# CMMC 2.0 Level 1 & 2 Readiness (NIST SP 800-171)

> From $9.5K · Compliance & GRC · https://cisomarketplace.services/services/cmmc-level-1-2-readiness

For contractors handling FCI or CUI. We scope the CUI boundary, assess all NIST SP 800-171 practices, calculate and document your SPRS score, write the System Security Plan and POA&M, and prepare you for self-assessment or a C3PAO assessment. CMMC phase-in dates have moved more than once; NIST SP 800-171 and DFARS 252.204-7012 obligations apply regardless, so we plan against the requirement rather than a single deadline.

## In scope

- CUI / FCI scoping and enclave boundary definition
- NIST SP 800-171 practice-by-practice gap assessment
- SPRS score calculation and documentation
- System Security Plan and POA&M authoring
- Self-assessment or C3PAO assessment preparation

## Deliverables

- Gap assessment report with SPRS score
- System Security Plan (SSP)
- Plan of Action & Milestones (POA&M)
- Assessment-readiness checklist

## Tiers

### Essential CMMC Level 1 Readiness: $9.5K

FCI only: 17 practices, self-assessment package and annual affirmation support

Limits: users 100, locations 2

Excludes:
- CUI — Level 1 covers FCI only
- SSP and POA&M authoring

### Advanced CMMC Level 2 Readiness: $22K

CUI, single enclave up to 250 users: full 110-practice gap assessment, SPRS score, SSP and POA&M

Limits: users 250, locations 3

### Enterprise CMMC Level 2 Program: $45K

Multiple enclaves or 250+ users: adds enclave design, remediation oversight and a mock C3PAO assessment

Limits: users 2500, locations 15

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=cmmc-level-1-2-readiness