CMMC 2.0 Compliance · Serving WA · OR · ID · MT
CMMC Compliance Services
in Kent, Washington
Or call (206) 397-8070
If you are reading this, a prime contractor or a contracting officer probably just told you something about CMMC, NIST 800-171, or DFARS 252.204-7012, and now your weekend is ruined. We get it. Most Kent aerospace suppliers we work with had the same Friday afternoon.
The good news is that CMMC is not exotic. The 110 NIST SP 800-171 controls are the same 110 controls smart MSPs have been recommending for a decade. The work is real. The path is well-mapped. The timeline is 9 to 18 months for most Kent businesses pursuing Level 2 readiness, depending on your starting point.
We are inTech Consulting, headquartered at 25725 101st Ave SE in Kent. Our team has guided dozens of Pacific Northwest manufacturers and defense contractors through CMMC, SPRS submissions, POA&Ms, and full third-party assessments. This page tells you what to expect, what it costs, and what we will not promise.
What is CMMC, and does it apply to you?
CMMC stands for Cybersecurity Maturity Model Certification. It is the Department of Defense's framework for verifying that contractors and subcontractors actually implement the security controls they have been claiming to implement under DFARS 252.204-7012 since 2017.
CMMC almost certainly applies to your business if any of these are true:
- You hold a DoD prime contract or subcontract
- Your contracts include DFARS clause 252.204-7012
- You receive technical drawings, specifications, or design data from a DoD prime
- You handle export-controlled information (ITAR or EAR)
- You work as a tier-2 or tier-3 supplier to Boeing, Lockheed Martin, Raytheon, Northrop Grumman, or any other prime
- You have been asked for an SPRS submission
- You are pursuing new DoD opportunities
If two or more of these apply to your Kent business, you are in the CMMC scope. The question is no longer "if," it is "by when, and how do we get ready?"
Why this matters more than people think
A lot of Kent suppliers are still treating CMMC as a paperwork exercise. That is the most expensive way to get this wrong.
Why? Because under the False Claims Act, attesting to controls you do not actually have in place is fraud. Treble damages. Personal liability for executives. Whistleblower lawsuits from former employees. Several DoD primes have already had FCA cases filed against them on cybersecurity grounds, and the cases are settling for tens of millions. This is not theoretical.
So when we say "real controls, not paperwork," we mean it because the legal exposure of paper compliance is now larger than the cost of real compliance.
Our CMMC compliance process
We run an 8-step process for every Kent CMMC client. It is the same process we have used for aerospace suppliers across the Pacific Northwest, refined over dozens of engagements.
- 1. Gap Assessment. A full review of your current state against all 110 NIST SP 800-171 controls. We tell you where you are, not where we wish you were.
- 2. CUI Scoping. What information actually needs protection? Not everything. Scoping correctly often cuts the cost of compliance in half.
- 3. System Security Plan (SSP) Development. The single most important document you will produce. Auditors live in this.
- 4. Plan of Actions and Milestones (POA&M) Creation. Every gap, with an owner, a deadline, and a cost.
- 5. SPRS Score Calculation. Your actual score, calculated honestly, before you submit anything.
- 6. Remediation Execution. This is the part most consultants skip. We do the actual work, with our managed IT and managed security teams.
- 7. Continuous Monitoring. Controls are only effective if they keep running. We watch them.
- 8. C3PAO Audit Preparation. Mock assessment, evidence package, interview prep, and walkthrough rehearsal.
Pricing and timelines
We are upfront about ranges, so nobody wastes time. For a typical Kent aerospace or defense contractor at 25 to 75 endpoints:
- Gap assessment and roadmap: $8,500 to $25,000, one-time, 4 to 6 weeks
- SSP and POA&M development: $12,000 to $22,000, one-time, 6 to 10 weeks
- Remediation: highly variable. Most Kent clients spend $35,000 to $90,000 on remediation, including hardware, software licensing, and our time. The biggest single cost is usually identity and access management cleanup.
