Phase 2 paused July 13, 2026 — the self-assessment and SPRS score were not
Assessment-ready in 30 days. Flat fee. No $80k consultant.
Your prime flowed down DFARS 252.204-7012 and now wants your SPRS score and CMMC plan. We produce your System Security Plan, POA&M, policy library, and SPRS score package — built for machine shops, fabricators, and engineering firms with 5–50 people, not for the Fortune 500.
Veteran-owned. We've lived inside DoD bureaucracy — now we translate it.
Level 1 Package — $6,500
All 15 FAR 52.204-21 basic safeguarding requirements: self-assessment package, policies, and attestation support for FCI-only contractors.
Level 2 Readiness — $14,500
Full 110-control gap assessment, System Security Plan, policy library, POA&M, SPRS scoring, and the evidence checklist your C3PAO will ask for.
Maintenance — $450/mo
Quarterly evidence refresh, policy updates when DoD guidance shifts, SPRS re-scoring, and audit fire-drill prep when your assessment date approaches.
Start reading here
No email required for any of it.
The questions we get in week one
Whether it applies to a sub-tier supplier, Level 1 versus Level 2, what an SSP is, what a good SPRS score looks like, and what to do the day a flow-down letter lands.
Read →Guides by industry
Machine shops, aerospace parts, electronics assembly, engineering services — where CUI actually sits in your kind of operation, and which requirements give it the most trouble.
Read →CMMC in Florida, measured
Every Florida machine shop with a recent DoD award, and what they show the public. Of the ones with a website, exactly one mentions CMMC.
Read →Where the rules stand
Since November 10, 2025, new DoD solicitations can require a CMMC level, met by self-assessment. The planned November 10, 2026 move to third-party (C3PAO) certification for CUI contracts was suspended by DoD on July 13, 2026, pending a 60-day review. What did not pause: DFARS 252.204-7012, the NIST SP 800-171 self-assessment, and a score in SPRS with an annual affirmation. Preparation for a first-time Level 2 assessment still typically takes 6–12 months.
If CUI touches your shop and there is no score on file, your primes notice before you do, because they're reporting supply-chain readiness upward whether or not the third-party date returns. The good news: a small shop with a clean scope can get assessment-ready fast when someone who has done it before writes the documents.