows, systems and security requirements.
Start with the contract clauses and CUI information flow.
Send us the applicable contract or flow-down clauses and identify the systems and services that receive, store, process or transmit CUI. Cyberneza can determine the applicable CMMC requirement, define the preliminary boundary, assess implementation gaps, and identify the documentation and evidence work required.
Discuss CMMC readiness