The Phase II Suspension Is Not a Pause on Your Obligations
Many contractors read “CMMC suspended” as “nothing to do.” That’s a costly mistake:
- DFARS 252.204-7012 already requires you to protect CUI using the 110 requirements of NIST SP 800-171.
- SPRS is where CMMC self-assessment results and annual affirmations are recorded, and where DoD posts its own assessment scores. Older contracts with DFARS 252.204-7019/7020 also require a current NIST SP 800-171 score there — and primes increasingly check SPRS before awarding subcontracts.
- CMMC Phase I self-assessment and affirmation requirements remain in effect.
- When Phase II resumes, contractors who used the pause to prepare will be ready to bid; the rest will be competing for a limited pool of assessors.
The suspension changed the timeline for third-party certification. It did not change what you’re responsible for today.
CMMC Engagements
Three ways to work with us, matched to the level your contracts require. Not sure which level applies? The free 30-minute scoping call answers that first.
CMMC Level 1 Readiness
For contractors that handle only Federal Contract Information (FCI).
| Who it’s for | Contractors and subcontractors whose contracts include FAR 52.204-21 and no CUI |
| What we review | Contracts and clauses, where FCI lives, and how each of the 15 Level 1 requirements is met today |
| You receive | Confirmation that Level 1 applies · requirement-by-requirement findings · a fix list in priority order · documentation of how each requirement is met · preparation for your annual self-assessment and SPRS affirmation |
| Typical duration | 2–4 weeks |
| Starting at | $3,500; scope and final price confirmed in writing after a 30-minute call |
CMMC Level 2 Readiness Review
Our lead engagement for contractors that handle CUI — fixed scope, fixed starting price.
| Who it’s for | Contractors and subcontractors (typically 10–100 employees) that handle or expect to handle CUI |
| What we review | Contracts and DFARS clauses, information types (FCI/CUI), system boundary, current controls, existing documentation |
| You receive | CMMC level applicability assessment · control-by-control gap findings · estimated SPRS score · prioritized remediation roadmap · executive summary for leadership |
| Typical duration | 3–6 weeks, depending on environment size and documentation readiness |
| Starting at | $7,500 for smaller, single-environment organizations; scope and final price confirmed in writing after a 30-minute call |
CMMC Level 2 End-to-End Readiness Program
From gap assessment to assessment day, with one senior lead throughout. For contractors that want a single partner to take them all the way to a Level 2 self-assessment or C3PAO assessment.
- Gap assessment. The Level 2 Readiness Review above: scope, gaps, SPRS score, and roadmap.
- Documentation. System Security Plan, POA&M, policies, and procedures that match how your environment actually works.
- Remediation coordination. We prioritize the fixes, work with your IT team or MSP as they implement them, and verify each one against the requirement.
- Evidence readiness. Evidence for all 110 requirements, organized the way assessors review it.
- Assessment preparation. A mock assessment, staff interview preparation, and support choosing a C3PAO and getting through the assessment.
Pricing: scoped and priced in writing after the Readiness Review, because the work depends on the gaps it finds. The Readiness Review fee is credited toward the program. We prepare you for assessment; we don’t certify, and no consultant can guarantee an assessment outcome.
Ask about the End-to-End Program →
Our CMMC Services
NIST SP 800-171 Gap Assessment
A requirement-by-requirement review of your environment against all 110 NIST SP 800-171 requirements, with an evidence-based SPRS score and a prioritized remediation plan. NIST 800-171 Compliance Services →
SSP & POA&M Development
System Security Plans that describe how your environment actually works — not a template with your logo on it — and POA&Ms with realistic owners, milestones, and closeout dates. SSP & POA&M Support →
Policies, Procedures & Evidence Readiness
The policies, procedures, and evidence an assessor will ask for, organized so your team can find and maintain them.
