Fixed-fee compliance for DoD contractors with 25 to 500 employees: NIST SP 800-171 done completely, an SPRS score you can sign, and CMMC Level 2 ready the day assessments resume.
In plain terms: the government requires you to prove your company protects the technical data your defense customers send you. We build that proof, and it holds up when someone checks.
Not ready for the full program? The Defense Compliance Diagnostic is $7,500 for the founding cohort, credited in full within 90 days. Or take the two-minute fit check first.
Dated, sourced, and kept current. Check it against anything a vendor tells you: DoD pause memo · DOJ settlement · DFARS 252.204-7012 text
The July 13 pause did not touch DFARS 7012, the 110 controls, your SPRS score, or the affirmation your executive signs. DOJ is settling cases against contractors whose scores didn't survive audit. One company your size settled for $507,144 weeks before the pause. Government assessors scored it at minus 170, on a scale where full compliance is 110. Someone signed the number it had reported instead.
76,598 contractors need Level 2 under DoD's own rulemaking estimate; fewer than 1,500 have finished. When the review concludes, the queue forms behind the contractors who used the quiet months.
Three ways to buy this work: boutiques ($65K to $150K+, quoted after a sales process), template mills (why most contractors arrive unprepared), and your MSP (essential, but they shouldn't grade their own homework). There's a gap in the middle: senior-led, independent, fixed-fee. That's SecureFort.
NIST SP 800-171, complete. CMMC Level 2, ready. Sixteen weeks, one fixed fee. Full SSP, 19 policies authored to your environment, control-by-control evidence register (110), POA&M with owners and dates, SPRS score you can sign, week-15 readiness review, C3PAO-ready handoff. Senior-led interviews and readouts throughout.
All 110 controls, narratives built to your environment.
Authored to your tooling and your people, not templates.
Every control mapped to the document an assessor asks for.
Named owners, real dates, board-ready.
The number, the basis, the paper trail.
Residual gaps flagged, options priced, decisions logged.
Everything packaged, plus assessor selection guidance.
Post-engagement questions answered without a new SOW.
Interviews across engineering, IT, HR, and operations. Where CUI enters, where it moves, where it lives. First cut of scope and enclave options.
Scored gap analysis against each of the 110 NIST 800-171 controls. Defensible SPRS position established. First executive readout.
Full System Security Plan drafted against your real environment. Control-by-control narratives. Delivered at week 8 as the milestone tied to your second payment.
Policies written to your environment, not templates: access control, incident response, media protection, personnel security, and the rest of the AC through SI families.
Working with your IT team or MSP to collect and index the evidence each control requires. Screenshots, configs, tickets, logs, memos. Nothing left as "trust me."
Named owners, real dates, and prioritized remediation of any residual gaps. We coordinate; your IT team or MSP executes.
Full mock walk-through of your package as an assessor would see it. Residual gaps flagged, options priced, decisions documented.
Handoff package assembled, C3PAO selection guidance provided, executive readout delivered. Thirty-day Q&A window opens.
All four guarantees appear verbatim in every SOW. We'll send it to your counsel before you sign anything.
The senior consultant you meet leads start to finish: every interview, judgment call, readout, and final QA. Specialists may assist under the lead's review; your named lead never changes without written agreement, or you terminate with a prorated refund of fees paid.
If a formal assessment within 12 months finds a material defect in a document we wrote, we correct it at no charge. We stand behind every page we deliver. What we don't guarantee: an assessor's judgment, or remediation that wasn't finished after we left.
Five business days after the Phase 1 readout to exit. Walk away and the engagement reprices to the Diagnostic: you pay $7,500, keep the gap report and scoping memo, and the rest of your deposit comes back within ten business days. Committing early never costs more than being cautious.
When your remediation is done, we come back: one full re-score across all 110 controls and a written go or no-go, before you spend a dollar on a C3PAO. One pass, within 120 days of handoff, included in the Program. You'll know you're ready before anyone official asks.
