Graydots International Concepts LLC embeds inside your Salesforce org, your Azure tenant, and your workflows, and doesn't leave until outcomes are measurable.
Graydots International Concepts LLC is an Atlanta area technology consulting firm specializing in CRM strategy, AI powered automation, and enterprise cloud solutions. We are led by a practitioner with more than a decade in enterprise IT and a grounding in Information Systems research.
Our methodology is evidence-based. Every engagement is grounded in Information Systems research frameworks (TAM, UTAUT, and change management theory), ensuring technology decisions translate into measurable adoption, not just deployment.
Headquartered in Smyrna, Georgia, we serve government agencies, mid market enterprises, and mission driven organizations across commercial and public sectors.
We embed where your team works: inside your Salesforce org, your Azure tenant, and your workflows. We don't leave until outcomes are measurable.
Every engagement is backed by active certifications from the platforms that power enterprise and government technology today.
Graydots understands the procurement landscape. We're fully registered, compliant, and positioned as a minority-owned vendor. That makes us an ideal partner for agencies with supplier diversity mandates.
Whether you're implementing Salesforce, automating workflows with AI, modernizing on Azure, or exploring a government contracting partnership, we'd love to hear from you.
A comprehensive overview of Graydots International Concepts LLC's cybersecurity posture, CMMC 2.0 compliance journey, and readiness framework for DoD and federal government contracting.
Graydots International Concepts LLC is a Smyrna, Georgia-based IT and CRM consulting firm pursuing federal and DoD contracts through SAM.gov registration (CAGE Code 10KT0), NAICS 541511 alignment, Team Georgia Marketplace supplier registration, and preparation for SBA 8(a) certification. Graydots has completed its CMMC Level 1 self-assessment and submitted its affirmation in SPRS.
This white paper serves three purposes: (1) to document Graydots' current cybersecurity posture and policies transparently, (2) to demonstrate our understanding of CMMC 2.0 requirements as both a contracting entity and an advisor, and (3) to position Graydots as a credible CMMC readiness partner for organizations pursuing government IT contracts.
Cybersecurity readiness is not a checkbox exercise. It is a living operational discipline. For any company pursuing DoD contracts, failure to meet the CMMC level a contract specifies can make it ineligible for award.
Key Takeaway: CMMC requirements began appearing in DoD solicitations and contracts on November 10, 2025 (Phase 1). Any company in the Defense Industrial Base, including IT consultants, MSPs, and cloud solution partners, must meet the CMMC level its contracts specify or risk ineligibility.
Program Status Update, November 2026: On July 13, 2026, the Department of War (DoD) CIO paused the Phase 2 rollout that would have made third-party C3PAO assessments the default for Level 2 contracts starting November 10, 2026, pending a CMMC Reform Task Force review. As of this update no new Phase 2 date has been announced. During the pause, contracts may designate only Level 1 (Self) or Level 2 (Self). The CMMC program rule (32 CFR Part 170), DFARS 252.204-7021, DFARS 252.204-7012, and NIST SP 800-171 obligations remain in force, and prime contractors may still require certification from their suppliers.
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's framework for ensuring contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
practices · FCI protection · Annual self-attestation by company leadership · Based on FAR 52.204-21
practices · NIST 800-171 Rev 2 · 14 control families · Self-assessment or C3PAO assessment, as the contract specifies
Level 2 practices plus 24 selected NIST 800-172 requirements · Government-led DIBCAC assessment · Highest CUI sensitivity programs
Critical Insight: CMMC is not a checkbox. It is a living, maturing program. False attestations carry criminal liability under the False Claims Act. The era of unchecked self-attestation without documentation is over.
Graydots maintains a documented, operationally active cybersecurity posture. The following elements are currently implemented and maintained as living policies, not aspirational documents.
CUI is sensitive but unclassified government information requiring safeguarding per law, regulation, or government-wide policy. It moves through everyday channels such as email, shared drives, and collaboration platforms, which makes disciplined handling essential.
Access control is one of the 14 NIST 800-171 control families and is foundational to CMMC at every level. Our policy follows least-privilege principles and is actively maintained.
