Frameworks
NIST SP 800-171 and CMMC, assessed in days
If your contracts involve Controlled Unclassified Information, the requirements are already live and the score is already expected. We deliver an SPRS-ready gap assessment, a prioritised Plan of Action and Milestones, and CMMC readiness — from people who have read the clause.
Three obligations that arrive together
Defence suppliers rarely meet these one at a time. The contract clause, the score and the certification requirement tend to land in the same quarter.
DFARS 252.204-7012
Required for DoD contracts involving Controlled Unclassified Information. It obliges you to implement NIST SP 800-171 and to report cyber incidents — and non-compliance can put the contract itself at risk.
SPRS scoring
Your NIST SP 800-171 assessment score has to be reported in the Supplier Performance Risk System. A score below the maximum of 110 has to be accompanied by a Plan of Action and Milestones.
CMMC certification
The Cybersecurity Maturity Model Certification programme adds a verification step on top: Level 2 is where handling CUI generally lands, and it is assessed by an authorised third party rather than self-declared.
Three scopes, depending on what your contract says
The right one depends on whether you hold Federal Contract Information, Controlled Unclassified Information, or both — which is the first thing we establish rather than something you have to know in advance.
- 01
NIST SP 800-171
The 110 security requirements across 14 families that DFARS obliges you to implement, assessed with the SPRS scoring methodology so the number you report is one you can defend. Typically three to five business days.
- 02
CMMC Level 1
Basic cyber hygiene for Federal Contract Information: 17 practices across 5 domains. The lighter scope, and the right one where no CUI is involved. Typically two to three business days.
- 03
CMMC Level 2
A readiness assessment against the 110 practices across 14 domains: a structured evaluation of your current controls, a detailed gap analysis, a prioritised Plan of Action and Milestones, and the SPRS calculation — to prepare you for third-party certification. Typically four to five business days.
Four steps, most of them ours
The time you spend on this is measured in hours, not weeks. That is deliberate: an assessment that consumes your engineering team defeats the point of buying one.
- 01
Contract and environment review
About an hour. We go through the relevant contracts and clauses, how Controlled Unclassified Information actually moves through your business, and what your current security posture looks like.
- 02
Tailored assessment
Under two hours of your time. A structured questionnaire built for defence suppliers rather than a generic control checklist, completed with your people rather than sent to them.
- 03
SPRS-ready results
Three to five business days. A gap report with the SPRS score and how it was calculated, the Plan of Action and Milestones, and a compliance roadmap in the order the work should actually be done.
- 04
Implementation support
A working session on remediation priorities and what certification preparation involves — so the report leaves with somebody who knows what to do with it.
The boundaries, stated before you buy
We do not submit your SPRS score. We calculate it and give you the data behind it; you or your prime contractor submit it through the SPRS portal, as DFARS requires of you rather than of us.
This is not a certification. We deliver a readiness gap assessment and a Plan of Action and Milestones. CMMC certification is performed by an authorised third-party assessor, and a firm that prepared you cannot be the one that certifies you. Our deliverables are built to make that step shorter.
The assessment is one-off, at a fixed scope and a fixed fee quoted before you start. If you want hands-on help closing the gaps, we scope that as separate follow-up work rather than folding it into an assessment fee.
A clause in a contract, and a date you did not choose?
Tell us what the contract says and what you hold. We will tell you which assessment applies and what it will take.