Security testing for suppliers whose contracts depend on it
For precision machine shops, electronics and component makers, and subcontractors on Long Island, typically 10 to 200 employees, often several tiers down from a prime, handling controlled unclassified information such as drawings, specifications, and technical data. We test the controls that keep those contracts.
What we test for suppliers
We focus on the NIST SP 800-171 controls that CMMC and DFARS require. Every engagement pairs with our web application penetration test approach and our cloud security assessment where they apply.
What is at stake
In the shop's language and the owner's language, these are the exposures a gap creates
A bid ruled non-compliant without the required CMMC status
The CMMC program rule (32 CFR Part 170) took effect December 16, 2024, and on November 10, 2025 the DFARS clause 252.204-7021 began appearing in new solicitations and contracts as Phase 1. A self-assessment can be a condition of award.
A weak SPRS score removes the firm before technical discussion
Self-assessment scores are posted to SPRS and affirmed by a senior official, and primes and contracting officers can see them. A weak score or a missing affirmation can remove a supplier from consideration before any technical discussion.
CUI walks out through a subcontractor
Drawings and specifications are controlled information, and primes check their subcontractors because a weak shop down the chain puts their contract at risk.
CMMC status
CMMC Phase 2, the third-party Level 2 certification that was due to start November 10, 2026, was suspended July 13, 2026, with no new date set. Phase 1 self-assessments, the NIST SP 800-171 controls, and the DFARS duty to protect CUI still apply. The pause is a window to close gaps, not a reprieve.
Level 2 scope
CMMC Level 2 is the 110 requirements of NIST SP 800-171 Rev. 2 across 14 families. Subcontractors handling federal contract information need Level 1; subcontractors handling CUI need Level 2.
Engagement and pricing
Assessments start at $5,000 and include a free 30-minute consultation. We scope the work to your CUI systems, your SPRS score, and the contract requirements you need to meet.
Based in Long Island and serving defense and aerospace suppliers across the region. See our Long Island security services page, compare options on our pricing page, or contact us to schedule a call.
Close the gaps before the next solicitation
Book a free 30-minute call. We will walk through your NIST SP 800-171 controls, CUI handling, and SPRS score and tell you where a gap would cost a contract.