📋 Pillar 1
Pre-Award Verification
Catch non-compliant subs before they touch your contract
- CMMC status captured during procurement, not after award
- Current SPRS score on file before any FCI-handling work begins
- Written attestation collected from every sub, every contract
- Sub vetting documented in the contract award file
📂 Pillar 2
Onboarding & Documentation
Capture initial posture and evidence on day one
- Sub's System Security Plan collected and reviewed
- CMMC clauses flowed down per DFARS 252.204-7021
- Sub acknowledgment of compliance obligations on file
- All evidence stored centrally, not scattered across emails
📊 Pillar 3
Active Monitoring
Know the status of every sub at any time
- Live compliance dashboard — not a one-time snapshot
- Gap tracking by sub, with status and remediation owner
- Escalation triggers defined for non-responsive subs
- Prime point-of-contact assigned to every active sub
🔄 Pillar 4
Annual Renewal
Catch expiring self-assessments before they lapse
- 10-month renewal trigger on every sub
- Automated reminders sent to sub and prime POC
- Renewal evidence collected before expiration date
- Refusal-to-renew protocol defined and documented
🗄️ Pillar 5
Evidence Archive
Defensible records for FCA defense or DCMA audit
- Chain-of-custody documentation on every artifact
- Retention period defined and enforced consistently
- Audit-ready format — not raw emails or scattered files
- KO and DCMA-ready package produced on demand
The 12 Documents an Auditor Will Ask For
If you can't produce these on request, your program is not defensible. Count what you have today.
Pre-Award & Onboarding
1.
FCI-Handling Sub Inventory
Complete list of every active sub touching FCI, by contract and FCI scope.
2.
SPRS Score Register
Current SPRS score for every sub, with date verified and source of verification.
3.
Flow-Down Clause Log
Proof that DFARS 252.204-7021 and CMMC clauses were included in every subcontract.
4.
Sub Compliance Attestations
Written statement from each sub confirming awareness of CMMC obligations.
5.
Sub System Security Plans
SSP from every sub — the SPRS score is meaningless without the plan behind it.
6.
Compliance Dashboard / Tracker
Living record showing current status of every sub against CMMC requirements.
Monitoring, Renewal & Defense
7.
Gap Remediation Log
Documented gaps, remediation steps, owner, and target close date.
8.
Renewal Calendar
Forward-looking calendar of SPRS score expirations with auto-triggered renewal workflow.
9.
Communication Archive
Record of every compliance-related communication with each sub, retrievable on demand.
10.
Escalation & Removal Records
Documentation of subs flagged, escalated, or removed for non-compliance.
11.
Annual Program Review
Yearly written review of program effectiveness, signed by responsible executive.
12.
FCA Defense File
Pre-assembled package showing good-faith program execution, ready for KO or counsel.
Ready to run this program?
PCC builds and manages this program for Pacific primes.
We give prime contractors in Hawaii, Guam, and CNMI a ready-to-run sub compliance program — onboarding packet, tracker, rollout playbook, DFARS 252.204-7021 clause language, and annual renewal workflow. Flat fee. Unlimited subs. Pacific-built.