CMMC Resources

Plain-language guides to CMMC and to hiring a consultant, plus the official references. If you are new to CMMC, start with the first guide and work down.

Working with a consultant

What Does a CMMC Consultant Do?

A consultant gets a contractor ready for the CMMC assessment its contracts require. This guide covers what that work involves, why contractors bring in help, and what a consultant cannot do.

Read the Guide

In this guide

  1. What consultants help with
  2. Why contractors bring in help
  3. Common services
  4. What a consultant cannot do
CMMC basicsCMMC Levels 1, 2 and 3 ExplainedWhat each level covers, who needs it, and how it is assessed.Read the GuideCMMC basicsRPO vs. C3PAO: Who Does WhatOne kind of firm helps you prepare. The other assesses you. Here is the difference.Read the GuideWorking with a consultantHow to Choose a CMMC ConsultantWhat to look for, what to ask, and whether the firm needs to be local.Read the GuideWorking with a consultantWhat CMMC Consulting Costs and How Long It TakesWhat drives the price and the schedule, and how to compare quotes.Read the GuideReferenceOfficial CMMC ReferencesThe program page, the accreditation body, the standard, and the rule.Read the Guide

Common questions

What is a CMMC consultant?

A CMMC consultant helps a defense contractor understand which Cybersecurity Maturity Model Certification level applies to its contracts, find the gaps in its current security practices, and get ready for a self-assessment or a third-party assessment.

How much does CMMC consulting cost?

Cost is determined by the CMMC level required, the size of the environment that handles federal information, and the remediation scope. Ask each firm for a written scope and a fixed or capped fee before you compare quotes.

How do I choose a CMMC consultant?

Look for documented CMMC or NIST SP 800-171 experience with companies your size, check credentials against the Cyber AB Marketplace, and ask what the firm delivers at the end of the engagement. How we rank explains how firms are ordered here.

Do I need a local consultant?

Readiness work includes remote support and on-site activities. Physical security reviews and facilities that process CUI require attention to the site itself. Choose a firm whose delivery approach matches your needs. Browse consultants by state.

Can a CMMC consultant certify my business?

No. Consultants prepare you. Level 2 certification assessments are performed by an authorized C3PAO, and a C3PAO cannot assess a company it has also advised on the same scope.

How long does CMMC preparation take?

Your current security practices, remediation scope, and available staff determine the preparation schedule. A gap assessment identifies the work required and establishes a realistic timeline.

What is the difference between CMMC Level 1 and Level 2?

Level 1 covers Federal Contract Information and requires 15 basic safeguarding requirements, confirmed by an annual self-assessment. Level 2 covers Controlled Unclassified Information and requires the 110 security requirements of NIST SP 800-171, assessed either by self-assessment or by a C3PAO every three years depending on the contract.

What is a C3PAO?

A CMMC Third-Party Assessment Organization. C3PAOs are authorized by the Cyber AB, the CMMC accreditation body, to conduct Level 2 certification assessments.