Whether you hold a Department of War (DoD) contract today or are preparing to bid on your first, Attest Advisory helps you meet its cybersecurity requirements. We work with you to implement and document NIST SP 800-171. Then we help you post a defensible SPRS score before award and keep it accurate through each annual affirmation. When CMMC Level 2 certification returns to DoD contracts, you'll already be ready.
Safeguard covered defense information with NIST SP 800-171 and report cyber incidents within 72 hours.
Have a current NIST SP 800-171 assessment score in SPRS to be eligible for award. This applies whether you hold a contract today or are bidding on your first.
Level 2 allows Conditional status at a score of 88 or higher with a Plan of Action and Milestones (POA&M) for eligible gaps. Those gaps must close within 180 days. Each requirement is worth 1, 3 or 5 points. Marking just a few as met when they aren't can overstate your score by 10 or 20 points.
On July 13, 2026, DoD suspended the move to mandatory third-party CMMC certification. A reform task force is now reviewing the program. Here is what that changes for your company and what it doesn't.
Updated October 13, 2026
Every engagement is built around one question: would this hold up in front of an assessor? You get documentation your team can maintain instead of a binder that goes stale. Engagements follow three steps. Most take six to twelve months from a cold start depending on how much is already in place.
We map where Controlled Unclassified Information (CUI) enters, lives and leaves. We categorize your assets and help you choose between an enclave and a company-wide boundary. We also review cloud and managed service providers (MSPs) for FedRAMP Moderate or equivalency.
We start by documenting your environment as it stands today. No generic templates. Your System Security Plan (SSP) shows how each of the 110 requirements is met or where it isn't yet. Policies and procedures are written around how your team really works. A shared responsibility matrix shows what your cloud providers and MSP cover.
Then we test that documentation the way a C3PAO would. We follow the CMMC Assessment Process through document review, interviews and live tests of evidence. Each of the 320 assessment objectives is mapped to the document and evidence that proves it. You find the weak spots before an assessor does.
Each requirement is scored with the DoD Assessment Methodology's point values of 5, 3 or 1. That gives you an SPRS score you can defend. We then build your POA&M within the CMMC rules.
Once your gaps are known, we help you implement the right controls. We work with your IT team or MSP and start with the highest-value gaps. Each fix is aligned to DFARS 252.204-7012. That includes preparing you to report cyber incidents within 72 hours with an incident response plan and the DoD-approved certificate for DIBNet reporting. Your SSP is updated as items close.
As remediation progresses, we help you update your SPRS score at key milestones such as reaching 88 or closing your final gaps. At 88 or higher with only eligible gaps left on your POA&M, you meet the threshold for Conditional CMMC Level 2 status.
After award, we can help keep that score accurate as your environment, scope or CUI boundary changes. Where your contract includes the CMMC clause (DFARS 252.204-7021), we can also review your controls and evidence before each annual affirmation of continued compliance. The official who signs it can then do so with confidence.
Employees pasting CUI into commercial chatbots can pull those tools into your assessment scope. AI also hides in less obvious places such as Microsoft 365 assistants, browser extensions, coding assistants or AI agents connected to company data. If CUI reaches a tool that isn't authorized to handle it, your SPRS score and annual affirmation are at risk.
We inventory the AI in use from sign-in records, network and endpoint data plus a short staff survey. Then we map where CUI could reach each tool. We help you choose a compliant path, such as keeping AI outside the CUI boundary or using an environment built for CUI like Microsoft GCC High. We also check AI vendors against the FY2026 NDAA's restrictions on certain foreign-owned AI. Finally, we write the policy, approved tools list and technical controls that keep CUI out, then update your SSP to match. This also prepares you for the AI security requirements DoD is developing as an extension of CMMC.
DoD still assesses against Rev 2, but the move to Rev 3 is coming. Rev 3 consolidates the 110 requirements into 97 across 17 families. It also adds organization-defined parameters that DoD has already set for defense contractors. We map your current SSP and controls to Rev 3 to show what changes for you. Then we build a transition plan so you aren't starting over when the deadline is announced.
