NOW INCLUDING HIPAA Safeguards, risk analysis, policies, and reviews. Program records, not patient records.
Explore HIPAA →CMMC + NIST CSF 2.0 + SOC 2 + HIPAA
Your security program.
One clear workspace.
CMMC and SOC 2 readiness. NIST CSF 2.0 risk management. HIPAA program management. Organize your evidence, identify gaps, and turn priorities into clear, actionable steps for your team.
5 days · CMMC + CSF + SOC 2 + HIPAA + ISO/IEC 27001 · No credit card required
Supporting real compliance programs
MICROSOFT 365 POLICY AUTOMATION
Included in DakeekoTurn a finding into
an approved policy change.
Create, modify and assign supported Intune policies in your Microsoft tenant, directly from Dakeeko. Keep the review, approval and recorded result with your compliance work.
Commercial, GCC and GCC High. Availability varies by workspace; Microsoft administrator consent and a licensed Intune tenant are required.
- 01Find a differenceReview Microsoft findings and your existing policy baseline.
- 02Review fixInspect a supported correction and its affected assignments.
- 03Approve the exact changeConfirm the tenant, policy, settings and scope.
- 04Run and verifyExecute the approved operation and read back Microsoft state.
- 05Recheck the findingCompare fresh Microsoft data against the original baseline.
SOC 2 READINESS
Prepare for the review.
Keep the operating history.
Type I and Type II workflows for customer-defined controls, dated evidence, exceptions, and auditor requests across all five Trust Services Categories. An independent CPA examination is separate.
Explore SOC 2 →NIST CSF 2.0 · AVAILABLE NOW
Not just an assessment.
A plan for what comes next.
Use CSF to understand your cybersecurity risks and decide where to improve. Keep a separate CSF assessment alongside your CMMC work, without treating one framework's results as the other's.
Set your starting point
Record your current profile and the outcomes that matter to your business.
Choose your target
Define the desired state, document risks, and identify the gaps worth addressing first.
Build your roadmap
Connect risks to actions, owners, and due dates so the next step is clear.
Keep leadership involved
Use quarterly reviews to discuss progress, open risks, and the decisions ahead.
Inside the CSF workspace
Real screens from our synthetic demo program. Select any image to take a closer look.
TAKE A LOOK INSIDE
Less chasing. More progress.
Explore the CMMC workspace and connected tools in the actual application. These screenshots use demo data; each framework has its own assessment experience.
One place to see your next step.
Review readiness, open POA&Ms, evidence needing attention, and assigned tasks without piecing together separate spreadsheets.
- Control and objective progress
- Remediation and task visibility
- Workspace-specific records
Keep the proof with the requirement.
Work through controls, capture implementation details, and link supporting evidence and assets. Keep your review decisions connected to the work behind them.
- Guided CMMC implementation
- Evidence and asset links
- Recorded statuses and rationale
Know when configuration moves off course.
Compare supported Microsoft policy state with a versioned baseline. Review changed, missing, and added settings before deciding what needs remediation.
- Versioned configuration baselines
- Supported live signals or policy JSON imports
- Findings to investigate, not automatic compliance claims
Make the scope easier to explain.
Bring the systems, services, and information flows in your environment into a visual boundary. Connect the scope of your program with the documentation your team maintains.
- Visual system-boundary planning
- Asset and service context
- CUI-flow documentation
A starting point, with you in control.
Ask Keeko to explain requirements, review selected documents, map evidence, or help draft procedures. Your team validates the output before using it in a compliance record.
- Control-aware explanations
- Document review and drafting help
- Human review remains essential
Turn ongoing work into useful documentation.
Prepare SSP drafts, POA&Ms, gap reports, and stakeholder summaries from the information your team maintains in Dakeeko.
- Documentation grounded in workspace records
- Exports for review and collaboration
- Review and approve before assessment use
CUSTOM COMPLIANCE WORKSPACES
Your framework. Your workflow.
Built around your team.
Turn your own requirements and review process into a workspace designed for the way you work. We help shape the controls, recurring reviews, trackers, approvals, and reports your program needs.
Design and implementation services · Scoped and quoted separately
Shape your framework
Organize your policies and requirements into a control set with clear responsibilities.
Build your review workflow
Define recurring tasks, evidence reviews, approvals, and follow-up actions.
Make progress visible
Scope the trackers, reports, and connected tools that support your delivery process.
A CONNECTED WORKFLOW
From a finding to a follow-through.
Bring in the evidence
Connect supported providers or add the documentation your team already has.
Review what it means
Understand the requirement, check the scope, and validate what the evidence supports.
Assign the next action
Track the gap, owner, and remediation work in the same workspace.
Keep it current
Revisit findings and baselines as the environment and evidence change.
YOUR PROGRAM. YOUR DELIVERY MODEL.
Built for both sides of the table.
Run your own security and compliance program or help clients run theirs. Keep the records in the right workspace.
Less time organizing.
More time moving forward.
Bring IT, security, and leadership together around CMMC readiness, cybersecurity risk, SOC 2 preparation, and HIPAA program management.
Explore your workspaceOne practice.
Separate client workspaces.
Support CMMC, CSF, SOC 2, and HIPAA programs, from current-state reviews to improvement plans and client conversations. Keep client records isolated with authorized team access.
Explore the partner programCONNECT YOUR STACK
Evidence from the tools
you already work in.
Microsoft 365 commercial and GCC High, endpoint tools, security platforms, and more. See which connectors are available and what each can actually collect.
Explore integrationsCLEAR BOUNDARIES. HUMAN DECISIONS.
Built to support readiness.
Not promise a certificate.
Dakeeko application data is hosted in Azure Government. Your team controls what evidence is added and validates findings before using them in an assessment.
Keep CUI in your authorized environment unless your agreement and configured Dakeeko environment explicitly permit its storage. Hosting alone does not certify your organization.
Read the security overviewSEE HOW IT FITS YOUR WORK
Start with your next compliance task.
Explore Dakeeko yourself, or let us walk you through it.
One framework $250/mo · Each additional framework $100/mo · Save 10% annually · New direct subscriptions View pricing
CONNECTED MICROSOFT WORKFLOW
Included in DakeekoMicrosoft 365
Policy Automation
Create, modify and assign supported Intune policies in your customer's Microsoft tenant, directly from Dakeeko, with approval before every change.
Included in the Dakeeko platform. Workspace permissions, Microsoft administrator consent and Intune licensing are required. Customer-tenant Intune acceptance testing remains pending.
TARGETS FIRST
Choose the group. Choose the action.
Review before anything changes.
- 01
Choose targets
Select an eligible device group in the connected tenant and inspect its visible direct members.
