Cybersecurity Maturity Model Certification (CMMC) · Published Prices

CMMC Self-Assessment Kits
Fixed Prices, Plain Language, Credentialed Review

When a defense contract requires a CMMC self-assessment, the supplier reports the result in the Supplier Performance Risk System (SPRS) and its senior official affirms it every year. These kits walk a small company through each step in plain language. Start free and buy a kit for $297 or $497 to do the work yourself, add a review by a CMMC Certified Professional, or get assisted help with a Guided package or a Hands-on Assessment. If you start with a kit and it becomes too confusing, the full amount you paid is credited toward Guided or Hands-on help. Every price is on this page.

Compare the Tiers Start With the Free Starter

Kits are delivered by email within minutes of payment. Full refund within the 20 day refund window if a file will not open or the kit is not as described. These kits support your own self-assessment. They do not give you a CMMC certification or status.

Who It Is For

Made for a supplier with no compliance department

A small manufacturer, machine shop, software firm, or services company that sells to the Department of Defense (DoD), or to a prime contractor that does, usually has one person handling security on top of a day job. These kits give that person a plain-language path from the first question to the signed affirmation.

Level 1: Federal Contract Information (FCI) only

Your contract involves Federal Contract Information, which is information the government provides or you generate under a contract that is not public. A contract that involves only this kind of information usually calls for Level 1, and the contract names the level. Level 1 means 15 basic safeguarding requirements from Federal Acquisition Regulation (FAR) clause 52.204-21, a self-assessment, and an annual affirmation.

Level 2: Controlled Unclassified Information (CUI)

Your contract involves Controlled Unclassified Information, which is information the Government creates or possesses, or that a company creates or possesses for the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. Expect Level 2 or higher; the contract names the level. Level 2 means the 110 requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2. Depending on the contract, Level 2 is a self-assessment or an assessment by a third party.

Not sure which level applies

Your contract, and the CMMC clause in it, decide the level. If a prime contractor flowed a requirement down to you, ask the prime which level and which type of assessment the solicitation requires. The free starter and the Frequently Asked Questions below help you sort it out.

Not the right fit: a company whose contract requires a Level 2 assessment by a Certified Third-Party Assessment Organization (C3PAO) still needs that assessment, and these kits do not replace it. The Level 2 Kit helps you prepare for one. Consultants and managed service providers who want to use a kit with several clients need a separate license for each client company. Each client license costs the same as the kit: $297 for Level 1 and $497 for Level 2.

Tiers and Prices

Every tier, every price, on one page

Pick the level your contract requires, then pick how much help you want. Kits are one-time purchases. The Annual Refresh is planned and not yet available. When it opens, it will be optional: one payment each year, with a reminder email 14 days before your renewal date and no automatic renewal. The Hands-on Assessment is quoted per company, starting at $9,000. Prices are in U.S. dollars.

Start free

Check whether Level 1 fits and see where your gaps are.

Free CMMC Level 1 Starter

$0 email required

Who it is for. Anyone who wants to learn whether Level 1 applies and where the gaps are before spending money.

Plain-language checklist of the 15 Level 1 requirements
Quick score worksheet: met or not met for each requirement
Affirmation readiness worksheet
Starter Sources: where each rule comes from, with links to the official text

Delivery. The download link appears on screen right after you submit the form, and a copy is emailed to you.

Get the Free Starter

Template kits: do it yourself, in plain language

Choose the kit for your level. Each kit is a do-it-yourself product for your company to complete on its own, and it is a one-time purchase with editable files you adopt as your own. Plan for several weeks. If it becomes too confusing, you can move to our assisted service, and the full amount you paid is credited.

CMMC Level 1 Self-Assessment Kit

$297 one time

Who it is for. A small supplier with Federal Contract Information that must complete a Level 1 self-assessment and affirm it each year.

Walkthrough of each of the 15 requirements and each assessment objective
Self-assessment workbook for all 59 objectives, with an evidence tracker that lists what to save as proof
Level 1 policy and procedure set, ready to edit
Remediation plan template for any requirement not yet met
Step-by-step guide to the affirmation and the SPRS entry
Short guide to brief your owner or senior official

Delivery. Download links by email within minutes of payment.