No software licenses. No enclave subscription. No managed IT. No assessment arm. Your MSP is essential: they implement and run the controls. We're the independent layer that documents that work and makes it stand up to assessors, primes, and auditors.
MSPs like working with us: we make their engineering look as good on paper as it is in the rack. And because we sell no tooling and no services beyond advice, our recommendations have nothing behind them but the assessment.
We don't need your CUI, so we never take it. No possession, no storage, no transmission: our deliverables describe your environment, they don't contain your data. On the rare occasion we need to see CUI at all, we view it inside your systems, under your credentials, and nothing leaves. It's written into the SOW.
Built for DoD contractors handling CUI, 25 to 500 employees. Not for primes with in-house teams or Level 1-only shops. Six questions, two minutes, no email, nothing recorded. Designed to tell you the truth, including "you don't need us."
If you don't currently do DoD work, DFARS and NIST 800-171 don't apply to you. Bookmark the page if that changes. Otherwise, this is time back.
Level 1 is an annual self-assessment against 15 FAR-based safeguarding requirements. Most small shops handling FCI (not CUI) can do this without outside consulting. Book a free 15-minute call and we'll confirm; we won't sell you work you don't need.
Book the free 15-min callIf drawings, specs, or technical data flow to you, you are Level 2 no matter your headcount. Our fixed-fee program is built for contractors with 25 to 500 employees, so we are probably not your most cost-effective option. Book 15 minutes and we will point you toward right-sized help, free.
Book the free 15-min callYou're likely handling CUI, and your SPRS score is missing, stale, or unowned. That is exactly the exposure DOJ is settling: signatures on numbers that didn't survive audit. Start with the Defense Compliance Diagnostic ($7,500 founding-cohort price, credits in full toward the Program within 90 days), or book a call.
You're on the right side of the score, with someone owning compliance. Now it's about getting your SSP, evidence register, and POA&M in a shape a C3PAO will accept. That's the Defense Compliance Program: $45,000, sixteen weeks, four written guarantees.
Above 500 employees you likely have the internal muscle (or the enterprise Big-4 relationships) that make our fixed-fee model the wrong fit. Book a call anyway: we'll be honest and point you at someone better suited.
Book a 30-min referral callThe Diagnostic is the Program's first phase, sold on its own. Its findings carry straight forward, nothing repeated, nothing re-billed, the fee credits in full. After certification, an ongoing partnership keeps you defensible year over year.
Scored gap analysis across all 110 controls, defensible SPRS position, prioritized roadmap, exec readout.
Credits in full toward the Program within 90 days.
For teams that don't yet know where they stand.
SSP, nineteen policies, evidence register, POA&M, readiness review, C3PAO handoff. Four written guarantees, in contract language.
First-year Affirmation Renewal at half rate for direct Program clients.
For teams that already know they're going all the way: one contract, one start date.
The annual re-score behind next year's executive affirmation. For contractors up to roughly 150 employees.
First year: $7,500 for direct Program clients.
Continuous coverage for contractors above 150 employees or with multiple prime relationships.
The number your executive signs next year should be as defensible as the one they signed this year. Two ways to keep it that way.
Multi-site, multi-CAGE, or above roughly 250 employees? Scoped individually, typically $65,000 to $75,000. Book a call; we'll size it in 30 minutes.
Founding cohort · 5 spots. Closes December 31, 2026 or when the five spots fill, whichever comes first. While spots last: the Program at $35,000 instead of $45,000, and the Diagnostic at $7,500 instead of $10,000, in exchange for a written case study and a testimonial only if you're happy.
Price-lock promise. The price on this page is the price. If it ever changes, this page changes first.
Sample gap-assessment report. Read it, share it with your IT lead or counsel, judge the depth yourself.
Free SPRS Sanity-Check.
