CMMC readiness support
Your next step starts with the right specialist.
Tell us about your business, your readiness stage and the help you need. Submit a request to discuss your needs with a CMMC consultant.
A clearer search. A more useful first conversation.
Start with the support you need
Understand the types of help available before discussing scope, responsibilities and costs with a consultant.
Understand your starting point and prioritize the work ahead.
Turn identified gaps into practical technical and operational changes.
Explore help maintaining your environment, processes and evidence.
Understand the starting point
The model has three levels. The information you handle and your contract requirements matter more than your company’s size or industry label.
Level 1
15 requirements for Federal Contract Information (FCI). The model uses an annual self-assessment.
Level 2
110 requirements from NIST SP 800-171 Revision 2 for Controlled Unclassified Information (CUI). Confirm the applicable assessment route.
Level 3
24 selected enhanced requirements in addition to the Level 2 baseline, for designated higher-risk requirements in the model.
Implementation update, October 9, 2026: Phase II is suspended and Phase I self-assessment requirements continue. A model level and a rollout phase are different things. Check your actual contract and current official guidance.
What to compare
Use these six questions to make your first conversations more useful and your comparisons more consistent.
Can they trace controlled unclassified information (CUI) through your business and help define a clear boundary?
Can they turn identified gaps into practical technical and operational changes your team can maintain?
Will the documentation describe your actual environment, supported by evidence of what you do?
How will they help your team prepare for interviews, testing, and evidence review?
Are responsibilities, deliverables, exclusions, and ongoing expenses clear before work begins?
Will they disclose conflicts and clearly distinguish consulting support from formal assessment services?
A clear next step
Provide a high-level description of your business, readiness stage and the kind of help you want to discuss.
Discuss relevant experience, scope, responsibilities and costs before deciding whether to move forward.
Agree on the time, participants and purpose. A meeting request does not confirm a booking.
You don't need every answer yet.
Not sure which kind of support you need? Start with a high-level description of your situation and the questions you want to discuss.
Keep requests high-level. Do not include CUI, passwords or an SSP. A request does not confirm a meeting.
A little more clarity
CMMC stands for Cybersecurity Maturity Model Certification. It is the U.S. defense department’s program for assessing how contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Start with the information your systems handle and the requirements in your solicitation, contract and applicable subcontract. Read our CMMC meaning, levels and readiness checklist.
Depending on the engagement, a consultant may help clarify scope, identify gaps, plan remediation, develop documentation, or support implementation. Ask each provider exactly what is included.
No. Readiness support and a formal assessment are different services. CMMC Shortlist helps you explore readiness support and does not provide certification or promise an assessment outcome.
Ask about relevant experience, the proposed scope, who will do the work, deliverables, costs, and how responsibilities will be shared with your team. Verify any credentials directly with the appropriate issuing organization.
Templates can provide a useful starting structure. Your final policies, procedures, and supporting evidence must accurately reflect your environment, responsibilities, and actual practices. Ask who will tailor and validate them.
No. GCC High is not a blanket requirement for every contractor or every environment. The right approach depends on the information you handle, applicable requirements, and system design. Ask a specialist to explain the fit and alternatives before committing to a platform.
No. A request is a starting point for discussing your needs. Meeting details and any costs need to be confirmed separately. Submitting the request form does not confirm availability or create a consulting engagement.
Keep the description high-level: your business, readiness stage and the support you want to discuss. Do not include CUI, passwords, a system security plan (SSP), or sensitive technical documents. Review the privacy notice before sharing contact information. The initial request should never include sensitive technical material.