Buy Level 1 Kit for $297 See what is inside

CMMC Level 2 Self-Assessment Kit

$497 one time

Who it is for. A small supplier with Controlled Unclassified Information that must complete a Level 2 self-assessment, or prepare for a third-party assessment.

All 110 NIST SP 800-171 Revision 2 requirements in plain language
Assessment objectives from NIST SP 800-171A for each requirement, built into the self-assessment workbook
SPRS scoring workbook using the CMMC scoring point values in Title 32 of the Code of Federal Regulations (CFR), section 170.24
System Security Plan (SSP) template
Plan of Action and Milestones (POA&M) template with the eligibility rules from 32 CFR section 170.21
SPRS entry and affirmation guide, evidence binder guide, and policy set

Delivery. Download links by email within minutes of payment.

Buy Level 2 Kit for $497 See what is inside

Kit plus a credentialed review

The same kit, plus one review session of your completed workbook with a CMMC Certified Professional. Kit plus review call is $697 at Level 1 (the review portion is $400) and $997 at Level 2 (the review portion is $500). Both reviewed options cost less than $1,000.

Level 1 Kit + CMMC Certified Professional Review Call

$697 one time

Who it is for. A Level 1 supplier who wants a credentialed person to look over the finished work before the senior official signs.

Everything in the Level 1 Kit
One review session of your completed workbook with Thabiti Adams, who holds the Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), CMMC Certified Professional (CCP), and CompTIA Security+ credentials
The review portion is $400 on top of the $297 kit
Written notes of what to fix before you affirm

Delivery. Kit by email within minutes of payment. Review call: 45 minutes, with the first available time within 5 business days of purchase. The call is valid for 60 days from purchase. If the review call is not held within 60 days of purchase, and we did not cause the delay, we refund the call portion ($400) minus card processing fees.

Buy Kit + Review for $697

Level 2 Kit + CMMC Certified Professional Review Call

$997 one time

Who it is for. A Level 2 supplier who wants a credentialed review of the completed workbook, score, and System Security Plan.

Everything in the Level 2 Kit
One review session of your completed workbook with Thabiti Adams (CISSP, CCSP, CCP, and CompTIA Security+)
The review portion is $500 on top of the $497 kit
Written notes of what to fix before you affirm

Buy Kit + Review for $997

Stay current each year

Your affirmation repeats every year, and the kit should be current when it does.

Annual Refresh (planned)

$497 one payment per year

Who it is for. A kit owner who must re-assess and affirm every year and wants the kit brought up to date first.

Updated kit version for the Level you use
Re-score check of your workbook
Reminder as your affirmation season approaches
An email 14 days before your renewal date
A short review: one 30 minute call

Delivery. The Annual Refresh is planned and not yet available. When it opens, refreshed files are emailed within 2 business days of payment once the refreshed set for your level is released. One payment each year, with a reminder email 14 days before your renewal date. It does not renew automatically.

Planned. The Annual Refresh is planned and not yet available. Kit buyers will receive an email when it is available.

Guided packages: built from your answers, remote

You contact us with a few details about your company. We confirm the scope and fit in writing before you pay anything, and your payment link comes with that written scope confirmation. Guided packages are remote and document based. They involve no system access and no testing.

Guided Level 1 Package

$1,995 one time

Who it is for. A supplier that wants the Level 1 work scoped to its own systems and the remediation plan written for it. Remote and document based, with no system access or testing.

Scoping questions about your company, contracts, and systems, answered by email
Checklist scoped to what you actually use
Completed remediation plan for the gaps your answers show
Affirmation readiness review
One 60 minute call
If the deliverables miss the written scope, we correct them at no charge within 30 days of delivery. A refund applies only if we cannot deliver the package

Delivery. Delivered within 10 business days, counted from the written scope confirmation and payment. We send your payment link with the written scope confirmation.

