Level 1 covers 17 basic practices for FCI (Federal Contract Information) like contracts and invoices. Level 2 covers 110 practices for CUI (Controlled Unclassified Information) like technical drawings, specs, or source selection data. If you handle anything beyond basic contracts, you need Level 2.

Not sure which you need? Take our 2-minute assessment or book a free consultation.

C3PAOs are auditors, not consultants. They find gaps but don't fix them. If you go unprepared:

• 40-60% fail readiness review
• You pay $18K-$30K to learn you're not ready
• Then you pay us (or someone) to fix it
• Then you pay the C3PAO again for re-assessment

Total cost: $40K-$60K+

Our approach: We prepare you first, then you pass the C3PAO audit once. Total cost: $25K-$45K (you save $15K-$20K).

Our 90-Day Documentation Assurance covers gaps in our deliverables found during your C3PAO readiness review (not the formal audit). We fix documentation errors at no charge—or refund your project fee.

We've had zero refunds in 500+ contractors. Our first-attempt pass rate is 98%.

What's NOT covered: Gaps from incomplete implementation (you didn't follow our guidance), scope changes, or C3PAO interpretation beyond NIST 800-171.

Yes, if you have:

• 80-120 hours available
• Deep knowledge of NIST 800-171 (110 controls)
• Experience writing SSPs that C3PAOs accept
• Time to argue findings with auditors

40% of DIY attempts fail readiness review.

Our clients get audit-ready in 3-8 weeks with 98% first-attempt pass rate. The question isn't "Can you DIY?"—it's "Is your time worth $50-$80/hour?"

Advisory is optional but highly recommended. Here's why:

CMMC requires continuous compliance (not one-and-done). Your compliance posture drifts over time:

• Employees leave (policies not updated)
• Systems change (evidence gaps)
• NIST requirements change (policies outdated)
• SPRS scores decay (quarterly submission required)

Advisory keeps you audit-ready year-round. It's included free for 3 months with Accelerator so you can experience the value—then decide.

Clients who keep Advisory: 0% re-assessment fees
Clients who cancel Advisory: 15-20% need remediation before re-certification

Both include full 110-control assessment, SSP, POA&M, SPRS, and 90-day guarantee.

Accelerator adds:

• Priority scheduling (3-6 weeks vs 4-8 weeks)
• White-glove service (more hand-holding)
• 3-month Advisory trial included ($2,385 value)
• Dedicated compliance analyst
• Priority remediation (≤5 days vs ≤15 days)

Choose Readiness if: Standard timeline works, you have some internal bandwidth
Choose Accelerator if: Tight deadline, complex environment, or you want ongoing support

Level 1 Express: 2-4 weeks
Level 2 Readiness: 4-8 weeks (complex: 8-12 weeks)
Level 2 Accelerator: 3-6 weeks

Timeline depends on:

• Your availability for interviews (2-3 hours total)
• How quickly you provide evidence (network diagrams, policies, etc.)
• Complexity of your environment (50+ devices, multiple locations, cloud + on-prem)

We deliver on time 95% of the time. Delays are almost always client-side (waiting for info).

Yes—you select your C3PAO independently from the Cyber AB Marketplace. We don't certify and take no referral fees.

We'll help you:

• Understand C3PAO pricing ($18K-$30K typical for SMB Level 2)
• Review your options (some C3PAOs are faster, some more thorough)
• Coordinate the handoff (send your deliverables, schedule readiness review)

We stay involved through the C3PAO readiness review (included in your 90-day guarantee). If they find documentation gaps, we fix them.

Yes. If you start with Level 1 Express and later discover you need Level 2 (prime requires CUI handling), we credit $2,000 toward Level 2 Readiness if you upgrade within 90 days.

Small changes (additional endpoints, minor scope adjustments): We handle at no charge during your engagement.

Major changes (new CUI types, additional enclaves, significant scope expansion): We'll provide a change order with transparent pricing. Most scope changes add $1,500-$3,000.

We provide implementation guidance (how to configure firewalls, set up MFA, etc.), but we don't do hands-on technical work.

You or your IT provider implement the controls. We document them in your SSP and verify evidence.

If you need technical implementation help, we can recommend vetted MSPs in your area.

Advisory Partnership ($795/mo):

• Monthly check-ins
• Ongoing policy updates
• SPRS submission support
• Priority remediation (≤5 days)
• Cancel anytime with 30-day notice

Quarterly Care ($595/quarter):

• Quarterly check-ins only
• Policy updates (as needed)
• Evidence review for annual affirmation
• Standard remediation (≤15 days)

Choose Advisory if: You want continuous monitoring and fast response
Choose Quarterly if: You have internal bandwidth and just need periodic tune-ups

No. We prepare you for certification—C3PAOs perform the audit.

We're independent consultants. We receive no fees from C3PAOs. You choose your assessor based on your needs and budget.

This separation is required by CMMC rules and protects you (no conflict of interest).

Step 1: Book a free 30-minute consultation (877-933-4465)
Step 2: We scope your environment and confirm L1 vs L2
Step 3: You choose a package (Express/Readiness/Accelerator)
Step 4: We kick off within 2 weeks (or <10 days with Rush Service)
Step 5: You're audit-ready in 2-8 weeks

Limited Q4 availability: Only 4 project starts remaining before year-end.