CMMC Support: Controls, Plans & Evidence

Level 4 MSSP · CMMC readiness support

CMMC Support: Controls, Plans & Evidence

Connect your security controls to the requirements your business needs to demonstrate. Level 4 brings managed security, technical evidence, and scoped engineering support to your CMMC readiness effort.

Discuss Your CMMC Scope Compare Converge Plans

Start with your information, systems, and responsibilities

CMMC readiness begins with knowing which information you handle, where it flows, and who is responsible for protecting it. Level 1 addresses FCI using the FAR basic safeguards. Level 2 addresses CUI using 110 requirements in NIST SP 800-171 Revision 2 across 14 families.

Level 1 support

Explore access, authentication, malware protection, patching, media, physical safeguards, and customer responsibilities.

View the Level 1 safeguard map →

Level 2 support

Explore the complete requirement map, Platinum service depth, evidence examples, and separately scoped work.

View the Level 2 control map →

Support—not a certification guarantee. This map explains how Level 4 services can support implementation and evidence. Customer-specific scope, configuration, operation, and assessment determine whether requirements are satisfied. Purchasing a tier does not confer CMMC status. Your contract determines the required level and assessment path.

Converge Silver · Gold · Platinum

Choose the service depth your team needs

Gold includes the Silver foundation. Platinum includes Gold plus the additional services below. These are commercial service tiers, not CMMC levels or certifications. Coverage applies to contracted users, systems, and supported integrations.

Converge service scope for CMMC readiness — scroll horizontally on smaller screens
Capability	Silver	Gold	Platinum
Base platform: endpoint protection, RMM, email threat protection, privileged-access tooling, SIEM/SOC	Included for contracted users, systems, and integrations	Everything in Silver	Everything in Gold
Security awareness, phishing simulation, insider-threat recognition/reporting, administrator-specific training	Included	Included	Included
Managed detection and response (MDR)	Included for covered servers and hosted applications/services	Silver coverage plus every supported enrolled endpoint, including workstations	Same expanded coverage as Gold
Initial supported report selection, schedule, and compliance-mailbox routing	Included within onboarding scope	Included	Included
RMM patch configuration, deployment, and reporting	Included; full Microsoft patch coverage for covered systems and supported third-party applications	Same coverage as Silver	Same coverage as Silver
Failed-patch reporting to internal IT	Included; identifies failed patches and affected machines	Included; identifies failed patches and affected machines	Included; identifies failed patches and affected machines
Failed patch investigation and hands-on remediation	Customer/internal IT unless Level 4 is separately engaged	Customer/internal IT unless Level 4 is separately engaged	Customer/internal IT unless Level 4 is separately engaged
Internal and external vulnerability scanning and review	Separately scoped if requested	Annual	Quarterly, or the customer-defined scope, plus checks for newly identified applicable vulnerabilities
Continuous agent-based vulnerability scanning	Not included	Not included	Included on supported enrolled devices; not a replacement for scans of agentless infrastructure
Internal and external penetration test	Separately billed and scoped	Separately billed and scoped	One scoped test per contract year covering agreed internal/external targets; scope established at the start of the engagement
Retesting findings Level 4 remediates	For contracted testing/remediation work	Same	Retest Level 4-remediated findings within agreed scheduling and scope limits
CISSP engineering/advisory assistance for templates, evidence, mapping, and exercises	Separately billed	Separately billed	12 hours per contract year, pooled and available for onboarding; unused hours expire at contract-year end and do not roll over; additional hours available by scope
Custom audit evidence repository	Optional additional-fee engagement	Optional additional-fee engagement	Optional additional-fee engagement; not automatically paid for by advisory hours
Network discovery and monitoring	Normally quoted as a separate line item; customer may decline	Normally quoted as a separate line item; customer may decline	Normally quoted as a separate line item; customer may decline
Managed UTM, backup/DR, media sanitization, private cloud, voice, and telecom services	Separate product/engagement when selected	Same	Same

What the scope means in practice

Patching: configuration, deployment, and reporting are the same across tiers. Microsoft patching is covered for supported, contracted systems. Supported third-party applications include standard browsers such as Chrome and Firefox and mainstream Adobe applications in the patch catalog. Not every application or vendor is supported. Internal IT receives failed-patch and affected-machine reports; investigation and hands-on correction remain customer-owned unless separately engaged.

