CMMC Phase 2 begins November 10, 2026 — 87 days away
Assessment-ready in 30 days. Flat fee. No $80k consultant.
Your prime flowed down DFARS 252.204-7012 and now wants your SPRS score and CMMC plan. We produce your System Security Plan, POA&M, policy library, and SPRS score package — built for machine shops, fabricators, and engineering firms with 5–50 people, not for the Fortune 500.
Veteran-owned. We've lived inside DoD bureaucracy — now we translate it.
Level 1 Package — $6,500
All 17 FAR 52.204-21 basic safeguarding requirements: self-assessment package, policies, and attestation support for FCI-only contractors.
Level 2 Readiness — $14,500
Full 110-control gap assessment, System Security Plan, policy library, POA&M, SPRS scoring, and the evidence checklist your C3PAO will ask for.
Maintenance — $450/mo
Quarterly evidence refresh, policy updates when DoD guidance shifts, SPRS re-scoring, and audit fire-drill prep when your assessment date approaches.
Why the deadline matters
Since November 10, 2025, new DoD solicitations can require a CMMC level. From November 10, 2026, contracts involving Controlled Unclassified Information move to Phase 2: a third-party (C3PAO) certification requirement, not self-attestation. Preparation for a first-time Level 2 assessment typically takes 6–12 months.
If CUI touches your shop and you haven't started, you are already behind — and your primes know it before you do, because they're reporting supply-chain readiness upward. The good news: a small shop with a clean scope can get assessment-ready fast when someone who has done it before writes the documents.