Ask About Guided Level 1

Guided Level 2 Package

$4,500 one time

Who it is for. A supplier with Controlled Unclassified Information that wants the Level 2 work scoped and drafted for it. Remote and document based, with no system access or testing.

Scoping questions about your company, contracts, and systems, answered by email
Checklist scoped to what you actually use
Filled System Security Plan outline
Prioritized Plan of Action and Milestones
SPRS score estimate based on your answers
One 90 minute call
If the deliverables miss the written scope, we correct them at no charge within 30 days of delivery. A refund applies only if we cannot deliver the package

Delivery. Delivered within 15 business days, counted from the written scope confirmation and payment. We send your payment link with the written scope confirmation.

Ask About Guided Level 2

Hands-on Assessment: we test your actual systems

For a supplier that wants its real systems tested, not only its documents. Quoted per company, from $9,000. On site in San Diego County and Orange County, and in Los Angeles County by arrangement.

Hands-on Assessment

From $9,000 quoted per company

Who it is for. A supplier that wants us to test its actual systems against the requirements, with a written quote for its own environment.

We test your actual systems, not only your documents
Scope and price set in a written proposal for your company
On site in San Diego County and Orange County, and in Los Angeles County by arrangement
Fixed price in a written proposal before work begins; 50 percent to begin and 50 percent on delivery of the findings report
Outside that area, choose the remote Guided packages
The full amount you paid for a kit is credited toward the price

Delivery. Complete findings package within two weeks once the deposit, signed scope, and access are in place.

Ask for a Hands-on Quote

Start Yourself, Upgrade Any Time

Upgrade credit: the full price of your kit counts toward Guided or Hands-on help

A kit is a do-it-yourself product for your company to complete on its own. If it becomes too confusing, you can move to our assisted service. If you do, the full amount you paid for your kit is credited toward the price of a Guided package or a Hands-on Assessment. One credit for each kit purchase. The credit is valid for 12 months from the kit purchase date and is void if the kit is refunded.

You bought	You move to	Credit	You pay
Level 1 Kit, $297	Guided Level 1 Package, $1,995	$297	$1,698
Level 2 Kit, $497	Guided Level 2 Package, $4,500	$497	$4,003
Kit with review call, $697 or $997	Guided Level 1 or Level 2	The full amount you paid	$1,298 for Level 1 or $3,503 for Level 2
Any kit	Hands-on Assessment, from $9,000	The full amount you paid	The quoted price less your credit

Where Hands-on work is done. We do on-site Hands-on Assessments in San Diego County and Orange County, and in Los Angeles County by arrangement. Adams Cloud is based in Santee, in San Diego County. If your site is farther away, the Guided packages are available to you remotely, and the upgrade credit applies to them. See the Guided and Hands-on page.

Delivery

When you receive what you bought

Tier	What you receive	When
Free Level 1 Starter	Download link on screen and by email	Right after you submit the form
Level 1 Kit, Level 2 Kit	Email with one download link for each file	Within minutes of payment. Links last 7 days, and we send fresh links on request.
Kit + Review Call (Level 1 or Level 2)	The kit by email, plus a link to book the review call online	Kit within minutes. Call: first available time within 5 business days of purchase, and valid for 60 days from purchase. If the review call is not held within 60 days of purchase, and we did not cause the delay, we refund the call portion ($400 for Level 1, $500 for Level 2) minus card processing fees.
Annual Refresh (planned, not yet available)	Updated kit files, re-score check, 14 day reminder email, short review	Refreshed files within 2 business days of payment, or of the yearly release of the refreshed set if that comes later. The 30 minute review call is booked within 60 days of payment.
Guided Level 1 and Guided Level 2	Completed deliverables and one call	Guided Level 1 within 10 business days and Guided Level 2 within 15 business days, counted from the written scope confirmation and payment
Hands-on Assessment	Testing of your actual systems; a findings report, a prioritized remediation roadmap, and a firm fixed price for any remediation work	Within two weeks once the deposit, the signed scope, and read-only access are in place. Price and scope are in the written proposal.

