Framework / HIPAA
CMMC READINESS
NIST 800-171 gap analysis, System Security Plan, POA&M, and SPRS score support for defence contractors. Built around what your contract requires today.
DELIVERED THROUGH
A Cloudsapio vCISO engagement
engagement levels
Advisor · Consultant · Leader
TYPICAL TIMELINE
10–20 weeks, depending on CUI scope
tHE PROBLEM
A prime asked for your SPRS score and you don't have one
Since November 2025, CMMC requirements have appeared in new DoD solicitations, and primes have been pushing them down their supply chains ever since. If you handle Federal Contract Information or Controlled Unclassified Information, you are expected to have self-assessed against NIST 800-171, submitted a score to SPRS, and be able to show a System Security Plan behind it.
The programme has also just shifted. In July 2026, the Department suspended the third-party certification phase pending a review, which has left a lot of contractors unsure whether to keep spending. The obligations underneath did not move. Self-assessments, SPRS submission, annual affirmation, and DFARS 252.204-7012 all still apply, and the signature on that self-assessment is yours. False Claims Act exposure sits with the person who signed, not with an assessor.
We do the assessment work, write the documentation, and get your score to something you can defend.
WHAT YOU GET
Deliverables
CMMC readiness for defence industrial base contractors. NIST 800-171 control coverage, System Security Plan authoring, POA&M development, SPRS scoring, and assessment readiness.
01
Kickoff call and scope confirmation
02
FCI and CUI identification, and the data flow that shows where it lives
03
CUI enclave scoping guidance, including whether to segment rather than assess your whole environment
04
NIST 800-171 control-by-control gap analysis across all 110 controls
05
SPRS score calculation and submission support
06
C3PAO selection and coordination support, if you choose to pursue certification
fit
Who is this for
Prime contractors, subcontractors, and manufacturers in the defence industrial base.
The questions that come up on every first call.
-
CMMC was paused. Do we still need to do this?
Only part of it was paused. In July 2026 the Department suspended the third-party certification phase and the milestones after it. Self-assessments, SPRS scores, annual affirmations, and DFARS 252.204-7012 remain in force, and the Department has said it will keep enforcing NIST 800-171 through self-assessment and government-led checks. A review is due to report in mid-September 2026. Contractors who stopped work will be behind whatever comes next.
-
Our prime still wants certification. Does the pause override that?
No. Primes can require whatever they want in a subcontract, and many are holding their expectations regardless of the federal timeline. Ask each prime in writing what they still expect and when. The clause on your existing contract also stays until that contract is actually modified.
-
What is a SPRS score and why does it matter?
Six to ten weeks to a documented programme for most companies, depending on how much PHI mapping is involved and how many technical gaps we find.
-
How much of my team's time does this take?
Expect five to eight hours a week from an IT or engineering lead during remediation, and about an hour a week from you for decisions and sign-off. CMMC touches more infrastructure than SOC 2 does, so the technical load is heavier.
-
Can we reduce the scope?
Usually, yes, and this is where most of the cost saving is. If CUI can be contained in a defined enclave rather than sprawling across your whole network, the assessment boundary shrinks and so does the remediation bill. We look at this in week one.
RELATED CAPABILITIES
Ready to move faster?
Too much to do,
too important to ignore.
Start with a 30-minute discovery call. If we're not the right fit, we'll tell you and point you in the right direction. If we are, we'll leave the call with a clear plan to get you up and running.