- 02
Choose an action
Use clickable actions to prepare a new policy copy or review an assignment. Use Policy Drift for an existing-setting fix.
- 03
Review & approve
Confirm the tenant, exact settings and affected targets. Dakeeko saves the proposed change and its approval.
- 04
Run & verify
Run the approved operation. Dakeeko checks Microsoft configuration and records the result for review.
Group browsing needs Microsoft admin consent. Unsupported, mixed or nested group targets cannot be selected for this pilot.
GCC HIGH CENTER + POLICY DRIFT + POLICY AUTOMATION
One connected review.
Your existing baseline.
Start from GCC High results and open the matching Policy Drift difference. Review fix prepares a supported correction using your existing baseline and the same policy approval flow.
After a verified correction, Recheck this finding runs a fresh Microsoft sync and comparison against the original baseline. Keep the recorded policy run for evidence review.
A broad Microsoft finding is not an automatic policy match. Unsupported changes show manual guidance. Device enforcement and compliance decisions remain separate.
- 01Find a differenceReview Microsoft findings and your existing policy baseline.
- 02Review fixInspect a supported correction and its affected assignments.
- 03Approve the exact changeConfirm the tenant, policy, settings and scope.
- 04Run and verifyExecute the approved operation and read back Microsoft state.
- 05Recheck the findingCompare fresh Microsoft data against the original baseline.
CONNECT ONCE. APPROVE EACH CHANGE.
See what is ready
and what needs attention.
Choose the Microsoft tenant already connected to your workspace and select Connect with Microsoft. An authorized Microsoft tenant administrator reviews the additional permissions.
Dakeeko manages the application certificates and renewal. Users do not upload private keys or maintain certificates.
Commercial, GCC and GCC High connections are supported. Policy actions require an Intune license, Dakeeko workspace access and a supported policy.
Connection readiness
- 01Tenant connected
- 02Microsoft permissions granted
- 03Workspace access approved
- 04Ready to prepare policy changes
Connecting does not change policies. Microsoft grants tenant-wide Intune configuration access; Dakeeko requires approval for each supported operation.
Evidence you can keep
Download the exact reviewed change, approval details and recorded result. Keep the run reference with the relevant finding for evidence review.
Reviewed recovery
Restore supported saved settings or assignments with a new approval. Cleanup is limited to the unchanged, unassigned copy created by that run.
Separate client workspaces
MSPs work within each authorized customer workspace and tenant. Approvals and results stay with that client; changes are not pushed across tenants in bulk.
Before you connect
Does this actually change a customer's Intune policies?
Yes. Enabled, supported operations create, modify or assign policies in the connected customer's Microsoft tenant. They require Microsoft permissions, authorized workspace access, review and approval before execution.
Can it change every Microsoft 365 setting?
No. The current scope is supported Windows Settings Catalog policy imports, Session Lock setting corrections and reviewed group assignments. Conditional Access, Exchange, Defender/Purview configuration, arbitrary scripts and bulk unattended changes are outside this pilot's execution scope.
Does a verified change make a control compliant?
No. Configuration verification checks Microsoft policy state. Device check-in and enforcement must be reviewed in Intune, and your team still makes the compliance determination.
Is Policy Automation available in my workspace?
Policy Automation is included in Dakeeko. Your workspace role, Microsoft tenant consent, licensing and supported policy scope determine the available actions. Each change still requires review and approval.
CONNECT YOUR STACK
Useful signals.
Clear responsibilities.
Bring supported provider data into your compliance workflow. Review the evidence, understand its limits, and decide what action comes next.
Coverage depends on your provider, cloud environment, licensing, and granted permissions. Connecting a system does not automatically prove compliance.
Available connections
NinjaOne
Bring company-wide device observations into your CMMC, NIST CSF 2.0, and SOC 2 evidence workflows.
- Inventory, software, OS patches, antivirus, and alert context
- Background sync with automatic discovery of new devices in your approved company
- Evidence exports, follow-up work, and optional Keeko review with human oversight
Read-only connection. Pilot activation requires company authorization and environment validation. Coverage depends on the data available from your NinjaOne account.
Ask about NinjaOne pilot access →
Microsoft 365
Commercial and GCC High connections for supported identity, device, access-policy, and security evidence.
- Entra ID and Microsoft Graph signals
- Intune device and policy context
- Source coverage and permission visibility
Policy Drift Findings
Compare supported policy snapshots against versioned baselines. Review differences without automatically changing your environment.
- Baseline versions and compare history
- Policy JSON import and export
- Read, compare, and report
With approved Policy Automation access, Review fix hands supported differences to a separate change approval.
Explore Policy Automation →Microsoft Sentinel
Connect supported Azure and Azure Government Sentinel environments to review logging, alerts, and incident context.
- Separate Azure connection and permissions
- Workspace-specific evidence
- Optional management actions require separate permissions
Nessus
Bring supported vulnerability-scan results into your review and remediation process.
- Vulnerability findings
- Asset context
- Evidence for human review
Duo Security
Collect supported MFA enrollment signals and review what they demonstrate for your environment.
- Enrollment evidence
- Control-linked review findings
- No automatic assessment verdict
Halo PSA
Send approved POA&M remediation work to Halo through an explicit, auditable action.
- Limited ticket-writing workflow
- Operator-controlled action
- No billing access
Autotask PSA
Review supported incidents, changes, and remediation tickets alongside compliance work.
- Work-management context
- Incident and change records
- Provider-specific setup
Google Workspace
Read-only, limited-coverage connector for supported directory, admin-role, MFA, device, audit, and alert signals.
- Google OAuth connection
- Edition-dependent coverage
- Human review required
Palo Alto Networks
Read-only SCM Pro and Cortex compliance signals. Contact us to confirm the supported product, tenant, and deployment scope.
- SCM Pro and Cortex XDR context
- Read-only collection
- Environment validation before onboarding
Product names and logos identify the connected services or their vendors. No vendor endorsement or partnership is implied.
Your evidence is broader than your connectors.
Use evidence requests, uploaded documents, and manual reviews for sources outside a supported API connection. A guided-evidence workflow is not the same as a live connector.
Ask about your environment →Understand the connection. Control the scope.
Evidence collection and management actions are different workflows. Review the permissions, supported data, and limits of each connector before enabling it.
Grant the required access
Follow the connector's setup guide. Your tenant, account permissions, licensing, and provider support determine what Dakeeko can access.
Bring in supported signals
Connections may use interactive authorization or server-side synchronization. Dakeeko stores the selected results needed by the supported workflow.
Validate before using
Review the source, scope, and evidence limitations. An observed configuration or finding is not, by itself, proof of compliance.