Why Adams Cloud

Twelve things you get here

Each statement below describes what we offer.

1. Fast, defined delivery

Kits arrive by email within minutes of payment. Review calls have a first available time within 5 business days of purchase, and Guided packages are delivered within 10 business days (Level 1) or 15 business days (Level 2) of the written scope and payment.

2. Published fixed prices

Every price is on this page, from $0 to $4,500, and the Hands-on Assessment starts at $9,000 and is quoted per company. You do not need a sales call to learn what it costs.

3. Plain language for very small shops

The kits are written for an owner or office manager who handles information technology alone or relies on an outside provider. Each requirement says what it means, what to look for, and what to save as proof.

4. Credentialed human review

The review call is with Thabiti Adams, who holds the Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), CMMC Certified Professional (CCP), and CompTIA Security+ credentials. The base kits are self-guided templates. Human review comes with the call tiers, the Guided packages, and the Hands-on Assessment.

5. Veteran-owned, with defense experience

Adams Cloud and Cybersecurity LLC is a Small Business Administration (SBA) certified Service-Disabled Veteran-Owned Small Business (SDVOSB). Thabiti Adams has more than 18 years in information technology and cybersecurity, much of it on the Department of Defense side.

6. One-time pricing, not subscriptions

The kits are one-time purchases with no subscription. The only planned yearly item is the optional Annual Refresh, which is planned and not yet available. When it opens, it is one payment each year, with a reminder email 14 days before your renewal date. Nothing renews automatically.

7. Built for what suppliers must do now

The kits follow the steps a supplier takes when its contract requires a self-assessment: assess, report the result in SPRS, and affirm every year (the Level 2 self-assessment itself repeats every three years).

8. An optional annual refresh (planned)

The $497 Annual Refresh is timed to the yearly affirmation. It is planned and not yet available.

9. A reviewed option under $1,000

Kit plus a review call by a CMMC Certified Professional is $697 for Level 1 (the review portion is $400) and $997 for Level 2 (the review portion is $500).

10. Written refund and correction terms

Kits have a 20 day refund window. A review call comes with a free second session if you ask within 7 days, then a refund of the call portion. If a Guided package misses its written scope, we correct it at no charge within 30 days of delivery, and a refund applies only if we cannot deliver the package. None of this is tied to a score, a pass, or a contract award. The terms are in their own section below and in the kit terms.

11. Start yourself, upgrade any time with full credit

Buy a kit and do the work yourself. If it becomes too much, move to a Guided package or a Hands-on Assessment, and the full amount you paid for the kit is credited toward the price.

12. A local hands-on option in San Diego and Orange County

Need someone to test your actual systems? We offer on-site Hands-on Assessments in San Diego County and Orange County, and in Los Angeles County by arrangement, at a fixed price in a written proposal. Outside that area, the Guided packages are remote.

How The Options Compare

Template kits, software subscriptions, consultants, and Adams Cloud

Your options fall into a few general categories. This table describes the categories in general terms and does not describe any specific company. Offerings within each category vary, so check any provider you consider.

What to look at	Template kits	Software subscriptions	Consultants	Adams Cloud kits
Price visible before you talk to anyone	Usually	Varies	Often quoted after a call	Yes, every price is on this page
Pricing model	One time	Recurring subscription	Project or hourly	One time, with a planned optional yearly refresh
Written for a small shop with no information technology staff	Varies	Varies	Varies	Yes, plain language is the design goal
Review by a credentialed person	Usually not included	Usually not included, or sold as an add-on	Yes	Included in the call tiers, the Guided packages, and the Hands-on Assessment. The base kits are self-guided.
Time to get started	Often an immediate download	Account setup and onboarding	Scoping and scheduling first	Kits by email within minutes
Walks through the SPRS score and the annual affirmation	Varies	Varies	Varies	Yes, both are covered in the kits
Cost to stay current each year	Often a new purchase	The subscription continues	A new engagement	Planned optional $497 Annual Refresh, not yet available
Who does the work	You	You, inside the software	The consultant, with your input	You with the kit. Thabiti Adams for the review call, the Guided packages, and the Hands-on Assessment.

