CMMC 2.0 Compliance Services

Q: How much does CMMC compliance support cost?

Typical ranges:CMMC Level 1 self-assessment support: $3,000 to $7,500CMMC Level 2 gap assessment and SPRS score review: $10,000 to $30,00090-Day Evidence-Backed Self-Assessment Package and remediation: quoted by scopeFinal pricing depends on scope; we provide a fixed quote after a free scoping call.

CMMC 2.0 Compliance Readiness for Defense Contractors

CMMC 2.0 Phase 1 took effect November 10, 2025, and remains in force. DoD solicitations can require a CMMC Level 1 or Level 2 self-assessment, with your score posted in the Supplier Performance Risk System (SPRS) and an annual affirmation from a senior official. On July 13, 2026, DoD suspended Phase 2, the planned move to third-party (C3PAO) Level 2 assessments, while it reviews the program. No new Phase 2 date has been published, and DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply.

Cyber Security Services helps defense contractors at every tier, prime contractors and subcontractors alike, assess their posture against CMMC requirements, build the evidence behind their SPRS scores, implement required controls, and stay ready for third-party assessment when DoD sets a new timeline. A score you can back with evidence protects both your contracts and your affirmation.

Jul 13, 2026

Phase 2 suspended

DoD suspended CMMC Phase 2, the planned start of required third-party C3PAO assessments, and launched a review of the program. Phase 1 self-assessment requirements remain in effect. (DoD CIO memorandum, July 13, 2026)

15

Level 1 requirements

CMMC Level 1 covers Federal Contract Information (FCI) and requires an annual self-assessment against the 15 basic safeguarding requirements in FAR 52.204-21. (32 CFR Part 170)

110

NIST SP 800-171 requirements

CMMC Level 2 requires full implementation of all 110 security requirements across the 14 control families of NIST SP 800-171 Rev 2 to protect Controlled Unclassified Information (CUI). (32 CFR Part 170)

Understanding CMMC 2.0: Three Levels Explained

Level 1: Foundational (15 Requirements)

Applies to contractors handling Federal Contract Information (FCI) but not CUI. Requires an annual self-assessment and affirmation against the 15 basic safeguarding requirements in FAR 52.204-21. No third-party certification required.

Level 2: Advanced (110 Requirements)

Applies to contractors handling CUI. Requires full implementation of all 110 requirements from NIST SP 800-171 Rev 2 across 14 control families. While Phase 2 is suspended, DoD is using Level 2 self-assessments with SPRS scores and annual affirmations, and is removing Level 2 (C3PAO) requirements from active solicitations and existing contracts. Keep meeting any C3PAO requirement already in your contract until it is formally modified. Third-party certification remains part of the CMMC rule and could return after the review, on a timeline DoD has not published.

Level 3: Expert (110+ Requirements)

Applies to contractors on DoD’s highest-priority programs handling CUI. Requires Level 2 plus selected requirements from NIST SP 800-172, verified through government-led (DIBCAC) assessments. Level 3 requirements are suspended during the DoD review and are being removed from active solicitations.

CMMC 2.0 Implementation Status (October 2026)

Phase 1

(Since Nov 10, 2025)

In effect. Level 1 and Level 2 self-assessments can be required in new solicitations.

Phase 2

(Suspended July 13, 2026)

Suspended, under DoD review, no published date. Would require C3PAO assessments for Level 2.

Phase 3

(No published date)

Suspended, under DoD review, no published date.

Phase 4

(No published date)

Suspended, under DoD review, no published date.

The 14 NIST SP 800-171 Rev 2 Control Families

Access Control (AC): 22 requirements
Awareness and Training (AT): 3 requirements
Audit and Accountability (AU): 9 requirements
Configuration Management (CM): 9 requirements
Identification and Authentication (IA): 11 requirements
Incident Response (IR): 3 requirements
Maintenance (MA): 6 requirements

Media Protection (MP): 9 requirements
Personnel Security (PS): 2 requirements
Physical Protection (PE): 6 requirements
Risk Assessment (RA): 3 requirements
Security Assessment (CA): 4 requirements
System and Communications Protection (SC): 16 requirements
System and Information Integrity (SI): 7 requirements

Our CMMC 2.0 Services

90-Day Evidence-Backed Self-Assessment Package

Phase 2 is suspended. Your SPRS score and DFARS 252.204-7012 obligations are not. This package builds the evidence behind your self-assessment claims: an SPRS claim check, an evidence folder for MFA, backups, and encryption, a monthly readiness review, and a gap preview against NIST SP 800-171 Rev 3. Rev 3 is not the current CMMC Level 2 baseline. A readiness review does not certify anything and cannot predict when DoD will set a new Phase 2 date. Schedule Your Free CMMC Readiness Consultation.

