CMMC Compliance Services for Defense Suppliers

No, and no MSP can. Level 2 certification comes only from an assessment by an authorized C3PAO (CMMC Third-⁠Party Assessment Organization), and Level 3 assessments are government-⁠led. Our role is everything before and after that visit: scoping, gap assessment against NIST 800-⁠171, remediation, documentation, and the managed security that keeps you assessment-⁠ready. The separation between preparers and assessors is deliberate — be wary of anyone who blurs it.

Yes. On-⁠site support is included within 175 driving miles of our Newport Beach headquarters, which covers Orange County, Los Angeles and the South Bay, San Diego and North County, the Inland Empire and the high desert. Most CMMC preparation happens remotely: scoping, the gap assessment against NIST SP 800-⁠171, remediation and documentation. We come on-⁠site for the work that needs hands on your hardware and premises, such as network segmentation, workstation builds and physical-⁠protection controls. The price is the same everywhere: CMMC work starts on Secure IT, at the published Secure IT rate plus the published 25% CMMC uplift.

The data decides. Federal contract information (FCI) generally means Level 1 — 15 basic safeguarding requirements with an annual self-⁠assessment and executive affirmation. Controlled unclassified information (CUI) generally means Level 2 — the 110 requirements of NIST SP 800-⁠171 Revision 2 (the version CMMC uses), with C3PAO assessment for most contracts (that third-⁠party phase-⁠in is suspended pending the program review) and self-⁠assessment allowed for a smaller set. Level 3 adds 24 requirements from NIST SP 800-⁠172 with government-⁠led assessment, for the most sensitive programs. Your solicitation states the required level.

For most small suppliers, the honest answer is quarters, not weeks. The 110 requirements include policy, documentation, and evidence work as well as technical fixes — and while the November 2026 third-⁠party phase-⁠in was suspended in July 2026, the underlying NIST 800-⁠171 obligation under DFARS 252.204-⁠7012 never paused. Starting after a solicitation names CMMC is usually starting late.

It depends almost entirely on scope — which is why scoping comes first. Many suppliers save real money with an enclave strategy: concentrating CUI into a contained, hardened environment so the 110 controls apply to one enclave instead of the whole company. The managed-⁠security base is Secure IT at $250 per user per month, and CMMC/DFARS work carries a published +25% uplift on the per-⁠user plan and per-⁠server management — $312.50 per user. That covers the customer responsibility matrix, input for your system security plan and POA&M, the evidence for the controls we run, and assessment preparation.

Time with your assessor is quoted project work. The one-⁠time 800-⁠171 gap assessment and remediation projects are quoted in writing after the initial gap read.

The System Security Plan is the document that explains how your environment meets each of the 110 requirements — it is the artifact your assessor works from, alongside a plan of action for open items (POA&M) and your SPRS score. That score carries a senior official’s affirmation, which is a legal statement the Department of Justice enforces under the False Claims Act. We keep our part of all three accurate: the responsibility matrix, our control descriptions and the tracking of fixes. Your firm owns the plan, the POA&M and the score.

If FCI or CUI flows down to you, yes. Primes are required to flow CMMC requirements to subcontractors, and many are already asking for SPRS scores and remediation plans ahead of contract deadlines because their own awards depend on the answers. A machine shop with one drawing of CUI on a shared drive is in scope.

Short answer: no. Under DFARS 252.204-⁠7012, a cloud that stores, processes or transmits CUI must be FedRAMP Moderate authorized, or validated as FedRAMP Moderate equivalent by a third-⁠party assessor. CRC Cloud’s private cloud is neither. Datacenter credentials like SOC 2 and ISO 27001 are facility facts. They do not satisfy that rule, and a provider who implies otherwise is setting you up to fail. CUI belongs in an environment built for it, such as Microsoft 365 GCC High.

We help you prepare and secure that environment as an outside service provider that handles security data, never CUI, with our access limited as your service order records. We track every gap until it is closed, quote the fixes in writing, and organize the evidence. The goal is that the assessment becomes a confirmation rather than a discovery exercise — but it is an independent judgment, and we will never call it a formality.

If the assessor still flags something, fixing it is quoted project work, and so is our time with the assessor. Our private cloud is the right home for everything that never touches CUI. Splitting the two is usually the cheapest way to shrink your scope.

Only a few — far fewer than most suppliers assume, and the rule is specific. Under 32 CFR 170.21, a plan of action and milestones is not permitted at all for a Level 1 self-⁠assessment. At Level 2 you may only carry one if your assessment score is at least 0.8 of the total — a score of 88 out of 110 — and nothing on the plan is worth more than 1 point under the CMMC scoring methodology. Since 3-⁠point and 5-⁠point requirements make up most of the hard ones, they must be genuinely met before the assessor scores them.

There is one narrow exception: CUI encryption (SC.L2-3.13.11) may go on the plan if you are encrypting but not yet with a FIPS-⁠validated module. Six requirements are barred outright — external connections, control of public information, escorting visitors, physical access logs and managing physical access (each worth 1 point), and the System Security Plan itself, which has no point value because without one the assessment cannot be completed. And a plan only earns you Conditional status: a closeout assessment must confirm the items are closed within 180 days of the conditional status date, or that status expires.

For a certification assessment the closeout must be done by an authorized C3PAO. In practice this means the plan is for the last few loose ends, not a way to defer the work.

Yes, and you should expect that of any provider worth hiring. Under 32 CFR 170, an external service provider is in scope when controlled unclassified information or security protection data is processed, stored or transmitted on its systems. Security protection data is the second trigger people miss — the logs, alerts, vulnerability findings, backup metadata and identity records that our monitoring and management tools hold. That means we are usually in scope even on engagements where no CUI ever reaches us.

The rule requires our relationship and the services we provide to be described in your System Security Plan, and it requires us to give you a customer responsibility matrix: a line-⁠by-⁠line statement of which of the 110 requirements we implement, which you implement, and which are shared and how. We give you that matrix and a description of our services, keep both current as the environment changes, and cooperate with your assessment; time with your assessor is project work. If a provider cannot give you one, they are not ready to support a CMMC assessment.