NIST SP 800-171 and CMMC readiness for DoD contractors and subcontractors. We scope where your CUI lives, assess you against the 110 requirements, write your System Security Plan and Plan of Action, prepare your SPRS score for you to submit, and fix the gaps. An authorized C3PAO does the certification.
Book your free 30-min AI Audit → Client login
demelos is not a C3PAO and not a CMMC Registered Provider Organization. We don’t certify anyone, we don’t issue scores, and we don’t promise a passing result. CMMC Level 2 certification assessments are run by C3PAOs authorized by the Cyber AB, and SPRS scores are submitted by your company, not by us.
What we do is the work before the assessment: scoping, gap assessment, documentation, remediation and preparation. Keeping those roles separate is the point. The firm writing your plan should never be the firm grading it.
DFARS 252.204-7012 has sat in defense contracts for years. It requires you to protect Covered Defense Information by implementing NIST SP 800-171, to report cyber incidents to DoD within 72 hours, and to flow the clause down to your subcontractors. For a long time, most of the checking was on the honor system.
The honor system is ending.
Since late 2020, DFARS 252.204-7019 and 7020 have required a current NIST SP 800-171 self-assessment score in SPRS, no more than three years old, before you’re considered for award. The CMMC program rule (32 CFR Part 170) took effect December 16, 2024. Phase 1 of the DFARS CMMC rule began November 10, 2025. Phase 2 begins November 10, 2026, and from then on DoD begins including the Level 2 third-party certification requirement, assessed by a C3PAO, in solicitations and contracts involving CUI.
Here’s where most small shops stand when they call. A score went into SPRS a few years ago, based on a spreadsheet someone filled in from memory. The System Security Plan is a template with the company name swapped in. CUI is everywhere: in email, on the engineering file share, on the CNC programming PC, on a USB stick in a drawer. Nobody has drawn a line around where controlled data lives, so the whole company is in scope.
An overstated score is a real exposure. The Justice Department has settled False Claims Act cases with contractors over misrepresented cybersecurity compliance. And a C3PAO doesn’t grade on effort. Each requirement is met or not met, against written assessment objectives.
You need an accurate picture, a defensible plan, and the fixes done before the assessor arrives.
Bring your contract clauses and your current SPRS score, if you have one. Thirty minutes is enough to tell you where to start.
Book your free 30-min AI Audit →We map where CUI and other controlled data enters your company, where it’s stored, who touches it and where it goes. Then we define your assessment scope and sort your assets into the categories CMMC Level 2 uses: CUI assets, security protection assets, contractor risk managed assets, specialized assets such as shop-floor equipment, and out-of-scope assets.
Where it makes sense, we recommend an enclave: a smaller, separate environment for CUI, so the assessment covers the people and systems who need controlled data instead of the whole company. A tighter scope usually means less to fix, less to document and less to assess.
We assess your environment against all 110 security requirements in NIST SP 800-171 Revision 2, the version CMMC Level 2 is built on, using the 320 assessment objectives in NIST SP 800-171A. Each requirement gets a status of met, partially met or not met, with the evidence behind it and the work needed to close it. You get a scored baseline using the DoD Assessment Methodology and a ranked remediation plan.
The SSP describes your CUI environment and how each requirement is implemented. Assessors read it first. We write yours to match what you run, not a template with blanks filled in, so what the assessor reads lines up with what the assessor sees.
For every requirement not yet met, the POA&M records what’s missing, who owns the fix, and when it closes. Under CMMC, a POA&M has limits: conditional Level 2 status requires a minimum score of 88 out of 110, only certain requirements are allowed on a POA&M at assessment, and open items have to close within 180 days. We plan around those rules so you know what has to be finished before assessment day and what’s allowed to carry over.
We calculate your NIST SP 800-171 score using the DoD Assessment Methodology, on a scale from minus 203 to 110, and assemble the evidence behind it. Your company’s authorized official submits the score in SPRS. We never submit on your behalf, and we won’t inflate a number to make a deadline.
We translate the clauses in your contracts into a to-do list. In plain terms: 7012 covers safeguarding, 72-hour incident reporting, cloud services meeting the FedRAMP Moderate baseline or equivalent, and flowdown to subs. 7019 and 7020 cover your SPRS score and DoD’s right to assess you. 7021 is the CMMC clause itself. We also help you get the pieces 7012 assumes you already have, like the DoD-approved medium assurance certificate needed to report an incident.
If your work involves export-controlled technical data, such as drawings and specifications on militarily critical technology, you need JCP certification to get it from DoD sources. We help you prepare the DD Form 2345 application and supporting documents. Your company submits it, and the JCP office at DLA approves it.
We close the gaps: multi-factor sign-in, access control, logging and monitoring, encryption, configuration baselines, vulnerability management, incident response, training, and the written policies and procedures behind all of it. We work alongside your IT provider or do the work ourselves. For the recurring scanning NIST SP 800-171 calls for, see vulnerability scanning.
