Is Lavawall® a CMMC C3PAO?

No. Lavawall® is the platform; ThreeShield is the audit firm. Level 2 assessments require an authorized C3PAO. Lavawall® generates the supporting evidence and documentation, but the certification decision belongs to the assessor.

Does Lavawall® cover NIST SP 800-171 independently?

Yes. NIST SP 800-171 is one of 15+ frameworks supported alongside CMMC 2.0, CPCSC, NIST CSF, CIS Controls, SOC 2, ISO 27001, PCI DSS, HIPAA, and the Canadian privacy regulations.

How is the System Security Plan generated?

Lavawall® generates a System Security Plan from the live control implementation evidence: what is configured, where, by whom, and on which devices and tenants.

Are FedRAMP or IL4 hosting options available?

Lavawall® hosts data in Canada (Calgary, Alberta). Organisations that require FedRAMP-Moderate or IL4 boundaries should contact support to discuss the available options.

Buyer's guide · CMMC 2.0

Best CMMC 2.0 software for MSPs

CMMC 2.0 readiness is now a hard requirement for MSPs serving US Department of Defense supply-chain clients. The best fit for a multi-tenant MSP is a platform that maps directly to NIST SP 800-171, collects continuous evidence from endpoints and cloud tenants, and generates the SSP and POA&M from that live evidence. On those criteria our top pick is Lavawall®.

Start your compliance wizard See the selection criteria

NIST SP 800-171 · CPCSC · multi-tenant · SSP & POA&M generation

CMMC 2.0 is the Department of Defense's contractor cybersecurity certification program. As of late 2025, organisations that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must demonstrate Level 1 (self-assessment) or Level 2 (third-party assessment) certification to keep their DoD contracts.

For Canadian MSPs, the parallel program is the Canadian Program for Cyber Security Certification (CPCSC), which uses the same NIST SP 800-171 control framework. That shared control base means a single evidence set can serve cross-border clients.

For an MSP, the practical challenge is scale. You are not certifying one company, you are collecting NIST SP 800-171 evidence across many client tenants and producing a defensible System Security Plan (SSP) and Plan of Action and Milestones (POA&M) for each of them, without paying enterprise-GRC prices per organisation.

See what Lavawall® does

Built and used internally by ThreeShield, an audit firm in Calgary. Built for MSPs and lean IT teams. Cross-platform patching, M365 / Entra / Azure / Google Workspace breach detection, 15+ compliance frameworks, kernel-free application control, smart helpdesk, multi-tenant remote support. One platform, native CAD billing.

Start the compliance wizard GRC & 15+ frameworks See pricing

What to look for

Seven criteria separate a real CMMC 2.0 platform for MSPs from a repackaged single-tenant GRC tool.

NIST SP 800-171 control mapping. Direct mapping to the 110 controls with continuous evidence collection, not generic claims or a one-time questionnaire.
CPCSC alignment. Explicit support for the Canadian program, which shares the NIST SP 800-171 control base, so cross-border clients are covered from one platform.
Multi-tenant capabilities. The ability to onboard many clients and deliver readiness as a repeatable service at scale.
Endpoint and cloud evidence. Data collected from Windows, macOS, Linux, and cloud platforms, where FCI and CUI actually live.
SSP and POA&M generation. Automated document production from live evidence rather than hand-maintained spreadsheets.
CUI handling discipline. Protection appropriate to Controlled Unclassified Information across the tools that touch it.
Audit-firm credibility. A platform built by an organisation with real assessment experience, not just a control checklist.

Options to evaluate

Five categories of tool show up in CMMC 2.0 buying processes for MSPs.

Lavawall®

Multi-tenant CMMC 2.0 / CPCSC platform for MSPs.

Maps to Level 1 and Level 2 frameworks with continuous evidence collection and co-branded document generation across every client tenant.

Best when: MSPs deliver compliance readiness as a service across multiple tenants, particularly Canadian and cross-border organisations.

Vanta or Drata

Single-tenant GRC with a CMMC module.

CMMC coverage added as an extension to a platform designed for one SaaS company, not MSP multi-client delivery.

Best when: an individual company is pursuing CMMC for its own contracts.

PreVeil

FIPS-validated CUI exchange.

A specialist encryption product focused on FIPS-validated Controlled Unclassified Information handling. It addresses one component of the broader framework.

Best when: a defence contractor needs secure CUI exchange as part of a wider compliance program.

Hyperproof / Tugboat Logic / Secureframe

Enterprise program management with CMMC templates.

Strong on policy structure, lighter on direct evidence collection from the endpoints and tenants themselves.

Best when: an organisation has a dedicated compliance team managing evidence separately.

Specialist consultancies + Excel

Manual, consultant-led approach.

Consultant support plus spreadsheet tracking. It works for a single engagement but does not become a repeatable service.

Best when: an MSP is handling a single compliance engagement rather than building a recurring offering.

How Lavawall® fits

Lavawall® treats CMMC 2.0 and CPCSC as first-class frameworks, both built on the NIST SP 800-171 control base. Level 1 and Level 2 controls map directly to the live evidence the platform already collects from Windows, macOS, Linux, and cloud tenants.

Continuous evidence collection means an assessor sees what is actually configured, where, by whom, and on which devices and tenants. The System Security Plan and the Plan of Action and Milestones are generated from that live state rather than typed into a template, so they stay current as the environment changes.

Multi-tenant by design lets one MSP run readiness for many DoD-supply-chain and cross-border clients from a single console, with per-client isolation, per-client billing, and co-branded documentation. ThreeShield, the Calgary audit firm that built Lavawall®, brings the assessment experience behind the control mapping.

Start your CMMC readiness →

Frequently asked

Is Lavawall® a CMMC C3PAO?: No. Lavawall® is the platform; ThreeShield is the audit firm. Level 2 assessments require an authorized C3PAO. Lavawall® generates the supporting evidence and documentation, but the certification decision belongs to the assessor.
Does Lavawall® cover NIST SP 800-171 independently?: Yes. NIST SP 800-171 is one of 15+ frameworks supported alongside CMMC 2.0, CPCSC, NIST CSF, CIS Controls, SOC 2, ISO 27001, PCI DSS, HIPAA, and the Canadian privacy regulations.
How is the System Security Plan generated?: Lavawall® generates a System Security Plan from the live control implementation evidence: what is configured, where, by whom, and on which devices and tenants.
Are FedRAMP or IL4 hosting options available?: Lavawall® hosts data in Canada (Calgary, Alberta). Organisations that require FedRAMP-Moderate or IL4 boundaries should contact support to discuss the available options.