Starting November 10, 2026, new DoD contracts that involve CUI will require third-party CMMC Level 2 certification — self-attestation stops being enough. If your shop handles controlled drawings and hasn't started, you're late. You're not out. Atom8 gets small defense subcontractors assessment-ready on a fixed price, and coordinates the certification.
Every requirement you miss subtracts weighted points from a maximum of 110. In our assessments, a typical small subcontractor that hasn't formally tackled 800-171 meets roughly half the requirements — and lands below zero. Certification needs 88 or better with a plan for the rest.
*A score of 88–109 with a Plan of Action & Milestones can earn Conditional Level 2 at assessment — remaining items must close within 180 days, and certain high-weight requirements can't be deferred at all. That's why sequencing matters as much as effort.
The path below reflects how we actually run it: shrink the assessment boundary first, knock out the highest-weight controls early, and get in the assessor queue before it fills.
Gap assessment across all 110 requirements. You get your real SPRS score, a prioritized roadmap, and a POA&M — not a lecture.
Scope a CUI enclave to shrink cost, migrate CUI to a FedRAMP-authorized environment, land the 5-point controls (MFA, FIPS crypto) first.
System Security Plan, policies, and an evidence register an assessor can actually follow. No SSP, no certification — full stop.
Internal mock assessment against 800-171A objectives, then we coordinate your C3PAO — whose queue you want to be in early.
Only handle FCI, not CUI? Level 1 readiness is a flat $3,500. Billed separately in every engagement: the independent C3PAO's certification fee (typically $30k–60k for small firms) and cloud licensing, passed through at partner rates.
You approve a number before work starts. No discovery retainers, no hourly meter running while you learn acronyms.
The person who assesses you is the person who remediates and preps you for the assessor. Nothing gets lost in handoffs.
SSP, scoring workbook, policies, and evidence register in the structure C3PAOs expect — see the sample below before you spend a dollar.
An enclave approach that keeps your CNC floor running and your assessment boundary — and cost — as small as defensibly possible.
Under the CMMC program, the certified assessment organization (C3PAO) that audits you is barred from consulting for you on the same scope. Anyone offering to do both is a red flag.
Atom8 sits deliberately on the preparation side: we get you ready, assemble the evidence, and coordinate with the independent assessor of your choice. The certification decision stays theirs — which is exactly what makes it credible to your primes.
We built a full engagement for a fictitious 42-person machining subcontractor: scoping, gap assessment with a real SPRS calculation, remediation deliverables, readiness attestation, and ongoing reporting. It's exactly what you'd receive.
Two quick checks: does DFARS 252.204-7012 appear in your contracts or POs, and do you receive technical data with distribution statements or export-control markings? If yes to either, you almost certainly handle CUI and will need Level 2. If you only handle Federal Contract Information (FCI), Level 1 self-assessment applies instead — a much lighter lift we also cover.
No — but the window for a comfortable path has closed. Remediation for a typical small shop runs 8–12 weeks after a 2–3 week assessment, then you need an assessor slot. Starting now positions you for assessment in the first half of 2027, with your documentation defensible to primes in the meantime. Waiting past this year genuinely risks contract eligibility.
Industry-wide, small contractors typically spend $75k–150k in the first year all-in. Our readiness work is fixed-price (assessment $4,950; remediation from $19,500). The independent assessor's fee — commonly $30k–60k for small firms — and cloud licensing are separate and paid directly. We keep both down by shrinking your assessment boundary.
Not for long, and not for CUI. Since November 2025, self-assessment has been required as a condition of award in applicable contracts; beginning November 10, 2026, applicable CUI contracts require third-party (C3PAO) certification. And self-attesting inaccurately is worse than not attesting — the DOJ has recovered tens of millions under the False Claims Act from contractors whose scores didn't match reality.
No — and be wary of anyone who says they can prep you and certify you. Certification comes only from an independent C3PAO, which is prohibited from consulting on what it assesses. We prepare you, then coordinate the assessment.
Yes — that's our core client. The workload lands on us, not your IT person: we design the enclave, implement controls, write the SSP and policies, and hand your team a defined operating rhythm. Your part is decisions and access, roughly a few hours a week during the sprint.
One call: we confirm whether Level 2 applies to you, estimate your likely score range, and map what's achievable before your next re-compete. If we're not the right fit, we'll tell you.
Book my free scoping call