Defense industrial base
You have a DFARS flowdown, a CUI obligation, and a prime asking about your SPRS score. We scope the boundary first, because that decision controls everything you will spend afterwards.
Bought under NAICS 541611, 541618, 541512 and 541519.
What you are actually dealing with
Most defense contractors discover their compliance obligation the same way: a prime sends a flowdown, or a solicitation arrives carrying a clause. From there the common path is to apply NIST SP 800-171 across the entire corporate network, which is slow, expensive, and frequently unnecessary.
The cheaper path is almost always to decide where Controlled Unclassified Information is allowed to live, confine it, and assess that. We make that decision with you before any control work starts.
The second predictable failure is an optimistic self-score submitted to SPRS. It is discovered during an assessment, at the point when remediation is most expensive and the contract is closest.
Where the rules stand today
| 32 CFR Part 170 | CMMC Program rule, effective 16 December 2024 |
|---|---|
| 48 CFR / DFARS | Acquisition rule, effective 10 November 2025 |
| CMMC Phase 1 | In force. Level 1 and Level 2 self-assessment in new solicitations carrying the clause |
| 800-171 Rev 2 | Remains the operative baseline for CMMC scoring and SPRS |
| 800-171 Rev 3 | Finalized May 2024; not the CMMC assessment baseline |
Reporting on CMMC phases after Phase 1 comes from trade press rather than a confirmable Department of Defense source. We will not put your procurement planning on a number we cannot stand behind. Send us your solicitation and we will separate what is confirmable from what is not.
The usual order of operations
Scope first, score second, remediate third. Taking these out of order is what makes compliance programs expensive.
CMMC readiness assessment
Scope the boundary, score every practice against evidence, and see the real distance to a certification assessment.
CMMC readinessManaged detection & response
Carries the continuous monitoring, logging and incident response requirements directly, and produces the evidence as it goes.
Managed detectionSecurity assessment
For most contractors the CUI enclave is built on Microsoft 365. This reviews it against real attack paths.
Security assessmentIdentity security & Zero Trust
Access control and privileged access are where 800-171 assessments most often come apart.
Identity & Zero TrustIncident response & forensics
DFARS 252.204-7012 carries an incident reporting obligation. A retainer means you are not finding a responder mid-incident.
Incident responseIt is rarely "are you certified". It is "what is your SPRS score, when was it calculated, and can you evidence it". A score you cannot evidence is worse than a lower score you can.
If a prime has given you a deadline, tell us the date in the first message. It changes the sequence we recommend.
Bring us the flowdown
Send the clause and the deadline. We will tell you what actually binds you and what the realistic path to a defensible score looks like.