Guides
Guides
Practical pages for a first contract, a first DCAA review, and CMMC. Each one lists its sources and the day we last checked them.
What to check before you hire a C3PAO
A C3PAO conducts Level 2 certification assessments and issues certificates. Confirm the firm on the Accreditation Body's public list. A firm that prepared you for CMMC in the last 3 years cannot assess you.
What CMMC Level 2 costs, by DoD's own estimate
DoD's small-entity figures: $34,277 for a Level 2 self-assessment and $101,752 for a C3PAO assessment. Phase 2 is suspended. These exclude NIST SP 800-171.
CMMC Phase 2 is suspended, and what still applies
The Department of War suspended CMMC Phase 2 on July 13, 2026. Its program offices may ask only for Level 1 or Level 2 self-assessments for now, and DFARS 252.204-7012 and NIST SP 800-171 Revision 2 still apply.
When a CMMC plan of action and milestones is allowed
32 CFR 170.21 allows a conditional Level 2 status only for select NOT MET requirements. The score ratio must be at least 0.8, any item worth more than 1 point stays off the plan except one encryption case, six named requirements cannot be on it, and closeout is 180 days.
How to scope CUI for a CMMC Level 2 assessment
Level 2 scope is set before the assessment. CUI assets and security protection assets are assessed. Contractor risk managed assets are documented. Specialized assets are documented and not assessed against the other requirements.
Two scores that both land in SPRS
DFARS 252.204-7019 and 252.204-7020 use the NIST SP 800-171 DoD Assessment Methodology, scored from 110. CMMC Level 2 uses 32 CFR 170.24, also scored from 110. They post different results into SPRS.
What a CMMC system security plan has to do
The system security plan describes the system, the environment, and how each security requirement is met. Without an up-to-date plan, the Level 2 assessment cannot be completed, and that requirement cannot sit on a plan of action and milestones.
Getting ready for a first federal contract
What a new company needs before a first federal bid. SAM.gov registration is free, and the checklist covers the UEI, CAGE code, NAICS codes, size standards, and where to look for work.
What an acceptable accounting system means before a first DCAA review
SF 1408 and DFARS 252.242-7006 in plain language. Timekeeping, unallowable costs, indirect rates, incurred cost submissions, and when DCAA is the audit agency.
What a GSA Multiple Award Schedule is
GSA's Multiple Award Schedule, also called Schedules or the Federal Supply Schedule, is how eligible government buyers purchase commercial products and services from contractors that hold a MAS contract. Getting the contract can take several weeks to months.
How the Small Contractor Software Pricing Index is built
The monthly index is planned to draw only on ledger rows that have a sourced dollar amount. Quote-only listings, missing sources, and stale checked dates stay out. This page publishes no index number.