Mid-market DIB suppliers handling CUI

Build a CMMC Level 2 readiness brief on {{company}}.

Pull from public sources only:
1. DoD revenue exposure
   - Active prime + sub awards in the last 36 months (USAspending.gov).
   - Top customer primes; estimated annual DoD revenue.
   - Any classified or ITAR indicators (8(a), facility clearance, DDTC registration).

2. CUI footprint indicators
   - Job postings mentioning "CUI," "DFARS," "ITAR," "GCC High," "CMMC."
   - Press releases mentioning enclave migrations, CMMC roadmaps, or RPO engagements.

3. Buying committee on LinkedIn
   - CISO, IT Director, VP Engineering, Compliance Manager, Contracts/Program Director.
   - Tenure in role; any recent hires in the last 6 months.

4. SPRS / Cyber AB signals
   - Public mention of an SPRS score (rare but check).
   - Any C3PAO or RPO listed as a partner.
   - Whether {{company}} itself appears in the Cyber AB Marketplace.

5. Trigger surface
   - Recent contract awards.
   - Recent breach/incident disclosures (state AG portals, DataBreaches.net).
   - Funding, M&A, exec hires.

6. Recommended approach
   - Likely scope (small enclave vs whole-environment).
   - 3 specific control families where they're most likely to struggle (justify with sector context).

Return as markdown with section headers and source URLs.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Generate a list of 20 mid-market US defense suppliers (50–1,000 employees) that are likely 6–18 months away from a C3PAO assessment.

Inclusion signals (any 2+):
- Active DoD prime/sub award ≥$5M in last 24 months (USAspending.gov)
- Recent LinkedIn hires with "CMMC," "compliance," "GRC," or "CISO" in title
- Public mention of GCC High migration, CUI enclave, or "CMMC Level 2"
- NAICS in: 334511, 336411, 336413, 336992, 541330, 541380, 541512, 541713, 541714, 541715
- Headquartered in: {{state_or_region}}

Exclusion signals (any 1):
- Already C3PAO-certified (search "{company name} CMMC certified")
- Listed as a C3PAO themselves on cyberab.org/Marketplace
- Public parent that mandates a specific GRC tool

Return as a table:
| Company | UEI | Est. employees | DoD revenue (proxy) | Top prime | Recent compliance hire? | GCC High signal? | CISO / IT Dir LinkedIn | Recommended opening hook |

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Write a 3-touch outbound email sequence to {{first_name}}, {{title}} at {{company}}.

Context:
- {{company}} handles CUI under DFARS 252.204-7012 and has a {{prime_name}} subcontract.
- Trigger event: {{trigger_event}} (e.g. "hired a Director of Compliance in March," "RFI dropped requiring L2 by FY27").
- They likely have an SSP but it's stale.
- Sender: {{partner_name}} from {{partner_company}}.

Constraints:
- Touch 1: ≤120 words. Opens with the trigger. Frames the assessment as "score the controls the way DoD scores them — before your C3PAO does."
- Touch 2 (day 4): ≤90 words. Drop a specific control-family observation common in their sector (e.g. AC, AU, IR).
- Touch 3 (day 9): ≤50 words. Break-up.
- No "I hope this finds you well." No "circling back."
- CTA: {{affiliate_link}} — frame as a self-service readiness check, NOT a sales call.

Return as three labeled blocks with SUBJECT + BODY.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Draft a 4-step LinkedIn cadence to {{first_name}} ({{title}} at {{company}}).

1. Connection note (≤300 chars): reference a specific recent post they wrote OR their {{trigger_event}}. No pitch.
2. DM #1 (post-accept): observation about a sector-specific CMMC L2 pitfall + one open question.
3. DM #2 (day 5): a single hyperlink — {{affiliate_link}} — with the framing "if you want to score it yourself before the C3PAO clock starts."
4. DM #3 (day 12): one-line break-up that leaves the door open.

Voice: peer security/engineering leader. No buzzwords. No "synergies." Reference NIST 800-171 by section when relevant.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Build a 25-minute discovery script for {{first_name}} ({{title}} at {{company}}).

Sections:
1. Open (2 min): confirm time, restate the hypothesis ("you have an SSP, you're not confident in the score, and you have a C3PAO date forming"), get permission for 6 questions.
2. Six qualifying questions:
   - When did you last refresh your SSP, and who owns it now?
   - What's your current self-reported SPRS score, and how old is it?
   - Have you scoped your CUI environment yet — full org, enclave, or hybrid?
   - GCC High: not started / in progress / done / not pursuing?
   - Which control families do you suspect are weakest? (AC, AU, IR, CM, MA are common)
   - Have you booked a C3PAO yet — and if yes, when's the readiness deadline?
3. Bridge to product (3 min): map their answers to the self-service Level 2 assessment workflow.
4. Close: book a working session, OR send the {{affiliate_link}} for them to start themselves.

Include a branching note: if no CUI is actually present, route to Level 1.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

You are a senior CMMC RP (Registered Practitioner) responding to {{first_name}} ({{title}}, {{company}}).

They just said:

"{{objection}}"

Reply in 3–5 sentences. Rules:
- Acknowledge in their language first.
- Cite NIST SP 800-171 Rev. 2, 800-171A, DFARS 252.204-7012/-7019/-7021, or 32 CFR Part 170 by clause/section when relevant.
- Surface a specific assessment objective if the objection touches a control area.
- End with a forward-moving question, not a pitch.
- No defensive language. No "actually."

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.