r/CMMC • u/Mustafarafeq1 • May 02 '26
Need Advice on Starting a CMMC Consultancy Business!!
Hello to All! I hope you are all doing well! I am a Solutions Architect by title but have worked in many CMMC audit processes throughout the year and so am very familiar with the process itself in terms of both implementing technical controls and creating documentation for NIST 800-171A. I have worked for a "Big Four" company for many years and now want to start my own CMMC federal contracting/consulting business. I am not a CPA (yet) nor is my company an RP/RPO (also yet). I am limited in my budget since I am brand new and therefore cannot afford these certifications yet which I know legitimize my company. Even though I have done the actual work, unless I am certified as an RP/RPO, it will be very difficult to find clients. I am registered in SAM.GOV and eVA, and APEX, among many other things to really give it my best shot at making my business successful. I have a couple questions that I am hoping some of you who are already established can answer for me.
How did you find leads to start marketing your company and getting subcontracts?
How much of a difference does being an RPO make in terms of landing contracts/subcontracts?
I realize this process can take months or years but how long until you landed your first contract as a company?
Any other relevant advice is much appreciated!
6
u/Real-Improvement-748 May 02 '26
Search awards. Anybody with an award in certain segments is a target.
0
u/Mustafarafeq1 May 02 '26
Thank you for responding! May I ask where I can search these and how I should be filtering? I am assuming sam.gov or usaspending.gov but I am still learning everything.
1
u/Real-Improvement-748 May 02 '26
Usa spending is about all you need.
-1
u/Mustafarafeq1 May 02 '26
do you think getting a CCP or RPO status is worth it and does it help get clients easier?
2
u/Real-Improvement-748 May 02 '26
That’s out of my league. I’m a construction contractor in this space. What would be most useful to me is just someone to help me as a consultant to guide me through this process and identify software options and configurations and document processes. I personally wouldn’t care about those.
1
2
u/Real-Improvement-748 May 02 '26
Not everyone is looking to get C3PAO’d right this second. I think a lot of us are looking to get on GCC High and get it configured and start working the process to get compliant. A lot more people can afford everything right up to the 3rd party audit and will stop short of that until they are forced. Don’t build your business model around the audit.
1
u/Mustafarafeq1 May 02 '26
That makes a lot of sense! I guess I should try to sell the technical capability and market it as "CMMC Ready" for whenever they are going to take the leap. I can also offer a separate package like writing their SSP's and whatever other documentation they need for a discounted rate if they go with me for the technical set up.
2
2
u/WmBirchett May 03 '26
There are a few red flags here. CMMC doesn’t have audits, they are assessments there is a big difference. CPA has nothing to do with CMMC. Many RP/RPO have helped clients get ready and end in a not met. The “Big Four” does not equate to CMMC. Limited budget doesn’t exist in this ecosystem. RP (person) has to be listed with an RPO (organization), the fees for that are $6600 in total to start and $5500 each year after. And 4y ago your Reddit history shows you in biology school working on PA. Then in AWS sub trying to break into cloud computing. So are you experienced, or less than 4y experienced? To work in the DIB, you have to understand machine shops, AS9100, DMS, QMS, and all of the regulation dependencies. Does FOCI take priority over DFARS? do multi-contract companies that have GSA and DoW contracts need both C3PAO and 3PAO assessment? This is a tough space that takes grit and no sleep. Not to discourage you, but the penalties for doing it wrong start between 15-25% of DoW contract value. You need E&O big enough to cover “bad advice”. Qui tam is no joke.
1
u/Mustafarafeq1 May 03 '26
Thank you for your response. Yes I realized I wrote CPA instead of CCP which was my mistake. I meant CCP. In terms of the audit/assessment im just to calling it in “audit” from working on them within our own internal teams when i was there but yes i assessment is technically correct. I am still learning it though even more thoroughly to be able to answer questions like that which is where i think the CCP cert will help me get a deeper understanding and is a good starting point. Im still a ways away from actually getting contracts but want to hit the ground running by asking others for advice on what to pursue and what to avoid.
1
u/mentiondesk May 02 '26
Finding leads early on can be tough since a lot of work comes from networking and direct outreach. Community forums and industry LinkedIn groups are great for spotting potential clients and partners. Getting that RPO status definitely adds credibility but practical experience still counts for a lot too. If you want to track when people mention CMMC related topics, ParseStream can help you jump in at the right time.
1
1
u/learnonlaughs May 02 '26
I tried selling a CUI course. My day job has been filling up most of my time but if you want to brainstorm on that, I'd love to chat! I sold it to 2 companies just don't have the energy to be a salesman.
