CMMC 2.0 · NIST SP 800-171 · DFARS 252.204-7012
If you machine parts, fabricate assemblies, build electronics, or move materiel for the defense supply chain, CMMC is now written into contracts — and your primes are asking for SPRS scores today. The big consultancies quote $50,000+ engagements. Generalist IT providers don't understand CUI scoping.
You need someone in between. Hardpoint Compliance works with small defense subcontractors — typically 25 to 250 people — who need to demonstrate NIST SP 800-171 compliance without derailing operations or replacing the IT setup that already works.
About
A hardpoint is where the weapon attaches to the aircraft — the mounting structure everything else depends on. We're where your compliance attaches to your business: engineered, load-bearing, and built to hold under inspection.
Hardpoint Compliance LLC is an Atlanta-based practice founded by Preston Lucas — a career IT and security leader with 18 years of hands-on experience running enterprise infrastructure, Microsoft 365 security, and live NIST-framework compliance programs, and a BS in Cybersecurity. We speak both languages: the assessor's and the shop floor's.
The person you talk to is the person who does the work.
Right-sized engagements, plain-language deliverables, no enterprise bloat.
If you don't need us — or don't need CMMC Level 2 at all — we'll tell you on the free call.
Services
Step 0 — Free
$0 · 45 minutes
Where you actually stand, in plain language: what your contracts require, whether you handle CUI, and what your realistic next step is. You leave with a one-page self-scoping checklist either way.
Step 1
Typically $3,500–$5,000 · one week
A rapid review of your NIST 800-171 self-assessment: a defensible SPRS score, the justification behind every point, and your top-10 gap list. The low-friction way to stop guessing.
Step 2
Typically $12,000–$25,000 · 3–4 weeks
The full engagement: all 320 assessment objectives, evidence review, an SSP skeleton, a POA&M, and a prioritized remediation roadmap with real costs — sequenced so your existing IT person can execute it.
Ongoing
Typically $3,000–$8,000/mo
Your fractional compliance officer: we run the POA&M, maintain the SSP, test controls quarterly, answer every prime questionnaire within 24 hours, and keep you assessment-ready year-round.
Every engagement is fixed-fee and scoped in writing before work begins.
What it looks like
A ~40-person precision machine shop posted a near-perfect SPRS score years ago because their IT vendor said the network was "secure." Their prime asked for evidence behind the score. There wasn't any — and a score you can't defend carries False Claims Act risk.
An honest re-assessment against all 110 controls, a corrected score with the justification written down for every point, and a prioritized 6-month remediation plan their existing IT vendor could execute.
A defensible score the owner can stand behind in front of any prime or assessor — and a paper trail that turns the next questionnaire into a 20-minute task instead of a fire drill.
A ~120-person electronics assembler saw CMMC Level 2 language show up in an RFP. A national consultancy quoted a six-figure engagement and a full network rebuild. The owner assumed the whole company was in scope.
Scoping first: mapping where CUI actually lives and shrinking the assessment boundary to one enclave — the engineering file server and the five people who touch drawings — instead of the entire plant.
Remediation at a fraction of the original quote, executed by their existing IT provider, with the rest of the plant left alone. Most companies over-scope — this is where the money gets saved.
Representative scenarios illustrating typical engagements — not client testimonials. Your numbers and timeline come from your scoping call.
How it works
A short call and a structured questionnaire: which contracts you hold, what data you touch, where CUI actually lives. Most companies over-scope — this is where money gets saved.
Objective-by-objective against NIST SP 800-171A — interviews plus evidence, not a checkbox survey. You get findings you can hand to an assessor with a straight face.
A prioritized, costed remediation plan — and if you want it, ongoing retainer support until you're through your assessment and beyond.
FAQ
The underlying obligation — NIST SP 800-171 under DFARS 252.204-7012 — has been in contracts for years. CMMC is the enforcement wave: it's now appearing in new solicitations and flowing down from primes. Even where CMMC language hasn't reached your contract yet, primes are already requiring SPRS scores from suppliers. Waiting doesn't make it cheaper; it compresses your timeline.
It's your NIST 800-171 self-assessment score (the scale runs from -203 to 110), posted to the DoD's Supplier Performance Risk System. Primes check it before awarding work. An inflated score you can't defend is worse than a low one — misrepresentation carries False Claims Act risk. We produce scores with the evidence trail behind every point.
Roughly: if you only touch Federal Contract Information, Level 1 (17 practices, self-assessed). If you touch Controlled Unclassified Information — drawings, specs, technical data marked for control — Level 2 (110 controls, and for most defense work a third-party assessment). Scoping which one applies, and shrinking where CUI lives, is usually the highest-value work we do.
Depends entirely on your starting point and scope. A focused small shop can often reach a defensible posture in a few months; complex environments take longer. That's a scoping-call answer, not a brochure answer — which is why the first call is free.
No — and you should walk away from anyone who says yes. Certification decisions belong to the assessor, not the consultant. What we guarantee is honest scoping, evidence-based findings, and deliverables built to the same objectives an assessor will test against.
No. We do the compliance layer and work alongside your existing IT provider — most of the remediation roadmap is written specifically so they can execute it. If gaps require new capability, we'll say so plainly and let you decide who builds it.
Contact
Tell us what your prime is asking for and what you make. We'll tell you what your realistic next step is — even if it's “you don't need us.”
Based in Atlanta, Georgia · serving small manufacturers across the Southeast and remote nationwide.