We were the assessor.
Now we sit on your side of the table.
CyberAutopsy was founded by lead assessors and former CISOs from inside the Defense Industrial Base. We have read packets that should have passed and watched them fail because the contractor never met an assessor before audit day. That is the problem we built the firm to solve.
A $30M company. A two-week findings report.
In the spring of 2023, I (M. Okafor) was the lead assessor on a C3PAO engagement for a $30M defense manufacturer in the Mid-Atlantic. The CEO had built the company over two decades. The CIO had a degree in mechanical engineering and a side-of-desk security function. They had bought a CMMC “readiness platform” for $80,000 the year before.
They failed in week two of the assessment. Not because their security was bad — it was fine — but because their evidence was unreadable. The SSP was generated from a tool. The artifacts were tagged by IT system, not by control. The CIO had to translate every question into a screenshot search. The audit window expired before we got through the Access Control family.
The contracting officer pulled the award two months later. The CEO laid off 40 people. The IT director quit. The company is still trading, but as a sub on smaller awards. It did not need to happen.
I left assessment six weeks after that engagement. CyberAutopsy is the firm I wished had been sitting next to that CEO. We build the packet the way the assessor reads it, we run the engagement the way the assessor runs the engagement, and we tell the truth about what is missing the day we walk in.
“Good companies do not fail CMMC because they have bad security. They fail because they have unreadable evidence. We fix the evidence.”
— M. Okafor, Founder & Managing Partner
No juniors. No subcontracted judgment.
Every engagement is signed by a partner. The person you meet on the triage call is the person who reads the Assessment Packet on the last day.
60+ C3PAO assessments led across primes and subcontractors. Prior to assessment, 12 years inside DCMA and DCSA. CISSP, CCP, CCA.
Built and operated the CUI enclave for a $1.2B program of record. 18 years in defense IT, focused on cryptographic boundaries and identity.
Ten years as a DCMA Industrial Security Specialist. Trained on NIST 800-171 from inside the government inspection regime.
40+ C3PAO engagements sat from the assessor side. Now runs our Audit Escort engagements where firms need someone in the room.
Where we’ve said it out loud.
- Mar 2026Federal News NetworkWhy most CMMC POA&Ms are written wrong
- Jan 2026NDIA Cyber SymposiumPanelist: Subcontractor flow-down in the new DFARS clauses
- Oct 2025Defense OneOp-ed: The contractor pipeline cannot survive a soft enforcement year
- Aug 2025AFCEA TechNet CyberTabletop: An Audit Escort engagement, narrated
We are hiring surgeons.
If you have led a C3PAO assessment, sat on the DoD assessment side, or held a CISO seat at a contractor under DFARS clauses, we want to talk. Compensation is partner-grade, travel is real, and engagements are signed by you.
careers@cyberautopsy.com →