How to Choose a CMMC Consultant: Proposal Questions and Red Flags
What to check before you hire a CMMC consultant: RPO status, engagement model, proposal questions, red flags, and who owns the SSP and evidence.
Short answer: choose a CMMC consultant by checking three things before price. First, confirm the firm is listed on the Cyber AB Marketplace as a Registered Provider Organization (RPO). Second, get its proposal to name exactly what it will produce: a scope boundary, a System Security Plan (SSP), a POA&M and an evidence set. Third, make sure your team will own and be able to maintain those artifacts after the engagement ends. A consultant prepares you. It does not certify you, and it can't be the organization that assesses you.
This guide is for defense contractors comparing consultants, RPOs and managed providers for CMMC Level 1 or Level 2. It covers what to ask in a proposal and which answers should end the conversation. For what an RPO is and how it differs from an assessor, start with our explainer on CMMC RPOs.
Where does CMMC stand in November 2026?
The rules you are buying help with are now in force:
- 32 CFR Part 170. This rule defines the CMMC program, its three levels and who may assess. It was published October 15, 2024 and took effect December 16, 2024.
- 48 CFR (DFARS Case 2019-D041). This rule puts CMMC requirements into contracts. It was published September 10, 2025 and took effect November 10, 2025, which also began Phase 1.
Phase 2 has changed. According to the DoD CIO's CMMC page, on July 13, 2026 the Department suspended Phase 2, which had been scheduled for November 10, 2026, and began a program review and set up a CMMC reform task force. While the suspension lasts, the DoD CIO says the program "may only require self-assessments at two levels," Level 1 (Self) and Level 2 (Self), and that the Department will enforce NIST SP 800-171 Rev. 2 compliance "through self-assessments and select government-led assessments." The obligation to protect CUI under DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 is unchanged.
This matters for buying. In practice, your first deliverable today is often an accurate Level 2 self-assessment that a senior official must affirm in SPRS. Third-party Level 2 certification is still defined in 32 CFR Part 170, so a good consultant prepares you for both outcomes and keeps watching the DoD CIO site as the review continues. Treat any proposal that quotes a fixed "certification deadline" as a sign the vendor hasn't read the current guidance.
What is the difference between a CMMC consultant and a C3PAO?
They play different roles, and the rule keeps them apart:
- C3PAOs are authorized or accredited by the Cyber AB. Under 32 CFR 170.9, they perform Level 2 certification assessments and issue the Certificate of CMMC Status.
- RPOs and Registered Practitioners are listed in the Cyber AB Marketplace to help organizations prepare. They don't issue results.
- The conflict rule. Under 32 CFR 170.8(b)(17)(ii)(G), the Cyber AB's Code of Professional Conduct must prohibit ecosystem members from taking part in a Level 2 certification assessment of an organization they consulted for to prepare it for any CMMC assessment within the previous 3 years. C3PAOs must follow that code under 32 CFR 170.9(b)(2).
So if a firm offers to "prepare and certify" you, it is either describing two separate companies or describing something the rule forbids. Ask which one. To understand the assessor side, read what a C3PAO does.
Which engagement model fits your situation?
Most CMMC consulting falls into one of five shapes. Decide which one you need before you compare prices, because the proposals won't be comparable otherwise.
| Model | What you get | Fits when | Watch for |
|---|---|---|---|
| Readiness program | Scoping, policies, SSP, remediation plan, evidence and assessment prep, run as one project | You handle CUI and have no security lead | Who keeps the program running after go-live |
| Gap assessment only | A scored review against the 110 NIST SP 800-171 requirements and a prioritized fix list | You have an IT team that can do the remediation | A report with no owner or sequence for the fixes |
| Enclave build | A segmented CUI environment, such as a government cloud tenant, plus the documents to match | CUI touches only a small part of the business | Enclave scope that doesn't match where CUI actually flows |
| Managed compliance | Ongoing control operation, monitoring, evidence upkeep and annual affirmation support | You want CMMC run as a function, not a one-off project | Lock-in to proprietary formats you can't export |
| Assessment prep | Mock assessment, evidence review and interview rehearsal | Your controls are built and you want a second check | Prep firms that drift into "guaranteeing" an outcome |
If you aren't sure how much of the business is in scope, buy scoping first. Our CMMC scoping guide shows why the boundary drives almost every later cost.
What should a CMMC consulting proposal include?
