Phase II Readiness
From an SPRS score to C3PAO-ready.
The full Brehon program for teams with a Phase II topic in sight. Everything in Guided SPRS, then we get you ready for a real C3PAO assessment: a mock assessment, a gap report, assessor matchmaking, and 90 days of support on the other side.
The call is a 30-minute fit check. We confirm the program is right for your timeline before you commit.
Who it's for
For the team whose next award depends on passing a real assessment.
A self-assessed SPRS score gets you in the door. A Phase II award, and the CUI that comes with it, eventually means a certified C3PAO assessment against CMMC Level 2. This program closes that gap before it becomes a blocker: you go in knowing you will pass, not hoping.
What's included
- Everything in Guided SPRS. Platform access, weekly working sessions, hands-on evidence support, POA&M strategy review, and a direct Slack channel.
- C3PAO assessor matchmaking. We connect you with a certified third-party assessor that fits your scope and timeline, and prep you for how they work.
- Mock assessment with gap report. A full dry run against CMMC Level 2, with a prioritized report of exactly what to fix before the real thing.
- 90 days of post-assessment support. We stay with you through remediation and the assessment window, not just up to it.
- Phase II proposal compliance review. A read of your proposal's security and compliance language so it matches the posture you actually have.
How it works
- 1
Qualification call and scoping
We map your Phase II target, your CUI footprint, and your assessment timeline, then build the 90-day plan backward from your date.
- 2
Score, then stress-test
We complete the SPRS self-assessment together, then run a mock C3PAO assessment and hand you a prioritized gap report.
- 3
Match, remediate, and assess
We match you with a C3PAO, work the gaps, review your proposal language, and support you through the assessment window.
What you walk away with
A company that is genuinely ready for a CMMC Level 2 assessment: a defensible SPRS score and SSP, a remediated control set proven by a mock assessment, a matched C3PAO, proposal language that matches your real posture, and 90 days of support to carry it across the line.
From the founder
Why I built this.
I'm David Moline. By day I run cybersecurity for a DoD contractor in Stuttgart, where I've spent the last several years watching small defense businesses get crushed by compliance requirements they had three months to figure out. I hold CISSP and CISM, I'm finishing graduate work at Johns Hopkins in generative and agentic AI, and I built Brehon because I kept seeing the same problem from the inside: the small business does not need a six-figure consulting engagement. It needs a tool that knows what to ask and what to do with the answer.
Brehon is that tool.
David A. Moline Founder, Solas AI
Questions
Phase II Readiness, specifically.
Do you perform the C3PAO assessment yourselves?
No, and by design. A C3PAO must be independent of the company it assesses. We get you ready and match you with a certified assessor; we cannot be both your readiness partner and your assessor.
Why a program fee instead of a fixed timeline price?
Readiness depends on where you start. The program fee covers the full 90 days of work, the mock assessment, matchmaking, and post-assessment support, regardless of how many sessions it takes to get you there.
What if we are not sure we need Level 2 yet?
Then start with Guided SPRS and a defensible self-assessment. We will tell you honestly on the qualification call whether a full readiness program is worth it for your situation, or premature.
Does the assessment cost come out of this fee?
No. The C3PAO charges their own assessment fee separately. This program is everything that gets you ready to pass it, plus support through the window.