Keep changes explicit
Where supported and enabled, guarded management actions use a separate, permission-controlled workflow. A read-only connection does not grant write access.
Dakeeko stores compliance records and evidence users choose to add. CUI upload is not required. Keep CUI in authorized systems unless your agreement and configured environment explicitly permit storage in Dakeeko. Do not place access tokens, passwords, or API secrets in evidence or support messages.
CUSTOM COMPLIANCE WORKSPACES
Your process.
Your workspace.
We work with companies, MSPs, and consultants to design Dakeeko workspaces around their own requirements and ways of working. Start with a recurring review process, or scope a complete internal control framework.
Personalized framework and workflow design · Scoped and quoted separately
Built around the work your team actually does.
Framework design
Organize your internal policies, customer commitments, and review requirements into a clear control set. Define owners, evidence expectations, and review criteria that fit your program.
Workflows & approvals
Design recurring reviews, preparation tasks, reviewer assignments, and sign-off steps. Keep responsibilities, due dates, and follow-up actions together.
Trackers & registers
Build a structured process for risks, exceptions, source failures, or remediation work. Define the fields, statuses, and review schedules your team needs.
Reports & review history
Shape reports and exports around the records your team maintains and the decisions your audience needs to see, with evidence references and a clear review history.
AN EXAMPLE ENGAGEMENT
Turn a weekly checklist into a repeatable review.
Your team defines the checks and evidence sources. We help shape the workspace, assign preparation and review steps, track missing information, record sign-off, and carry open follow-ups into the next review.
The same design approach can support scheduled risk reviews or a consultant's own client-delivery process. Features and rollout are agreed for each project.
FROM YOUR PROCESS TO A WORKING PILOT
Define it together. Build it with purpose.
Show us the process
Start with a sanitized checklist, workflow outline, or description of the result you want. Identify who does the work and who reviews it.
Agree on the scope
Define the control structure, fields, roles, approvals, reports, and acceptance criteria. Confirm the timeline and written quote.
Try it with your team
Build and test the agreed workspace using appropriate test data. Walk through the process and refine it against the agreed requirements.
Put it into practice
Review the result together, prepare the setup guidance, and agree on rollout, support, and future changes.
A clear scope from the start
Can you design our own framework?
Yes. We can scope an internal control framework around your organization's policies, commitments, and operating procedures. Where an external standard applies, we agree on the source material and permitted use. Your organization retains responsibility for interpreting its obligations and approving its requirements.
Is custom design included in a subscription or the launch offer?
Custom design and implementation are quoted separately. Your proposal identifies the required subscription, project deliverables, and any ongoing support or maintenance. The HIPAA, SOC 2, and CSF launch discount does not cover custom project work.
Can this support our consulting or MSP practice?
We can scope a repeatable delivery process for your team and client workspaces, including reusable setup, client-specific responsibilities, and reporting. Workspace access and any rollout across clients are defined as part of the project.
Can the workspace connect to our tools?
Custom integrations can be included in the proposal when the vendor's API, permissions, and environment support the required workflow.
Explore custom integrations →BRING US YOUR PROCESS
What should your workspace do?
Tell us what you track, who reviews it, and what a useful result looks like.
CUSTOM INTEGRATION SERVICES
Make Dakeeko work
with the tools you use.
Your compliance process should not depend on copying the same information between disconnected systems. We design and build custom integrations around the workflow you need.
For companies, consultants, MSPs, and software partners.
Start with the connection that saves you work.
Custom API connectors
Connect a supported vendor API to bring the agreed data into Dakeeko. Define the permissions, collection schedule, workspace boundaries, and evidence context for your use case.
Policy & baseline comparisons
Explore mapping a provider's available configuration data into a repeatable baseline and drift-review workflow. Coverage is based on what the provider actually exposes.
Workflow automation
Scope ticket creation, follow-ups, or approved management actions that connect your compliance process to the systems your team already uses.
Import & export workflows
Bring structured JSON, spreadsheets, or supported vendor exports into a defined process, with validation and clear source attribution.
Partner & multi-client workflows
Design connections around authorized customer workspaces, with clear ownership and separation of each client's records.
Environment-specific setup
Evaluate government-cloud endpoints, vendor-managed tenants, licensing dependencies, and access limits before committing to an implementation.
A SCOPED PROJECT, NOT AN OPEN-ENDED PROMISE
Agree on the result. Build it. Prove it works.
Define the use case
Tell us the platform, environment, desired data or action, and the manual work you want to remove.
Confirm access & effort
Validate API availability, vendor permission, security boundaries, acceptance criteria, timeline, and a written quote.
Start with a focused pilot
Implement and test the agreed workflow using appropriate test data and authorized access.
Review before rollout
Check the result together, document the setup, and agree on production rollout and ongoing support.
CONTROLLED ACCESS. CLEAR SCOPE.
Build the connection.
Keep the boundaries.
Read access and write actions are scoped separately. Where write access is part of the project, the design includes appropriate permissions, operator approval, and auditability.
Custom implementation is quoted separately from your subscription. Vendor licensing, API access, hosting changes, and ongoing maintenance are addressed in the proposal where applicable.
Not every vendor exposes the required API or permits third-party access. We confirm feasibility before promising a connector.
WHAT WOULD YOU LIKE TO CONNECT?
Bring us the workflow.
Start with the tool name and the task you want to simplify.
No credentials or sensitive customer data needed for the initial conversation.
COMPLIANCE & CYBERSECURITY FRAMEWORKS
Your framework.
Your next step.
CMMC, NIST CSF 2.0, SOC 2, HIPAA, and ISO/IEC 27001 are available. Prepare for assessments, manage cybersecurity risk, and organize your program work with separate framework decisions. Explore all five in one five-day trial.
SOC 2
Prepare controls, dated evidence, internal reviews, and auditor requests for an independent examination.
- Type I and Type II readiness planning
- Workflows for all five Trust Services Categories
- Separate internal decisions and retained review history
Start with SOC 2 at $250/month per workspace, then add each additional framework for $100/month. Save 10% annually. Independent audits are separate. Choose a plan in the app after signing in.
Explore SOC 2 workflows →
CMMC
Bring controls, evidence, assets, and follow-up work together in a dedicated compliance workspace.
- Track control and assessment-objective progress
- Connect evidence to the work it supports
- Manage POA&Ms, tasks, and reporting
NIST CSF 2.0
For teams that want to understand cybersecurity risk, prioritize improvements, and keep leadership informed.
- Document current and target profiles
- Connect risks with actions and a target roadmap
- Prepare quarterly reviews and leadership summaries
HIPAA
Organize safeguards, risk analysis, policies, training, and follow-up work for your HIPAA program.
