Reviewed October 6, 2026: the planned Phase II expansion is suspended. Maintain applicable self-assessments and safeguarding obligations, and confirm contract amendments or modifications before pursuing a third-party assessment. Read the current-status playbook.
The number that decides whether you can bid
Under DFARS 252.204-7019/7020, applicable solicitations require a current NIST SP 800-171 self-assessment score in SPRS as a condition of award — and primes screen subcontractors on it. The DoD Assessment Methodology starts you at 110 and subtracts weighted deductions of 5, 3, or 1 points per unimplemented requirement, down to a floor of −203. Use evidence to determine the starting score; there is no assumed result for a first assessment.
What the engagement covers
- CUI boundary definition — where CUI actually lives, mapped and verified. Discovery establishes the boundary before remediation; any reduction must be supported by evidence. See the Scope Reduction Field Guide.
- Gap assessment against all 110 controls — scored to the DoD Assessment Methodology at the objective level, producing your real SPRS score and a gap register sequenced by point weight and lead time.
- SSP & POA&M production — written from the live environment during remediation, never from a template before it. The SSP is the document every C3PAO interview anchors to.
- Remediation execution — five-point gaps first: MFA, FIPS-validated cryptography, logging, boundary protection. Run as Factory stations 02–03, not open-ended consulting hours.
- Objective-level evidence & mock assessment — artifacts collected against the individual objectives an assessor tests, then a full internal mock assessment as the release gate before your C3PAO.
Why it works: this is the exact sequence inDirectIT ran on its own environment to earn CMMC Level 2 under 32 CFR Part 170 — and the sequence Allyon ran to its June 2026 certification. Same runbook, every time.
Questions contractors ask us
What does a CMMC Level 2 gap assessment cost?
Pricing depends on the assessed boundary, evidence readiness, and agreed deliverables. Ours is fixed-scope: CUI boundary definition, scoring against all 110 controls, your real SPRS score, and a sequenced remediation register — priced up front, no discovery-phase creep.
How long does CMMC Level 2 readiness actually take?
Readiness depends on scope, existing controls, staffing, and evidence quality. Our Factory model compresses the technical baseline into a 12–14 week build because the playbook, templates, and evidence structures already exist — you're inheriting a working pattern, not funding an experiment.
What happens if we don't have a System Security Plan?
Without an SSP there is no submittable assessment at all — the DoD methodology treats it as a gate, not a deduction. And an inflated score submitted anyway is False Claims Act exposure. The SSP is written from your live configuration during remediation, never before it.
Can we do the self-assessment ourselves?
Yes — and you should start there. Score yourself free at CMMC Calculator using the official DoD methodology. Where contractors get in trouble is scoring optimistically: your SPRS submission is a federal representation, and the honest number is the one that survives a C3PAO.
Request your gap assessment.
Tell us where the program stands and we'll come back with scope, timeline, and a fixed price. Or email rj@indirectit.com directly.