Ongoing CMMC Advisory (vCISO)
Compliance doesn’t end at the assessment. Monthly advisory to maintain controls, update documentation, track remediation, keep your SPRS score current, and monitor program changes. vCISO & Ongoing Advisory →
CMMC Level 1 vs. Level 2
| Level 1 — Foundational | Level 2 — Advanced | |
|---|---|---|
| Protects | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 basic safeguarding requirements (FAR 52.204-21) | 110 requirements of NIST SP 800-171 Rev. 2 |
| Assessment | Annual self-assessment + affirmation in SPRS | Self-assessment or third-party (C3PAO) assessment every 3 years, depending on the contract; annual affirmation |
| POA&Ms allowed? | No — all requirements must be met | Limited — conditional status requires a score of at least 88/110, only 1-point requirements (plus non-FIPS-validated encryption) may stay open, and they must be closed within 180 days |
| How we help | Gap review, documentation, self-assessment preparation | Full readiness review, SSP, POA&M, evidence, assessment preparation |
Level 3 (for the highest-priority programs) adds requirements from NIST SP 800-172 and is assessed by the government; it is outside the scope of our services.
Read: CMMC Level 1 vs. Level 2 — Which One Applies to You? →
Read: CMMC Level 2 Readiness Guide — From Scoping to Assessment →
How a CMMC Engagement Works
- Scoping call (30 minutes, free). Your contracts, the information you handle, your systems, and your timeline. You receive a written scope and price.
- Define the boundary. We identify where FCI and CUI live and flow — the single decision that most affects your cost and effort.
- Assess. We review controls and documentation against the applicable requirements and estimate your SPRS score.
- Prioritize. You get a remediation roadmap ranked by compliance impact, risk, and cost.
- Support. We help with SSP and POA&M development, evidence, and ongoing advisory — as a project or a monthly engagement.
Why Contractors Work With USCIBER
- CISO-level leadership on every engagement. Senior practitioners holding CISSP, CISA, and CISM credentials do the work — not a junior analyst with a template.
- Federal control experience. Our leadership has applied NIST SP 800-53 — the federal catalog NIST SP 800-171 is derived from — in DHS environments.
- An auditor’s eye. CISA-certified leadership means we prepare evidence the way an assessor will evaluate it.
- Built for small organizations. Fixed-scope packages, clear pricing, and recommendations sized to a small team and budget.
- Northern Virginia-based. Close to the Washington, DC-area defense community, with on-site support across Northern Virginia and the DC metro and remote support for defense contractors nationwide.
Important: USCIBER provides CMMC readiness consulting and implementation support. We are not a C3PAO, we do not perform official CMMC certification assessments, and no consultant can guarantee certification.
Frequently Asked Questions
Does every defense contractor need CMMC Level 2?
No. Contractors that handle only Federal Contract Information need Level 1. Level 2 applies when you process, store, or transmit Controlled Unclassified Information, as specified in your contract. A readiness review starts by confirming which level applies.
Is CMMC still required after the Phase II suspension?
Yes, in part. Phase I self-assessment requirements remain in effect where contracts include them, and DFARS 252.204-7012 still requires NIST SP 800-171 compliance. What was suspended is the move to broader third-party certification requirements.
What is an SPRS score?
The Supplier Performance Risk System (SPRS) score summarizes your NIST SP 800-171 self-assessment. It ranges from −203 to 110; 110 means all requirements are implemented. Primes and contracting officers can see it.
How much does CMMC compliance consulting cost?
CMMC Level 1 Readiness starts at $3,500. Our Level 2 Readiness Review starts at $7,500 for smaller, single-environment organizations, and its fee is credited toward the End-to-End Readiness Program if you continue. SSP and POA&M documentation projects and ongoing advisory are scoped after a call. Remediation costs (tools, IT changes) depend on your gaps and are separate.
How long does CMMC readiness take?
A readiness review typically takes 3–6 weeks. Reaching full Level 2 readiness commonly takes several months, depending on how many gaps exist and how quickly your IT team or provider can remediate them.
Can USCIBER certify my company?
No. Official Level 2 certification assessments are performed by authorized C3PAOs. We help you prepare so you’re ready when you’re assessed.
We already have an MSP. Do we still need a CMMC consultant?
Often, yes. MSPs implement technical controls; CMMC also requires scoping, policies, an SSP, POA&Ms, and evidence. We work alongside your MSP and coordinate the compliance side.
Find Out Where You Stand
Book a 30-minute scoping call. We’ll confirm which CMMC level applies, outline what a readiness review would cover, and send a written scope and price — usually within one business day.