- Scope, responsibilities, and recurring reviews
- Sanitized evidence with advisory Keeko review
- Separate human decisions and approval history
Program management only. No PHI or patient-record storage.
Framework graphics identify the programs supported by Dakeeko; they do not represent Dakeeko certification, an issued SOC report, or endorsement. CSF six-functions graphic reprinted courtesy of the National Institute of Standards and Technology, U.S. Department of Commerce. No NIST endorsement is implied.
ISO/IEC 27001 · ISMS workspace
Build an information-security management program with original Dakeeko practice guidance, scoped risks, safeguard applicability decisions, policies, evidence, assigned work, internal audits and management reviews.
Keep drafts, human approvals and revision history separate. Keeko provides advisory guidance; people make the decisions.
$250/month per workspace includes ISO 27001 and unlimited users. Each additional framework in that workspace is $100/month. Pay annually for 10% off: $2,700/year for one framework. Existing customer and partner rates remain unchanged.
This module is not the ISO publication or a complete requirements/control catalog. Mappings and coverage are not independently verified. Use your authorized standard and qualified reviewer to determine requirements. No ISO endorsement, certification or guaranteed audit outcome is implied.
ISO/IEC 27001 is included in the same five-day no-card direct trial, with its original deadline and limits. Paid ISO remains separate from existing bundles and partner contracts. Previously invited companies keep their separately agreed access period.
See ISO pricing → Ask about complimentary access →Which framework fits your next step?
CMMC supports assessment preparation for defense contractors. NIST CSF 2.0 helps teams understand and improve their cybersecurity risk program. SOC 2 helps service organizations organize controls and evidence for an independent CPA examination. HIPAA supports safeguard, risk, and privacy-program management using sanitized records. Maintain each program in Dakeeko with separate assessments and human-reviewed decisions.
Walk through your use caseA few things to know
Does CSF give us a pass/fail score or certification?
No. The CSF experience supports your organization's risk decisions, current and target profiles, and improvement plan. It is not a certification or an automatic compliance determination.
Does using CSF change our CMMC assessment?
No. CSF and CMMC assessments are separate. Working in CSF does not automatically transfer scores, statuses, or approvals to your CMMC records.
Which subscription should we choose?
Try all five frameworks before choosing a paid plan. New direct subscriptions are $250/month for one framework and $100/month for each additional framework in the same workspace. Save 10% with annual upfront billing. Unlimited users; existing customer and partner pricing stays unchanged. The billing owner confirms any purchase.
Compare framework pricing →About Dakeeko
Dakeeko is a readiness and program-management platform for companies, MSPs, and consultants working with CMMC, NIST CSF 2.0, SOC 2, and HIPAA. It replaces disconnected spreadsheets and manual workflows with a shared system for assessment objectives, evidence, policies, SSP drafts, POA&Ms, assets, tasks, and client workspaces.
From your first self-assessment through preparation for a C3PAO engagement, Dakeeko helps organize controls, assessment objectives, evidence, documentation drafts, and remediation work. Final compliance determinations remain with your organization and its assessor.
Built on Azure Government Cloud
Dakeeko is hosted in Microsoft Azure Government and uses applicable services within Microsoft's federal authorization scope. Azure Government provides U.S. government regions and additional personnel-screening assurances; customers remain responsible for validating their own architecture, configurations, agreements, and system boundary.
What Makes Dakeeko Different
Most compliance tools are built for large enterprises with dedicated security teams. Dakeeko is built for the rest of the defense industrial base - small and mid-size contractors, IT service providers, and the consultants who support them.
AI-Powered Assessor
Our AI reviews selected documentation and evidence, suggests objective-level findings, identifies possible gaps, and drafts remediation actions for human review.
Microsoft 365 Workspace + Integrations
Connect Microsoft 365 commercial or GCC High to map selected tenant signals to relevant NIST SP 800-171 requirements, import approved assets, and review guided implementation steps for the remaining work.
Multi-Client Management
Consultants and MSPs can manage multiple client enclaves from a single account - each with its own controls, evidence, documentation, and team workspace.
Assessor-Grade Documentation
Generate complete SSPs, POA&Ms, and SPRS scores that meet assessor expectations. Every document is built from your actual control data - not generic templates.
Meet the Founder
Tim Cleland
With over a decade of experience in government cybersecurity, I founded Dakeeko after seeing how defense contractors - especially small and mid-size companies - struggled to navigate CMMC without enterprise budgets. I've spent years working in federal compliance and understand what assessors actually look for. Dakeeko is built to make that expertise accessible to everyone in the defense industrial base, whether you're a solo contractor or an MSP managing dozens of clients.
Our Mission
CMMC preparation should be understandable for organizations of every size. We build tools that help small internal teams and experienced consultants organize the same requirements, evidence, responsibilities, and remediation work without pretending software replaces qualified judgment.
Every feature in Dakeeko is designed around real-world assessment workflows. We don't just track controls - we help you understand what each one requires, document how you meet it, and prove it with evidence. You stay in control. We accelerate the work.
Built on Azure Government Cloud
Dakeeko runs in Microsoft Azure Government using applicable services within Microsoft's federal authorization scope. This gives defense-sector customers a government-cloud foundation while preserving the shared-responsibility model for application security, configuration, data handling, and CMMC compliance.
HIPAA data boundary
The HIPAA module supports sanitized program documentation, not PHI or patient-record storage. Government-cloud hosting does not by itself establish HIPAA compliance or authorize patient-data processing in this product.
Read about the HIPAA module →Federal Cloud Foundation
Uses applicable Azure Government services within Microsoft's authorization scope. Dakeeko does not claim that hosting alone certifies a customer environment.
US Sovereign Data
All data processed and stored in U.S. Government data centers operated by screened U.S. persons.
CUI Boundary Friendly
Built so teams can manage CMMC workflows while keeping CUI and export-controlled files in their authorized environment.
Government Cloud Foundation
Designed for defense contractor compliance workflows on Azure Government, with customer CUI kept outside the Dakeeko app.
What This Means for You
Your CUI stays in your authorized environment
Use Dakeeko for control status, POA&Ms, SSP drafts, AI assessments, and evidence references. Do not upload CUI; keep source files and controlled data in your approved tenant or repository.
You practice what you preach
When your C3PAO auditor asks where your compliance workflow data lives, the answer is Azure Government infrastructure, with CUI intentionally kept in your authorized environment.
A clearer data-residency story
Dakeeko application data is hosted in Azure Government. CUI remains in the customer-controlled systems your organization has already approved.
AI review is for non-CUI compliance content
Use Keeko AI for non-CUI notes, mappings, and evidence references. Do not submit CUI to Keeko AI.
