If your business handles Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) for the Department of Defense, your cybersecurity responsibilities are determined by your contract, solicitation, and flow-downs. A paused assessment milestone is not the same as a canceled security obligation.
BrightWorks Technologies provides hands-on CMMC readiness and implementation support for small and mid-sized businesses in Columbia, Camden, Sumter, and throughout South Carolina. We help you define scope, understand where you stand today, close high-risk gaps, maintain evidence, and prepare for the verification path your contracts require.
The Cybersecurity Maturity Model Certification (CMMC) program gives the Department of Defense a way to verify that contractors protect sensitive defense information. The current program is being reviewed after the July 13, 2026 suspension of planned Phase II requirements, but the need to protect FCI and CUI has not disappeared.
The short version: Do not assume that the suspension makes cybersecurity optional. Determine which requirements apply to your contract, keep the required controls operating, and maintain accurate documentation and evidence.
Depending on the contract and information handled, the work may involve:
Do not choose a level from a generic web page. Read the solicitation, contract, and prime flow-downs, then document the systems, people, vendors, and data in scope.
You may have CMMC-related obligations if your business:
This can include manufacturers, IT service providers, engineering firms, logistics companies, professional services firms, and other subcontractors in the defense supply chain. Being located near a military installation does not, by itself, create a CMMC obligation; the contract and information handled determine the work.
We do not sell you a checklist and disappear. We work alongside you to build and document real security capabilities that reduce risk, support contract continuity, and prepare your team for the verification path that applies.
We help identify FCI and CUI, map the environment, review contract language, and evaluate current practices against the applicable requirements. You receive a clear, prioritized report showing what is operating, what is partially implemented, and what needs attention.
We design the technical and policy changes needed to close gaps: SSP development, POA&M documentation, architecture changes, access control, encryption, incident response, and training programs.
We help you execute the plan. Whether you need hands-on technical work, policy writing, staff training, or all three, we provide the expertise to move from paper plan to operational reality.
We organize evidence, test controls, prepare your team for review, and identify last-mile gaps. When an independent assessment is required, an authorized independent assessor—not the preparer—conducts it.
Cost depends on your current security posture, environment size, contract scope, and target verification path. Planning ranges for South Carolina small businesses may include:
| Item | Typical Range or Structure |
|---|---|
| Scope and gap assessment | $3,000 - $10,000, depending on systems and contract scope |
| Remediation (technical + policy) | $15,000 - $75,000+ based on starting posture and required changes |
| Ongoing readiness maintenance | $2,000 - $8,000/month for operations, evidence, and improvement |
| Independent assessment, when required | Priced by the authorized assessor and assessment scope |
These are planning ranges, not a BrightWorks quote or a government fee schedule. The businesses that spend the least are usually those with a defined CUI boundary, reliable IT operations, and evidence already being collected. We provide a transparent estimate after understanding your environment and contract requirements.
If you have not started preparation, use the pause to clarify scope and prioritize the controls that reduce real risk. A gap assessment can take weeks, and remediation can take months depending on your starting point.
For some contracts, the current program may allow a self-assessment and affirmation path. Other contracts may require an independent assessment or another verification method. Check the solicitation, contract, flow-downs, and latest official guidance. Maintain evidence that supports the score and the controls you describe.
A subcontractor's obligations depend on the contract, the clauses flowed down by the prime, and the information it handles. If you handle FCI or CUI, ask the prime which systems, controls, records, and evidence are in scope.
It paused the planned Phase II expansion of third-party assessment requirements and related milestones while the program is reviewed. It did not erase applicable contract obligations, the need to protect FCI and CUI, or Phase I self-assessment requirements. Read the official CMMC page for current status.
No. NIST SP 800-171 is a set of security requirements for protecting CUI in nonfederal systems. CMMC is the Department's contract-linked verification program. A contract may reference NIST practices, CMMC requirements, DFARS clauses, or more than one of these.
Timing depends on scope, starting posture, contract requirements, and the evidence needed. A defined environment with mature operations can move faster; businesses starting without an inventory, SSP, or repeatable evidence may need several months. Use the current pause to build a realistic plan rather than waiting for a deadline.
Use the current review period to clarify your contract requirements, reduce your CUI boundary where possible, and build controls and evidence your team can operate.