If your contracts carry NIST 800-171 or CMMC obligations, the work of getting ready is mostly documentation, evidence, and a handful of technical controls. Hashwhales.com is an Arlington team that prepares small contractors for assessment — without the six-figure consulting engagement.
Requirements arrive through a contract clause or a prime pushing them down to subs, usually with a deadline attached. Large consultancies price the work well beyond what a ten- or thirty-person firm can justify, and the internal alternative is an engineer learning 110 controls in their spare time. Most firms stall at the same place: no current System Security Plan, and no honest picture of the gap.
We assess where you actually stand against NIST 800-171, build the System Security Plan and POA&M, draft the policies and procedures that auditors expect to see, and help close the technical gaps we find. You end up assessment-ready with documentation you own and understand — not a binder you cannot maintain.
No, and no consultant can. A CMMC certification assessment may only be performed by a certified assessor working for an authorised C3PAO. Our role is readiness: we prepare your documentation, evidence, and controls so that the assessment goes smoothly. Anyone who tells you they can certify you is misrepresenting how the programme works.
NIST 800-171 is the control set — 110 requirements for protecting Controlled Unclassified Information. CMMC is the Department of Defense programme that verifies you have implemented them. Readiness work is largely the same either way: assess the gap, document the system, close what is missing.
Documentation and evidence, far more often than technology. A System Security Plan that does not match how the business really operates, a POA&M with no dates, and controls that are in place but cannot be demonstrated are the common findings.
It depends on how much is already in place and how large your CUI environment is. A gap analysis and SSP for a small firm is typically weeks rather than months; remediation timelines come out of what the gap analysis finds. We scope it after an initial conversation rather than quoting blind.
A short call to understand your contract obligations and what readiness would actually involve for your firm — no obligation.
Websites start with a flat $500 build — see pricing & plans.