Bison Security Solutions
CMMC & NIST 800-171 READINESS · COLORADO

Your prime sent the letter. Now what?

CMMC and NIST 800-171 readiness for defense contractors — and enterprise security for everyone else.

If you handle Controlled Unclassified Information, DFARS 252.204-7012 has applied to you since 2017. Your SPRS score is still due. Your prime may still require certification regardless of what the DoW paused.

We get you compliant, and we do the work — not just the report.

Book a 30-minute call 30 minutes · No pitch deck · Registered Practitioner, Cyber AB
Cyber AB Registered Practitioner· 25+ years in IT· 7+ years security-focused· U.S. Person / ITAR eligible· Microsoft security stack· Castle Rock, Colorado
Where CMMC actually stands

Suspended isn't the same as cancelled.

On July 13, 2026, the Department of War suspended CMMC Phase II — the third-party certification requirement that was set to take effect in November. A lot of contractors read the headline and stood down.

That's a mistake, for three reasons.

Phase I never went away. Level 1 and Level 2 self-assessment requirements remain in force. DFARS 252.204-7012 is fully operative, including the 72-hour incident reporting obligation and mandatory flowdown to subcontractors. NIST SP 800-171 Rev. 2 is still the standard.

Your prime may not care what the DoW paused. The suspension applies to Department contracting personnel. It does not rewrite your contract with your prime. Several primes have already told their supply chains they will keep requiring certification. Confirm in writing before you change anything.

Self-attestation raises your risk, it doesn't lower it. With third-party assessment paused, the SPRS score you submit is still an attestation to the federal government — but the assessor who would have caught an inflated number is out of the loop. False Claims Act settlements in this space have run into the millions.

The controls didn't get easier. Only the verification mechanism changed.

What we deliver

Six engagements
01

CMMC & NIST 800-171 Readiness

A full gap assessment against all 110 NIST SP 800-171 controls and 320 assessment objectives, followed by the documentation you're actually required to produce: a System Security Plan, POA&Ms, and a defensible SPRS score.

Then we remediate. Most readiness firms hand you a findings list and leave. We close the gaps — identity, access control, configuration management, monitoring, incident response — because we're security engineers first.

Typically $16,000 – $32,000 · 10 to 16 weeks
02

SPRS Score Review & Attestation Support

A focused engagement for contractors who already submitted a score and want to know whether it holds up. We validate your scoring against the actual implementation, identify where the evidence doesn't support the claim, and give you a corrected position before someone else finds the gap.

This one exists because inflated SPRS scores are the specific thing driving False Claims Act cases. Contractors who submitted a number in 2021 and never revisited it are exposed.

Typically $4,500 – $8,000 · 2 to 3 weeks
03

Microsoft 365 & Azure Security Assessment

A fixed-scope review of your tenant against CIS Benchmarks and Microsoft security baselines. Identity and conditional access, Defender configuration, Purview and DLP, external sharing, privileged access, and licensing gaps.

You get a report with prioritized findings, risk ratings, and specific remediation steps — written to be acted on, not filed.

Typically $5,500 – $9,000 · 2-week turnaround
04

Compliance Readiness

SOC 2 Type II, HIPAA, and CIS Controls. Gap assessment, control mapping, policy and documentation development, remediation planning, and audit support.

Typically $16,000 – $27,000 · 6 to 16 weeks
05

Security Engineering & Implementation

We close findings, not just report them. Conditional Access and identity hardening, Microsoft Defender deployment and tuning, Purview and DLP, Intune endpoint baselines, Sentinel deployment, and email authentication.

Fixed fee, staged and reversible — changes are previewed before enforcement wherever the platform supports it, with rollback documented.

Typically $6,750 – $18,000 per engagement
06

Virtual CISO & Incident Response

Ongoing security leadership for organizations that need it but can't hire it: risk register, policy management, quarterly reviews, board-grade reporting, and questionnaire support.

And when something goes wrong — containment, investigation, forensic analysis, and executive communication, backed by hands-on experience with FTK, Cellebrite, and Magnet.

vCISO from $3,000/month · IR hourly, retainer available

Pricing reflects typical engagements. Environments above 500 users, multi-tenant estates, and multi-framework programs are scoped individually.

Who this is for

Defense contractors & subcontractors

You handle CUI or FCI, you have DFARS clauses in your contracts, and you need to reach and hold a defensible NIST 800-171 position. Manufacturers, engineering firms, and suppliers across the Front Range.

Regulated small & mid-size businesses

Healthcare, financial services, and professional services facing SOC 2, HIPAA, cyber insurance questionnaires, or customer security reviews — without a security team to answer them.

Companies running on Microsoft

If your business runs on Microsoft 365 and Azure and nobody has ever verified it's configured securely, that's the assessment. It usually finds more than people expect.

IT providers & consultancies

We work behind other firms as a subcontracted security capability, under their brand, when they need depth they don't have in-house.

Who you're actually getting

Lloyd Fuller, Principal

Cyber AB Registered Practitioner. Formally registered with the Cyber Accreditation Body to provide CMMC consultative and readiness services.