Categories as reviewed November 2026. Which option fits depends on your contract, your staff, and your budget. A kit suits a company that can do the work itself. A consultant, a Guided package, or a Hands-on Assessment suits a company that wants the work done for it, and the full price of a kit you already bought is credited toward the last two.

Refund and Correction Terms

What we do if something is not right, in writing

Review call. If you are not satisfied with a review call, ask within 7 days of the session for a free second session of up to 30 minutes. If you are still not satisfied, we refund the call portion ($400 for Level 1, $500 for Level 2). Guided packages. If the deliverables miss the written scope we confirmed, we correct them at no charge within 30 days of delivery. A refund applies only if we cannot deliver the package. Before work begins on a Guided package you may cancel for a full refund, and after work begins and before delivery you may cancel for a 50 percent refund. None of these terms is tied to a score, a pass, or a contract award, and we do not guarantee any of them.

Kits. Full refund within the 20 day refund window if a file will not open or the kit is not as described on this page. If you have not downloaded any file, you may ask for a refund within 20 days of purchase for any reason. Because downloaded files cannot be returned, a change of mind after download does not qualify for a refund. See the kit terms.

Adams Cloud and Cybersecurity LLC is not affiliated with, endorsed by, or authorized by the Department of Defense, The Cyber AB, or ISACA. CMMC Certified Professional (CCP) is a credential issued to an individual by ISACA. These products are not a CMMC assessment and do not provide or imply any CMMC Status.

Please Read

What these kits are and are not

These kits do not certify you, and they are not legal advice.

Not a certification. No kit, review call, Guided package, or Hands-on Assessment from Adams Cloud and Cybersecurity LLC gives your company a CMMC certification, and none of them confers a CMMC Status. A self-assessment status comes only from your own completed self-assessment and affirmation, entered by your company in SPRS. A Level 1 result and a Level 2 self-assessment result are your own company's assessment. Where a contract requires an assessment by a Certified Third-Party Assessment Organization (C3PAO), only that official process produces the result.

Not legal advice. The kits and our reviews are general information and planning tools. They do not create an attorney-client relationship. Ask qualified counsel about your contract terms and your legal exposure.

Your senior official signs the affirmation. Under the CMMC rule (32 CFR Part 170), a senior official of your company affirms the result and then affirms continuing compliance every year. That official is responsible for the accuracy of the statement. A false or inaccurate affirmation can create liability under the False Claims Act (Title 31 of the United States Code, sections 3729 to 3733). We cannot make that affirmation for you, we do not enter your results in SPRS, and we cannot take on that responsibility.

We do not guarantee a result. We do not guarantee any score, any outcome of any assessment, or any contract award. The accuracy of your answers, your evidence, and your score is your company's responsibility.

Please do not send us controlled information. Do not place Controlled Unclassified Information, Federal Contract Information documents, passwords, or technical data in a workbook you send us or in an email to us. Describe your systems in general terms.

Questions

Before you buy

Which level do I need?

Your contract decides. A contract that involves only Federal Contract Information usually calls for Level 1. If your contract involves Controlled Unclassified Information, expect Level 2 or higher. The solicitation or contract names the required level and, for Level 2, whether a self-assessment or a third-party assessment is required. If a prime contractor flowed the requirement down, ask the prime. The free starter helps you sort this out.

Will a kit make my company CMMC certified?

No. Level 1 is a self-assessment that your company affirms. Level 2 is either a self-assessment or an assessment by a Certified Third-Party Assessment Organization, depending on the contract. The kits help you do the self-assessment well and prepare for a third-party assessment. They do not produce a certification, and they do not confer a CMMC Status. A self-assessment status comes only from your own completed self-assessment and affirmation, entered by your company in SPRS.

Who signs the affirmation, and what is the risk?

