CMMC Consulting Services
Browse consultants by the type of CMMC work they do, from a first readiness assessment through to ongoing managed compliance. Each service page lists the firms that offer it, in national ranking order.
- CMMC Readiness AssessmentsA structured review of how an organization currently measures up against the CMMC requirements that apply to its contracts, completed before any formal assessment.
- CMMC Level 2 ConsultingGuidance for contractors that handle Controlled Unclassified Information and need to implement the 110 security requirements of NIST SP 800-171.
- NIST SP 800-171 ComplianceHelp implementing and documenting the NIST SP 800-171 security requirements that form the basis of CMMC Level 2.
- CMMC Gap AssessmentsA requirement-by-requirement comparison of current practices against the standard, producing a list of gaps to close.
- Compliance RemediationHands-on work to close identified gaps, such as configuring systems, tightening access controls, and tracking a plan of action and milestones.
- Security DocumentationWriting and maintaining the System Security Plan, policies, and procedures that assessors review as evidence.
- Managed Compliance ServicesOngoing monitoring, evidence collection, and maintenance that keeps a compliance program current between assessments.
- CMMC Assessment PreparationMock assessments, evidence review, and staff interview practice ahead of a C3PAO certification assessment.
Services That Get Mixed Up
Readiness assessment and gap assessment
Firms use these two names loosely. In general, a readiness assessment looks at the whole program and tells you how close you are, and a gap assessment goes line by line and leaves you with a list to work from. Ask to see a sample report before you choose.
Level 2 consulting and NIST SP 800-171 compliance
CMMC Level 2 is built on the 110 requirements in NIST SP 800-171, so the work overlaps almost completely. The label mostly reflects how a firm describes itself. If you need Level 2, look at the firms under both.
Assessment preparation and the assessment
Preparation is practice. The certification assessment is carried out by a separate organization, a C3PAO, and it cannot be a firm that advised you on the same systems. RPO vs. C3PAO: Who Does What explains the split.
Services FAQ
Do I need all eight services?
No. Most contractors need a few of them, and which ones depends on where they are starting. An assessment usually comes first because it shows what else is needed.
Can I use different firms for different services?
Yes. Some contractors use one firm for an assessment and another for remediation or ongoing management. If you would rather keep one firm throughout, each listing shows every service that firm is listed under.
Do these services apply to CMMC Level 1?
Some do. Level 1 covers 15 basic safeguarding requirements and is confirmed by a yearly self-assessment, so a readiness review or help with documentation can still be useful. Most of the services here are aimed at Level 2. CMMC Levels 1, 2 and 3 Explained covers the difference.