NIST SP 800-171 Rev 2 groups its requirements into 14 families. Access control and system protection make up a third of the total. They are also where most assessments are won or lost.
| ID | Family | Reqs | |
|---|---|---|---|
| Total | 110 |
These are the 14 families of Rev 2, the version DoD assesses today. Rev 3 reorganizes them into 17 families and 97 requirements.
Richard Pratt is a cybersecurity consultant with 13 years of GRC experience. His current work centers on the Defense Industrial Base. He scopes FCI and CUI, assesses NIST SP 800-171 implementation under DFARS 252.204-7012 and guides SSP and POA&M development. He also prepares the assessment results behind contractors' SPRS scores under DFARS 252.204-7019 and their CMMC affirmations under DFARS 252.204-7021.
Before that, Richard led federal FISMA assessments built on NIST SP 800-53 and the Risk Management Framework. That work included Security Assessment Reports that supported authorization decisions. He also spent years on SOC 2, ISO 27001, PCI, HIPAA, FedRAMP and SOX engagements. Attest Advisory brings that federal assessment discipline to defense contractors without the overhead of a large firm. Every engagement is built the way an assessor will test it.
You work directly with Richard on every engagement, from the first scoping call to the final deliverable. You get plain answers about where you stand.
Attest Advisory is a consulting firm, not a C3PAO. CMMC rules bar the same organization from both preparing and certifying a contractor. We will never assess a company we have advised. When you are ready, we can refer you to authorized C3PAOs.
The pause affects when third-party certification appears in contracts. It does not change the requirement to implement NIST SP 800-171 today, post an accurate SPRS score and affirm it annually where CMMC applies. Companies that use this window to get ready will be in a far better position when certification returns. Their current affirmations will also be defensible in the meantime.
If you only handle Federal Contract Information, Level 1 usually applies. It covers 15 basic safeguarding requirements. If you receive or create Controlled Unclassified Information such as controlled technical drawings, you need Level 2. Your contracts, DFARS clauses and CUI markings tell us which. We sort this out on the first call.
Your SPRS score starts at 110. Each requirement that isn't fully met subtracts 1, 3 or 5 points. To reach Conditional Level 2 status with open items, the CMMC rule (32 CFR 170.21) requires a score of at least 88. Only 1-point requirements can go on the POA&M. The one exception is SC.L2-3.13.11. It can be included when your CUI is encrypted but the encryption isn't FIPS-validated. Six 1-point requirements can never be on a POA&M: AC.L2-3.1.20 (external connections), AC.L2-3.1.22 (publicly accessible content), CA.L2-3.12.4 (system security plan) and PE.L2-3.10.3, 3.10.4 and 3.10.5 (escorting visitors, physical access logs, physical access devices). Every POA&M item must be closed and verified within 180 days. We check each gap against these rules. You know before an assessor does which items can wait and which must be fixed first.
Not yet for scoring. Your SPRS score, affirmations and any assessment are still based on Rev 2. DoD has signaled the transition is coming, though. Rev 3 also rewrites and consolidates many requirements. Mapping your environment to Rev 3 now avoids a second round of documentation later.
A C3PAO is authorized to perform the official certification assessment. We help you get ready for it through scoping, documentation, an assessor-style gap assessment and remediation guidance. CMMC rules keep those roles separate to protect the integrity of your certification.
Commercial AI tools are generally not authorized to process CUI. If CUI reaches them, they may fall inside your assessment scope and create a compliance problem. One option is keeping AI tools out of the CUI boundary with technical controls. Another is using an environment built for CUI such as Microsoft GCC High. Our AI tool review covers this.
Your MSP configures and runs your systems. We make sure what they build satisfies each assessment objective with the right documentation and evidence. We work alongside your MSP. We also review their own role as an external service provider in your scope.
Very likely. Engagements are delivered remotely for contractors anywhere in the United States. On-site visits are available when an assessment needs them.
No cost and no obligation. We'll cover:
contact@attest-advisory.com