Three services.
One goal: your certification.

It depends on whether your contract involves Controlled Unclassified Information — things like technical drawings, specifications, or engineering data. Level 1 is self-attestation. Level 2 requires a formal third-party assessment. Not sure which applies? That's exactly what our first call covers.

6–18 months from kickoff, depending on your current IT environment and how much needs to change before the formal assessment. The earlier you start scoping, the more options you have.

The full journey — remediation plus assessment — typically runs $30,000–$300,000+ for Level 2, depending on company size and scope. See our full cost breakdown for details. The main cost driver is the number of systems in your assessment scope — an enclave strategy that isolates CUI to a defined set of systems can dramatically reduce both scope and cost. We help you understand the full picture before you commit to anything.

Good — that may help your readiness. But most IT vendors aren't qualified to perform CMMC assessments. That's a separate, accredited process. We help you navigate that specific requirement without replacing your existing team.

That's the most common starting point. We walk through your contract language and help you determine scope. Many companies assume they don't handle CUI — and they're wrong. Better to know now.

We're compensated by the assessment and remediation partners in our network — a referral model similar to how independent insurance brokers or mortgage advisors work. Our fee comes from the partner, not from you. This means we have no incentive to recommend a more expensive solution than you need, and no reason to expand your scope beyond what's necessary.

Starting November 2026, contracts with CMMC requirements will not be awarded to non-certified contractors. Existing contracts may not renew. Self-attesting compliance you don't actually have carries False Claims Act risk — one contractor recently paid $4.6M in penalties. The risk of inaction is typically higher than the cost of certification.

Almost certainly, yes. If your prime contractor flows down DFARS clauses to your subcontract, CMMC requirements apply to you. Many primes are already requiring CMMC certification from their subs — ahead of the formal mandate. If you handle CUI from your prime, you likely need Level 2.