CMMC · NIST SP 800-171 · DFARS

What we do, and which tier your contracts put you on

GuardNet, our compliance-operations platform — deploy engine, L2 configuration baseline, evidence pipeline, and assessment tooling.

Start a scoping conversation

What the work is, all of it

You are dealing with one practice and no second service line — and the ledger proves it.

The whole practice

CMMC and NIST 800-171 work is the whole practice — there is no second service line.
One kind of work

More than ninety-nine cents of every dollar on the ledger has gone to one kind of work — compliance management, enclave operations, Microsoft 365 licensing for those environments, and the help desk that keeps them running.

Three tiers, one platform

Three tiers on one platform. Where you land is set by what your contracts require of you, not by what you are sold.

FCI / Level 1

Essentials

The on-ramp: FAR 52.204-21 basic safeguarding for contractors handling FCI only, self-attested at Level 1.
Level 2 · self-assessment

Managed

Where most clients land: the full NIST SP 800-171 baseline, run with you, kept current in SPRS.
Level 2 · C3PAO certification path

Certified

Everything in Managed, held to assessment-grade documentation standards, with assessment-day support once scheduled.

On "Certified" You pursue certification; an independent C3PAO confers it. We do the documentation, preparation, and assessment support — including sitting the assessment with you.

The structure

Three service tiers on one platform.
A defined posture band

Each tier carries a defined SPRS posture band, math-enforced, so you know the ceiling your tier supports.
How it is priced

One simple package, priced to your SPRS posture — not billed control by control.

Place yourself from the paperwork you already hold

The rung is not a preference and not a quote. Three documents decide it, and you already hold all three: the solicitation that names a level, the clause your contract carries, and the score posted against your name.

Contracting officers must check SPRS before award, and must not award a contract, task order, or delivery order to an offeror whose CMMC status is not posted there at the level the solicitation requires.

Source: DFARS 240.371-4(b), Class Deviation 2026-O0025 (effective February 1, 2026; current revision Revision 3, September 3, 2026).
Where a contract carries the safeguarding clause, the contracting officer must verify before award that a current assessment score for that system is posted in SPRS - and the same verification applies to an option exercise or a contract extension.

Source: OUSD(A&S) memorandum, "Contractual Remedies to Ensure Contractor Compliance with DFARS Clause 252.204-7012," June 16, 2022 (DARS Tracking USA000807-22-DPC).
Not every gap can be deferred. A plan of action is not permitted at all at Level 1, and at Level 2 it may not carry the system security plan requirement or five other named requirements.

Source: 32 CFR 170.21(a).
A NIST SP 800-171 assessment score is not a percentage. It runs from -203 to 110, and a score can be deeply negative.

Source: U.S. Department of Justice settlement announcements, March 26, 2025 and June 18, 2026.

The clauses that put you here

You did not choose this rung — a clause did. And the score it produces follows you into the next bid.

Flow-down mechanics

DFARS 252.204-7012 / 7019 / 7021 and 252.240-7997 and their flow-down mechanics are baseline literacy in everything we deliver. Under the 2026 DFARS class deviation, 252.240-7997 replaced 252.204-7020.
SPRS stays current

We prepare and maintain your NIST SP 800-171 Basic Assessment so your SPRS entry stays current.

Three clocks are already running against your posted status

Your posted status runs on the government's clock, not a supplier's — and two more run behind it.

A conditional status runs on a clock: the plan of action must be closed out by a follow-up assessment within 180 days of the conditional status date, and if it is not, the conditional status expires.

Source: 32 CFR 170.21(b).
The affirmation is a person, not a company: a named senior official must affirm continuing compliance in SPRS after every assessment and annually after that.

Source: 32 CFR 170.22(a).
The same check governs renewal: a contracting officer must not exercise an option or extend a period of performance unless the contractor's CMMC status is current in SPRS at the level the contract requires.

Source: DFARS 240.371-4(c), Class Deviation 2026-O0025 (effective February 1, 2026; current revision Revision 3, September 3, 2026).

What the published cost assumes you already did

Government cost estimates for CMMC leave out the work itself. Their stated reason is a date.