- Continuous monitoring (post-readiness): folded into our managed IT services in Kent and managed security services in Kent, typically $175 to $250 per user per month
- C3PAO audit prep: $6,000 to $12,000, one-time, 4 weeks before the audit
Total cost of getting from "DFARS clause in our contract, no idea what to do" to "passed Level 2 audit" is usually $80,000 to $160,000 over 12 to 18 months for a 25 to 75 person Kent business. That is a real number. Anyone selling you compliance for $15,000 is selling you paperwork.
Additional compliance frameworks we support
CMMC is what brings most Kent businesses to us, often in tandem with our backup and disaster recovery services in Kent and cloud migration services in Kent. The same 110 controls map cleanly to:
- NIST CSF (the foundational framework)
- HIPAA for healthcare partners and clinics
- PCI DSS for payment-handling
- SOC 2 for SaaS and professional services
- DFARS 252.204-7012 (the precursor to CMMC, still active)
- Washington state data privacy requirements
If you are pursuing more than one framework, we map them together so you do not pay twice for the same control. Our vCIO services in Kent drive that strategy at the leadership level.
Why a Pacific Northwest MSP that knows CMMC
Most national MSSPs do not understand CMMC. They will sell you a security stack and call it a day. CMMC requires a security stack and a process, documentation, and ongoing evidence. The MSP that runs your network has to be able to produce audit evidence on demand, six months after the audit, with logs that match the SSP.
We can do that because we built our practice around it. The team has worked through dozens of SPRS submissions and POA&Ms in the Pacific Northwest specifically. Our internal documentation is the same documentation we hand to a C3PAO. Boring is the goal.
False Claims Act, again
We bring this up twice on the same page because we keep meeting Kent business owners who do not know about it. If you are submitting an SPRS score, signing a DoD contract, or attesting to NIST 800-171 implementation, you are making a federal claim. If that claim is false, you are personally exposed.
The good news: real implementation, honestly documented, is also the cheapest legal defense available. We design our engagements so the SSP and POA&M are defensible if challenged.
Frequently Asked Questions
What level of CMMC do we need?
For most DoD work, Level 2. Level 1 covers basic safeguarding (FCI only, 17 practices). Level 2 covers controlled unclassified information (CUI, 110 controls). Level 3 is for the most sensitive work and applies to a small number of contractors.
Can we self-attest, or do we need a C3PAO?
Depends on the type of CUI you handle. Some Level 2 contracts allow self-attestation. Others require a C3PAO third-party assessment. Read the contract clauses carefully. We will tell you which path applies on the first call.
What is an SPRS score and why does it matter?
SPRS (Supplier Performance Risk System) is the DoD's database. Your SPRS score is a number from -203 to 110 representing your NIST 800-171 implementation. A score below 110 means you have gaps and a POA&M. Many primes will not award subcontracts to suppliers below a certain SPRS threshold.
How long does this actually take?
For a Kent business starting from zero, 12 to 18 months to Level 2 readiness. We have done it faster (9 months) when the starting point was strong. We have seen it take longer (24+ months) when the starting point was a single IT person and a Dropbox.
What happens if we already have a managed IT provider?
We can work with you in three ways: take over fully, work as a co-managed compliance partner alongside them, or provide compliance-only services while they keep running operational IT. The first is most common for CMMC work because the documentation requirements are so high.
Will compliance break our productivity?
Briefly, yes. Most Kent clients see 2 to 4 weeks of friction during MFA rollout, identity cleanup, and conditional access policy enforcement. After that, productivity returns to baseline. The myth that compliance kills productivity comes from compliance done badly.
Ready to find out where you actually stand?
We offer a free 30-minute CMMC readiness call for any Kent business that has been asked about NIST 800-171 or CMMC by a prime or contracting officer. We will tell you what level you need, how far you are, and what the realistic budget and timeline look like. No sales pressure.
Call (206) 397-8070 or book a free CMMC readiness consultation at intechnw.com.
inTech Consulting, LLC. | 25725 101st Ave SE, Kent, WA 98030 | Certified Minority Business Enterprise (Washington OMWBE) | 90-day money-back guarantee on managed IT and managed security engagements
Book a Free CMMC Consultation Call (206) 397-8070