NIST SP 800-171 · CMMC Level 2 · AWS

NIST 800-171 and CMMC Level 2 on AWS, done by people who have built to it.

If you hold or want DoD contracts that involve Controlled Unclassified Information, you need a defensible SPRS score and a path to CMMC Level 2 certification. LanSurfers assesses your AWS environment against all 110 controls, builds the remediation plan, and does the engineering work to close the gaps.

Start a Gap Assessment See how it works

Who this is for

Suppliers who need a credible answer, not a binder

Defense primes' suppliers who have been told a CMMC Level 2 certification is coming, and need to know what it will take.
Engineering, manufacturing, and research firms that handle CUI and run (or want to run) on AWS.
Companies with an SPRS score they would not want audited.

What you get

Assessment, remediation, and readiness

Each stage is fixed price and scoped from the one before it. You can stop after any stage with a deliverable you can use.

Stage 1

Gap Assessment

Control-by-control review of your AWS environment against NIST SP 800-171, all 14 families and 110 controls, mapped to CMMC Level 2 practices
Findings report with each control marked Met, Partially Met, Not Met, or Not Applicable, with evidence notes
Remediation plan ordered by SPRS point value and effort, so the first week of work moves the score the most
Draft System Security Plan (SSP) outline and Plan of Action and Milestones (POA&M) template, populated from the findings
Two-hour readout with your leadership and whoever will own the work

Fixed price, quoted after a 30-minute call. Two to three weeks.

Stage 2

Remediation

The engineering work to close the gaps, delivered as infrastructure as code wherever possible so the control stays enforced after we leave.

AWS GovCloud or commercial account architecture for the CUI boundary
IAM and MFA enforcement, CloudTrail and centralized logging
Encryption at rest and in transit, backup and recovery
Security Hub with the NIST 800-171 standard enabled
Boundary protection and the configuration management baseline

Fixed-price SOW, scoped from the assessment findings.

Stage 3

Pre-Assessment Readiness

Before a C3PAO assessment, a mock audit against the same evidence standard the assessor will use, so nothing is a surprise on the day.

Evidence walkthrough for every control, in the assessor's format
Updated SSP and POA&M reflecting the remediated state
Optional: we are in the room during the assessment

Fixed price, scoped after remediation.

Why LanSurfers for this

The assessment and the engineering come from the same team

Most compliance consultants write documents. Most cloud engineers have never read 800-171. LanSurfers was built by an architect who spent a decade in federal cloud environments at USGS, NASA, and NGA, where these controls were the baseline rather than an aspiration, and who has built AWS architectures that passed federal authorization.

Because the people who find the gaps are the people who close them, the remediation plan is one you can actually execute, not a list of findings handed to someone else.

How it works

Four steps from first call to handoff

Discovery Call

30 minutes, free. Which systems touch CUI, where they live, and what your current SPRS score is.

Gap Assessment

Two to three weeks. Read-only access to your AWS accounts, interviews with your IT lead, document review.

Readout & SOW

Findings readout, then a fixed-price proposal for the engineering work, phased by SPRS impact.

Remediation & Handoff

Infrastructure as code, runbooks, updated SSP and POA&M, and a knowledge transfer session.

FAQ

Common questions

Do we need GovCloud?

Not always. Commercial AWS can meet 800-171 for many CUI types. ITAR data and certain DoD contracts push you to GovCloud. The assessment tells you which.

Can you get us certified?

No one can certify you except a C3PAO. We get you ready, and we can be in the room during the assessment.

We are on Azure or on-prem. Can you still help?

Yes for Azure. For on-prem, the usual answer is to move the CUI boundary to AWS, which is often cheaper than hardening the existing environment. We can scope both.

How is pricing structured?

The Gap Assessment is a fixed price, quoted after a 30-minute call about your environment. Remediation is a fixed-price SOW scoped from the assessment findings. No hourly billing.