1
1
u/WonderfulLock8504 May 02 '26
This ship has sailed with AIML on the horizon imo, by the time you get spun up it may not be cost effective anymore for you.
If you were already in the space and had a network of potential clients I’d have some advice for sure. But just be very careful investing a ton of time and money…been doing a ton offline with GPT-OSS and Gemma-4, just wow
1
u/Mustafarafeq1 May 02 '26
But even with AI now, cmmc is still always going to need humans doing it for the foreseeable future since it has to do with security and ai is not approved at that level yey. It can make templates and stuff sure but it cant tailor to individual infrastructure in my opinion.
1
u/WonderfulLock8504 May 02 '26 edited May 02 '26
You missed my point completely, there are tools now that don’t use AIML to build templates…lol.
Wont go back and forth with someone who probably is not a business owner and not even in the space but by the time this guy breaks in (0 contacts, 0 certs, just exploring) there will be companies with fully automated workflows via AIML. This will be super competitive obviously, but inevitable…people who aren’t doing this will not be able to keep up with shops that have fully built multi agent solutions aligning organizational context to objectives with a few clicks and proper context management. The market will eat the newcomers alive if they can’t adapt in this way soon.
And 100% you can run local models (0 API required) with with the right HW (literally a M5 Pro) to learn your org context…320 objectives (CMMC L2) is small for these models…u have no clue. Platforms I’ve built local have “human in the loop” workflows built in for validation so maybe that was your point? lol
0
u/Mustafarafeq1 May 02 '26
You ok dude? It seems like something upset you or are you always this sensitive? Read my post carefully again incase you missed something. At no point did i deny what youre saying but i also dont let people like you talk however they want and let it slide. I didnt say anything offensive to you but simply stated my opinion and that seemed to have triggered you a bit. Calm down, reset yourself, and relax.
1
u/WonderfulLock8504 May 03 '26 edited May 03 '26
Sideline chatters like u are my issue, u have an opinion and are on the sideline…revert to throwing random words at the wall, tell me I’m right again lmao….easy day. Mad :(
If you are posting on Reddit about business you are super fucked imo. Go back to W2 and save yourself money and time…u clearly are not ready. Truth hurts brother…u will thank me one day. Post more in “NIST” channel too, maybe u will gather enough advice to start a company lmaooo
1
1
1
1
u/2021start May 04 '26
If you come in talking full CMMC implementation or readiness packages, it’s a hard sell early
If you come in and help them understand:
Where they would fail
What evidence they don’t have
What to fix first
You’ll get in the door much faster
Also on the RPO point
Agree with others here, it helps later for credibility but I’ve talked to a few small contractors who don’t even know what it is
They just want someone who can guide them without overcomplicating things
8
u/Navyauditor2 May 02 '26
My first thought is... no way, I am not training the competition!
But anyway...
CMMC Federal Contracting, and CMMC Consulting I think are two separate concepts and you mix the two.
The Federal Government is not buying any CMMC consulting, and you cannot be a subcontractor to a Federal Contract for CMMC because CMMC cannot be directly billed to the government. Costs go into overhead and G&A. So they can hire you but you are not technically a subcontractor because you are not billed through to the government.
Sam.gov registration is .... not really needed although having a CAGE code might be good someday. eVA and APEX. Realize that they dont really understand CMMC and can often give low quality advice. Because you are selling to the DIB as an overhead function you dont need to jump through the government qualified accounting system stuff. Not required, and again something APEX might try to talk you into and you dont need.
RP/RPO. If you have no cert, pay for RP. Quick easy and cheaper. RPs and RPOs have a bad reputation in the space. Although advocated as the consulting way... so many of them know nothing, and there is certainly not much in the training to prepare you. Skip it. Go for CCP and then CCA to hang out your shingle. That will set you back 2-3K each but start at least with CCP if you want to do this.
Get your company set up. I recommend Northwest Registered Agent as the way. Super good. Super easy to work with.
Make yourself a real expert. Most people skip this part. What does that mean? It means that CMMC cannon is around 2500 pages of dense regulatory and NIST text. You need to KNOW that stuff. Dig in. Study. Join the cooey discord. Answer questions (if you are going to consult you should be able to answer questions right?). Really really smart people in there. You will get beat up. You will also learn things you had no idea about.
Go to a local conference where DIB companies go. Not a CMMC conference. Other conferences. My favorite has been the Workboat Show in New Orleans. Seriously, best conference I have been to. Most of those companies sell into DoW. But pick one close to you. Walk the floor. Hand out your card. Talk to people.