FAR 52.204-21 has required the safeguarding work since June 15, 2016; DFARS 252.204-7012 has required it since December 31, 2017. The published cost of a CMMC assessment leaves out the cost of meeting the security requirements, and gives those two clauses as the reason: that work was already owed. What the program adds is the checking. Contractors once attested to their own compliance, and auditors at the Inspector General and the Defense Contract Management Agency reported that what the clause required was not consistently implemented — so they recommended the Department assess that ability itself. The Department has also said where that leaves a business which cannot comply. In its own words, a small business that cannot comply with DFARS clause 252.204-7012 and NIST SP 800-171 R2 should not be processing, storing, or transmitting CUI. That is the door closing, and the same public record states how it stays open. An award can be made while a Level 2 status is still conditional; Level 1 requires a final status before award. A contractor that falls short is not out of moves either: in a 2025 resolution the Justice Department said the consequences can be mitigated through timely self-disclosure, cooperation, and prompt remedial measures — a matter that resolved on allegations alone, with no determination of liability. Read together, the record reaches a plain conclusion: the assessment is not new work arriving; it is work owed since those two dates finally being checked. Whether this describes you is a matter of record too. By the Department's own count of its contract data for fiscal years 2019 through 2021, 31,338 unique awardees a year hold contracts carrying the safeguarding clause. 23,475 of them are small businesses.

Source: 89 FR 83092 (32 CFR part 170, CMMC Program final rule, October 15, 2024), Regulatory Impact Analysis.

Source: 89 FR 83092 (32 CFR part 170, CMMC Program final rule, October 15, 2024), Department response to comments on small-business impact.

Source: DFARS 240.371-3(b)(2), Class Deviation 2026-O0025 (effective February 1, 2026; current revision Revision 3, September 3, 2026).

Source: U.S. Department of Justice, Civil Division, settlement announcement, July 31, 2025.

What meeting the requirements consists of, and what operating them looks like, is the rest of this page — starting with who it is not built for.

Who this is not for

Naming the buyers this is not built for is part of being straight about the ones it is.

Sub-10-seat product or DIY buyers — served, if at all, only by Essentials self-serve.
Pre-contract aspirants with no forcing function — a nurture track, never a sales target, and never sold on a manufactured deadline.
Large enterprises above roughly 100 seats who want a managed enclave and named-face proof.
Assessment-only shoppers looking for a rubber stamp rather than an operated program.

What gets built inside your tenant, and what is still there afterwards

Your tenant is where this gets built — the environment, the documentation set, the policies and procedures — and it is all still there afterwards.

We build, migrate into, and operate Microsoft 365 GCC High environments.
The full CMMC Level 2 certification package is a complete, assessment-grade documentation set — a 9-layer SSP, a Shared Responsibility Matrix mapped to all 110 requirements, 14 families of policies and procedures, and an evidence binder.
14 families of security policies and 14 families of operational procedures, authored to NIST assessment standard — not templates.
Implemented and operated — not just advised.

What the baseline covers

The security requirements the baseline covers, and the insurance questionnaire it answers on the way past.

The baseline, counted

Of the 110 NIST SP 800-171 security requirements, we implement and operate 92 inside your tenant. Another 8 are performed by your own people and managed and tracked by us, and 5 are yours alone. The 5 physical-protection requirements sit with your own facilities, or are inherited from the cloud platform where your engagement carries a written cloud-only applicability statement.
The Level 1 subset

15 security requirements at Level 1.
The insurer checklist

MFA everywhere, EDR, patch discipline — the insurer checklist is inside the baseline we deploy.
A Shared Responsibility Matrix mapped to all 110 NIST SP 800-171 requirements, per client.

Compiled. Current. Ready.

A document that fails its readiness gate is held back; your assessor decides. The record is kept — not reconstructed.

You are buying readiness, not the assessment itself

Suppliers describe this work in different words, and some of the difference is real. Two boundaries decide most of it.

Readiness, not the assessment

A pre-audit readiness verdict, not an assessment of record — a licensed C3PAO runs the real assessment; we tell you what still fails.
What the tier can carry

The service matrix is a file the engines read, not a brochure — combinations that can't deliver are refused by the tooling, and cloud limits are declared with their exact score impact.

Find your tier

Your contracts decide which rung applies to you, not a preference. Tell us what landed and we will tell you where it puts you.

Start a scoping conversation Not ready to talk? Read how we work