Peregrine Solutions Group — CMMC Level 2 Readiness for Small Defense Contractors

The clock

Why this is urgent now

It's in the contracts

CMMC is in DFARS clauses now. Phase 2 makes a C3PAO Level 2 assessment a requirement on applicable awards starting Nov 10, 2026.

The queue is the bottleneck

Roughly a hundred authorized assessors serve a defense industrial base of tens of thousands of firms. You must be fully ready before you can even book — and the wait is months.

Most shops aren't close

Only a small fraction of the DIB is assessment-ready today. The contractors who move now win the work the unready ones lose — readiness is becoming a competitive edge, not a checkbox.

SPRS · NIST SP 800-171

Do you actually know your score?

SPRS runs from −203 to +110, and primes can see what you've posted. Most shops have never scored themselves honestly — or posted a number they can't defend. The Snapshot scores all 110 controls and gives you a preliminary SPRS you can stand behind, in days.

The ladder

How we work with you

Step	What you get	Investment
Strategy Call	A blunt 60-min read on your SPRS score, top gaps, and fastest path. One-page written summary.	$350
SPRS + Gap Snapshot	Fixed-scope gap analysis across all 110 controls — delivered in days, not weeks. Most consultants charge more for the gap analysis alone.	$3k–5k
Readiness Assessment	Full SSP, POA&M, remediation roadmap, branded report — assessment-ready package. Engineer-designed remediation of the hard technical controls, specified and sequenced for your IT team or MSP to execute.	$8k–15k
vCISO Retainer	Ongoing compliance leadership through assessment and beyond.	$2.5k–5k/mo

The difference

Why Peregrine

Engineer-led, not paper-only. The hard controls — Azure/M365 GCC High configuration and compliance design, Intune policy design, the access/audit/crypto families most consultants gloss over — are designed and documented by a practicing cloud-security engineer, ready for your IT team or MSP to execute.
Fast, fixed-price. A purpose-built system generates your full readiness package in days. See a sample package — synthetic client, real format.
Independent. No assessment arm — no conflict. We route you to a C3PAO with open capacity.
Local to the Carolinas, available nationally. Based in the Charlotte metro (Mooresville area). In-person strategy sessions available for NC-based contractors. Remote delivery everywhere else.
Veteran-owned (SDVOSB certification pending). Led by a 2025 BEYA Modern-Day Technology Leader and senior cloud-security engineer. CAGE 9ZEH9, SAM.gov active. Verify every claim →

No CUI · General context only

Free SPRS Reality-Check / Request Info

Tell us a little about your situation. We'll get back to you with a realistic read on where you stand — or book the paid strategy call above for a full working session. Prefer to talk now? Book the free 20-minute reality-check directly.