By: David Dillow, CTO, Greypike Inc.
Last updated: November 1st, 2026
When I walk the floor at defense conferences, I hear the same story from small business owners. They hired someone to “get them CMMC compliant.” Six months and a lot of money later, they have a binder of policies, a SPRS score nobody can explain, and no idea whether they would pass an assessment.
The consultant wasn’t always the problem. Usually the business didn’t know what to ask before signing. In my 20+ year government career I was always taught, never assume anything. That goes double when you’re picking who will build your compliance program.
This is the checklist I’d use if I were buying.
BLUF
Choose a CMMC consultant who scopes your environment before quoting, gives you a price in writing, is trained and registered through the Cyber AB, does not also assess you, and leaves you owning your System Security Plan and evidence. Walk away from anyone who guarantees certification, promises a perfect SPRS score of 110 before seeing your network, or won’t put the scope in writing.
Key takeaways
- Scope first, price second. A quote without a scoping conversation is a guess.
- A consultant gets you ready. A C3PAO assesses you. The same company should never do both for you.
- You should own every document and every piece of evidence when the engagement ends.
- Ask who does the technical fixes. Policies alone don’t pass an assessment.
- Ask how they’ll keep you compliant after the first assessment, because CMMC is a yearly obligation, not a one-time project.
What does a CMMC consultant actually do?
A good consultant helps you with five jobs:
- Scoping. Find where your Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) live, and draw the smallest boundary you can defend.
- Gap assessment. Score you honestly against the 110 requirements in NIST SP 800-171.
- Documentation. Write the System Security Plan (SSP), policies and the Plan of Action and Milestones (POA&M).
- Remediation. Close the gaps, like multifactor authentication, logging and encryption, or coordinate your IT provider to do it.
- Assessment readiness. Organize evidence so a C3PAO can verify it quickly.
Some firms do all five. Some only write documents. Know which one you’re buying.
What is the difference between an RP, RPO and C3PAO?
| Role | What it means | Can they assess you for certification? |
|---|---|---|
| RP (Registered Practitioner) | A person trained and registered through the Cyber AB to give CMMC advice | No |
| RPO (Registered Provider Organization) | A company registered through the Cyber AB to provide CMMC consulting | No |
| C3PAO (Certified Third-Party Assessment Organization) | An authorized organization that performs official CMMC Level 2 certification assessments | Yes, but not for a company it consulted for |
The CMMC Code of Professional Conduct requires a separation of roles. A C3PAO that helps you get ready can’t be the one that certifies you. If a firm offers to do both, that’s a red flag. We cover this in more detail in C3PAO vs RPO.
You can look up registered practitioners, RPOs and C3PAOs on the Cyber AB marketplace before you sign anything.
What should you ask a CMMC consultant before you sign?
- Will you scope our environment before you give us a price?
- Is the price fixed, and what exactly is included in writing?
- Who on your team holds Cyber AB credentials, and will that person work on our account?
- Do you also perform CMMC assessments? (The answer should be no.)
- Who does the technical fixes, you or our IT provider? Who coordinates them?
- Will we own the SSP, policies and evidence if we leave?
- How do you score our SPRS number, and will you show us the math?
- Do you have experience with companies our size and in our industry, like machine shops or engineering firms?
- What happens after the first year? How do you keep us compliant?
- If we handle CUI, can you help us reduce scope with an enclave instead of locking down the whole company?
What are the red flags?
- A guaranteed certification. Nobody can promise what an independent assessor will find.
- A perfect SPRS score promised before anyone looks at your network.
- No scope in writing. That’s how a project quietly doubles in cost.
- Template policies with your logo pasted on. Assessors check whether you actually do what your policies say.
- They keep your documents in their system and you lose access when the contract ends.
- Hourly billing with no cap and no monthly report of what you got for the money.
Here’s a common picture. A 20-person machine shop hires a firm that writes 30 policies in six weeks. The policies say every laptop is encrypted and every login uses multifactor authentication. Nobody turned either one on. On paper, they look great. In an assessment, they fail, and the SPRS score they posted doesn’t match reality.
That last part is the whole problem. A policy is a promise. The assessor checks whether you kept it.
Consultant, software or managed service: which should a small business choose?
| Option | You get | Watch out for | Best fit |
|---|---|---|---|
| Traditional consultant | Hands-on expertise for a project | Help ends when the project ends | A one-time gap assessment |
| Compliance software alone | A place to track controls and evidence | Nobody checks your work | Teams with in-house compliance staff |
| Software plus expert review | The tool, plus a named expert who reviews each task | You or your IT provider still do the work | Most small contractors with an IT provider |
| Managed compliance | A team that runs the program while you make the decisions | Higher monthly cost | Companies with no one to own compliance |
At Greypike, we built our plans around the last two rows, because that’s where we saw small businesses get stuck. Our Compliance App is $399 a month with a named compliance manager who reviews every completed task. Managed is $999 a month, and Managed + Fixes is $1,999 a month. All prices are public on our pricing page. We are veteran-owned, our team holds Cyber AB Registered Practitioner credentials, and we don’t perform assessments, so we can tell you exactly where you stand.
How much does a CMMC consultant cost?
Pricing varies widely and many firms don’t publish it, so get every quote in writing and compare them on the same terms: total cost for 12 months, what’s included, and who does the fixes. Remember that the C3PAO assessment is a separate bill. In the CMMC rule, DoD estimated a small business Level 2 certification assessment at about $104,670 over three years. That doesn’t include the work to get ready.
For a side-by-side look at pricing models, see our post on CMMC compliance software pricing.
Before you talk to any consultant, use our free 15-page scoping workbook to map where your CUI lives. Or book a scoping session with our team and get a straight answer, not a sales pitch.
Get the free workbook Book a scoping sessionWhoever you hire, ask the ten questions above and get the answers in writing. It’s worth getting ahead of it before your next contract requires it.
Frequently asked questions
Does my CMMC consultant need to be an RPO?
You are not required to hire a consultant at all. A Cyber AB credential, such as Registered Practitioner or Registered Provider Organization, tells you the person or firm has been trained on CMMC and agreed to the Cyber AB code of conduct. Check the Cyber AB marketplace before you sign.
Can a CMMC consultant also do my certification assessment?
No. The CMMC Code of Professional Conduct requires a separation of roles. A C3PAO cannot assess a company it also consulted for. If a firm offers to do both, choose someone else.
How long does it take a small business to get CMMC Level 2 ready?
It depends on your scope and how many of the 110 NIST SP 800-171 requirements are already in place. A clear scope and an honest gap assessment are the fastest way to get a real timeline.
What should a CMMC consultant deliver?
At minimum: a defined scope, an honest gap assessment and SPRS score, a System Security Plan, policies, a Plan of Action and Milestones, and organized evidence. You should own all of it when the engagement ends.
Is managed CMMC compliance better than hiring a consultant?
For companies with no one to own compliance, a managed service is often a better fit because it continues after the first assessment. For companies with an IT provider and someone to make decisions, software with expert review usually costs less.
What are the biggest red flags when hiring CMMC help?
Guaranteed certification, a perfect SPRS score promised before anyone looks at your network, no written scope, template policies that don’t match what you actually do, and losing access to your documents when the contract ends.
