CMMC 2.0 · Level 2
Simple CMMC gap readiness: from wherever you are to 110.
A fixed-scope package for defense suppliers who need a defensible SPRS score, an SSP a C3PAO will accept and a remediation path that fits a small company. No consulting army, no six-month discovery. Phase 2 is paused; primes and DFARS 7012 are not.
From $6,000
Published price. Larger scopes quoted in the call.
3 to 5 weeks
3 to 5 weeks to the delivered gap assessment, SSP and POA&M
8
named deliverables, listed below
Who it is for
Defense manufacturers, engineering and design firms, and IT and service suppliers of 10 to 300 people handling CUI
Practitioner-led with a compliant CUI enclave partner; we are a readiness partner, not a C3PAO, and we say so.
What you get
- CUI scoping and data-flow mapping: where CUI lives, moves and can be contained
- 110-control gap assessment against NIST SP 800-171 Rev 2 with objective-level findings
- System Security Plan (SSP) written to what a C3PAO expects
- Plan of Action and Milestones (POA&M) with only eligible items and dated closure
- Defensible SPRS score with the scoring worksheet behind it
- Policy gap closure across the required policy set
- Environment recommendation: Microsoft 365 Commercial, GCC, GCC High, or an encrypted CUI enclave that shrinks scope
- Remediation roadmap with cost projection and a readiness readout for leadership
Questions
Straight answers.
What does a CMMC gap assessment cost?
Ours starts at $6,000 for a small supplier with contained CUI; larger environments are scoped in the call. Published market ranges for gap assessments run from a few thousand dollars to well over $20,000, and full Level 2 programs from $30,000 upward. We keep the assessment simple so more of your budget goes to remediation.
Should we build an enclave?
If CUI touches only part of the business, an enclave usually cuts assessment scope and cost dramatically. The package includes the recommendation and, if you choose it, the enclave through our partner.
What still applies while CMMC Phase 2 is paused?
DFARS 252.204-7012 still requires the 110 NIST SP 800-171 requirements and a 72-hour incident report, DFARS 7019 and 7020 still require a current SPRS score, and Phase 1 self-assessments still appear in solicitations. The September 2026 class deviation only removes the C3PAO requirement from contracts for now.Source: DFARS Class Deviation 2026-O0025 Rev 3
Is AccuSights a C3PAO?
No. Only an authorized C3PAO can perform a CMMC Level 2 certification assessment, and the same firm cannot both prepare you and certify you. We do gap readiness: scope CUI, score you honestly against NIST SP 800-171, write the SSP and help fix the gaps, so you are ready whenever assessments resume.Source: DoD CIO CMMC FAQ
Start here