CMMC Compliance Services

No, and be cautious of anyone who claims they are. Certification is granted by an independent, accredited third-party assessor (a C3PAO); no consultant or IT provider can both prepare you and certify you, because the rule deliberately separates those roles. What LRG provides is the readiness work, assess, document, remediate, and manage the controls, so that when your official assessment comes, you pass on the merits.

Five things, delivered as one continuous engagement: a gap assessment against NIST 800-171 with your current SPRS score, a written System Security Plan (SSP), a Plan of Action & Milestones (POA&M) for the gaps, the hands-on remediation work to close them, and ongoing management to keep the controls in place. The advantage of one team doing all of it is continuity, the people who find the gaps are the people who fix and maintain them.

Very likely yes. If Controlled Unclassified Information, or even basic Federal Contract Information, flows down to you from a prime, you carry the same obligation they do, usually CMMC Level 2. This reaches well beyond obvious defense contractors: the Gulf Coast's shipbuilding and marine-fabrication economy around Mobile Bay pulls in machine shops, engineering firms, and marine-trades vendors who don't think of themselves as 'defense contractors' at all, until a prime suddenly requires their SPRS score before the next purchase order.

The System Security Plan (SSP) describes how your business meets each required control; the Plan of Action & Milestones (POA&M) records any gaps and your plan to close them. Together they're the paperwork the DoD expects to see, and a credible POA&M is often what keeps you eligible to bid while remediation is still underway. We write both with you rather than leaving you to assemble them yourself.

Plan for months, not weeks, the timeline depends on how mature your IT is today. On cost: published 2026 industry benchmarks put a small business's first-year Level 2 readiness (assessment plus remediation) at roughly $75,000–$150,000, with ongoing annual maintenance closer to $20,000–$40,000, that's market data, not an LRG quote, and your real number depends entirely on how far you're starting from. A business with solid IT hygiene might land toward the low end and be ready in a few months; one starting from scratch on MFA, encryption, logging, and documentation should expect longer and higher. We scope and price the actual work after a readiness assessment, so you get a real number instead of an industry average. The biggest cost driver is waiting, remediation and a third-party assessment both take time to schedule.

Yes, it's live now, this isn't hypothetical. The DFARS rule enabling CMMC requirements in new DoD solicitations and contracts took effect November 10, 2025, and Phase 2, mandatory third-party C3PAO assessments for most CUI contracts, begins November 10, 2026. If you're waiting for it to feel 'real' before you act, the window to prepare without rushing is already closing.