Getting started
You need to understand what applies, where sensitive information lives, and which systems and providers are involved.
Start with scope and priorities.CMMC readiness & ongoing management
Build your CMMC posture.
Keep it ready.
Prepare for assessment. Manage the technology. Keep safeguards and evidence current as your business evolves.
Karhu connects compliance guidance with MDR, SIEM, and technical management for defense contractors and manufacturers—from initial readiness through daily operations.
Michigan rooted. Supporting organizations nationwide.
Meet your team where it is
You don’t need every answer
to take the next step.
Your applicable requirements depend on your contracts and the information you handle. We begin by understanding your situation.
Closing known gaps
You have findings or a partial roadmap and need help turning recommendations into working safeguards and documented practices.
Connect findings to implementation.Preparing for assessment
You want to review your documentation, organize evidence, and identify the work still outstanding before the applicable assessment.
Bring the evidence together.Maintaining your posture
You need ongoing security operations, technical management, and compliance coordination as your people, systems, and contracts change.
Plan for ongoing support.Explore the shared responsibility
See where Karhu
fits into your program.
Explore all 110 Level 2 requirements across 14 control families. Select a control to see how Karhu can contribute, what your team owns, and the evidence you can maintain together.
Example service model
Assumes an engagement covering compliance guidance, technical management, MDR, SIEM, and security training. Assignments depend on your systems and agreed scope. Colors show responsibility—not assessment results or a compliance score.
Select any highlighted tile. Each column is one family; each tile is one requirement. Scroll sideways on smaller screens, or switch to the readable list.
AC3.1Access Control
AT3.2Awareness & Training
AU3.3Audit & Accountability
CM3.4Configuration Management
IA3.5Identification & Authentication
IR3.6Incident Response
MA3.7Maintenance
MP3.8Media Protection
PS3.9Personnel Security
PE3.10Physical Protection
RA3.11Risk Assessment
CA3.12Security Assessment
SC3.13System & Communications Protection
SI3.14System & Information Integrity
110 requirements · 14 families · NIST SP 800-171 Rev. 2
All controls remain in scope for this example. Client-led does not mean unsupported or not applicable.
How to read this example and turn it into your responsibility matrix
These are proposed service allocations, not verified control implementations. Karhu-led means Karhu can lead the described service activity; client approvals, participation, and accountability still apply. Shared delivery requires work from both parties. Client-led activities typically include personnel decisions, physical safeguards, and business approvals.
Before use in an engagement, validate every assessment objective, identify each system and external provider, confirm service capabilities, and record the agreed owner, evidence source, review frequency, and dependencies in your System Security Plan and service agreement. Technical tools alone do not satisfy an entire requirement.
Level 2 uses the 110 requirements in NIST SP 800-171 Rev. 2 under the current CMMC model, even though NIST has published a newer revision. This is a requirement-level overview, not an objective-by-objective assessment or SPRS scoring tool.
Beyond the control map
Keep the program
moving forward.
The operating plan also addresses contract and supplier reviews, SPRS assessment submissions, annual affirmation support, reassessment planning, and permitted POA&M closeout. These activities complement the 110 requirements; they are not extra control tiles.
Build your responsibility planFrom readiness to ongoing operations
A coordinated plan.
Practical follow-through.
Work alongside your leadership, IT team, and providers. Each step makes the next decision clearer.
Define the scope.
Start with your contract requirements, the information your organization handles, and the people, systems, and service providers involved. Establish the boundaries of the readiness work.
A shared understanding of the environment and requirements to review.
Understand the gaps.
Review current safeguards, policies, and available evidence against the applicable requirements. Distinguish what is in place from what needs implementation, documentation, or validation.
A gap review that connects findings to the work ahead.
Put the plan to work.
Prioritize improvements around dependencies, operational constraints, and your team’s capacity. Coordinate safeguard implementation and policy work with your internal IT team and providers.
A practical remediation plan with clear responsibilities.
Prepare your evidence.
Connect documented practices to how your environment actually operates. Organize supporting evidence, review remaining gaps, and help your team prepare for its applicable assessment path.
An organized view of evidence, ownership, and outstanding actions.
Maintain your posture.
Keep safeguards, documentation, and evidence current as your business changes. Bring ongoing security monitoring, technical management, contract review, and affirmation preparation into an agreed operating plan.
A recurring review schedule, clear owners, and visibility into the work ahead.
What you receive
Work your team
can carry forward.
Define the deliverables up front. Depending on your engagement, the work can include the following practical outputs.
Talk through your scopeScope & gap review
A documented view of the environment reviewed, applicable requirements, and identified gaps.
Prioritized improvement plan
Recommended actions, dependencies, and ownership to help your team sequence the work.
Policy & documentation support
Preparation and review of agreed documentation, aligned to how your organization operates.
Evidence & readiness review
An organized view of supporting evidence, remaining questions, and actions to resolve.
Ongoing program visibility
For ongoing engagements: a maintained compliance calendar, evidence records, recurring management reviews, and an action register with owners and due dates.
