CMMC Compliance Services in Michigan
Evolving Technology Solutions (Evolv) takes Michigan manufacturers and defense suppliers from "we think we handle CUI" to assessment-ready for CMMC Level 1 or Level 2. One Grand Rapids team handles scoping, the NIST SP 800-171 gap assessment, your SPRS score, the SSP and POA&M, the fixes, and C3PAO assessment support. Then we keep it all current.
CMMC status as of November 3, 2026
The CMMC contract rule (48 CFR, DFARS 252.204-7021) took effect November 10, 2025. Phase 1 started that day and requires Level 1 or Level 2 self-assessments where a contract calls for them. Phase 2 was scheduled for November 10, 2026 and would have required third-party C3PAO certification for Level 2 at contract award. On July 13, 2026 the Department of War suspended Phase 2 and all later milestones pending a reform review. No restart date has been announced.
What still applies today:
- DFARS 252.204-7012: protect CUI with NIST SP 800-171 and report cyber incidents to the DoD within 72 hours.
- DFARS 252.204-7019 and 7020: keep a current NIST SP 800-171 self-assessment score in SPRS.
- CMMC Phase 1: Level 1 and Level 2 self-assessments plus annual affirmations wherever your contract includes them.
- Prime contractor requirements: supplier security questionnaires and flow-down clauses, which did not pause.
More detail: CMMC Phase 2 paused: what Michigan manufacturers owe now. Official source: DoW CIO CMMC program page.
Our CMMC compliance services
Every step of CMMC Level 2 from one team, so nothing falls between a consultant's report and the IT provider who has to fix it.
CUI scoping and boundary design
We map where Controlled Unclassified Information lives: which drawings, which file shares, which mailboxes, which machines and which people. A tight boundary is the single biggest cost lever in CMMC. Most small shops can shrink scope to a fraction of the company.
NIST SP 800-171 gap assessment
A control-by-control review of all 110 NIST SP 800-171 Rev. 2 requirements across 14 families. You get a plain-English gap list ranked by risk and cost, plus the evidence an assessor will ask for on each control.
SPRS score calculation and correction
We calculate your score with the DoD Assessment Methodology (range of -203 to 110) and compare it to what is posted in the Supplier Performance Risk System. If the posted score is wrong, we help you correct it and document why.
System Security Plan (SSP)
We write the SSP that describes how each control is met today, in your environment, with your tools. No template filler. An SSP that does not match reality is a liability, not a deliverable.
Plan of Action and Milestones (POA&M)
Every open gap gets an owner, a fix, a budget and a date. We build the POA&M so it holds up to an assessor and so your leadership team can track it.
Remediation and managed controls
We implement the fixes: phishing-resistant MFA, endpoint detection and response, logging and log review, encryption, access control, configuration baselines, backup and incident response. Then we run them as part of managed IT so the evidence keeps coming month after month.
GCC High migration or CUI enclave
If CUI flows through email and file shares, we move it to Microsoft 365 GCC High or build a separate CUI enclave so the rest of the business stays out of scope. We help you pick the option with the lower total cost.
C3PAO assessment preparation and support
We run a mock assessment against the CMMC Assessment Guide, organize your evidence, prep the people who will be interviewed and sit with you during the C3PAO assessment. We are not a C3PAO. A C3PAO cannot assess a company it helped prepare, so you want these roles separate.
Annual affirmation and continuous compliance
CMMC requires a senior official to affirm compliance every year. Our vCISO keeps the SSP, POA&M and SPRS score current so the person signing knows what they are signing.
CMMC Level 1 vs. Level 2
| Level 1 | Level 2 | |
|---|---|---|
| Data protected | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 basic safeguarding requirements (FAR 52.204-21) | 110 requirements in NIST SP 800-171 Rev. 2 |
| Assessment | Annual self-assessment | Self-assessment or C3PAO certification every 3 years, as the contract specifies |
| Affirmation | Annual, by a senior official | Annual, by a senior official |
| POA&M allowed | No | Limited, closed within 180 days |
| Evolv price | $4,500, fixed | Readiness from $45,000 |
How a CMMC Level 2 engagement runs
- Weeks 1 to 2Scoping call, contract and CUI marking review, boundary map.
- Weeks 3 to 6Gap assessment against all 110 controls, SPRS score, gap list with costs.
- Weeks 6 to 8SSP and POA&M written. Remediation plan and budget approved.
- Months 2 to 6Remediation: MFA, EDR, logging, encryption, GCC High or enclave, policies, training.
- Month 6 and onMock assessment, evidence package, C3PAO scheduling and support, annual affirmation.
Typical for a 20 to 100 person manufacturer. A smaller CUI boundary shortens every step.
