Regulated
Healthcare & DentalFinancial ServicesLaw FirmsAccounting & Tax FirmsGovernment & Defense ContractorsAI & Technology CompaniesArchitecture, Engineering & ConstructionEveryone else
Retail & Multi-Location StoresManufacturing & Machine ShopsReal Estate Brokerages & TitleNonprofits & AssociationsAuto Repair & Skilled TradesRestaurants, Hotels & HospitalityPrivate Schools & TutoringAgencies, Staffing & ConsultanciesFederal & defense · US Department of Defense (DoD)
Phase 1 self-assessments, DFARS 7012 and SPRS scores are in force today. Third-party certification is paused and out of contracts for now, not cancelled.
Rather skip the call? Get a fixed-fee CMMC 2.0 quote in writing.
AccuSights is not a C3PAO, is not affiliated with the Cyber AB or the Department of Defense, and does not certify or guarantee certification. We prepare you for your CMMC assessment; we do not conduct it. Third-party assessments are subject to DoD and Cyber AB rules as published, which may change.
Who it applies to
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Defense manufacturers, engineering and design firms, and IT and service suppliers of 10 to 300 people handling CUI
Suppliers who need a current, defensible SPRS score now and a clear path toward Level 2 later
Organizations within 90 days of a SOC 2 audit, an OCR inquiry or a C3PAO assessment, and any leadership team that wants to know before it counts
Readiness Re-Performance Commitment: if, within six months of a readiness report marking a control Ready, your C3PAO finds that control deficient, we re-perform the readiness work for it at no charge, on the conditions in Section 11 of the Terms of Service. Re-performance is the only remedy; it is not a refund.
What it asks for
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
CMMC in more detail: the certification path · what drives the cost · the 12-item checklist · rehearsing the C3PAO assessment
Where it starts
The certification requirement is out of contracts for now. The 110 controls, the SPRS score and the 72-hour report never left, and primes still ask for all three.
Phase 1 self-assessments have appeared in solicitations since 10 November 2025. Phase 2 third-party assessments were suspended on 13 July 2026, and the class deviation of 3 September 2026 removed the C3PAO requirement from contracts for now, with no end date and no repeal.
Most platforms give you a control list and an enclave to buy. We scope the CUI with you, score you honestly against NIST SP 800-171, write the system security plan and fix the gaps, so you are ready whenever assessments resume and credible with your prime now.
Trace the CUI: tick what is true for you
Your likely level: Level 1. Fifteen practices, a yearly self-assessment and an affirmation. No CUI means no Level 2.
The steps
The whole CMMC journey, short version. We handle every step with you.
Level 1 covers Federal Contract Information with 15 practices and a yearly self-assessment. Level 2 covers Controlled Unclassified Information with the 110 requirements of NIST SP 800-171. Your contract clauses and your prime tell you which applies.
Where CUI arrives, where it is stored, which machines read it and who can reach it. A small boundary is a small assessment; CUI spread across every laptop is the expensive version.
With AccuSights: we trace the CUI flow with you on the intake form and a call, and put the boundary in writing before anyone buys an enclave.
Each requirement met, not met or not applicable, using the DoD assessment methodology. The score starts at 110 and can fall to negative 203. An inflated score is a False Claims Act problem; an honest one is a plan.
With AccuSights: your engineer scores it the way an assessor would, so the number you post in SPRS is one you can defend.
MFA on CUI systems, FIPS-validated encryption, logging, access control, incident response, and the system security plan that describes how each requirement is met. The POA&M lists what is still open, with owners and dates.
With AccuSights: remediation is in-house or with your IT provider, and we write the SSP and the POA&M in assessor language.
The affirmation is yearly, and a senior official signs it. Controls that drift between affirmations are the risk: a new hire without MFA, a laptop outside the boundary, a log nobody reads.
Does it pay for itself
Most of a supplier's hours go into the SSP and the POA&M, which a platform tracks but does not write. Half is a fair starting guess for evidence; lower for the documents.
With AccuSights: our endpoint agent and monitoring watch the boundary around the clock and flag the drift to your engineer.
An assessor asks for evidence per objective, not per control. A mock assessment finds the objectives you thought were met and were not, while fixing them is still cheap.
With AccuSights: we run the mock assessment the way a C3PAO does, objective by objective, and hand you the findings list.
For now you self-assess, post the score in SPRS and affirm. When a contract requires certification again, an authorized C3PAO performs the assessment. We are not a C3PAO, and the same firm cannot prepare you and certify you.
Ten questions to ask before you sign
With AccuSights: we help you pick the C3PAO, schedule it, and sit with you through the evidence requests.
Level 2 certification lasts three years with an annual affirmation. The evidence that got you there has to keep existing, which is a calendar problem more than a technical one.
With AccuSights: the evidence keeps collecting itself, so the yearly affirmation is a review, not a scramble.
Why AccuSights
The platforms were built for companies with an IT department. Most machine shops have an IT provider and a very busy owner.
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
The 110 requirements map to NIST CSF, CIS Controls and the questionnaires your commercial customers send, so the same evidence answers all of them.
What it costs
The assessor fee is off the table for now. The readiness work is not. Here is what is published.
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
Service sheet, free to keep and share
The Phase 2 third-party assessment requirement is paused. Here is what still applies to you. Two pages, PDF, written for whoever runs the office.
By asking for the sheet you agree to the privacy policy. We may follow up once about it; reply stop and we will not write again.
Questions
Also in Federal & defense: NIST 800-171 · CJIS 6.0 · every framework by industry
Next step
Book the demo and see how one control set carries CMMC 2.0 and everything else you owe. Or leave your details and an engineer replies within one business day.