CMMC 2.0 · NIST SP 800-171 · DFARS 252.204-7012
Fixed-fee gap assessments. An SPRS score you can defend. A remediation roadmap your existing IT person can execute — no rip-and-replace, no scare tactics.
Who we serve
If you machine parts, fabricate assemblies, build electronics, or move materiel for the defense supply chain, CMMC is now written into contracts — and your primes are asking for SPRS scores today. The big consultancies quote $50,000+ engagements. Generalist IT providers don't understand CUI scoping. You need someone in between.
Hardpoint Compliance works with small defense subcontractors — typically 25 to 250 people — who need to demonstrate NIST SP 800-171 compliance without derailing operations or replacing the IT setup that already works.
Services
Step 0 — Free
$0 · 45 minutes
Where you actually stand, in plain language: what your contracts require, whether you handle CUI, and what your realistic next step is. You leave with a one-page self-scoping checklist either way.
Step 1
Typically $3,500–$5,000 · one week
A rapid review of your NIST 800-171 self-assessment: a defensible SPRS score, the justification behind every point, and your top-10 gap list. The low-friction way to stop guessing.
Step 2
Typically $12,000–$25,000 · 3–4 weeks
The full engagement: all 320 assessment objectives, evidence review, an SSP skeleton, a POA&M, and a prioritized remediation roadmap with real costs — sequenced so your existing IT person can execute it.
Ongoing
Typically $3,000–$8,000/mo
Your fractional compliance officer: we run the POA&M, maintain the SSP, test controls quarterly, answer every prime questionnaire within 24 hours, and keep you assessment-ready year-round.
Every engagement is fixed-fee and scoped in writing before work begins.
How it works
A short call and a structured questionnaire: which contracts you hold, what data you touch, where CUI actually lives. Most companies over-scope — this is where money gets saved.
Objective-by-objective against NIST SP 800-171A — interviews plus evidence, not a checkbox survey. You get findings you can hand to an assessor with a straight face.
A prioritized, costed remediation plan — and if you want it, ongoing retainer support until you're through your assessment and beyond.
About
A hardpoint is where the weapon attaches to the aircraft — the mounting structure everything else depends on. We're where your compliance attaches to your business: engineered, load-bearing, and built to hold under inspection.
Hardpoint Compliance LLC is an Atlanta-based practice founded by Preston Lucas — a career IT and security leader with 18 years of hands-on experience running enterprise infrastructure, Microsoft 365 security, and live NIST-framework compliance programs, and a BS in Cybersecurity. We speak both languages: the assessor's and the shop floor's.
The person you talk to is the person who does the work.
Right-sized engagements, plain-language deliverables, no enterprise bloat.
If you don't need us — or don't need CMMC Level 2 at all — we'll tell you on the free call.
FAQ
The underlying obligation — NIST SP 800-171 under DFARS 252.204-7012 — has been in contracts for years. CMMC is the enforcement wave: it's now appearing in new solicitations and flowing down from primes. Even where CMMC language hasn't reached your contract yet, primes are already requiring SPRS scores from suppliers. Waiting doesn't make it cheaper; it compresses your timeline.
It's your NIST 800-171 self-assessment score (the scale runs from -203 to 110), posted to the DoD's Supplier Performance Risk System. Primes check it before awarding work. An inflated score you can't defend is worse than a low one — misrepresentation carries False Claims Act risk. We produce scores with the evidence trail behind every point.
Roughly: if you only touch Federal Contract Information, Level 1 (17 practices, self-assessed). If you touch Controlled Unclassified Information — drawings, specs, technical data marked for control — Level 2 (110 controls, and for most defense work a third-party assessment). Scoping which one applies, and shrinking where CUI lives, is usually the highest-value work we do.
Depends entirely on your starting point and scope. A focused small shop can often reach a defensible posture in a few months; complex environments take longer. That's a scoping-call answer, not a brochure answer — which is why the first call is free.
No — and you should walk away from anyone who says yes. Certification decisions belong to the assessor, not the consultant. What we guarantee is honest scoping, evidence-based findings, and deliverables built to the same objectives an assessor will test against.
No. We do the compliance layer and work alongside your existing IT provider — most of the remediation roadmap is written specifically so they can execute it. If gaps require new capability, we'll say so plainly and let you decide who builds it.
Contact
Tell us what your prime is asking for and what you make. We'll tell you what your realistic next step is — even if it's “you don't need us.”
Based in Atlanta, Georgia · serving small manufacturers across the Southeast and remote nationwide.