CMMC and NIST SP 800-171 readiness for small defense manufacturers
Theme
Client sign-in

Get ready fast. Stay ready.

Most compliance tools are a filing cabinet. We built the opposite.

With most tools, you type answers into fields, the answers sit there, and the hard thinking stays with you. We do the thinking with you, get you ready fast, then keep you ready. We built this for manufacturers who sell to the Department of Defense and don't have a security team to spare.

What applies to you today

The rules that decide whether you keep your contracts are already in force.

The news is about the third-party Cybersecurity Maturity Model Certification (CMMC) assessment, which the Department of Defense suspended in July 2026. The security rules that assessment was meant to check were never suspended.

In force right now

  • FAR 52.204-21

    15 basic safeguards for Federal Contract Information (FCI), the everyday non-public information that rides along with almost any government contract.

  • DFARS 252.204-7012

    If you handle Controlled Unclassified Information (CUI), your systems must meet the security standard NIST SP 800-171, Revision 2: 110 requirements.

  • CMMC self-assessment

    Contracts can still require a CMMC Level 1 or Level 2 self-assessment. You assess your own systems against the standard, enter the result in the government's Supplier Performance Risk System (SPRS), and a senior official of your company affirms continued compliance every year.

On the horizon: we keep you ahead of it

  • CMMC third-party assessments

    An assessment by an accredited third-party assessor (C3PAO), or by the government's own assessors for the most sensitive work. While the program is suspended, contracts may not require either assessment, and existing requirements for them are being removed. The suspension lasts until the Department lifts it. Suspended or not, the rules under In force right now still apply.

  • NIST SP 800-171 Rev 3 and SP 800-172

    The next version of the standard, and a higher tier of requirements for the most sensitive work. NIST has published both. We build your program a step ahead of them.

Why our approach is different

Every answer you give us feeds a later step.

1

Nothing is wasted

We never ask you the same question twice, and we never send you chasing proof you don't need. Your program is built from how your business runs, not from a template filled in for someone else.

2

One connected process

You walk us through how information moves through your company, once. Where your information goes decides which systems are in scope. The systems in scope decide which questions we ask, and your answers decide which proof we collect. By the end, the work you have already done has drafted your System Security Plan (the master document an assessor reads), your score, and a plan of action for every gap. We confirm every statement in the System Security Plan before calling it final.

3

We won't tell you you're fine when you're not

When our software can't justify calling a system out of scope, the software keeps that system in scope and flags it for review. A missed gap stays invisible until an assessor finds it, so the software is built to refuse the easy answer. The software does the sorting and reading so we can spend our time on the judgment calls, and a person makes every one of them.

4

We keep you ready, every month

Getting to ready is a push. Staying ready is the longer job. Rules change, screenshots go stale, and your company's annual affirmation comes due. Every month we sit down with you to walk your compliance calendar, review the evidence you've refreshed, and work through what changed: a new rule, a new hire, or new software you want to bring in, which we review before it goes in. Behind that, we watch the official sources every day and read new DoD solicitations for the CMMC level each one asks for.

5

We check the claims you rely on

If a cloud provider stores or handles your contract's covered defense information (the CUI that DFARS protects), DFARS 252.204-7012 makes you responsible for ensuring the provider meets security requirements equivalent to the FedRAMP Moderate baseline, the federal government's cloud security standard. One vendor headline we checked read "FedRAMP Authorized" while the government's listing said In Process. We check each provider's FedRAMP authorization claim against the government's own Marketplace data and re-check it every day.

6

You see where you stand, any day

You sign in to your own portal with a one-time code sent to your email. The portal shows your current score, what we still need from you (with our feedback on anything we sent back), and your latest System Security Plan to download. You upload each piece of proof straight to the request it answers. Questions go to Ask, which answers from our library of answers checked against the official sources.

The arc of an engagement

  1. 1Scaffold
  2. 2Interview
  3. 3Scope
  4. 4Prove
  5. 5Score
  6. 6Recommend
  7. 7Deliver

You're not buying a one-time scramble. You're buying a readiness program that keeps running after the assessment.

Where boundaries belong.

Start with a scoping conversation joe@metebound.com