CMMC Readiness Assessment & SPRS Score Calculation

We perform a comprehensive gap assessment against NIST SP 800-171, calculate your current SPRS (Supplier Performance Risk System) score, and provide the documentation needed for your self-assessment affirmation. We help you understand exactly where you stand before any government review.

System Security Plan (SSP) Development

CMMC requires a fully documented SSP describing how each of the 110 practices is implemented, your CUI boundary, and your Plans of Action & Milestones (POA&M) for any practices not yet fully implemented.

Remediation Implementation

Our engineers implement technical controls, including MFA, endpoint detection, audit logging, network segmentation, and encryption, to close gaps identified in the assessment. We work within your timeline and budget constraints.

C3PAO Preparation & Mock Assessment

When DoD sets a new Phase 2 date, we prepare you for your official C3PAO assessment with a mock assessment that simulates the real process, resolves remaining gaps, organizes your evidence packages, and trains your team on what to expect. Until then, a mock assessment is a practical way to test the evidence behind your SPRS score.

Protect Your DoD Contracts with CMMC 2.0 Readiness

Phase 1 self-assessment requirements are in effect. Make sure the evidence behind your SPRS score holds up.

Schedule Your Free CMMC Readiness Consultation

Get a Quote

Tell us what you need and a senior consultant will reply within one business day with next steps or a quote. Prefer to talk? Book a call.

Name

Work email

Company

Phone

What do you need?

Tell us a little about it

Frequently Asked Questions

Is CMMC Phase 2 suspended?

Yes. On July 13, 2026, DoD suspended Phase 2, which was scheduled to begin November 10, 2026 and would have required third-party (C3PAO) Level 2 assessments, and launched a review of the CMMC program. Phase 2 is suspended, not canceled, and no new date has been published. Phase 1 self-assessment requirements remain in effect.

Do I still need a SPRS score?

Yes. If you handle CUI, DFARS 252.204-7019 and 252.204-7020 still require a current NIST SP 800-171 self-assessment score in SPRS, and CMMC Phase 1 solicitations can require Level 1 or Level 2 self-assessments with annual affirmations. The suspension paused third-party assessments, not your obligation to protect CUI under DFARS 252.204-7012 or to report your score.

Should I prepare for NIST SP 800-171 Rev 3?

Plan for it, but build to Rev 2 today. NIST published SP 800-171 Rev 3 as final on May 14, 2024, but CMMC Level 2 and DFARS 252.204-7012 still use Rev 2 as the enforced baseline, and DoD’s July 2026 guidance keeps Rev 2 in force. A Rev 3 gap preview helps you budget for the eventual transition without changing what you are assessed against now.

What happens if we are not CMMC compliant when bidding on a contract?

Phase 1 is in effect, so DoD solicitations can include a CMMC Level 1 or Level 2 self-assessment requirement as a condition of award. If you have not posted a current self-assessment score in SPRS and completed the annual affirmation at the required level, you may be ineligible for award. A score you cannot support with evidence carries its own risk, because inaccurate affirmations can lead to False Claims Act liability.

Do subcontractors need to meet CMMC requirements?

Yes. The applicable CMMC assessment level flows down through the supply chain. While Phase 2 is suspended, that generally means a Level 1 or Level 2 self-assessment for any subcontractor that handles FCI or CUI. Prime contractors must confirm that their subcontractors meet the applicable level.

How long does CMMC Level 2 readiness take?

Organizations with some existing cybersecurity controls typically reach Level 2 readiness in 6 to 12 months. Organizations with minimal controls may need 12 to 18 months. The date that matters most right now is your next SPRS affirmation: your score should reflect controls you can prove with evidence, not controls you plan to implement.

How much does CMMC compliance support cost?

Typical ranges:

CMMC Level 1 self-assessment support: $3,000 to $7,500
CMMC Level 2 gap assessment and SPRS score review: $10,000 to $30,000
90-Day Evidence-Backed Self-Assessment Package and remediation: quoted by scope

Final pricing depends on scope; we provide a fixed quote after a free scoping call.

What is a C3PAO and how do we select one?

A C3PAO (Certified Third-Party Assessment Organization) is a company authorized by the Cyber AB, the CMMC accreditation body, to conduct official Level 2 certification assessments. The Cyber AB Marketplace lists all authorized C3PAOs. While Phase 2 is suspended, DoD is generally not requiring C3PAO assessments for new awards, but they remain part of the CMMC rule. We help you prepare the evidence and controls any C3PAO will expect.