Security Responsibilities at a Glance
Dakeeko provides a government-cloud foundation; customers still own scope, configuration, and data-handling decisions.
| Security Feature | Dakeeko | Customer Responsibility |
|---|---|---|
| Cloud Infrastructure | Azure Government | Define the authorized boundary |
| Cloud Authorization Scope | Applicable Azure services | Validate selected services |
| CUI Storage Model | No CUI storage required | Classify content before upload |
| ITAR / Export-Controlled Files | Keep in customer system | Approve storage locations |
| Data Residency | U.S. Gov Only | Confirm contractual requirements |
| Hosting Personnel Assurance | Azure Government commitments | Validate operational roles |
| Defense Workload Foundation | Azure Gov foundation | Document shared responsibilities |
| AI Review Boundary | Non-CUI content and evidence references | Approve content submitted to AI |
Ready to See Dakeeko in Your Workflow?
Run an AI-assisted readiness review while keeping CUI in your authorized environment and validating every suggested finding.
SIMPLE FRAMEWORK PRICING
Choose what you need.
Build on it.
$250/month for one framework. $100/month for each additional framework in the same workspace. One platform, unlimited users, and 10% savings when you pay annually.
Try all five frameworks for five days without a card. Your existing trial deadline stays the same. No automatic paid subscription.
USD per workspace for new direct subscriptions. Existing customer rates, included workspace allowances and partner agreements remain unchanged.
YOUR WORKSPACE
1 framework
$250/month
Billed monthly
Unlimited users
Policy Drift and Microsoft 365 Policy Automation included
Workspace permissions, Microsoft consent and change approvals still apply.
Start your free trial →CMMC selected
| Frameworks | Monthly billing | Annual upfront | Monthly equivalent |
|---|---|---|---|
| 1 | $250 | $2,700 | $225 |
| 2 | $350 | $3,780 | $315 |
| 3 | $450 | $4,860 | $405 |
| 4 | $550 | $5,940 | $495 |
| 5 | $650 | $7,020 | $585 |
A few things to know
How are additional workspaces priced?
For new direct subscriptions, the same $250 plus $100-per-additional-framework formula applies to each workspace. Additional workspaces on the same subscription use the same framework selection. Two workspaces with two frameworks each cost $700/month, or $7,560/year prepaid. Existing contracted workspace rates and partner pricing stay unchanged.
Will my current price change?
No. Existing subscriptions, included-workspace allowances, prepaid terms and partner agreements keep their contracted pricing. Contact Dakeeko before changing an existing framework bundle. There is no automatic repricing.
How does annual billing work?
Pay twelve months upfront at 10% less than twelve monthly payments. One framework is $2,700/year, equivalent to $225/month. The monthly equivalent is for comparison; the charge and renewal are annual. Stripe displays the final total and start date before you subscribe. Prices are before applicable tax.
Can I choose any combination?
Choose from the frameworks available in Plans & billing: CMMC, NIST CSF 2.0, SOC 2, HIPAA and ISO 27001. Each program retains its own assessments and human approvals. Contact Dakeeko to add frameworks to an existing agreement; the exact change must be reviewed before a purchase.
Is Microsoft 365 Policy Automation extra?
No separate add-on charge. Supported Microsoft 365 Policy Automation workflows and Policy Drift are part of the platform. Microsoft licenses, tenant consent, workspace roles and approvals for policy changes are still required.
What happens after my trial?
The five-day no-card trial expires without an automatic charge. Saved work is not deleted by trial expiry. Choose a paid plan to continue with its frameworks. Switching frameworks does not restart the trial. Separately invited access retains its agreed expiry.
Are audits and consulting included?
Software subscriptions do not include independent audits, certification, Microsoft licenses, consulting, legal advice or custom integrations. Dakeeko does not guarantee an audit outcome. ISO uses original Dakeeko guidance, not licensed ISO publication text or verified full-standard coverage. HIPAA records must be sanitized and must not contain patient records.
What about MSP and partner pricing?
Partner-managed workspaces follow their existing agreements. Contact us to discuss your delivery model and clients. Existing partner prices are unchanged.
Optional guided onboarding: $500
A one-time package covering preparation, one scheduled walkthrough and written next steps. Scope and approval are confirmed before invoicing. Additional training, migration and custom integration work are quoted separately.
Talk through your plan →HIPAA PROGRAM MANAGEMENT
A clearer picture.
A stronger program.
Bring your HIPAA scope, safeguards, risk analysis, policies, and follow-up work into one workspace. Keep the evidence organized and the decisions with your team.
5 days · CMMC, NIST CSF 2.0, SOC 2, HIPAA, and ISO/IEC 27001 · No credit card required
HIPAA is $250/month for one workspace and unlimited users. Add any other available framework for $100/month per workspace. Save 10% with annual billing. Existing rates and partner agreements are unchanged.
PROGRAM RECORDS, NOT PATIENT RECORDS
Keep PHI out of your workspace.
This module is for sanitized program documentation and evidence. Do not upload protected health information (PHI), patient records, patient identifiers, or credentials. Record systems, processes, and responsibilities without including the underlying health information.
THE WORK, IN ONE PLACE
From scope to your next review.
Use a shared workflow for ownership and evidence while keeping HIPAA decisions separate from your other frameworks.
Start with your environment
Record your entity role, program scope, security and privacy officials, and safeguard responsibilities. Work from original, source-linked guidance with required and addressable designations.
Turn risks into follow-up work
Document threats, vulnerabilities, treatment plans, owners, and recurring reviews. Keep sanitized asset and ePHI-flow metadata alongside the program it supports.
Make expectations clear
Tailor policy starters, track training and acknowledgments, and keep review history. Templates support your work; they do not automatically establish implementation.
Track the relationships
Maintain vendor and business associate agreement metadata, responsible owners, and review dates. Use sanitized records rather than patient data or sensitive source documents.
Document human decisions
Track privacy procedures and incident-response documentation, with human-entered decisions and follow-up work. Dakeeko does not decide whether a legal notification is required or send one automatically.
Know what needs attention
Bring due work into My Work. Review program records, retain change history, and export CSV or JSON for your team's next conversation.
Keeko helps review. Your team decides.
With explicit consent, Keeko can review selected, sanitized evidence and provide an advisory implementation recommendation with citations and limitations. An owner or admin accepts, adjusts, or rejects the recommendation. A status decision saves a draft; final record approval remains a separate human step.
- 01
Define the scope
Choose the record and confirm the relevant program context.
- 02
Select safe evidence
Use sanitized files and give consent for the selected review.
