Level 1 covers 15 basic practices for FCI (Federal Contract Information) like contracts and invoices. Level 2 covers 110 practices for CUI (Controlled Unclassified Information) like technical drawings, specs, or source selection data. If you handle anything beyond basic contracts, you need Level 2.

Not sure which you need? Take our 2-minute assessment or book a free consultation.

C3PAOs are independent auditors — not consultants. Their role is to assess your environment against CMMC requirements, not to help you prepare for them.

If significant gaps are identified during the assessment:

• You still pay the full C3PAO fee (typically $35,000–$60,000+)
• You must remediate identified deficiencies
• You may need to re-engage the C3PAO for a follow-up assessment
• Project timelines and contract eligibility can be delayed

For many small to mid-sized environments, remediation plus re-assessment can materially increase total certification cost beyond the original assessment fee.

Our approach focuses on preparation first. We help you identify and close gaps before you engage a C3PAO, reducing the likelihood of unexpected findings and helping you enter the assessment process with confidence.

Cyber TQ guarantees the completeness of documentation deliverables within agreed scope. If a C3PAO identifies a material documentation gap within 30 days of final delivery, Cyber TQ will revise the affected deliverable at no additional service fee. This does not guarantee certification or cover client implementation failures.

This applies to documentation completeness — not to client implementation outcomes or C3PAO assessment methodology differences.

What's NOT covered: Gaps from incomplete implementation (you didn't follow our guidance), scope changes, or C3PAO interpretation beyond NIST 800-171.

Yes, if you have:

• 80-120 hours available
• Deep knowledge of NIST 800-171 (110 controls)
• Experience writing SSPs that C3PAOs accept
• Time to argue findings with auditors

40% of DIY attempts fail readiness review.

Our clients get audit-ready in 3-8 weeks with 98% first-attempt pass rate. The question isn't "Can you DIY?"—it's "Is your time worth $50-$80/hour?"

Advisory is optional but highly recommended. Here's why:

CMMC requires continuous compliance (not one-and-done). Your compliance posture drifts over time:

• Employees leave (policies not updated)
• Systems change (evidence gaps)
• NIST requirements change (policies outdated)
• SPRS scores decay (quarterly submission required)

Advisory keeps you audit-ready year-round. It's included free for 3 months with Accelerator so you can experience the value—then decide.

Clients who keep Advisory: 0% re-assessment fees
Clients who cancel Advisory: 15-20% need remediation before re-certification

Both include full 110-control assessment, SSP, POA&M, SPRS, and 90-day guarantee.

Accelerator adds:

• Priority scheduling (typical 3–6 weeks from kickoff vs 6–10 weeks standard)
• White-glove service (more hand-holding)
• 3-month Advisory trial included ($2,385 value)
• Dedicated compliance analyst
• Priority remediation (≤5 days vs ≤15 days)

Choose Readiness if: Standard timeline works, you have some internal bandwidth
Choose Accelerator if: Tight deadline, complex environment, or you want ongoing support

CUI Environment Navigator: 2-4 weeks
Level 2 Readiness: Typical 6–10 weeks from kickoff, dependent on client responsiveness and environment complexity
Level 2 Accelerator: Typical 3–6 weeks from kickoff, contingent on client responsiveness and environment complexity

Timeline depends on:

• Your availability for interviews (2-3 hours total)
• How quickly you provide evidence (network diagrams, policies, etc.)
• Complexity of your environment (50+ devices, multiple locations, cloud + on-prem)

We deliver on time 95% of the time. Delays are almost always client-side (waiting for info).

Yes—you select your C3PAO independently from the Cyber AB Marketplace. We don't certify and take no referral fees.

We'll help you:

• Understand C3PAO pricing (typically $35,000–$60,000+ depending on scope)
• Review your options (some C3PAOs are faster, some more thorough)
• Coordinate the handoff (send your deliverables, schedule readiness review)

We stay involved through the C3PAO readiness review (included in your 90-day guarantee). If they find documentation gaps, we fix them.

Yes. If you start with the CUI Environment Navigator and later confirm you need Level 2, we apply the full $4,995 as credit toward Level 2 Readiness or Accelerator if you upgrade within 90 days.

Small changes (additional endpoints, minor scope adjustments): We handle at no charge during your engagement.

Major changes (new CUI types, additional enclaves, significant scope expansion): We'll provide a change order with transparent pricing. Most scope changes add $1,500-$3,000.

We provide implementation guidance (how to configure firewalls, set up MFA, etc.), but we don't do hands-on technical work.

You or your IT provider implement the controls. We document them in your SSP and verify evidence.

If you need technical implementation help, we can recommend vetted MSPs in your area.

Advisory Partnership ($1,995/mo):

• Monthly check-ins
• Ongoing policy updates
• SPRS submission support
• Priority remediation (≤5 days)
• Cancel anytime with 30-day notice

Quarterly Care ($595/quarter):

• Quarterly check-ins only
• Policy updates (as needed)
• Evidence review for annual affirmation
• Standard remediation (≤15 days)

Choose Advisory if: You want continuous monitoring and fast response
Choose Quarterly if: You have internal bandwidth and just need periodic tune-ups

No. We prepare you for certification—C3PAOs perform the audit.

We're independent consultants. We receive no fees from C3PAOs. You choose your assessor based on your needs and budget.

This separation is required by CMMC rules and protects you (no conflict of interest).

Step 1: Book a free 30-minute consultation (877-933-4465)
Step 2: We scope your environment and confirm L1 vs L2
Step 3: You choose a package (Express/Readiness/Accelerator)
Step 4: We kick off within 2 weeks (or <10 days with Rush Service)
Step 5: You're audit-ready in 2-8 weeks