A useful proposal names artifacts, owners and exit terms. Ask every bidder to answer these in writing:
- Level and scope. Which CMMC level are you scoping for? Which asset categories (CUI assets, security protection assets, contractor risk managed assets, specialized assets, out-of-scope assets) will you document, and how will you map CUI flows?
- Named deliverables. Will you deliver the SSP, POA&M, network and data-flow diagrams, policies and procedures, and an evidence index mapped to each assessment objective? In what format?
- Who does the work. Which tasks does your team perform, and which stay with our IT staff or managed service provider? Get a responsibility matrix, not a sentence.
- Credentials. Is the firm a current RPO in the Cyber AB Marketplace? Which named people will be on the engagement, and what CMMC credentials does each hold?
- Self-assessment support. How will you help us score a Level 2 (Self) assessment honestly and support the affirming official before results go into SPRS?
- Independence. Do you have any relationship with a C3PAO that we might later hire? How do you avoid the 3-year conflict rule?
- Handover. What do we receive at the end? How do we maintain the SSP and evidence without you? What does exit look like if we switch providers?
- Change tracking. With Phase 2 suspended and under review, how will you tell us when DoD guidance changes, and what happens to the scope if it does?
If you are still deciding whether you need outside help at all, the same questions apply to a narrower CMMC gap assessment.
What are the red flags in a CMMC consultant?
- Guaranteed certification. No consultant controls a C3PAO's result. The Code of Professional Conduct required by 32 CFR 170.8(b)(17)(ii)(E) also bars ecosystem members from exaggerating the services they are capable or authorized to deliver.
- "Prepare and assess" in one contract. See the conflict rule above.
- A template SSP. An SSP that doesn't describe your actual systems and boundary will fail the first interview question about it.
- No evidence plan. Policies alone don't show a requirement is met. Ask how each assessment objective will be shown.
- Vague staffing. "Our experts" with no names, roles or credentials attached.
- Captive artifacts. Deliverables that live only inside the vendor's portal, with no export.
- Stale timelines. Pitches built on a Phase 2 date that has since been suspended.
Who should own the SSP, evidence and POA&M?
Your organization should. The SSP describes your systems, the POA&M commits your team to fixes, and a senior official at your company signs the affirmation. A consultant can draft, structure and maintain these documents, but the contract should state that you own them and can export them in standard formats at any time.
A practical test: ask the consultant to walk your IT lead through updating one SSP section and adding one piece of evidence. If that takes a support ticket, you will be dependent on that vendor for every audit cycle.
What does a good handover look like?
- Artifact package. SSP, POA&M, diagrams, policies and an evidence index, all in formats you can edit.
- Named internal owners. One owner per control family, recorded in the SSP.
- Operating calendar. Recurring reviews, evidence refresh dates and the annual affirmation date.
- Change triggers. A short list of events that should reopen scoping, such as a new contract with CUI, a new cloud service or an office move.
How does Workstreet approach CMMC?
Workstreet is an RPO and supports defense contractors through scoping and data mapping, NIST SP 800-171 policies and procedures, SSP and POA&M development, government cloud environment support, and ongoing compliance management ahead of an assessment. We combine compliance automation with hands-on expert work, and we don't perform C3PAO assessments. See the CMMC program overview or our wider government compliance services.
If you are comparing proposals now, book a CMMC scoping call and bring the questions above. We'll answer them in writing.
CMMC consultant FAQs
Do I need a consultant for CMMC Level 1?
Often not. Level 1 is an annual self-assessment against the 15 requirements in FAR 52.204-21, which many small teams can complete with internal IT. Outside help is more common at Level 2, which covers the 110 NIST SP 800-171 Rev. 2 requirements for CUI.
Can my consultant also be my C3PAO?
No. Under 32 CFR 170.8(b)(17)(ii)(G), the Cyber AB's Code of Professional Conduct must bar ecosystem members from taking part in a Level 2 certification assessment of an organization they consulted for to prepare it for any CMMC assessment within the prior 3 years.
Is a Level 2 C3PAO assessment required right now?
As of November 2026, the DoD CIO says Phase 2 is suspended, the program may only require Level 1 (Self) or Level 2 (Self) assessments, and the Department will enforce NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments. Check the DoD CIO CMMC page and your contract language, because this may change after the program review.
How do I verify an RPO?
Search the Cyber AB Marketplace for the firm and the named individuals in the proposal.
.avif)