How to Choose a CMMC Consultant

How to Choose a CMMC Consultant

Hiring a CMMC consultant is one of the first big decisions a contractor makes on the way to Level 2. A good one saves months. A bad one costs money and leaves you with documents you cannot defend. Here is how to tell them apart before you sign.

What a CMMC Consultant Does

CMMC consulting covers the work between deciding to pursue Level 2 and sitting for the assessment. The usual list includes scoping your environment, a gap assessment against NIST SP 800-171, writing the System Security Plan and policies, planning fixes, gathering evidence, and running a mock assessment.

What a consultant cannot do is certify you. Your status comes from an assessment, and our CMMC Level 2 guide explains the two forms it takes. Several roles get mixed up in this process, so here is how they differ.

If your gap is security leadership and not project help, read our post on the virtual CISO role. If the gap is day-to-day IT, look at managed IT services for defense contractors.

Types of CMMC Consulting Services

Most engagements mix two or three of these. Our CMMC readiness assessment is an example of the gap and mock assessment type, and managed CMMC compliance covers the ongoing type.

What Credentials Do and Do Not Tell You

The Cyber AB lists Registered Practitioners and Registered Provider Organizations in its marketplace. You will see the abbreviations RP and RPO often. A listing tells you the person or firm is part of the program. It does not mean they can assess you, and it does not guarantee they have done this work for a company like yours.

Treat credentials as a starting point. Ask how many Level 2 engagements the firm has completed, ask for references from companies of your size, and ask to meet the people who will do the work.

Independence and Your Assessor

The firm that prepares you and the firm that assesses you should not be tied to each other. Under 32 CFR 170.9, a C3PAO has to follow the Accreditation Body’s policies on conflict of interest, code of professional conduct, and ethics. The regulation points to those policies and does not spell them out here, so ask for them.

Put the question to both sides. Ask a consultant whether the firm also performs assessments and how it keeps the two apart. Ask a C3PAO for its conflict of interest policy in writing, and for what it will not do for a company it assesses. Do this before you sign with either one, since a conflict found late can cost you time. Our page on C3PAO certification describes what the assessment side involves.

Who Touches Your CUI

A consultant who works inside your environment or holds your documents is handling sensitive information. The rule defines an External Service Provider as outside people, technology, or facilities that provide and manage IT or cybersecurity services for you, and it ties that status to CUI or security protection data being processed, stored, or transmitted on their assets.

So ask plain questions. Where will your documents and evidence be stored? Which tools will the consultant use to reach your systems? How is that access approved, logged, and removed at the end? If your CUI sits in Microsoft’s government cloud, our guide to GCC High for CMMC compliance explains why the answers matter.

Questions to Ask Before You Sign

1. How many Level 2 engagements have you finishedAsk for references from companies near your size and in your industry.
2. Who will do the workGet names. Some firms sell with senior people and staff the job with junior ones.
3. What are the written deliverablesThe scope should list the documents, reports, and meetings you receive, with dates.
4. What do you need from my teamControl owners must be involved. A consultant who says they will handle it all without your people is setting you up for a hard interview.
5. How do you handle my CUIAsk where it is stored, who can reach it, and how access ends.
6. What is your policy on assessor independenceAsk whether the firm also assesses, and how the two are kept apart.
7. What happens to the documents if we stopThe SSP, policies, and templates should belong to you.
8. What do you not doA firm that is clear about its limits is easier to trust than one that does it all.

Red Flags

• A guarantee that you will pass or be certified.
• A fixed price with no written scope or deliverables.
• Generic templates handed over with your company name swapped in.
• No named people, no references, or no willingness to explain past work.
• Pressure to buy specific tools before anyone has scoped your environment.
• Vague answers on where your CUI will live during the engagement.

What CMMC Consulting Costs

We do not print a price range here, because the published numbers come mostly from vendors, rarely cite a source, and differ too much to trust. Price follows the size of your environment, the number of gaps, how much of the work the firm does and how much your team does, and how long the engagement runs. Ask for a written scope with deliverables and hours, then compare quotes on that basis.

Cost is also tied to timing. Gaps found early are cheaper to fix than gaps found by an assessor. Our post on CMMC assessment preparation best practices covers how to test your program before the real assessment.