CMMC Level 2 certification can be required in DoD solicitations from November 10, 2026. We build a scoped enclave for CUI work on AWS GovCloud or commercial US Regions, implement and document the 110 NIST SP 800-171 requirements for it, and get you ready for a C3PAO assessment.
8–14 weeks
$30k–$90k
For engineering, design and manufacturing firms that handle controlled unclassified information as DoD subcontractors, CMMC Level 2 is becoming a condition of bidding. Certifying the whole company is expensive and disruptive. We build an enclave on AWS that holds CUI work, and certify that.
Find where CUI arrives and lives: contracts, drawings, specifications, email
Decide GovCloud or commercial US Regions, based on export-controlled data and contract terms
Draw the assessment boundary and the data flows across it
Multi-account structure with centralized logging, encryption by default and least-privilege access through Identity Center with MFA
Cloud workstations (Amazon DCV or WorkSpaces) and file storage for CUI projects
Monitoring, vulnerability scanning and backup with tested restores
System security plan, policies and evidence for each NIST SP 800-171 requirement
Incident response and 72-hour reporting procedures
Mock assessment and a remediation list before the C3PAO
The enclave in your AWS accounts, defined in code, with the SSP and evidence package
Tell us about your current environment and goals. We'll review the details and respond with a proposed engagement structure and timeline.
Typical response time: 1–2 business days.
Prices and timelines are estimates for typical engagements, not offers. Scope, price and terms are set in a written agreement after we understand your situation. Terms of use.