- 03
Review the recommendation
Check citations, missing evidence, and stated limitations.
- 04
Make the human decision
Save your decision and complete the separate approval workflow.
Four frameworks. Separate conclusions.
Reuse suitable sanitized evidence across CMMC, NIST CSF 2.0, SOC 2, and HIPAA when its scope is relevant. Each program keeps its own assessments, reviews, and approvals. A result in one framework does not automatically satisfy another.
Start with one framework at $250/month. Add each additional framework for $100/month in the same workspace: two cost $350, three $450, four $550, and five $650. Save 10% when paying annually. Existing customer and partner rates remain unchanged.
See the full pricing breakdown →Clear boundaries from the start
Does Dakeeko certify HIPAA compliance?
No. Dakeeko provides program-management software, not a certification, legal opinion, or guarantee of compliance. Your organization remains responsible for its scope, safeguards, policies, evidence, and decisions. Independent legal advice and hands-on consulting are separate.
Is the guidance independently reviewed?
The module contains original Dakeeko guidance with regulatory references and source links. It has not been independently reviewed and is not presented as complete legal coverage. Review and tailor it with your organization's qualified advisers. Proposed rule changes are not treated as current requirements.
Can I store PHI or patient records here?
No. This release is limited to sanitized program records and evidence. Remove PHI and patient identifiers before uploading or requesting AI review. Hosting in a government cloud does not, by itself, authorize patient-data storage in Dakeeko.
Does HIPAA use a separate trial?
No. CMMC, NIST CSF 2.0, SOC 2, HIPAA, and ISO/IEC 27001 share the same five-day no-card direct trial and its existing limits. Switching frameworks does not restart the trial or create a paid subscription. Trial expiry retains saved records but ends trial access.
Will existing subscriptions or partner pricing change?
No automatic changes. Existing subscriptions, prepaid terms, and partner agreements stay in place. The existing CMMC + CSF + SOC 2 bundle remains a three-framework plan. Contact Dakeeko before adding HIPAA to an existing agreement; the billing owner must approve any purchase.
Official background: HHS Security Rule overview and HHS Privacy Rule resources. These links identify source material, not an endorsement of Dakeeko.
Start with your program, not another spreadsheet.
Explore all five frameworks in one five-day trial, or talk through your use case before choosing a paid plan.
SOC 2 READINESS
Organize the work.
Show how it operates.
A dedicated workspace for your controls, evidence periods, internal reviews, and auditor requests. Prepare for an independent SOC 2 examination without treating a checklist as an audit opinion.
Includes CMMC, CSF, SOC 2, HIPAA, and ISO/IEC 27001. No credit card required. Choose a paid plan only when you decide to subscribe.
New customers can choose a SOC 2 plan in the app. Existing customers should contact Dakeeko to preserve their current agreement.
One scope. The categories your examination needs.
Workflows support Security, Availability, Confidentiality, Processing Integrity, and Privacy without a per-category software charge. Agree the scope and relevant criteria with your independent CPA firm; one category's evidence does not automatically satisfy another.
Define the engagement
Record the service boundary, customer commitments, category selections, and Type I target date or Type II observation period.
Document actual controls
Customize Dakeeko-authored control starters with an owner, operating frequency, evidence expectations, and review procedure. Use related SOC 2 criteria to guide your workspace review; selecting a template never marks a control implemented.
Review evidence over time
Link workspace evidence to controls with coverage dates, findings, and limitations. Keep missing or partial periods visible.
Prepare the handoff
Organize system-description notes, exceptions, access and vendor reviews, auditor requests, and a saved-record readiness package.
Type I and Type II preparation
Type I examines control design at a specified date. Type II also examines operating effectiveness over a specified period. Software cannot create missing historical evidence or guarantee the period your auditor will accept.
Clear boundaries from the start
Does this include an audit or a SOC 2 report?
No. Dakeeko supplies readiness software. An independent CPA firm performs the examination and issues the report. Auditor fees and hands-on consulting are separate. There is no guaranteed pass or SOC 2 certification provided by Dakeeko.
Is this the official criteria publication?
No. Related SOC 2 criteria are shown using reference IDs and source links, not reproduced AICPA publication text. Dakeeko provides original control templates and suggested criterion associations. Customers should tailor controls to their environment; mappings alone do not establish compliance. These associations have not been independently reviewed.
Can we reuse CMMC or CSF evidence?
Files may support more than one program when their scope and period are relevant. Reviews and decisions remain separate; CMMC and CSF statuses do not automatically become SOC 2 conclusions.
Will existing subscriptions change?
No. Existing customer, prepaid, and partner agreements stay unchanged. Contact Dakeeko to discuss adding SOC 2 to an existing agreement before making a purchase.
A Faster Way to Review
Your CMMC Evidence.
Review the implementation notes and evidence you provide against CMMC requirements and assessment objectives. Dakeeko suggests findings, identifies potential gaps, and drafts remediation actions for your team to validate before they become part of the compliance record.
How It Works
From documentation to a human-reviewed readiness record in 5 steps
Document Your Controls
Add "How We Comply" notes to your controls describing your organization's current security implementations, and attach non-CUI evidence references for AI review. You can type notes manually, import from a spreadsheet, or use AI to help draft implementation statements.
Run an AI-Assisted Review
Run a review across documented controls or focus on an individual control. Dakeeko compares the supplied content with NIST SP 800-171 requirements and CMMC assessment objectives, then returns suggested findings rather than a certification decision.
Review Detailed Results
Review the suggested finding (Met, Partial, or Not Met), confidence indicator, supporting rationale, identified gaps, and remediation suggestions. Trace each recommendation back to the content that was reviewed.
Validate Results and Preview POA&Ms
Accept, revise, or reject suggested findings. Preview proposed POA&M content for applicable gaps before creating any record, then assign ownership, milestones, and dates through the normal workflow.
Export & Repeat
Export a readiness report for internal review or collaboration with your consultant. As evidence and implementations change, run another review to compare progress while preserving human ownership of final determinations.
Dakeeko reviews selected non-CUI evidence and suggests how it may support relevant NIST SP 800-171 requirements
See What AI Assessment Results Look Like
Suggested outcomes are presented for review and do not replace an assessor's determination
The supplied content appears to support the requirement; a reviewer confirms whether the evidence is sufficient.
Some aspects appear supported while identified gaps still require evidence, implementation, or clarification.
The supplied content does not yet support the requirement; proposed POA&M content can be previewed and edited.
What the AI Evaluates
Structured around NIST SP 800-171 requirements and CMMC assessment objectives
Implementation Completeness
Does your documentation address all aspects of the control requirement? The AI analyzes your "How We Comply" notes and non-CUI evidence references against the full control description and assessment objectives.