Ongoing CMMC posture management
Keep your safeguards working.
Keep your evidence current.
New contracts, people, systems, and service providers can affect your CMMC posture. Karhu helps manage the security operations, technical environment, and recurring compliance work that support it.
MDR & SIEM
Managed detection and response (MDR), together with security information and event management (SIEM), connects threat detection, centralized logs, investigation, and response coordination. Review monitoring coverage and retain supporting evidence for the systems in scope.
Technical management
Manage endpoints, servers, networks, and cloud environments supporting your CMMC scope. Coordinate patching, secure configurations, identity and access, device onboarding and offboarding, backups, recovery checks, and day-to-day technical support.
Contract & supplier review
Review cybersecurity requirements in solicitations, awards, modifications, and supplier relationships. Identify implications for CUI handling, system scope, assessment requirements, and subcontractor obligations alongside your contracts team.
SPRS & annual affirmation support
Prepare and validate NIST SP 800-171 DoD assessment information, support authorized SPRS submissions and updates, and track relevant deadlines. Organize the evidence your organization’s affirming official needs to review continuing compliance.
Documentation & control reviews
Maintain your System Security Plan, policies, inventories, diagrams, and evidence. Review access, vulnerabilities, configuration changes, and control effectiveness, then assign and track corrective actions.
Training & assessment continuity
Provide security training and coordinate incident exercises, reporting preparedness, and reassessment planning. Track remediation and any permitted POA&M closeout, and review how new people, systems, and providers affect your posture.
Karhu supports the work and evidence behind your posture. Your organization retains responsibility for its compliance representations and annual affirmation; certification assessments remain with the authorized assessment organization.
The people behind the work
Security expertise.
Practical follow-through.
Karhu combines compliance guidance with managed security operations, technical administration, training, and program leadership. Bring the right capabilities into your plan, with responsibilities established for each engagement.
Explore our team’s expertiseCCPCMMC Certified Professional
CISSPCertified Information Systems
Security Professional
Security Professional
Selected credentials held across the Karhu team.
Common questions
Clarity before
you commit.
Start with what you need to know. We’ll work through the specifics together.
Where should we start if we don’t know our scope?
Start with the information you handle and your customer or contract requirements. Bring your IT team and key service providers into the conversation. We can help identify the systems, workflows, and responsibilities that need to be understood before defining the readiness engagement.
Can you work with our current IT provider?
Yes. Our approach includes coordination with your internal team, service providers, assessors, and other stakeholders. The engagement should define who implements changes, who supplies evidence, and who maintains each safeguard.
What determines the cost and timeline?
Scope, the number and complexity of systems, existing safeguards, documentation quality, and your team’s availability all affect the work. A discovery conversation helps establish the effort and sequence. Any proposed schedule and fee should reflect that scope.
How do CMMC and NIST SP 800-171 fit together?
NIST SP 800-171 provides security requirements for protecting controlled unclassified information in nonfederal systems. CMMC establishes assessment requirements for applicable defense contracts. We use the requirements and versions applicable to your engagement, rather than assuming every organization has the same obligations.
Does a readiness engagement provide CMMC certification?
A readiness engagement helps you identify gaps, strengthen safeguards, and prepare evidence. It does not itself issue a CMMC certification. Your applicable assessment path is determined by the program and contract requirements, and any required certification assessment is performed by the authorized assessment organization.
Can you help with policies and supporting evidence?
Policy and evidence preparation are part of Karhu’s compliance capabilities. We agree the specific documents, reviews, and responsibilities in the engagement scope, and connect the documentation to the safeguards actually operating in your environment.
Can Karhu manage the technology supporting our CMMC posture?
Yes. Karhu can provide MDR, SIEM, and management of endpoints, servers, networks, cloud systems, identities, patches, configurations, and backups. We agree the systems, service coverage, response responsibilities, and evidence needs with your team, including coordination with existing providers.
How does ongoing monitoring support CMMC?
Threat monitoring helps detect and respond to security events. Maintaining CMMC posture also requires recurring control reviews, current documentation, training, change management, and evidence. Karhu connects these activities in an agreed operating plan; monitoring alone does not establish compliance.
Can Karhu submit our SPRS score and annual affirmation?
Karhu can help prepare, validate, and support authorized submission of NIST SP 800-171 DoD assessment information in SPRS. That score is distinct from CMMC status. We also prepare supporting evidence and guide annual affirmation, which must be made by the designated senior representative within your organization. Required certification assessments remain with the authorized assessment organization.
For current program requirements and official guidance:
SPRS submission & affirmation guidance Official CMMC program NIST SP 800-171 referenceStart with a conversation
Make your next
CMMC decision clearer.
Tell us where you are today and what you’re working toward. We’ll help identify a practical starting point.
Include your organization, the requirements you face, and whether you need initial readiness or ongoing support in your message.
You can also email [email protected] or call (906) 212-4100.
Take the next step
Tell us what you need.
Start a conversation or request an assessment. Your message will go to the Karhu team.