How Ready Are You?

We think we need CMMC but we’re not sure which level — can you help us figure it out? We’re a 30-person manufacturer with one DoD contract — how big is this effort for us? We’ve done some NIST 800-171 work but never had a formal assessment — how ready are we? Our IT provider says we’re compliant but we have no SSP or POA&Ms — is that a red flag? I’m prepping a client for Level 2 — can IX help me find their gaps faster? How does this assessment compare to a full NIST 800-171 gap analysis? Our SPRS score is below 70 and our C3PAO is booked for Q4 — what do we tackle first? We scoped our CUI enclave but aren’t sure our inherited controls from our CSP are documented correctly.