How to Choose a CMMC Consultant

We sell services in this space, so read this with that in mind. It is still worth writing down, because the most expensive mistakes here are made in the first conversation rather than in the work.

Software and consultants solve different problems

Compliance software is good at holding state. It tracks which requirements are met, stores evidence against them, reminds you when something needs reviewing, and produces reports. Over a multi-year programme that is genuinely valuable, and it is the part that decays fastest when done in spreadsheets.

What it cannot do is decide what your contracts require, draw your CUI boundary, or judge whether your MFA implementation satisfies the objectives under 3.5.3. Those are judgement calls made against conventions, and a platform that asks you to self-attest per requirement will faithfully record whatever you tell it.

A consultant is for the judgement. Scoping, objective-level assessment, and the documentation conventions an assessor expects. The risk is the mirror image: advice that arrives as a report and leaves nothing behind that you can maintain.

Most contractors end up needing both, in that order — judgement first to establish the position, software afterwards to hold it.

Questions worth asking

• How do you scope? If the answer does not involve tracing where CUI actually enters and rests, the engagement will assess the wrong environment competently.
• Do you assess at objective level? There are 320 objectives under the 110 requirements. An assessment at requirement level will produce a number that looks better and means less.
• What do I own at the end? The SSP, the POA&M and the evidence package should be yours, in a format you can edit, without a subscription.
• What happens when your recommendation is impractical? An enclave that engineering will route around is worse than no enclave. Listen for whether they have views on adoption or only on architecture.
• What are your independence constraints? Particularly relevant if they are affiliated with a C3PAO.

Claims that should slow you down

“We’ll get you certified.” Third-party certification is suspended. Anyone selling it today is either behind on the regulation or hoping you are.

“Guaranteed 110.” Nobody can guarantee a score they do not control, and a first honest assessment of an unprepared environment is frequently negative. A partner promising a perfect score is promising a particular set of answers, not a particular set of controls.

“You just need our platform.” No platform scopes your boundary. That work is done by people looking at your systems.

Anything that treats the suspension as the end of the obligation. DFARS 252.204-7012, 7019 and 7020 are all still in force. A partner who does not know that is not following the regulation closely enough to advise on it. See program status.

How engagements are priced, and what that tells you

Three shapes are common, and the shape reveals more about the engagement than the number does. Fixed-fee for a defined deliverable — a scoped boundary, a scored position, a documentation set — is the easiest to compare and the easiest to hold someone to, provided the deliverable is described precisely enough that you would know if it were missing. Time and materials is honest for remediation, where the work genuinely cannot be sized until the assessment is done, and dangerous for assessment itself, where an unbounded scope tends to grow. Subscription suits ongoing maintenance and suits nothing else; a one-off scoping exercise billed monthly in perpetuity is a financing arrangement wearing a service’s clothes.

The useful test is whether a quote changes when your environment turns out to be larger than described. A partner who has scoped properly will have asked enough questions that it should not, and will say so. A quote produced without any question about how many systems touch CUI is a quote for an unknown quantity of work, and the adjustment arrives later. See what compliance actually costs for the line items a credible quote should account for.

What good looks like

A partner who starts with your contracts rather than your network. Who scopes before scoring. Who gives you a lower number than you expected and explains exactly where it came from. Who leaves you with documents you can maintain and a plan ordered by points per unit of effort rather than by what is easiest to sell.

And who will tell you when you do not need them — that you are a Level 1 organisation holding only FCI, and the Level 2 programme you were about to buy is for someone else. That conversation is rarer than it should be, and it is the clearest signal you are dealing with someone honest. Start with the clause test.