Verify credential →

25+ years in IT, the last seven focused on cybersecurity.

Most recently Senior Manager of Endpoint and Email Security at Kenvue (formerly part of Johnson & Johnson), directing a 39-person team protecting 20,000 users and 43 million monthly emails. Delivered $2M in annual savings through SIEM and platform optimization, and led a zero-disruption migration of more than 30,000 mailboxes in five months.

Before that, sole Microsoft 365 and Azure security SME for a 30,000-employee enterprise, and security lead for a Tier 1 automotive manufacturer — a live production environment where IT met the plant floor. Earlier, IT infrastructure at a federal chemical demilitarization facility.

Natural-born U.S. citizen. Meets ITAR U.S. Person requirements for work involving export-controlled technical data.

Depth where it counts
NIST SP 800-171 CMMC Level 1 & 2 CIS Benchmarks & Controls SOC 2 Type II Microsoft Defender suite Sentinel (SIEM/SOAR) Purview & DLP Entra ID & Conditional Access Intune — Windows, macOS, Linux Tenable VM Digital forensics & IR

And something rarer: genuine hands-on digital forensics experience with FTK, Cellebrite, and Magnet.

When you hire us, you're not getting a junior analyst reading from a runbook. You're getting the person who has actually done this at enterprise scale.

Why contractors hire us instead of a bigger firm

We do the remediation. Most readiness consultants deliver a gap report and hand you a to-do list your IT person can't execute. We're security engineers — we close the gaps ourselves.

You get the principal, not a bench. The person who scopes your engagement is the person who does the work. Nothing gets handed to an associate.

Fixed scope, fixed price. You know the cost before we start. Change orders only when scope actually changes.

We're local. Castle Rock, serving the Front Range. On-site when it matters.

FAQ

Is CMMC cancelled?

No. On July 13, 2026, the Department of War suspended Phase II — the requirement for third-party C3PAO certification as a condition of award. Phase I self-assessment requirements, DFARS 252.204-7012, and NIST SP 800-171 Rev. 2 all remain in force. The Cyber AB confirmed that C3PAOs remain authorized to conduct Level 2 certification assessments for organizations that want them. A Reform Task Force is reviewing the program and reporting back. This is a suspension and review, not a repeal.

My prime says I still need certification. Who's right?

Your prime. The DoW suspension applies to Department contracting personnel — it does not rewrite your contract with a prime contractor. Several primes have told their supply chains they will continue requiring certification regardless. Get your prime's position in writing before changing your compliance plans.

What's the difference between CMMC and NIST 800-171?

NIST SP 800-171 is the control standard — 110 controls that define what you have to do. CMMC is the verification program that checks whether you did it. DFARS 252.204-7012 has required 800-171 since 2017. CMMC Level 2 assesses those same controls.

What is a Registered Practitioner?

An individual registered with the Cyber Accreditation Body (Cyber AB) to provide CMMC consultative and readiness services, having completed required training and background screening and agreed to the Cyber AB Code of Professional Conduct. RPs help organizations prepare for assessment. They do not perform certification assessments — that's a C3PAO, and the same firm cannot both prepare and assess a client.

Can you certify us?

No, and neither can any consultant who prepares you. Certification assessments are performed by a C3PAO, and independence rules prohibit the firm that prepared you from also assessing you. We get you ready and can refer you to independent C3PAOs when you're there.

How long does CMMC readiness take?

Most organizations need 6 to 12 months from start to assessment-ready, depending on how much is already in place and how quickly remediation moves. The gap assessment itself takes 3 to 4 weeks.

We already submitted an SPRS score. Are we fine?

Maybe not. Many contractors submitted an optimistic score years ago and never revisited it. With third-party assessment paused, that number is still a representation to the federal government, and inflated scores are what drive False Claims Act cases in this space. A score review is a short, focused engagement that tells you where you actually stand.

Do you work with companies outside the defense sector?

Yes. CMMC and NIST 800-171 are a specialty, not a limitation. We do Microsoft 365 and Azure security assessments, SOC 2 and HIPAA readiness, security engineering, vCISO, and incident response for organizations in any industry.

Do you work with our existing tools?

Yes. We're tool-agnostic on monitoring and detection. If you already run Huntress, Arctic Wolf, SentinelOne, Sophos, or Defender, we work within it. We're not reselling a platform.

What size organizations do you work with?

Most engagements land between 25 and 1,500 users. Below 25, an assessment usually makes sense but an ongoing retainer rarely does. Above 500 users, engagements are scoped individually.

How fast can you start?

Assessments typically begin within two weeks of a signed engagement. Incident response is immediate.

Are you an MSP?

No. We don't do help desk, endpoint management, or managed IT. We're a security engineering and compliance practice. If you need day-to-day IT support, we're happy to work alongside whoever provides it.

Let's have a 30-minute conversation.

No pitch deck · No qualification form · No sales sequence

Tell us where you are — a flowdown letter you don't understand, an SPRS score you're not confident in, or a tenant nobody has looked at. You'll leave the call knowing what you're actually required to do, whether or not you hire us.

Book a call