Flow-Down Policy: All third-party subcontractors and vendors who access our systems or client data are subject to the same access control standards. This flow-down requirement is documented in all vendor agreements.
Graydots maintains a documented, plain-language Incident Response Plan (IRP). The Founder & CEO is the primary Incident Response Owner. The five-phase response cycle:
Compliance Note: This IRP complies with US data breach notification requirements and DFARS 252.204-7012, which requires cyber incident reporting to the DoD within 72 hours via the DIBNet portal.
| Framework | Relevance | Status |
|---|---|---|
| NIST CSF | Foundational risk management: Identify, Protect, Detect, Respond, Recover | Active |
| NIST 800-171 Rev 2 | 110 requirements, 14 control families; the CMMC Level 2 foundation | In Progress |
| DFARS 7012 | DoD clause for cyber incident reporting and CUI protection | Active |
| CMMC 2.0 Level 1 | 17 practices, FCI protection, annual self-assessment & affirmation | Affirmed in SPRS |
| CMMC 2.0 Level 2 | 110 practices, CUI protection, self or C3PAO assessment per contract | Readiness Underway |
| SOC 2 | Trust service criteria for enterprise client assurance | Roadmap |
| FedRAMP | Cloud service authorization awareness for Level 2 readiness | Awareness Active |
As an AI and automation consulting firm deploying Salesforce Agentforce and Azure OpenAI, Graydots applies formal responsible use policies to all AI deployments, both internally and in client engagements.
Why This Matters: Emerging DoD guidance is beginning to address AI use in government contracting. Proactively establishing AI governance positions Graydots ahead of anticipated regulatory requirements.
Graydots offers CMMC readiness advisory services grounded in the Georgia MEP / GT Apex Accelerator CMMC training program framework, adapted for small businesses under 10 employees pursuing Level 1 self-attestation or Level 2 C3PAO assessment.
Reference Program: Our advisory methodology is informed by the Georgia MEP / GT APEX Accelerator CMMC training program. When third-party assessment is required, we refer clients to the APEX Accelerator network, CMMC Registered Practitioners, and authorized C3PAOs listed on the Cyber AB Marketplace.
Based on the Georgia MEP / GT Apex Accelerator 30–60 day foundational program for small businesses under 10 employees. Complete these steps in order to establish a defensible CMMC posture.
Level 1 requires a self-assessment and an annual affirmation by a senior company official, submitted in SPRS, that all 17 practices from FAR 52.204-21 are implemented. Graydots status: all 17 practices met; affirmation submitted in SPRS.
| # | Practice Area | Domain | Status |
|---|---|---|---|
| 1 | Limit information system access to authorized users | Access Control | ✅ |
| 2 | Limit access to types of transactions authorized users are permitted to execute | Access Control | ✅ |
| 3 | Verify and control/limit connections to external systems | Access Control | ✅ |
| 4 | Control CUI posted or processed on publicly accessible systems | Access Control | ✅ |
| 5 | Identify information system users, processes, and devices | Identification & Auth | ✅ |
| 6 | Authenticate users, processes, or devices before allowing access | Identification & Auth | ✅ |
| 7 | Sanitize or destroy information system media containing FCI before disposal/reuse | Media Protection | ✅ |
| 8 | Limit physical access to organizational systems to authorized individuals | Physical Protection | ✅ |
| 9 | Escort visitors and monitor visitor activity | Physical Protection | ✅ |
| 10 | Maintain audit logs of physical access | Physical Protection | ✅ |
| 11 | Control and manage physical access devices | Physical Protection | ✅ |
| 12 | Monitor, control, and protect communications at external boundaries | System & Comm Protection | ✅ |
| 13 | Implement subnetworks for publicly accessible system components | System & Comm Protection | ✅ |
| 14 | Identify, report, and correct information system flaws | System & Info Integrity | ✅ |
| 15 | Provide protection from malicious code at appropriate locations | System & Info Integrity | ✅ |
| 16 | Update malicious code protection mechanisms | System & Info Integrity | ✅ |
| 17 | Perform periodic scans and real-time scans of files from external sources | System & Info Integrity | ✅ |
Download the complete CMMC 2.0 Compliance & Security Posture white paper, formatted for sharing with procurement officers, prime contractors, and government clients.