Defense Suppliers
CMMC readiness for shops in the defense supply chain.
The 48 CFR rule took effect November 10, 2025, and CMMC requirements are now phasing into DoD contracts. If a prime has started asking about your SPRS score or Level 2 plans, the runway to a certification assessment is realistically six to twelve months. That’s enough time if you start with an honest picture of where you stand.
NIST 800-171 remediation and implementation is work we do right now for a machine shop in the defense supply chain.
Level 2 means a third-party assessment against all 110 controls. Preparation is the part you can control.
DFARS 252.204-7012 flow-downs reach subcontractors unaltered. Reading them early is cheaper than discovering them at award.
Everyday IT and compliance readiness are one engagement here, so the fixes stay fixed.
The First Step
A fixed-fee gap assessment, not a contract.
We run all 110 NIST 800-171 controls against your environment, hand you the SPRS score you’ll owe the DoD anyway, and give you a written plan for closing each gap with what closing it would cost. Fixed scope, fixed fee, typically $3,500 to $4,500 for a single-site shop up to about 25 endpoints, and two to three weeks from kickoff to report.
You keep the report and the score whether or not you ever hire us to do the fixing.
- Every one of the 110 NIST 800-171 controls checked against your actual environment, with evidence
- The DoD Assessment Methodology score you owe under DFARS 252.204-7019 and 7020, ready for SPRS
- A POA&M for every gap, in the format your assessor and your prime expect
- A costed remediation roadmap: what closing each gap takes and what it costs
The Real Questions
What defense suppliers actually ask.
We got a flow-down letter. Do we even handle CUI?
“We're not sure” is the most common answer, and it's a fine place to start. Whether you hold CUI, covered defense information, or ITAR technical data, and where it lives, gets settled during discovery. Settling it is half of what the assessment is for.
Do we need GCC High, or can we stay on commercial Microsoft 365?
It depends on your contracts and where CUI needs to live. Plenty of small shops can scope CUI tightly instead of migrating everything. The honest answer is a boundary decision made deliberately, with the costs of each option on the table, and we'll walk that decision with you and put it in writing.
What about our SPRS score?
The assessment produces it. You get a score built with the DoD Assessment Methodology, starting from 110 and applying the weighted deductions, along with what each deduction is and which fixes move the number. Primes are already asking subs for this; you'll have a real answer.
What happens if we have an incident mid-contract?
DFARS 252.204-7012 gives you 72 hours to report to DIBNet, and that clock is survivable only if the plumbing exists before the incident. Incident reporting readiness is part of remediation planning from day one.
Are you a C3PAO?
No, and that's the point. Certification assessments belong to a licensed third party, and you don't want your preparation vendor grading its own homework. Near Earth Orbit prepares your environment and your evidence, then works alongside your assessor. When you need the certifying audit, we'll say so plainly.
Boundaries
Where the lines sit, in writing.
Assessors read scoping sloppiness as a finding. Ours is deliberate.
- Work happens inside your tenant, on your tools, under your controls
- Nothing regulated touches our systems, which keeps your assessment boundary clean
- CUI-bearing deliverables live in your authorized environment, never on ours
- The remediation roadmap is yours, whether or not you hire us to execute it
Next Step
Bring the flow-down letter.
A discovery call reads your actual contract language against where your environment stands today. You’ll know your real exposure and your first step before we ever talk price.
Prefer the phone? +1 (402) 819-7177