What this service does
CMMC 2.0 (L1, L2, L3) readiness, NIST 800-171, DFARS 7012/7019/7020/7021, ITAR, FedRAMP Moderate, GCC High / GovCloud architecture. Only 0.5% of 80-000 CMMC L2 contractors are certified , Phase 2 hits 10 Nov 2026. The C3PAO ecosystem can't service the backlog in time. $138K-$500K Year 1 + $50K-$100K/year sustainment.
Senior practitioner on every engagement. Quinnlan Varcoe (Founder and CEO) oversees every engagement and reviews every case before findings leave the practice; Jose Santana, Lead Technical Consultant, oversees the practitioner team executing the technical work under her methodology. NDA-protected. No black-box delivery, no off-shoring, no junior staff bait-and-switch.
What we deliver
- CMMC 2.0 Level 2 Readiness. 110-control NIST 800-171 implementation, scoping the CUI enclave (most contractors over-scope and pay 3-5× the necessary cert cost), C3PAO coordination, mock assessment, deficiency remediation, certification submission.
- CMMC Level 3 + NIST 800-172 Enhanced. For prime contractors and high-impact subs handling export-controlled or critical-program CUI. Government-led assessment coordination with DCMA DIBCAC.
- NIST 800-171 SSP + POA&M + SPRS. System Security Plan written to actual environment, Plan of Action and Milestones tracked monthly, Supplier Performance Risk System score management. Annual reaffirmation.
- DFARS 7012 / 7019 / 7020 / 7021. Safeguarding Covered Defense Information (CDI) compliance. Cyber-incident reporting program. Subcontractor flow-down language. CMMC L2 contractual readiness.
- ITAR + Export Controls. 22 CFR 120-130 compliance program. Technical data segregation. GCC High or GovCloud architecture. Empowered Official designation. License + agreement management.
- GCC High + GovCloud Architecture. Microsoft 365 GCC High tenant build, Azure Government, AWS GovCloud architecture. CUI segregation by design. Cross-tenant collaboration patterns. Conditional access tuned for ITAR.
- FedRAMP Moderate Authorization. For DIB SaaS providers. 3PAO coordinated. SSP, SAR, POA&M lifecycle. Continuous monitoring. Faster path via the Joint Authorization Board or single agency sponsor.
- Federal AI + OMB M-25-21/M-25-22. AI use case inventory under OMB AI Use Case requirements. NIST AI 600-1 GenAI profile. ATO support for AI systems. EO replacements (post-EO 14110 rescission Jan 2025).
How an engagement begins
- Confidential consultation. NDA-protected. 30 to 60 minutes. Direct conversation with Quinn, not a sales rep.
- Scoped engagement. Written proposal with defined deliverables and pricing. Hourly with milestone caps for open scopes; fixed fee where the work is well-defined.
- Delivery and reporting. Court-admissible methodology where evidence matters. Written deliverables you can hand to counsel, the board, or your auditor.
Why this work runs through Witness
Witness is the parent brand for the practice. The same firm operates a B2B sister brand at varcoe.ai for buyers whose procurement workflow expects a B2B website and a B2B sales motion. Same legal entity (Blueberry Security Global, Inc., Delaware C-corp). Same Quinn. Same delivery team. The split is by audience, not by capability.
