The operating model

From obligation to implementation. From implementation to evidence. From evidence to readiness.

That sentence is the whole model. An engineered program moves your shop through four states, in order, with nothing left to invent along the way. Here is what each state actually involves.

§ 01 · Obligation

Know exactly what applies to you

Most small contractors are not short on effort. They are short on a defensible answer to "what exactly do we owe, and where?" The program starts by fixing that answer in writing: which contracts carry which clauses, where CUI actually lives, which systems and people are in scope, and which of the 110 requirements bind you as a result.

  • Scope defined and recorded, not assumed
  • CUI locations named: machines, shares, people
  • A boundary you can defend to an assessor

Leaves behind Scope & Boundary Definition · CUI location map

Stage 01 · Scope on paper

§ 02 · Implementation

Work a program that already exists

This is where the engineering pays off. Instead of staring at a requirements list, you work the 93 steps in sequence. Each step deploys or operates part of the controlled document set: adopt the policy, configure the practice it describes, assign the owner, record the result. Plain instructions, sized for a team that has a company to run at the same time.

  • Controlled documents adapted to your shop, not written from scratch
  • Every step owned by a named role
  • Progress you can see and report at any moment

Leaves behind Adopted policies · configured practices · named owners

Stage 02 · The program at work

§ 03 · Evidence

Collect proof as a habit, not a scramble

An assessor does not grade intentions. Every step in the program states the evidence it should leave behind: a signed policy, a configuration export, a training record, a review log. Evidence is collected as the work happens and referenced from the documents that rely on it, so the assessment file assembles itself over the life of the engagement.

  • Evidence expectations defined per step, in advance
  • Everything referenced, versioned, and findable
  • No end-of-engagement archaeology

Leaves behind An evidence archive, referenced per family

Stage 03 · Proof, collecting

§ 04 · Readiness

Arrive prepared. Hand off to your assessor.

Readiness is a state you can inspect: a complete SSP that matches reality, a POA&M that is managed rather than embarrassing, and evidence on file for what you claim. From there, an authorized C3PAO conducts the official assessment and makes the certification decision. Our job ends where theirs begins, and we are careful about that line.

  • SSP and POA&M complete and current
  • Evidence organized the way assessors ask for it
  • A clean handoff to the C3PAO you choose

Leaves behind A current SSP · a managed POA&M · the assessment file

Stage 04 · The payoff

§ 05 · Inside the program

Ninety-three steps, excerpted

Every step names its owner, says what to do in plain language, and states what it leaves behind. Five of the ninety-three, the way they read in the program:

07
Owner / ISSO

Scope & boundary definition

Fix the boundary in writing: the enclave, what is in scope, what is out, and who owns the answer.

Approved
39
IT Lead

Quarterly access reviews

Run the review, record who has access to what and why, and file the signed log as evidence.

Complete
41
IT Lead

Removable media control

Adopt the media policy, configure the device control it describes, and record the result.

In review
68
Office Mgr

IR tabletop exercise

Walk the incident response plan around the table; the notes become the evidence.

Due Q3
93
Owner / ISSO

Readiness review

SSP current, POA&M managed, evidence on file: the handoff to your C3PAO is a scheduling call, not a scramble.

Ready

The step numbers, owners, and dates here are illustrative. Your deployment carries your scope, your roles, and your calendar.

§ 06 · The engagement

High-touch where it counts, structured everywhere else

JumpStart Fed is not a login and a wish of good luck. Engagements are scoped and set up with you: the program is deployed for your environment, and you work it with guidance rather than alone. That is also why pricing is scoped per shop instead of listed on a page.

How pricing works

Put your shop on this path

A thirty-minute scoping call is the first step of stage one: your contracts, your CUI, your boundary, and a realistic timeline.

Book a scoping call
Coming soon

Check where you stand first

The free readiness snapshot will map your current state against the 110 requirements. Get notified when it launches.

Get notified