Defense contractors are getting $75,000–$150,000 consultant quotes for CMMC readiness. Aegis Firma takes you through the full 110-control NIST 800-171 program for a fraction of that — and every deliverable is yours to keep, with no expiration.
No credit card for the free check · deterministic scoring, no AI guesswork
Still in force
DFARS 252.204-7012, self-assessment, SPRS score, annual affirmation
110
NIST 800-171 controls across 17 domains
$2,499
one-time Level 2 readiness package
You own it
every deliverable is yours to keep
On July 13, 2026 the Department of War suspended CMMC Phase 2 — the phase that would have let a contracting officer require a C3PAO Level 2 assessment as a condition of award from November 10, 2026 — and froze the later phases pending a reform review. What did not change: DFARS 252.204-7012, your Level 1 and Level 2 self-assessments, NIST SP 800-171 Rev 2 implementation, your SPRS score, and your annual affirmation. The program rule was not repealed; a reformed version is expected to follow the review.
Your SPRS score is already visible to every contracting officer who looks. A low or stale score is a disadvantage on every bid, and a negative score with no remediation plan can take you out of the running entirely.
The usual answer is a consultant engagement quoted at $75,000 to $150,000 — where the consultant keeps the templates and you re-hire them next year. Aegis Firma is built the opposite way: you run the program, and the SSP, POA&M, and evidence are yours to keep with no expiration.
Assess
Answer the 110 NIST 800-171 control questions across all 17 domains. Get your SPRS score and your top gaps in one session.
Document
Generate a System Security Plan with narratives specific to your environment, and a POA&M with a 180-day remediation timeline.
Evidence
Collect and store evidence in a cryptographically signed vault with a tamper-evident audit trail — the artifacts a C3PAO asks to see.
Stay ready
Optional monitoring keeps your 110 controls, annual affirmation, and DFARS flow-down current after your initial package.
Full 110-control gap assessment
Every NIST SP 800-171 Rev 2 control scored, with failing controls ranked by SPRS point impact.
System Security Plan generator
An SSP with customer-specific narratives, generated from your assessment answers — not a blank template.
Mock C3PAO assessment
A practice run scoring the NIST 800-171A assessment objectives across all 110 controls, so the real assessment holds no surprises.
POA&M with 180-day timeline
Every gap tracked as a Plan of Action & Milestones item, with owners and target dates.
DFARS subcontractor flow-down
Templates to flow CMMC requirements down to subcontractors who touch CUI — a prime contractor liability.
Signed evidence vault + audit trail
Ed25519-signed evidence storage with a tamper-evident audit trail. All deliverables are yours to keep, with no expiration.
What Aegis Firma is not
Aegis Firma is not a C3PAO and does not issue your CMMC certificate — only an authorized C3PAO can do that. What it does is get you to their door fully prepared: the SSP written, the POA&M built, the evidence collected, the SPRS score known. It does not replace your assessor; it makes sure the assessment is not the first time you have seen these questions.
Pricing
The CMMC Level 2 Readiness Package is $2,499 one-time, and every deliverable is yours to keep. Add Level 2 Monitoring at $199/month to stay current — or choose the Federal plan if you would rather spread the cost across the full platform.
See full pricingCMMC Phase 2 is suspended — is any of this still required?
Yes. The CMMC Final Rule took effect December 16, 2024 and the program began rolling out in phases. On July 13, 2026 the Department of War suspended Phase 2 — third-party C3PAO assessment as a condition of award, which was to begin November 10, 2026 — and froze the later phases pending a review by a CMMC Reform Task Force. A follow-up directed that Level 2 and Level 3 assessment requirements be removed from active solicitations and contracts. This is a policy suspension, not a repeal: the 32 CFR program rule and the DFARS were not rescinded, and Phase 1 Level 1 and Level 2 self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS score posting and annual affirmations all continue to apply.
We are a subcontractor — does CMMC apply to us?
Yes, if you handle CUI. DFARS 252.204-7021 requires prime contractors to flow CMMC requirements down to subcontractors who touch CUI. Many subs first learn this when a prime asks for their SPRS score. Aegis Firma includes the flow-down templates and a subcontractor tracker.
Is $2,499 really all-in?
The $2,499 CMMC Level 2 Readiness Package is a one-time purchase, and the deliverables are yours to keep with no expiration. Ongoing monitoring is an optional $199/month subscription. There is no consultant retainer and no per-document fee.
Do we still need a C3PAO?
For CMMC Level 2 at the assessed level, yes — certification is issued by an authorized C3PAO. Aegis Firma gets you assessment-ready; it does not replace the assessor. Level 1 is a self-assessment, which Aegis Firma supports end to end.
Run the free CMMC self-assessment and see your SPRS estimate and top gaps before you spend a dollar. Your score is visible to contracting officers today, suspension or not.