Before you book an assessor, we run a readiness review against the same objectives the C3PAO uses. We organize your evidence by requirement, prepare the people who’ll be interviewed, and walk you through what assessment week looks like. You choose and contract the C3PAO directly; we help you prepare for their process.
Each of the 110 requirements gets a status of met, partially met or not met, with the evidence behind it.
You get an honest score on the DoD scale, from minus 203 to 110, and a ranked plan to raise it.
We look at your contracts, what kind of data you receive from your customers, and where you stand today.
We map your CUI and agree on the assessment boundary, including whether an enclave fits.
We assess you against the 110 requirements and give you a scored baseline and a ranked plan.
We write the SSP and POA&M and work through remediation with your team or IT provider.
We check you against the assessment objectives again, prepare your SPRS submission for your official, and get your evidence in order.
You schedule an authorized C3PAO. We help you prepare for the process.
You build to drawings from a prime or a higher-tier sub, and those drawings are often CUI or export-controlled. Your shop-floor equipment, your CAD and CAM workstations, and your quality records all matter for scope.
Your purchase orders carry 7012 and the CMMC clause, and your customer has started asking for your SPRS score and your certification plan.
You receive specifications, test data or technical reports marked CUI, and your whole company runs out of one Microsoft 365 or Google Workspace tenant.
If your work never involves CUI, you likely need CMMC Level 1, not Level 2. Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21 and is an annual self-assessment. We help you confirm which level applies and get the self-assessment right.
CMMC isn’t a one-time event. A Level 2 certification lasts three years, and your company’s senior official has to affirm compliance every year. Your SSP has to stay current as your systems change. Vulnerabilities need scanning and fixing on a schedule. We stay on to keep your documentation, scans and fixes current between assessments, so the next one isn’t a fresh scramble.
Published prices for the same kind of work, from each provider’s own website. Shorter bar, lower price.
Gap assessment of all 110 requirements, System Security Plan and POA&M.
Assessment, scanning and NIST 800-171 readiness from one team. Nobody above publishes a combined price, so this compares buying the three separately.
Other providers’ prices and scope are quoted as published on their own websites, checked October 16, 2026. Names link to the source page. Scope is close to ours but not identical, and prices change, so check each provider for current terms.
RSI Security’s figure adds its listed internal and external scan prices. Invadel’s figure is two of its $1,500 scans, one internal and one external. Totem Technologies’ price includes a year of its compliance software.
demelos prices are starting prices for a company of up to about 25 users at one location. Fixing the gaps and any new licensing, such as Microsoft GCC High, are quoted separately.
A CMMC Level 2 certification assessment by an authorized C3PAO is separate from everything above. DoD estimates about $101,752 for a small company (CMMC final rule, 89 FR 83092).
An enclave keeps CUI with the few people and systems who need it, so the rest of the company stays out of scope.
Less to fix. Less to document. Less for the assessor to review.
Book your free 30-min AI Audit →
We’re not a C3PAO, so the firm getting you ready and the firm assessing you are always separate. You get advice aimed at passing a real assessment, not at selling you one.
Your SSP describes your machines, your people and your network. When the assessor asks how a requirement is met, the answer in the document and the answer on the floor are the same.
We build and support IT systems, so the gap list comes with people able to close it. You don’t need three vendors to get from gap assessment to assessment-ready.
If your score is lower than what’s in SPRS today, we’ll say so, and help you decide what to do about it with your own counsel.
No. demelos is not a C3PAO and doesn’t certify anyone. Level 2 certification assessments are run by C3PAOs authorized by the Cyber AB. We prepare you for the assessment: scoping, gap assessment, SSP, POA&M, SPRS score preparation and remediation.
It depends on the data in your contracts. If you only handle Federal Contract Information, Level 1 applies. If you receive or create Controlled Unclassified Information, you’ll need Level 2, and from November 10, 2026, DoD begins including the third-party Level 2 certification requirement in applicable solicitations and contracts. The CMMC clause and the data markings in your contracts tell you which; we help you read them.
Only if it’s less than three years old and still accurate. A score posted in 2020 or 2021 has expired unless someone redid it, and a score filled in from memory tends to run high. We reassess against the 110 requirements and give you an honest number for your official to submit.
Not always. DFARS 7012 requires cloud services holding CUI to meet the FedRAMP Moderate baseline or equivalent, and export-controlled data under ITAR or EAR adds requirements of its own. Many defense suppliers end up on GCC High; others use a different setup or a smaller enclave. The answer depends on your data, your customers’ flowdowns and your budget, and we work through it with you during scoping.
It depends on how far your setup is from the 110 requirements and how big your scope is. We give you a timeline after the gap assessment. Work backward from your contract dates, and leave room to schedule a C3PAO with your documents and fixes already finished.
Nobody honest guarantees a result, and we don’t. If the assessment finds requirements not met, CMMC allows conditional status in some cases, with a POA&M closed within 180 days, as long as your score meets the minimum and the open items are ones the rules allow. We plan for those limits from the start and help you close any findings after the assessment.
