An open invitation to every accredited 3PAO.
FORCE has completed a full internal self-audit. Our evidence package — across CMMC Level 2, FedRAMP Moderate, SOC 2 Type II, and ISO 27001:2022 — is OSCAL-formatted, hashed, and ready for assessment.
Rather than negotiate quietly with a single firm, we are inviting every accredited FedRAMP 3PAO and CMMC C3PAO to review the package and propose scope, timeline, and price. The fastest, most rigorous bid wins the engagement and the publicity that comes with it.
Every bid received also informs the FORCE 3PAO Recommendation Engine — winners and runners-up alike receive priority routing for future referrals from FORCE customers.
What you're being invited to assess
FORCE is operationally complete and self-audited against four control sets:
- • CMMC Level 2 (NIST SP 800-171)
- • FedRAMP Moderate (rev5 and 20x track baselines)
- • SOC 2 Type II (Trust Service Criteria)
- • ISO 27001:2022
Every framework has a complete OSCAL package. Every control has implementation evidence in the live evidence chain. Every finding from our internal self-audit is documented with a remediation plan. The diligence package contains all of the above, plus access to read the live evidence chain in real time.
Your job is to validate, not to discover. We have already done the discovery.
What's in the diligence package
- • OSCAL Profile, SSP, POA&M, Assessment Results (AR-input)
- • Cross-framework crosswalk: CMMC L2 · FedRAMP Moderate (rev5 + 20x) · SOC 2 Type II · ISO 27001:2022
- • Evidence chain manifest — every artifact SHA-256-hashed, S3 Object Lock-preserved, 7-year retention
- • Self-audit findings summary with severity counts and remediation cadence
- • Continuous monitoring posture (integrations, evidence cadence, control-family coverage)
Evaluation criteria
Speed of engagement
Days from kickoff to first assessor briefing. Lower is better.
Rigor of approach
Depth of test plans, evidence-pull strategy, control-family coverage. We'd rather pay more for a thorough assessment.
GovCloud experience
Prior engagements where the customer ran on AWS GovCloud. Material to FedRAMP and CMMC scoping.
Schedule capacity
When you can actually start, not when you'd like to. We'll publish your earliest available start date as part of the announcement.
How to participate
- Email partners@bigforgeone.com from your firm's accreditation-of-record domain.
- We respond with the diligence package — Tier 1 capability snapshot first, Tier 2 expanded artifacts after firm identity is verified.
- Submit your bid (scope, timeline, price, GovCloud experience, earliest start) within 30 days.
- We publish the shortlist and the winner's announcement on this page.
Privacy: this page is public, but bid submissions are confidential until the firm consents to publication.