CMMC • NIST 800-171 • SPRS
CMMC & NIST 800-171 compliance for small defense contractors.
I help small DIB companies get an honest SPRS score, a real System Security Plan, and a clear plan to close the gaps, at a small-business price, so you keep your DoD contracts.
Pick a time that works for you · or email brad@jumpercyber.com
Service-Disabled Veteran-Owned · Based in North Alabama · Serving defense suppliers nationwide
Credentials
CMMC Registered Practitioner (RP) · CISM · C|CISO · CompTIA SecurityX · CySA+ · Security+ · E|CSA
M.S. Cybersecurity & Information Assurance · MBA, Project Management
If you handle CUI, your score is on the line.
DFARS 252.204-7012 and CMMC self-assessments are in force now. Contracting officers can see your SPRS score, and an inflated one is a False Claims Act risk. Most small shops don’t need a big program. They need to know where they stand and fix what matters first.
What you get
CMMC Readiness Package
- Gap assessment against all 110 NIST SP 800-171 controls
- System Security Plan (SSP) and POA&M
- Your SPRS score, calculated and ready to submit
- A prioritized list of what to fix first
- Optional hands-on help closing the gaps
Fixed price. Done remotely or on-site. Level 1 (FCI-only) packages available.
You work directly with me.
- 20+ years in military, government, and defense cybersecurity
- CMMC Registered Practitioner, authorized by the Cyber AB to provide CMMC advisory services
- RMF and ATO experience from inside DoD programs
- Service-Disabled Veteran, Army National Guard Chief Warrant Officer, and active security clearance holder
- No junior staff, no upsell, no scare tactics
How it works
1. Free call
20 minutes. We look at your contract clauses and the data you handle.
2. Assessment
I review your environment and score it honestly.
3. Your documents and plan
SSP, POA&M, SPRS score, and a fix list you can act on.
Common questions
CMMC Phase 2 is paused. Do I still need this?
Yes. Third-party certification is paused, but DFARS 252.204-7012, NIST SP 800-171, and SPRS self-assessments still apply, and your annual affirmation has to be accurate.
Do I need Level 1 or Level 2?
Federal Contract Information only generally means Level 1. Controlled Unclassified Information (CUI) generally means Level 2. On the free call, I’ll help you figure out which applies.
Do you work with companies outside Alabama?
Yes. I’m based in Guntersville, near Huntsville, Alabama, and most of the work can be done remotely, so I support defense suppliers anywhere in the U.S.
More plain-English guides for defense suppliers: read the Insights blog →
For prime contractors & agencies
Cleared RMF and ISSM support, on contract.
Service-Disabled Veteran-Owned small business providing experienced, cleared cybersecurity compliance support to primes and federal programs, as a subcontractor or prime.
Core capabilities
- RMF / ATO package development (eMASS)
- ISSM / ISSO support
- Continuous monitoring and POA&M management
- NIST SP 800-53, 800-171 and CMMC
- AI risk governance (NIST AI RMF)
Company data
- Service-Disabled Veteran-Owned Small Business
- Active security clearance
- DoD 8140 work role: 722 Information Systems Security Manager (ISSM)
- DoD 8570 baseline: IAM III (CISM, C|CISO) · IAT III (SecurityX) · IAT II (Security+, CySA+)
- Primary NAICS 541512; also 541519, 541611, 541690, 541513, 541618, 541990, 611430
- Available C2C, part-time or full-time
Find out where you stand in 20 minutes.
No cost, no pressure. You’ll leave the call knowing what applies to you and what to do next.
or email brad@jumpercyber.com