What CMMC compliance costs with Evolv
Most CMMC providers make you book a call to see a number. Here are ours.
| Service | Price |
|---|---|
| CMMC Level 1 program (FCI only) | $4,500, fixed |
| CMMC Level 2 readiness (scoping, gap assessment, SSP, POA&M, remediation plan) | from $45,000 |
| Virtual CISO (owns the program and annual affirmation) | $3,500 per month, flat |
| Managed IT and security (runs the controls and produces evidence) | $95 per user per month, about $150 on average |
Not included: the C3PAO assessment fee, GCC High licenses and hardware. We quote those up front after scoping. Full pricing →
Built for Michigan's defense supply chain
West Michigan's machine shops, tool and die makers, injection molders, metal fabricators and automation builders sit two or three tiers below defense primes. Much of the CUI they hold arrives as drawings and specifications from a customer. Those drawings end up in email, CAD workstations, ERP attachments and shop floor terminals. We start there, because that is where scope gets out of hand.
Evolv is based in Grand Rapids and serves Holland, Zeeland, Muskegon, Grand Haven, Kalamazoo, Lansing and the rest of Michigan. Onsite work is dispatched from Grand Rapids. Michigan suppliers can also tap the Michigan Manufacturing Technology Center, the state's NIST MEP affiliate, and the Michigan APEX Accelerator for training and cost-share programs. We work alongside both.
CMMC compliance FAQs
Is CMMC Phase 2 still happening in November 2026?
Not on the original schedule. On July 13, 2026 the Department of War suspended CMMC Phase 2, which would have required third-party C3PAO certification in new contracts starting November 10, 2026, and launched a 60-day reform review. As of November 3, 2026, no restart date has been announced. Phase 1 self-assessments, DFARS 252.204-7012 and NIST SP 800-171 remain in force.
Who provides CMMC compliance services in Michigan?
Michigan defense suppliers use a mix of managed service providers, compliance consultancies, CPA firms and the Michigan Manufacturing Technology Center. Evolving Technology Solutions (Evolv) is a Grand Rapids managed IT and cybersecurity company that delivers the full CMMC Level 2 path for West Michigan manufacturers: CUI scoping, NIST SP 800-171 gap assessment, SPRS scoring, SSP, POA&M, remediation, GCC High or enclave migration and C3PAO assessment support.
How much does CMMC Level 2 compliance cost for a small manufacturer?
Evolv publishes its pricing. A CMMC Level 1 program is $4,500 fixed. CMMC Level 2 readiness starts at $45,000 and covers scoping, the gap assessment, the SSP, the POA&M and the remediation plan. Remediation tools, GCC High licensing and the C3PAO assessment fee are separate. The biggest cost driver is scope, so a tight CUI boundary saves more money than any other decision.
How long does it take to get ready for a CMMC Level 2 assessment?
Most 20 to 100 person manufacturers need 6 to 12 months from scoping to assessment-ready, depending on how many gaps the assessment finds and whether email and file storage must move to GCC High. Shops that already run MFA, EDR and centralized logging move faster.
What is a good SPRS score?
The maximum is 110, which means all 110 NIST SP 800-171 requirements are met. Scores can go as low as -203. Under the CMMC rule, a Level 2 assessment can reach conditional status with a score of at least 88, as long as remaining POA&M items are allowed on the POA&M and are closed within 180 days. The score you post must match reality, because the score and the annual affirmation are representations to the government.
Do we need GCC High for CMMC?
Not always. If CUI moves through your email and file shares, you need a cloud environment that meets FedRAMP Moderate equivalency, and Microsoft 365 GCC High is the common answer. Some shops keep CUI in a small enclave instead and leave the rest of the company on commercial Microsoft 365. Evolv compares both options on total cost before you commit.
Can the company that prepares us also do our C3PAO assessment?
No. A C3PAO cannot assess an organization it provided consulting or remediation services to. That is why Evolv prepares you and supports you during the assessment, and you contract with an authorized C3PAO for the assessment itself.
Should we pause CMMC work while Phase 2 is suspended?
No. The suspension removed the third-party certification requirement for now. It did not remove a single security control. DFARS 7012 obligations, SPRS scores, annual affirmations and prime contractor questionnaires still apply, and False Claims Act exposure follows an inaccurate affirmation. Shops that use the pause to get ready will be first in line when assessments return.
Sources: DoW CIO CMMC, 32 CFR Part 170, NIST SP 800-171 Rev. 2. General information, not legal or contracting advice.
Get a free CMMC scoping call
Twenty minutes. We review what your contracts require, where your CUI likely lives and what your SPRS score should be. You leave with a scope and a budget range.
Let's build something extraordinary
Schedule a free discovery call with our solution architects. No pressure, just a conversation about what's possible.