Reviewed October 6, 2026: the planned Phase II expansion is suspended. Maintain applicable self-assessments and safeguarding obligations, and confirm contract amendments or modifications before pursuing a third-party assessment. Read the current-status playbook.
The number that decides whether you can bid
Solicitations that include DFARS 252.204-7019/7020 make a current NIST SP 800-171 self-assessment score in SPRS a condition of award, and primes screen subcontractors on it. The DoD Assessment Methodology starts you at 110 and subtracts 5, 3, or 1 points for each unimplemented requirement, down to a floor of −203. Base your starting score on evidence; there is no assumed result for a first assessment.
What the engagement covers
- CUI boundary definition maps and verifies where CUI actually lives. Discovery sets the boundary before remediation starts, and any reduction has to be supported by evidence. See the Scope Reduction Field Guide.
- A gap assessment against all 110 controls, scored to the DoD Assessment Methodology at the objective level, gives you your real SPRS score and a gap register ordered by point weight and lead time.
- The SSP and POA&M are written from the live environment during remediation, never from a template beforehand. Every C3PAO interview works from the SSP.
- Remediation starts with the five-point gaps: MFA, FIPS-validated cryptography, logging, and boundary protection. It runs as Factory stations 02 and 03, a defined scope of work instead of open-ended consulting hours.
- Objective-level evidence is collected against each objective an assessor tests. A full internal mock assessment is the last check before your C3PAO.
We ran this sequence on ourselves first. inDirectIT used it on its own environment to earn CMMC Level 2 under 32 CFR Part 170, and Allyon ran it to its June 2026 certification. Every engagement uses the same runbook.
Questions contractors ask us
What does a CMMC Level 2 gap assessment cost?
Pricing depends on the assessed boundary, evidence readiness, and agreed deliverables. Ours is fixed-scope: CUI boundary definition, scoring against all 110 controls, your real SPRS score, and a sequenced remediation register, priced up front with no discovery-phase creep.
How long does CMMC Level 2 readiness actually take?
Readiness depends on scope, existing controls, staffing, and evidence quality. Our Factory model compresses the technical baseline into a 12 to 14 week build because the playbook, templates, and evidence structures already exist. You inherit a pattern that already works.
What happens if we don't have a System Security Plan?
The DoD methodology gives the SSP no point value. Without one, the assessment cannot be scored at all, so you have nothing to submit. Submitting an inflated score anyway creates False Claims Act exposure. We write the SSP from your live configuration during remediation, never before it.
Can we do the self-assessment ourselves?
Yes, and it is the right place to start. You can score yourself free with the CMMC Calculator, which uses the official DoD methodology. Contractors get into trouble when they score optimistically. Your SPRS submission is a federal representation, and only an honest number holds up in front of a C3PAO.
Request your gap assessment.
Tell us where the program stands and we'll come back with scope, timeline, and a fixed price. Or email rj@indirectit.com directly.