Peregrine Solutions Group — CMMC Level 2 Readiness for Small Defense Contractors

The clock

Why this is urgent now

It's in the contracts

CMMC is in DFARS clauses now. Phase 2 makes a C3PAO Level 2 assessment a requirement on applicable awards starting Nov 10, 2026.

No assessment = no award.

The queue is the bottleneck

Roughly a hundred authorized assessors serve a defense industrial base of tens of thousands of firms. You must be fully ready before you can even book — and the wait is months.

Booking late lands you in 2027.

Most shops aren't close

Only a small fraction of the DIB is assessment-ready today. The contractors who move now win the work the unready ones lose — readiness is becoming a competitive edge, not a checkbox.

Ready shops take the recompetes.

Plain terms

Three terms, one goal

NIST SP 800-171

The 110-control security standard your DoD contracts already require.

SPRS

The self-assessment score you post to the government — visible to your primes.

CMMC Level 2

The third-party assessment that verifies you actually meet the standard.

We get you ready for all three — one engagement, one fixed price.

SPRS · NIST SP 800-171

Do you actually know your score?

Your posted score is already visible to your primes — the question is whether you can defend it. SPRS runs from −203 to +110, and most shops have never scored themselves honestly. The Snapshot scores all 110 controls and gives you a preliminary SPRS you can stand behind, in days.

The ladder

How we work with you

Step	What you get	Investment
Strategy Call	Know exactly where you stand — in one call. A blunt 60-min read on your SPRS score, top gaps, and fastest path; one-page written summary within 24 hours.	$350
SPRS + Gap Snapshot	A defensible score you can post — in days. Fixed-scope gap analysis across all 110 controls. Most consultants charge more for the gap analysis alone.	$3k–5k
Readiness Assessment	Walk into your assessment with the full package. SSP, POA&M, remediation roadmap, branded report — with engineer-designed fixes specified and sequenced for your IT team or MSP to execute.	$8k–15k
vCISO Retainer	Stay ready after you get ready. Ongoing compliance leadership through assessment and beyond.	$2.5k–5k/mo

The difference

Why Peregrine

Engineer-led, not paper-only

The hard controls — Azure/M365 GCC High configuration, Intune policy design, the access-control, audit, and encryption controls most consultants gloss over — designed and documented by a practicing cloud-security engineer, ready for your IT team or MSP to execute.

Fast and fixed-price

A purpose-built system generates your full readiness package in days. See a sample package — synthetic client, real format.

Independent

No assessment arm — no conflict of interest. We route you to a C3PAO with open capacity.

Veteran-owned

SDVOSB certification pending. Led by a 2025 BEYA Modern-Day Technology Leader — senior cloud-security engineer and associate solutions architect. CAGE 9ZEH9, SAM.gov active. Verify every claim →

Based in the Charlotte metro (Mooresville) — in-person for NC contractors · remote delivery nationally

No CUI · General context only

Free SPRS Reality-Check / Request Info

Tell us a little about your situation. We'll get back to you with a realistic read on where you stand — or book the paid strategy call above for a full working session. Prefer to talk now? Book the free 20-minute reality-check directly.

~90 seconds · 8 fields · no CUI