CMMC gap assessment
For Level 2, we review the 110 NIST SP 800-171 Rev. 2 requirements, calculate an SPRS score and provide a prioritized gap report. The L1 Starter provides an SPRS overview.
CMMC and NIST 800-171 readiness
Plan your CMMC work with a gap assessment.
ThinkCodec provides fixed-fee CMMC readiness consulting for defense contractors in Dallas-Fort Worth and Chicago. We assess gaps, document preparation work and help you scope Level 1 or Level 2 support.
What the work involves
DoD estimated $5,977 for a small contractor's Level 1 assessment and initial affirmation.
DoD estimated $104,670 over three years for a small contractor's Level 2 certification assessment and affirmations.
These models cover contractor staff time and outside help in 2023 dollars with safeguards already implemented; our consulting fee does not replace those costs.
"Public marketing site and guest Wi-Fi. Validate that no FCI crosses into either."
What we deliver
SSP and remediation planning
For Level 2, we document your System Security Plan and support remediation planning. An assessment POA&M is permitted only for eligible unmet requirements under 32 CFR 170.21. Level 1 permits no POA&M under 32 CFR 170.15(a)(1).
Remediation support
The L2 Certification Sprint provides hands-on remediation alongside your team. Managed compliance covers ongoing evidence maintenance and an annual SPRS refresh.
Fixed-fee packages. You know the number before we start.
CMMC L1 Starter
from $3,500
Scope assessment, essential policies & procedures, basic evidence guidance, SPRS overview, and one coaching call. For contractors handling FCI and Level 1.
CMMC L2 Readiness
from $14,900
Full 110-requirement gap workshop, populated SSP, remediation planning with an assessment POA&M only where permitted, policy kit, evidence checklist, SPRS walkthrough, and two pre-assessment coaching calls. The CMMC Level 2 assessment baseline is NIST SP 800-171 Rev. 2 under 32 CFR 170.14(c)(3). Any Rev. 3 mapping is separate preparation work, outside the CMMC assessment baseline.
L2 Certification Sprint
$25,000 to $45,000
Hands-on remediation alongside your team, scoped to your starting gap and timeline.
vCISO and Managed Compliance
from $1,500/mo
Ongoing compliance upkeep, evidence maintenance, and an annual SPRS refresh.
Every engagement starts with a free gap call to scope your situation. How long the L1 Starter or L2 Readiness takes depends on what you need and how quickly we get the information we ask for. ThinkCodec provides readiness consulting. An authorized C3PAO performs the final certification assessment.
Model Level 2 assessment-support labor
DoD's small-entity Phase 2 defaults:
"A director (MGMT5) for 64 hours ($190.52/hr x 64hrs = $12,193)"
"An external service provider (ESP) for 128 hours ($260.28/hr x 128hrs = $33,316)"
Source: DoD, Federal Register, October 15, 2024, page 83186.
Formula: director hours x director hourly rate + provider hours x provider hourly rate.
Using the published hours and rates: 64 x $190.52 + 128 x $260.28 = $45,509.12 in modeled Phase 2 support labor.
Modeled Level 2 certification Phase 2 support labor
excluding the C3PAO fee and other phases. This models assessment effort with safeguards implemented, not remediation or savings from hiring us.
How it works
1
Free gap call
The free gap call lasts 30 minutes. We discuss your contract request and scope the preparation work.
2
Gap assessment
The assessment documents gaps and preparation steps; remediation depends on the selected package.
3
Implementation
In our L1 sample, the company implements safeguards, verifies evidence and submits its own assessment and affirmation. ThinkCodec provides readiness guidance.
Common questions
Does CMMC apply to my company?
Bring your contract request and the FCI or CUI involved to the free call so we can discuss what to scope.
What does it cost?
Fixed-fee packages starting at $3,500 for Level 1 and $14,900 for Level 2. Book the free call to discuss your scope.