We review your Microsoft 365 or Google Workspace, your laptops, network and backups, scan for known vulnerabilities, and get defense suppliers ready for NIST SP 800-171 and CMMC. You get a plain-English list of what to fix, in order, and help fixing it.
Book your free 30-min AI Audit → Client login
Most small businesses learn about their security the expensive way.
A bookkeeper’s mailbox gets taken over on a Tuesday, and by Thursday your customers have invoices with new bank details on them. A ransom note shows up on the file server on a Monday morning, and the backup in the closet turns out to sit on the same network, encrypted along with everything else. Or a prime contractor sends a supplier questionnaire asking for your SPRS score, and nobody in the building knows what an SPRS score is.
None of this takes a nation-state hacker. It comes from ordinary gaps. An admin account with no multi-factor sign-in. A former employee who still has a login. A firewall nobody has touched since the installer left. A laptop on a version of Windows Microsoft stopped patching.
You don’t need a 40-page framework to fix those. You need someone to look, tell you what’s wrong in order of what would hurt most, and help you close it.
Tell us what prompted the question. Thirty minutes is enough to point you at the right one.
Book your free 30-min AI Audit →Three services. Start with the one matching the question you’re asking right now.
A review of how your business runs today: email and file sharing in Microsoft 365 or Google Workspace, laptops and desktops, your network and firewall, your backups, and the written policies, or the lack of them. You get a findings report with every issue ranked by risk, and a fix list your team or ours works through.
Security assessments →External scans of everything you expose to the internet, and internal scans of the machines inside your network. We explain the results in plain terms, help fix what matters, and rescan to confirm the fix held. Run it once, or on a recurring schedule.
Vulnerability scanning →For DoD contractors and subcontractors who handle Controlled Unclassified Information. We scope your CUI environment, run a gap assessment against the 110 NIST SP 800-171 requirements, write your System Security Plan and Plan of Action, prepare your SPRS score for you to submit, and get you ready for a CMMC Level 2 assessment by an authorized C3PAO.
We don’t certify anyone. We get you ready for the assessors who do.
NIST 800-171 and CMMC readiness →Every review ends the same way: a list of what’s wrong, ranked by what would hurt most, with the fix for each item.
Your team works through it, your IT provider does, or we do. Then we confirm each fix held.
Thirty minutes. You tell us what’s going on: an incident, an insurance questionnaire, a customer asking questions, a contract clause. We tell you which service fits and what it involves.
We agree in writing on what we review, which systems, and when. Before we scan anything, you sign an authorization naming the systems in scope.
We do the work we agreed to, on the schedule we agreed to, with as little disruption to your day as we manage.
A report written for the owner, not for a security conference. Every finding comes with a risk rating, what it means for the business, and the fix.
Your team fixes it, your IT provider fixes it, or we do. Then we check the fix worked.
Dental and medical offices, law firms, accounting practices, contractors, real estate teams. Usually IT is an outside provider you call when something breaks, or one person on staff who also orders the toner. The questions show up anyway: from your cyber insurer at renewal, from a client’s vendor-security form, from a bank after a wire goes to the wrong account.
You make parts, assemblies or services for a prime or a higher-tier sub. You’ve seen DFARS 252.204-7012 in your purchase orders for years, and now your customer is asking about CMMC. Phase 2 of the CMMC program begins November 10, 2026. From then on, DoD begins including the CMMC Level 2 third-party certification requirement in solicitations and contracts involving CUI. If your work touches CUI, your next contract is the deadline.
Published starting prices. After the free call you get a fixed quote, once we know how many people, computers and locations are in scope.
From $2,500
Microsoft 365 or Google Workspace, laptops, network, backups and policies. A findings report ranked by what to fix first.
See the assessmentFrom $1,500
Internal and external scans, a report ranked by severity, and one rescan after you fix things.
See scanningFrom $6,000
All 110 requirements, your System Security Plan, POA&M and SPRS score, in a client portal with e-signed reports.
See NIST and CMMCFrom $8,500
$1,500 less than buying each one from us on its own. One team carries what it learns from the assessment into the scan and the 800-171 work.
Book your free 30-min AI AuditPublished prices for the same kind of work, from each provider’s own website. Shorter bar, lower price.
Review of email and cloud accounts, computers, network, backups and policies, with a written report of what to fix first.
Internal and external scans with a report ranked by severity.
Gap assessment of all 110 requirements, System Security Plan and POA&M.
Assessment, scanning and NIST 800-171 readiness from one team. Nobody above publishes a combined price, so this compares buying the three separately.
Other providers’ prices and scope are quoted as published on their own websites, checked October 16, 2026. Names link to the source page. Scope is close to ours but not identical, and prices change, so check each provider for current terms.
RSI Security’s figure adds its listed internal and external scan prices. Invadel’s figure is two of its $1,500 scans, one internal and one external. Totem Technologies’ price includes a year of its compliance software.
demelos prices are starting prices for a company of up to about 25 users at one location. Fixing the gaps and any new licensing, such as Microsoft GCC High, are quoted separately.
A CMMC Level 2 certification assessment by an authorized C3PAO is separate from everything above. DoD estimates about $101,752 for a small company (CMMC final rule, 89 FR 83092).
Your cyber insurer asks at renewal. A client asks on a vendor-security form. A prime asks for your SPRS score.
You get a report written for the owner, with the evidence your IT provider and your customers want to see.
Book your free 30-min AI Audit →
We’re an IT and AI firm. We build and run systems for clients, so our report doesn’t end with “consult your IT provider.” If you want us to make the changes, we make them.
demelos is not a C3PAO and not a CMMC Registered Provider Organization. We don’t sell certifications, and we never promise a score or a pass. For CMMC, the firm assessing you is a separate, authorized C3PAO, so the people writing your plan are never the people grading it.
Staff paste client data into chatbots. Apps connected to your email read every message. As an AI consultancy, we look at which AI tools have access to your mail and files and what your policy says about them, alongside the usual checks.
You get a ranked list of fixes and an explanation of why each one matters. No 300-page scanner export with your name on the cover.
No. demelos is not a C3PAO and doesn’t certify anyone. CMMC Level 2 certification assessments are run by C3PAOs authorized by the Cyber AB. We prepare you for the assessment: scoping, gap assessment, documentation, SPRS score preparation and remediation.
Yes. Most attacks are automated, and the tools sweeping the internet for weak logins and unpatched devices don’t check your headcount. Small businesses get hit because their gaps are easier to find, not because someone picked them by name.
If you don’t know where you stand, start with a security assessment. If you hold DoD contracts involving CUI, start with NIST 800-171 and CMMC readiness. If an insurer, customer or auditor wants proof you check for vulnerabilities, start with scanning.
Yes, and we agree on exactly what access in writing first. For reviews of Microsoft 365 or Google Workspace, we ask you to create a dedicated account for us with the access the review needs, and to remove it when we’re done. Never send passwords by email.
It depends on the number of people, devices and locations, and for CMMC, on the size of the environment holding CUI. We give you a written quote after the free call, before any work starts.