Assessment Objective Alignment
The 110 NIST SP 800-171 requirements contain 320 CMMC assessment objectives. Dakeeko compares supplied content to each applicable objective and suggests an outcome for review.
Gap Identification
The AI specifically identifies what's missing - not just "you're not compliant" but exactly which aspects of the requirement your documentation doesn't address, so you know precisely what to fix.
Actionable Suggestions
Beyond identifying problems, the AI suggests specific remediation steps - what to implement, what to document, and how to strengthen your compliance posture for each control.
Confidence Scoring
Every determination comes with a confidence level (High, Medium, Low) so you know which assessments are solid and which might need human review. Full transparency, no black boxes.
POA&M Drafting
For applicable gaps, Dakeeko proposes a weakness description, remediation steps, milestones, and a target timeline. Users preview and approve the record before creation.
Frequently Asked Questions
How accurate is the AI assessment?
Output quality depends on the completeness and accuracy of the submitted notes and evidence. Treat every result as a preliminary suggestion, review its rationale, and make final determinations with qualified personnel or your assessor.
Is my compliance data sent to third parties?
Selected content is processed through Dakeeko's configured Azure AI service under the service's applicable data-handling terms. Do not submit CUI unless your agreement and configured environment explicitly permit it. Dakeeko does not use customer prompts or outputs to train a public model.
Can I re-run the assessment after making changes?
Yes - unlimited times. Run a full assessment, remediate the gaps, update your documentation, and re-run to verify improvement. You can also re-review individual controls for a deeper analysis. This iterative approach is how real compliance maturity works.
Does this replace a C3PAO assessment?
No. The AI-assisted review is a pre-assessment readiness tool that helps organize possible gaps before an official assessment. A C3PAO makes its own determinations, and using Dakeeko does not guarantee certification or a particular assessment outcome.
Do I need to document every control before running it?
No. The AI assesses whichever controls have documentation. You can document a few controls and run a partial assessment, or document all 110 and run a full assessment. Start wherever you are - the AI meets you there.
Is the Keeko AI included?
Yes - fully included with unlimited assessments. No per-run fees, no token limits, no upsells. Every Dakeeko subscription includes the complete AI assessment engine.
Ready to See Where You Stand?
Add your compliance documentation, connect supported Microsoft evidence, and start organizing your readiness workflow.
White Label Dakeeko
Under Your Brand
Offer your clients a fully branded CMMC compliance platform - your logo, your colors, your domain. Powered by Dakeeko's AI assessment engine and hosted on Azure Government Cloud. Small defense contractors can also use Dakeeko directly in company mode when they are running their own CMMC program.
Trusted by customers and partners
Consulting teams, service providers, and defense-industry organizations use Dakeeko to organize CMMC delivery across real client environments.
Built for Consultants, MSSPs, C3PAOs & Small Businesses
Run CMMC for clients, prepare organizations for formal assessment, or manage your own internal CMMC program as a small defense contractor.
Compliance Consultants
Offer a branded compliance portal to your clients. Manage assessments, documentation, and remediation across your entire client base from one dashboard.
Managed Service Providers
Add CMMC compliance as a service offering. Your clients see your brand - not ours. Increase contract value with a turnkey compliance solution.
RPOs & C3PAOs
Provide your assessed organizations a branded platform to track their compliance posture. Streamline pre-assessment workflows and evidence collection.
Small Defense Contractors
Run your own CMMC program in company mode with Microsoft 365 guidance, evidence mapping, and assessor-ready documentation in one workspace.
POLICY AUTOMATION FOR MSPS
Carry the review into your customer's tenant.
Use each client's existing Microsoft connection and baseline to prepare supported Intune changes. Confirm the exact tenant, review the change, approve it and retain the result in that client's workspace.
Customer administrator consent and approved Dakeeko access are required for each tenant. Partner access and rollout are confirmed separately; existing agreements are unchanged.
What's Included
Everything you need to run a branded compliance practice.
Custom logo, colors, and company name throughout the platform
compliance.yourcompany.com with managed SSL certificate
AI-assisted evidence review, objective findings, and POA&M drafts with human approval
Manage all client enclaves from a single partner view
Map Microsoft 365 evidence across commercial and GCC High client tenants
Azure Government hosting using applicable federally authorized cloud services
Partner Engagement
Partner pricing is shared during onboarding based on enclaves, delivery model, and support scope.
Ready to structure your partner package?
Schedule a Partner Call →Get Started in 3 Steps
Schedule a Partner Call
We'll walk through the platform, discuss your practice, and define branding, provisioning, support, and integration requirements. Timing depends on the selected partner configuration.
We Configure Your Portal
Send us your logo, brand colors, and custom domain. We'll set up your white-label instance with managed SSL - ready to show your clients.
Start Onboarding Clients
Add client workspaces, run AI assessments, and deliver compliance services under your brand as your customer list grows.
No commitment required. Let's see if it's a fit.
Microsoft 365 GCC High Licensing
Get help planning and ordering Microsoft 365 GCC High licensing for your organization. We can help you identify your licensing needs, prepare the information required for an order, and coordinate the next steps.
Plan Your Licensing
Review your estimated user count, required Microsoft services, environment, and expected timeline before placing an order.
Support Regulated Work
Discuss licensing needs for organizations working with federal information and preparing their Microsoft environment for CMMC requirements.
Get Ordering Assistance
Receive a clear next-step process for validating the request, confirming the appropriate licensing, and moving the order forward.
What to Have Ready
Company name and primary contact
Current and near-term seat count
Microsoft workloads you expect to use
When you need the environment available
Licensing availability, eligibility, product selection, and pricing are subject to the applicable requirements and final quote.
Contact Us
Have questions about a framework, a custom workspace, or your team's workflow? We're here to help you find the right fit.
Send Us a Message
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is the Department of War's framework for verifying that defense contractors protect Federal Contract Information and Controlled Unclassified Information. Here's what organizations need to know.
Current summary as of July 2026. Always confirm final requirements against the applicable solicitation, contract, and official CMMC program guidance.
The Basics
CMMC stands for Cybersecurity Maturity Model Certification. It is the U.S. Department of War (DoW) program for assessing whether companies in the defense supply chain have implemented applicable safeguards for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
CMMC adds standardized assessment levels, affirmation requirements, and contract enforcement to existing safeguarding obligations. Depending on the solicitation or contract, Level 2 may require either a self-assessment or an independent certification assessment by a C3PAO.
The CMMC program rule at 32 CFR Part 170 became effective December 16, 2024. The companion DFARS rule became effective November 10, 2025, beginning a four-phase implementation. Phase 1 runs through November 9, 2026 and focuses primarily on Level 1 and Level 2 self-assessment requirements, although certification requirements may appear in selected procurements.
