# Defense Industry Security Program

> From $12.5K · Compliance & GRC · https://cisomarketplace.services/services/defense-industry-security

Comprehensive security assessment and compliance program for defense contractors and military industrial complex, focusing on CMMC, NIST 800-171, and classified information handling.

## In scope

- CMMC compliance assessment
- Classified information handling review
- Supply chain security evaluation
- Physical security assessment
- Insider threat program evaluation

## Deliverables

- Defense security architecture
- CMMC readiness report
- Classified data handling procedures
- Supply chain risk analysis
- Security program documentation

## Tiers

### Entry — market-sized scope: $12.5K

CMMC Level 2 / NIST SP 800-171 gap assessment of 1 enclave at 1 location, up to 50 employees: all 110 requirements scored from interviews and document review, with a gap report and a draft plan of action. No documentation writing.

Limits: employees 50, locations 1

Includes:
- Assessment of the 110 NIST SP 800-171 requirements
- Scoping of the CUI boundary for 1 enclave
- Scored gap report
- Draft plan of action and milestones
- Readout call

Excludes:
- System Security Plan or policy writing
- Supply chain, physical security and insider threat reviews
- Control implementation
- Level 3 preparation

### Core Defense Security Assessment: $85K

CMMC Level 1-2 readiness for up to 250 employees, up to 2 locations and up to 10 suppliers: gap assessment, System Security Plan and policy set, review of classified / controlled information handling, physical security assessment of each site and supply chain risk analysis.

Limits: employees 250, locations 2, vendors 10

Includes:
- CMMC Level 1-2 gap assessment and readiness report
- System Security Plan and policy documentation
- Classified / controlled information handling procedures
- Physical security assessment of up to 2 sites
- Supply chain risk analysis for up to 10 suppliers

Excludes:
- CMMC Level 3 preparation
- Insider threat program evaluation
- Hands-on control implementation
- The certification assessment itself

### Advanced Defense Security Program: $150K

CMMC Level 2 with third-party (C3PAO) assessment preparation: remediation oversight, evidence library and a mock assessment, plus supply-chain flow-down review.

Limits: employees 1000, locations 5, vendors 25

Excludes:
- Program management of the full implementation
- Mock assessment before certification
- The certification assessment itself

### Enterprise Defense Security Solution: $250K

CMMC Level 3 preparation (NIST SP 800-172 enhanced requirements, DIBCAC-assessed) and multi-enclave program management. CMMC 2.0 has three levels; there is no Level 4 or 5.

Limits: employees 5000, locations 15, vendors 75

Excludes:
- The certification assessment itself (performed by an independent assessor)
- Facility clearance sponsorship
- Purchase of security tooling
- Managed security operations

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=defense-industry-security