CMMC consultants and service providers

Start with the work and data, then choose a provider

A startup selling to the defense sector does not need to buy every CMMC service at once. Begin with the work you are pursuing, the information your team receives or creates, and the language in the solicitation, contract, or subcontract. Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) affect the security requirements you need to evaluate. If you are unsure what information is in scope, resolving that question is a better first engagement than scheduling a certification assessment.

1. Identify the requirement. Read the relevant contract clauses and ask the prime contractor or contracting contact to clarify ambiguous data-handling requirements. Do not assume every defense customer or contract calls for the same CMMC level.
2. Map where the information goes. Include email, file storage, engineering tools, laptops, cloud services, and outside partners that may process, store, or transmit the information. This map helps define an assessment boundary and the work a provider must price.
3. Check your present security work. Gather existing self-assessment results, policies, system descriptions, and open remediation items. A consultant can help validate the scope and turn gaps into an implementation plan.
4. Buy the next needed service. Seek readiness or implementation help for unresolved gaps; seek an authorized assessment only when it is required and the environment is ready. Recheck current program guidance before committing to a date.

For technical scoping, the Department’s Level 2 scoping guide explains how assets in an assessment scope are treated. Use it alongside current program guidance and your actual contract requirements.

What type of provider do you need?

Readiness consultant or Registered Provider Organization (RPO)

Use this kind of help to determine scope, review current practices, identify gaps, and plan remediation. Ask for specific outputs: a documented boundary, prioritized findings, assigned work, and a clear account of what the consultant will and will not implement. RPO status identifies a role in the Cyber AB ecosystem; it does not authorize a firm to issue a CMMC certification.

Implementation or managed security provider

Use one when your team needs help configuring systems, operating security controls, collecting evidence, or maintaining them after an initial project. Ask who owns each control and what happens when the engagement ends. If a provider hosts or manages systems containing FCI or CUI, include its services in your data-flow and scope discussion.

CMMC Third-Party Assessment Organization (C3PAO)

An authorized C3PAO conducts an official CMMC Level 2 certification assessment. A readiness review or mock assessment is different. Confirm the organization’s current authorization in the Cyber AB Marketplace, and disclose any earlier advisory work so the assessment team can address independence. The Cyber AB says assessors who helped prepare an organization cannot assess that same organization.

A firm may advertise more than one kind of service. Ask which legal entity and team will perform each part of the work; do not infer assessment authority from a general “CMMC services” label. See the Cyber AB’s assessment roles.

Use the contract to identify the level and assessment path

The CMMC model ties security requirements to the information and systems used for the work: Level 1 addresses Federal Contract Information (FCI), while Level 2 addresses Controlled Unclassified Information (CUI). Level 2 can involve a self-assessment or a third-party assessment depending on the requirement; Level 3 is assessed by the DoD’s DIBCAC. With Phase II requirements suspended, do not infer a current certification deadline from an older rollout chart. The solicitation, contract, subcontract flow-downs, and current Department guidance determine what applies to your work.

This is a scoping aid, not a determination that a contract requires a particular level. Read the live DoW CMMC status and guidance, the applicable DFARS 204.7504 clause guidance, and the contract itself. See the CMMC rule at 32 CFR Part 170.

Compare quotes by scope, not by the headline price

CMMC work has no dependable flat price for every startup. Cost and schedule depend on the number and complexity of systems and locations in scope, where FCI or CUI flows, how much of the environment can inherit security from an eligible cloud service, the state of existing policies and evidence, the remediation backlog, and whether ongoing operations or an independent assessment are included. Ask providers to price those pieces separately and show the assumptions that could change the estimate.