A 20-minute self-scoring worksheet: find out whether the score in SPRS is one your executive should be affirming.
Download it now (PDF, 5 pages). No email, no form, no follow-up.
Eight years of cybersecurity risk and compliance consulting across regulated industries. The framework names change; the work is the same: translating what your IT team actually does into control narratives an external assessor will accept.
Working with SecureFort means you talk to the same person from first discovery call through final readout. No account team. No mid-stream handoff.
Wait on the certification booking, sure. Waiting on readiness is the expensive mistake: your DFARS 252.204-7012, NIST 800-171, and SPRS obligations are in force today (that is what DOJ enforces). Everything we build is NIST 800-171 work that holds value under any review outcome, and when certification resumes the ready contractors get assessed first.
They're essential; they implement. But the party attesting to compliance should not be the party selling the IT it is attesting to. We work alongside your MSP; we sell nothing else.
No one credible guarantees an assessor's judgment. We guarantee our documents: if a formal assessment within 12 months finds a material defect in something we wrote, we correct it at no charge. That covers our work product, not remediation that wasn't finished or changes made after handoff.
When you've closed out the remediation we scoped, we re-score you across all 110 controls and put it in writing: ready to schedule, or not yet, and exactly why. One pass, within 120 days of handoff, included in the Program. It's a checkpoint, not a second engagement. If you want us alongside you through the whole fix window, that's Remediation Support, quoted separately. If your remediation window runs past 120 days, we extend the validation by written agreement.
About a month, door to door, and we would rather you hear that from us. One to two weeks for your team to gather the evidence checklist and sit the interviews (we send the checklist and scheduler the day you book, and your MSP will do most of the artifact lifting), then ten business days of assessment on our clock, ending in the executive readout. No clock starts until your artifacts are in and your interviews are done.
No. The Diagnostic's scoped gap analysis, SPRS position, and roadmap become the Program's starting inputs; the fee credits in full and nothing is re-billed. The Program still runs sixteen weeks, because its pace is set by your team's decisions and changes, not by our analysis speed. Diagnostic clients spend the first month validating and going deeper instead of starting cold, which is why their Programs tend to land on schedule.
No. SecureFort is a readiness practice. The formal Certified Third-Party Assessment Organization (C3PAO) assessment is conducted by a separate, independent firm; we help you engage the right one after your readiness package is complete. This separation is required by the CMMC program and protects the integrity of the assessment.
Depends on what you buy. The Diagnostic is 100% at booking. The Program is 50% at kickoff and 50% at week 8, tied to SSP v1.0 delivery, with no change orders. Affirmation Renewal is billed annually; the Full Retainer is monthly ACH on a 6-month initial term. All ACH or wire, and every SOW goes to your counsel before you sign anything.
The founding cohort is the first five Program clients. They pay $35,000 (vs. $45,000 standard), and while spots remain the Diagnostic is $7,500 (vs. $10,000 standard). In exchange we ask for a written case study and a testimonial, only if you're happy. First come, first served, until the five spots are filled.
Level 1 is an annual self-assessment against 15 basic safeguarding requirements (FAR 52.204-21). If that is all you need, we'll confirm it in a free 15-minute call and point you at the FAR 52.204-21 checklist. We will not sell you work you don't need.
Hourly billing creates the wrong incentives. Fixed fee aligns them: a complete, assessor-ready package delivered in sixteen weeks. If we run long, that is our problem to absorb, not your invoice to swallow.
Enforcement is happening today under DFARS and the False Claims Act. Readiness takes sixteen weeks. When certification resumes the queue forms behind the contractors who used the quiet months. The reason to start now is enforcement and runway, not deadline math.
We scope technical implementation out of our engagement, but we partner with technical implementation firms and MSPs who can execute alongside us. We coordinate; they execute.
Your contract exposure, your real SPRS position, whether this is even your priority right now. Not the right fit? We'll say so and point you to someone better suited.