Who Needs CMMC?
If your company processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) in performance of an applicable DoW contract, the solicitation or contract may require a specific CMMC level. This applies to:
Companies that contract directly with the DoW
Any tier in the supply chain that touches CUI or FCI
Managed service providers supporting defense contractors
Parts, materials, or engineering firms in the defense industrial base
The 3 CMMC Levels
Level 1 - Foundational
Self-Assessment • 15 Practices • FCI OnlyLevel 1 covers basic cyber hygiene for companies handling Federal Contract Information (FCI) only - not CUI. It requires 15 practices from FAR 52.204-21, things like using antivirus, limiting access, and basic password management. Assessment is a self-assessment, affirmed annually by a senior company official.
Level 2 - Advanced
Self or C3PAO Assessment • 110 Requirements • CUILevel 2 requires implementation of all 110 requirements from NIST SP 800-171 Rev. 2, covering 14 requirement families. The solicitation or contract specifies whether Level 2 requires a self-assessment or a certification assessment by a C3PAO. CMMC status is generally valid for three years, subject to annual affirmation and other program conditions.
Do not infer the assessment type from the organization or data alone; confirm the requirement stated in the applicable solicitation or contract.
Level 3 - Expert
Government-Led • NIST 800-172 • APT DefenseLevel 3 is for selected organizations supporting the most sensitive DoW programs. It adds requirements selected from NIST SP 800-172, focused on protection against Advanced Persistent Threats (APTs). Assessment is performed by DCMA DIBCAC rather than a C3PAO.
Key Terms You'll Hear
CUI - Controlled Unclassified Information
Sensitive government information that isn't classified but still requires safeguarding. Think technical drawings, test data, personnel info, export-controlled data. CUI is defined by the National Archives (ISOO) and marked in contracts.
FCI - Federal Contract Information
Information provided by or generated for the government under a contract, not intended for public release. FCI has fewer protection requirements than CUI (Level 1 vs Level 2).
C3PAO - Certified Third-Party Assessor Organization
The independent organizations authorized by the CMMC Accreditation Body (Cyber AB) to conduct Level 2 assessments. They send certified assessors to evaluate your implementation of the 110 controls.
SSP - System Security Plan
Your master document describing how your organization meets each of the 110 NIST 800-171 controls. This is the first thing an assessor reviews. A strong SSP is the single most important CMMC artifact.
POA&M - Plan of Action and Milestones
A document listing controls you haven't fully met yet, along with your plan and timeline to fix them. Under CMMC, limited POA&Ms are allowed - but NOT MET controls with high point values may be disqualifying.
SPRS Score
Your Supplier Performance Risk System score, ranging from -203 to 110 points. Calculated based on which of the 110 controls you've implemented (each has a 1, 3, or 5 point value). You're already required to submit this score today under DFARS 7019/7020.
NIST SP 800-171
The National Institute of Standards and Technology publication that defines the 110 security controls for protecting CUI in non-federal systems. CMMC Level 2 is a direct implementation verification of 800-171 Rev 2.
Scoping - CUI Boundary
The systems, people, and facilities that process, store, or transmit CUI. Defining your CUI boundary is one of the first and most critical steps - it determines what's in scope for your assessment.
The 14 Control Families
NIST 800-171's 110 controls are organized into 14 families. Here's what each one covers:
What a C3PAO Assessor Actually Looks For
A CMMC Level 2 assessment isn't a simple checkbox exercise. Assessors use the CMMC Assessment Guide which breaks each control into individual assessment objectives - 320 total across the 110 controls. For each objective, they look for three things:
Review documentation - policies, procedures, SSP, configurations, screenshots, and evidence artifacts.
Talk to personnel responsible for implementation to confirm they understand and follow the documented practices.
Verify the control is actually working as described - inspect live systems, check configurations, validate technical implementation.
Pro tip: The best way to prepare is to write your SSP as if the assessor is reading it. For each control, document what you do, how you do it, and what evidence proves it. If you can satisfy Examine + Interview + Test before the assessor arrives, you're in great shape.
CMMC Timeline
Streamlined from 5 levels to 3. Aligned Level 2 with NIST 800-171.
CMMC program codified in federal regulation. Defines assessment requirements.
CMMC program officially in effect. C3PAOs can begin conducting assessments.
The companion DFARS rule became effective and began the phased inclusion of CMMC requirements in applicable DoW procurements.
Implementation focuses primarily on Level 1 and Level 2 self-assessments. DoW may include Level 2 certification requirements in selected Phase 1 procurements.
Applicable solicitations increasingly require Level 2 certification assessments when that assessment type is specified by the program office or requiring activity.
Phase 3 adds Level 3 requirements where applicable. Full implementation begins November 10, 2028 for applicable solicitations and contracts involving FCI or CUI.
Common Misconceptions
Company size does not determine the requirement. The information handled, the systems used, and the applicable solicitation or contract determine the required CMMC level and assessment type.
Tools are important, but CMMC is about proving that you've implemented practices - policies, procedures, training, and evidence. You can have the best firewall in the world, but if you can't document how it's configured and why, it doesn't count.
The 32 CFR final rule is already in effect. C3PAOs are authorized and conducting assessments now. Even before CMMC appears in your contract, DFARS 7012/7019/7020 already require you to implement NIST 800-171 and report your SPRS score. Primes are also increasingly requiring it of their subs.
Your MSP might manage your infrastructure, but you are responsible for your CMMC certification. You need to understand your CUI boundary, document your security practices, and own the assessment process. Your MSP is a partner, not a substitute.
Most organizations need 6-18 months to go from starting their compliance journey to being assessment-ready, depending on their starting point. Dakeeko dramatically accelerates this, but implementing real security practices still takes focused effort.
Getting Started with CMMC
Identify what CUI you handle, where it flows, and which systems, people, and facilities are in scope. This is the foundation everything else builds on.
Evaluate your current security posture against NIST 800-171's 110 controls. Dakeeko's AI assessor can do this in minutes instead of weeks.
Implement missing controls, create policies and procedures, and build your SSP. Create POA&Ms for anything you can't fix immediately.
Gather screenshots, configuration exports, policy documents, training records, and other artifacts that prove each control is implemented.
Submit required assessment results in SPRS, complete the required affirmation, and engage a C3PAO when the contract requires a Level 2 certification assessment.
Ready to Start Your CMMC Journey?
Dakeeko makes CMMC compliance achievable for organizations of any size. Start with guided controls, Microsoft evidence mapping, and Policy Drift Findings in one workspace.