Request the same written scope from each finalist. Use this checklist to make the bids comparable:

• Boundary: people, facilities, devices, networks, cloud services, business systems, and outside providers included or excluded.
• Starting point: existing assessments, policies, evidence, open findings, and technical work the provider assumes is already complete.
• Deliverables: gap analysis, system boundary or diagram, remediation plan, implementation tasks, evidence package, training, and continuing support.
• Assessment: self-assessment support, mock/readiness review, or official C3PAO assessment, with the organization and team responsible for each clearly named.
• Commercial terms: fixed fee or time and materials, milestone payments, exclusions, change-order rates, schedule dependencies, and who owns the resulting documentation and configurations.

If quotes differ substantially, ask each provider to explain its boundary and exclusions before assuming one is a better deal. A short paid scoping phase can be useful when the environment is not yet clear; get its output and decision point in writing.

Prepare a one-page brief before requesting quotes

A useful brief lets providers quote the same job. State the contract or opportunity, the apparent FCI or CUI involved, your proposed scope, the number of people and locations, major systems and cloud services, existing security documentation, and the decision you need to make next. Include a target date only if it comes from a real procurement or internal commitment.

Then ask each provider to separate discovery, readiness review, remediation, ongoing operations, and any official assessment in its proposal. A low quote for “CMMC readiness” may cover only a gap report; another may include implementation and evidence collection. Those are different purchases.

Questions to ask every finalist

1. Which deliverables will we receive, and can you show a redacted example?
2. Who defines the boundary, and how will you handle our cloud tools, remote staff, and subcontractors?
3. Which tasks will your team perform, and which remain with our employees or other vendors?
4. What assumptions drive the fee and schedule? What changes would increase either one?
5. Who will retain and maintain the documentation, evidence, and system configurations after the project?
6. If you also offer assessments, how will you avoid a conflict with work you did to prepare us?

Common purchasing mistakes

Booking an assessment before defining scope: the provider cannot give a dependable price or schedule if no one can identify where CUI lives. Start with a bounded discovery or scoping engagement.

Buying software as a substitute for implementation: a tool can support a security practice, but someone still has to configure it, operate it, and show how the organization meets the applicable requirement. Ask how a proposed product changes the work and who owns that work.

Comparing unlike quotes: request the same deliverables and boundary from each bidder, and ask for exclusions in writing. Separate a one-time readiness review from remediation and continuing managed services.

Relying on an old deadline or badge: program milestones and provider status can change. Check current Department guidance and the Cyber AB Marketplace at the point of purchase.

Common questions

Can a consultant certify my organization?

No. An official Level 2 certification assessment is performed by an authorized C3PAO. Consultants and RPOs can help with readiness and implementation.

Should we stop security work because Phase II is suspended?

No. Phase I self-assessment requirements remain in place, and applicable contract obligations to safeguard covered defense information continue. The sensible next step depends on your contracts, data, and existing security gaps.

Does this directory verify provider credentials?

No. Listings describe services using provider information and researched sources. Check the current credential in the Cyber AB Marketplace, confirm the proposed team’s role, and ask about independence before signing.

How much does CMMC compliance cost?

There is no single reliable price for every company. Scope, existing controls, remediation, cloud and provider dependencies, ongoing operations, and the required assessment route all affect cost. Compare proposals against the same boundary and deliverables.

For the broader path into defense procurement, see our guide to getting your first government contract.

Build a CMMC budget from your scope and actual quotes

A small environment with a defined information boundary and a distributed engineering business can need very different work. A national “average CMMC cost” is not a useful purchasing budget unless its assumptions match yours. Start by separating external cash costs from your team’s time.

How to use the workbook

1. Record the requirement, boundary and quote date. Set a common planning period in months.
2. Enter each one-time and recurring external cost. Use zero only when you have confirmed no cost; leave unknowns blank.
3. Estimate internal hours and an hourly planning rate separately. The workbook shows external spend, internal time value and their combined planning total.
4. Record the source and assumptions for each amount. Include exclusions or additional charges in the quote comparison.
5. Change the planning period to see the effect of recurring services. Update the inputs if the boundary or required assessment changes.

This is a planning worksheet with no vendor price benchmarks. It does not predict assessment outcomes or determine whether an assessment is required.