CMMC consulting: what CMMC consultants do and how to choose one

• Scoping: find where CUI enters, where it is stored and who touches it, and decide whether an enclave makes sense.
• Gap assessment: test the 110 requirements and their 320 objectives, and score the result the way DoD does.
• Documentation: the System Security Plan, the POA&M, the policies and procedures for each family.
• Remediation support: multi-factor authentication, logging, FIPS-validated encryption, the move to GCC High or an enclave, either done by the consultant or guided for your IT provider.
• The SPRS submission: a self-assessment you can defend. See how the SPRS score works.
• Mock assessment: a rehearsal of the real one, against the same objectives, before a C3PAO arrives.

Listing in the Cyber AB marketplace is not required to give CMMC advice, and it does not let a firm assess or certify anyone. What matters more is whether the people doing the work have run NIST SP 800-171 assessments before and can show you a sample SSP.

• Hourly advisory: flexible, hard to budget, and the documents are often left to you.
• Fixed-scope readiness: a defined set of deliverables, the gap assessment, SSP, POA&M and score, for a fee agreed after scoping.
• Cohort programs: several suppliers work through the same structured modules at once, with templates and workshops, which keeps the cost down for small companies.
• Ongoing compliance: the controls are watched and the evidence kept current between assessments, so the yearly affirmation is true when a senior official signs it.

What drives the price is the scope of the CUI, where email and files live, and how much is already written down. The cost lines are on what drives the cost of CMMC.

1. Who will do the work, and how many NIST SP 800-171 assessments have they completed?
2. Will we receive an SSP and POA&M we own, and can we see a redacted sample?
3. Do you score against all 320 objectives in NIST SP 800-171A, or only the 110 headings?
4. How do you decide between an enclave, GCC High and our current environment?
5. What is fixed in the fee, and what is billed separately?
6. Who does the technical fixes: you, our IT provider or us?
7. What happens after the assessment: who keeps the evidence current?

• A guarantee of certification. No consultant can promise the assessor’s result.
• “CMMC certified” as a claim about the consulting firm. Contractors reach a CMMC status through an assessment; a consulting firm is not certified to sell advice.
• A price before anyone has asked where your CUI is. Scope sets the work.
• Templates with your name pasted in. An SSP that does not describe your systems fails the first interview.
• GCC High for everyone. It suits many suppliers, but an enclave or a smaller boundary is sometimes cheaper.
• Consulting and assessing from the same firm. The conflict-of-interest rules forbid it.

The CMMC Level 2 Readiness Accelerator is an eight-week cohort program for small defense suppliers: scope and CUI discovery, identity and access, systems and security controls, data protection, policies, gap analysis, the SSP and POA&M workshops, and a final readiness review. For companies that want the work done for them, the CMMC packages are fixed fees, published on our pricing page.

AccuSights is not a C3PAO, is not affiliated with the Cyber AB or the Department of Defense, and does not certify or guarantee certification. We prepare you for your CMMC assessment; we do not conduct it. Third-party assessments are subject to DoD and Cyber AB rules as published, which may change.