Cmmckit
A white-label CMMC 2.0 Level 2 evidence kit that lets a solo security consultant run compliance for up to eight DoD-contractor clients from a single seat — auto-collected MFA evidence, OSCAL artifacts, and a one-click assessor packet.
A DoD supplier can't win the contract without a CMMC Level 2 certification, and the small ones can't get there alone — so they hire an independent security consultant. That consultant is now doing the same identity-control evidence work by hand, per client, in spreadsheets and screenshots, while every one of those clients is stuck in an 18-month line for one of the roughly 600 assessors who can certify them. The work is the bottleneck under the bottleneck, and nobody is arming the person doing it.
The independent security consultant (solo or 2-5 person shop) who already gets paid to take DoD contractors through CMMC — Cmmckit is the tool they bill against, not a new line item they have to justify.
Confirmed signal: CMMC 2.0 Phase 1 enforcement is active with long C3PAO wait times — named and current, not speculative.
An independent security consultant serving DoD contractors, priced and capacity-bounded (8 clients per seat) — specific enough to write the sales email to.
One cross-reference and the named SelfCMMC sibling, but zero independent graph connections — the bank has not echoed this consultant-channel angle, making it the weakest dimension.
A crisp, priced buyer (the independent security consultant) sits against a confirmed, active regulatory deadline and a genuinely unoccupied channel. The standout is the productive tension: roughly 600 assessors against tens of thousands of contractors is a hard supply bottleneck, and arming the consultant — the multiplier node — resolves scale-versus-scarcity in a way that neither more direct-to-contractor tools nor more assessors can.
Convergence is the weak dimension — one cross-reference and a named sibling, but no independent graph echo of the consultant-channel angle and no related evidence-automation APIs catalogued. The idea stands largely on its own reasoning rather than on convergence across the bank, which is exactly why it scores below the gem line.
Genesis doesn't invent in isolation — Cmmckit shares architecture with, or powers, these ideas.
Discussion
No comments yet — be the first to weigh in.