A senior official of your company affirms the result in SPRS and affirms continuing compliance every year. A false or inaccurate affirmation can create liability under the False Claims Act. The kits explain the steps and what evidence supports a truthful answer. The affirmation and its accuracy remain your company's responsibility.

Will you enter my score in SPRS for me?

No. Your company enters its own results, because the affirmation belongs to your senior official. The kits include a step-by-step guide to the entry so the person who does it knows what to expect.

What if I find a requirement I have not met?

For Level 1, each of the 15 requirements is met or not met, and the Level 1 Kit includes a remediation plan template to track the work needed to close each gap. A gap stays not met until it is fixed, because no Plan of Action and Milestones is permitted for Level 1 (Title 32 of the Code of Federal Regulations (CFR), sections 170.15(a)(1) and 170.21(a)(1)). For Level 2, the Level 2 Kit includes a POA&M tracker and the eligibility rules from 32 CFR 170.21.

What does the review call cover?

One session with Thabiti Adams, who holds the CISSP, CCSP, CCP, and CompTIA Security+ credentials, to review your completed workbook: whether your answers match your evidence, whether anything looks overstated, and what to fix before the senior official affirms. The call is 45 minutes. It is not an assessment, and it does not produce a certification. See the kit terms.

What does the Annual Refresh include, and how does it renew?

The Annual Refresh is planned and not yet available. When it opens, it will include an updated kit version for your level, a re-score check, a reminder as your affirmation season approaches, and a short review (one 30 minute call). It is one payment of $497 each year. It does not renew automatically. We email you 14 days before your renewal date, and you renew by paying again. See the kit terms.

Can a consultant or managed service provider use a kit with clients?

Not under the single-company license. Each kit licenses one company. Each client license costs the same as the kit: $297 for Level 1 and $497 for Level 2. Please contact us about a separate license for each client company.

What if CMMC requirements change?

The kits cite primary sources and carry a version date. The planned Annual Refresh is meant to bring your kit up to date. It is not yet available. Check your contract and the current rule text before you affirm.

When should I choose a Guided package instead of a kit?

Choose a kit if you can do the work yourself with a clear guide. Choose a Guided package if you want the checklist scoped to your systems, the remediation plan or System Security Plan outline written for you, and a call to go over it. Guided packages are remote and document based, with no system access and no testing.

What is the Hands-on Assessment, and where do you do it?

In a Hands-on Assessment we test your company's actual systems. It is quoted per company, starting at $9,000, at a fixed price in a written proposal before work begins. You pay 50 percent to begin and 50 percent on delivery of the findings report. We do it on site in San Diego County and Orange County, and in Los Angeles County by arrangement. If you are outside that area, the Guided packages are available remotely. It does not give you a CMMC certification or confer a CMMC Status. See the Hands-on terms.

If I buy a kit and it becomes too confusing, what happens?

You can move to our assisted service. If you do, the full amount you paid for your kit is credited toward a Guided package or a Hands-on Assessment. For example, the $297 Level 1 Kit credited toward Guided Level 1 at $1,995 leaves $1,698 to pay, and the $497 Level 2 Kit credited toward Guided Level 2 at $4,500 leaves $4,003 to pay. If you bought a kit with a review call, the full amount you paid is credited. One credit for each kit purchase. The credit is valid for 12 months from the kit purchase date and is void if the kit is refunded.

What if it is not what I expected?

If a file will not open or the kit is not as described on this page, email thabiti@adamscloudcyber.com within 20 days of purchase for a full refund. If you have not downloaded any file, you may ask for a refund within 20 days for any reason. A change of mind after download does not qualify. See the kit terms and the example of what the files look like.

Sources

Primary sources behind the kits

Requirement text, identifiers, objectives, and scoring come from primary sources. Requirement citations were verified as of 2026-11-05.

Start With the Level Your Contract Requires

Published prices, plain language, and a credentialed review when you want one. Full refund within the 20 day refund window if a file will not open or the kit is not as described.

Compare the Tiers Book a Free Consultation

CMMC Self-Assessment KitsFixed Prices, Plain Language, Credentialed Review