01
Gap assessment
We evaluate your environment against the requirements for your level and build a path to compliance.
CMMC readiness
From first scoping call to assessment-ready.
Working with Cyber AB Registered Practitioners, HARDAC prepares defense contractors for the CMMC level their contracts require, and supports them through self-assessment, certification, and annual affirmation.
01 — Methodology
Four stages to CMMC readiness.
Each stage produces evidence you keep, so the work holds up when an assessor or a prime asks to see it.
02
Remediation support
We help implement missing controls and develop the documentation that supports them.
03
Readiness review
We review your evidence and score your environment the way an assessor would, before the official assessment.
04
Assessment and affirmation
We support your self-assessment and SPRS submission, or your preparation for a C3PAO certification assessment.
02 — Services
What our CMMC engagements cover.
We scope each engagement to your level and your environment rather than selling a fixed package.
01
Scoping
We identify which systems, people, and facilities process, store, or transmit FCI or CUI, along with the security tools that protect them. A well-defined scope keeps effort and cost focused.
02
Gap assessment
We measure your current practices against the 15 Level 1 requirements or the 110 Level 2 requirements and deliver a prioritized remediation roadmap.
03
Remediation support
We work alongside your team to close gaps, from access control and multi-factor authentication to logging, configuration management, and incident response.
04
Documentation
We develop your system security plan, policies, procedures, and plan of action and milestones so your documentation matches how your organization actually operates.
05
Advisory and ongoing support
We help you maintain compliance through annual affirmations, scope changes, and new contract requirements.
03 — What you receive
Deliverables you keep.
Every CMMC engagement ends with documents you can hand to an assessor or a prime contractor.
Gap assessment report
Your posture against the requirements for your level, with each gap mapped and prioritized.
System security plan
Your system boundary, how each requirement is implemented, and who is responsible.
Plan of action and milestones
Not permitted at Level 1. At Level 2, limited to eligible requirements and closed within 180 days.
Policies and procedures
The written controls behind your plan, developed with your team.
04 — CMMC levels
Your contract sets the level.
Each level adds requirements and a stricter form of assessment. We prepare you for the one your contract names.
Foundational
For contractors that handle Federal Contract Information.
- Requirements
- 15 requirements from FAR 52.204-21
- Assessment
- Annual self-assessment
- Affirmation
- Annual, in SPRS
- POA&M
- Not permitted
Advanced
For contractors that handle Controlled Unclassified Information.
- Requirements
- 110 requirements from NIST SP 800-171 Rev 2
- Assessment
- Self-assessment or C3PAO, every three years
- Affirmation
- Annual, in SPRS
- POA&M
- Limited; closed within 180 days
Expert
For a limited set of high-priority defense programs.
- Requirements
- Level 2 plus selected NIST SP 800-172 requirements
- Assessment
- DCMA DIBCAC, every three years
- Prerequisite
- Final Level 2 status from a C3PAO
- POA&M
- Limited; closed within 180 days
05 — Who needs CMMC
Primes, subcontractors, and suppliers.
The requirement follows the information. If FCI or CUI reaches your systems, CMMC applies to you.
Prime contractors
When a contract carries a CMMC requirement, your status must be in place before award, and you must flow the requirement down to your subcontractors.
Subcontractors
A subcontractor handling only FCI needs Level 1. One handling CUI needs at least Level 2, matching the assessment type the prime contract requires.
Suppliers preparing to bid
Starting before a solicitation arrives gives you time to close gaps rather than racing a proposal deadline.
06 — Program status
Where CMMC stands today.
Self-assessment requirements are in effect now. DFARS 252.204-7012 still requires contractors to protect CUI.
Program rule effective
32 CFR Part 170 establishes the CMMC program and its three levels.
Phase I begins
Contracts may require Level 1 and Level 2 self-assessments as a condition of award.
Phase II suspended
The Department suspended the phase that would have required Level 2 C3PAO certification for many contracts.
DFARS 7012 still applies
Safeguarding, 72-hour incident reporting, and SPRS scoring remain contract requirements.
07 — FAQ
CMMC questions.
Have a question we did not answer? Call +1-615-219-9582.
What does a CMMC consultant do?
A CMMC consultant prepares you for assessment rather than performing it. That means scoping your environment, running a gap assessment, drafting your system security plan and supporting documents, guiding remediation, and reviewing your evidence before an assessor sees it.
Can HARDAC certify us?
No. HARDAC advises and prepares. Certification assessments are conducted by accredited C3PAOs at Level 2 and by DCMA DIBCAC at Level 3.
How long is a CMMC status valid?
Level 1 self-assessments are repeated every year. Level 2 and Level 3 assessments are valid for three years. At every level, an affirming official must affirm continued compliance in SPRS after each assessment and annually thereafter.
What should we prepare before an engagement?
Your contract language and any DFARS clauses, a description of the information you handle, a network diagram or system inventory, existing policies, and any current SPRS score.
How much does CMMC readiness cost?
Cost depends on your level, the size of your in-scope environment, and how many requirements you already meet. A C3PAO assessment fee, when one is required, is paid to the assessor and is separate from consulting. We scope each engagement after an initial consultation.
Get started
Start your CMMC readiness.
Speak with a Registered Practitioner about your contracts and the level you need to meet.