CMMC Consultant for Level 2 Readiness

What CMMC Level 2 actually requires

Level 2 aligns to NIST SP 800-171 - 110 security requirements across 14 families including access control, audit and accountability, configuration management, identification and authentication, and incident response. Readiness means every one of them is implemented, documented, and evidenced in a way someone outside your company can verify. Scoring is the part most contractors underestimate. Each requirement carries a weight of 1, 3, or 5 points against a maximum of 110, and a conditional Level 2 status requires a score of at least 88. Anything still open goes on a Plan of Action and Milestones that has to be closed and re-verified within 180 days, and a handful of requirements cannot be deferred to a POA&M at all. That scoring math is why an honest gap assessment early is worth more than an optimistic one.

What counts as CUI in your environment

Controlled Unclassified Information is government information that requires safeguarding under law, regulation, or government-wide policy but is not classified. In a contractor's environment it is rarely labeled and almost never confined to one place. It arrives as a drawing attached to a purchase order, a specification in a prime's supplier portal, a technical data package on an engineer's laptop, or a quality report emailed to a program manager. Before anything else is worth doing, you need to know where CUI enters your business, where it comes to rest, how it moves between systems and people, and where it leaves. In our experience that mapping exercise changes the shape of a project more than any technical finding, because it is what determines how much of your company the assessment actually touches.

How your assessment boundary gets drawn

Once you know where CUI lives, every asset in your environment falls into one of five categories defined by the DoD's Level 2 scoping guidance. The category decides how much of the standard that asset has to carry. Getting an asset into the right category is legitimate scoping, not avoidance, and it is the conversation that decides more about the budget than any other.

• ✓CUI Assets: systems that process, store, or transmit CUI. These carry all 110 requirements.
• ✓Security Protection Assets: the tools that protect the environment, such as SIEM, EDR, and identity, assessed against the requirements relevant to what they do.
• ✓Contractor Risk Managed Assets: systems that could access CUI but are not intended to, managed under your documented risk policy.
• ✓Specialized Assets: operational technology, test equipment, and government furnished equipment, handled with a limited assessment and documented in the SSP.
• ✓Out-of-Scope Assets: systems physically or logically separated from CUI, carrying none of the requirements.

Why an enclave is usually cheaper than putting the whole company in scope

The default approach is to treat the entire company network as the assessment boundary. For most small and mid-size contractors that is the most expensive option available. An enclave takes the opposite approach: a deliberately small, segmented environment where CUI is allowed to exist, with everything else separated from it and out of scope. For a manufacturer where a handful of engineers touch technical data packages, that can be the difference between putting a dozen systems under the full weight of the standard and putting the entire company there. Enclaving is not free. It takes real network segmentation, disciplined data handling, and a workforce that understands which system a given file belongs on. But it is almost always cheaper than pulling accounting, sales, and the production floor into a 110-control program they never needed to be in.

What a CMMC readiness engagement actually looks like

We run readiness as a program with a deadline, in four phases. The ranges below assume a contractor with an existing IT environment and a team that can give the project real attention; they move with scope and starting maturity.

• ✓Scoping and readiness assessment (2 to 6 weeks): a CUI data flow map, an asset inventory categorized against the scoping guidance, and a control-by-control assessment of all 110 requirements with your current SPRS score.
• ✓Remediation (2 to 6 months): the hands-on technical and administrative work to close gaps across identity and MFA, segmentation, logging, encryption, backup, and access review.
• ✓Documentation (runs alongside remediation): a System Security Plan describing your environment as it actually is, the supporting policies and procedures, and a POA&M for anything still open.
• ✓Pre-assessment verification (2 to 4 weeks): evidence organized against each requirement, plus a mock assessment that tests whether someone outside your company can follow the story.

What drives the cost of a CMMC consultant

We do not publish a price, because two contractors with the same headcount can differ by a wide margin. Four things move the number. Scope is the largest: how many systems end up inside the boundary, and whether you enclave. Starting maturity is second, and a company already running managed identity, MFA, central logging, and supported hardware is closing gaps, while a company with shared production-floor accounts, unmanaged switches, and an unsupported machine controller is rebuilding. Third is how much of the remediation your team absorbs internally versus hands to us. Fourth is documentation debt, because writing an SSP against an environment nobody has ever documented takes far longer than updating one that exists. Expect readiness to run in months rather than weeks, and be skeptical of anyone who quotes a fixed price before seeing where your CUI lives.

What a CMMC consultant cannot do for you

The formal Level 2 certification assessment is performed by an independent CMMC Third Party Assessment Organization (C3PAO), and the rules deliberately prevent the firm that prepared you from also assessing you. That separation is the point: an assessor who helped write your SSP cannot objectively judge it. We do the preparation work, meaning scoping, assessment, remediation, documentation, and the monitoring controls the standard requires, and we do not perform certification assessments. Be careful with any provider whose marketing blurs that line, or who implies a relationship that guarantees a result. Nobody can guarantee the outcome of an independent assessment, and a consultant who suggests otherwise is telling you something useful about how the rest of the engagement will go.

Where the CMMC program stands right now

In July 2026 the Department of Defense suspended CMMC Phase 2, pausing the requirement for third-party certification assessments on applicable Level 2 contracts, along with Phase 3, while a reform task force reviews the program's cost and capacity burden on smaller suppliers. What did not change is the part that carries legal exposure. DFARS 252.204-7012 still requires you to safeguard covered defense information and report cyber incidents within 72 hours. NIST SP 800-171 still applies in full. Phase 1 self-assessments, your posted SPRS score, and the annual affirmation that goes with it remain in force, and an inaccurate score is a False Claims Act problem rather than a paperwork problem. Our read is that the reprieve is a reason to do the scoping and remediation properly, not a reason to stop, because the underlying obligations never went away.