Platinum testing: the annual penetration test covers agreed internal and external targets—not unlimited sites or applications. Targets, exclusions, rules of engagement, and deliverables are established at the start of the engagement. Retesting is tied to findings Level 4 remediates within agreed timing and scope. Partner-delivered testing may be available; the quote identifies who delivers it and whether it fulfills the annual inclusion or is additional.

Platinum advisory: 12 CISSP engineering/advisory hours are pooled for the contract year and can be used during onboarding. Unused hours expire at the end of that contract year and do not roll over. Additional hours and partner consulting can be separately scoped.

Network visibility: network discovery and monitoring are normally included in the proposed solution as a separate quote line item. If declined, inventory and monitoring responsibilities must be assigned to your team or an alternative provider. Managed firewall/UTM, backup and disaster recovery, and infrastructure work are separate services.

Who does what?

Converge is co-managed security. Your internal IT and compliance teams remain central to the program. MSSP One or a separate infrastructure engagement can shift additional operational work to Level 4.

Level 4 manages the contracted security tools

We reconcile supplied user and asset lists, configure supported tools and reporting, manage security-tool changes with cybersecurity-team approval, and track findings from contracted vulnerability scans and penetration tests.

Supported threat containment follows an agreed escalation and approval path. If the customer cannot be reached, approval escalates to Level 4's cybersecurity team under the agreed response authority.

The customer owns the broader environment

Your team approves access and policies, identifies FCI/CUI and the assessment boundary, supplies asset changes, performs native AD/Microsoft 365 account actions, and normally owns infrastructure remediation, recovery, physical safeguards, and personnel processes.

Offboarding requires an authorized ticket. Level 4 disables access in its covered tools; internal IT handles native accounts and other systems unless that work is contracted.

Standard hardening policies and Microsoft security-baseline engineering are available within the agreed implementation scope. Under Converge, internal IT normally applies infrastructure changes unless Level 4 is specifically engaged. Firewall-rule review and network visibility do not include unlimited firewall administration.

We support Microsoft-native multifactor authentication where applicable and alternative methods to suit customer systems and scope. Each required access path needs configuration and validation; MFA on a management platform alone does not prove MFA on every underlying system.

Evidence that supports your team

Reports are the starting point—not the whole audit file

During onboarding, we configure supported report types, schedules, and delivery to your designated compliance mailbox within the purchased scope. Your team can collect available exports directly where supported, organize reports, and retain the evidence it needs. We can assist with collection and audit preparation through our ticketing system when engaged.

Included technical reporting

Supported security-tool, training, and patch reports, including failed patches and affected machines.
Security-tool change records and approvals; scan and remediation records for contracted testing.
Central security logs retained for 90 days by default. Exports and extended retention are available by scope.
Collection-health alerts for expected sources that stop reporting; supported Windows log archiving can be configured.

Customer-specific evidence support

Templates can help develop the customer's security program, policies, and system security plan. Templates are tailored during an engagement, not published for download here.
Documentation and evidence assistance is separately billed for Silver and Gold; eligible Platinum assistance draws from the annual advisory pool.
A custom audit evidence repository is available as a separate, additional-fee engagement for technical and customer-provided evidence.

Evidence location, access, retention, review frequency, and responsibility are agreed for the environment. Reports and repositories must be evaluated for the sensitivity of the information they contain before use. Do not send CUI, credentials, or sensitive configurations through a public contact form.

Framework references

Requirement summaries are plain-language paraphrases. Use the official texts and applicable assessment objectives for a customer assessment. Framework references reviewed October 14, 2026.

NIST has published Revision 3; this CMMC Level 2 map uses Revision 2 because that is the version incorporated by the CMMC rule reviewed above.

Connect the controls to your operating plan

We can work alongside your internal team and compliance consultant to document the boundary, allocate responsibilities, and identify the services and evidence your environment needs.

Plan a Technical Scope Review