CMMC Consultant: What the Rule Regulates and What It Leaves to You
The CMMC rule mentions consultants once, to bar the firm that prepared you from assessing you. Assessment is regulated. Preparation is not. That changes who you should hire.

Founder & Managing Consultant, Amerifusion Bookkeeping
Former KPMG financial auditor, former Senior Manager for IS Assurance and Third-Party Risk Management at BDO’s Dallas office (SOC 1/2, HITRUST, HIPAA), and former Senior Technology Risk Manager at Stryker. Joseph writes on DCAA-compliant accounting systems, FAR Part 31 cost allowability, and indirect rate strategy for government contractors.
The CMMC rule mentions consultants once, to bar the firm that prepared you from assessing you. Assessment is regulated. Preparation is not. That changes who you should hire.
Most pitches lead with cost, 60% of a full-time hire. That is the wrong frame. Federal contractors hire a fractional CFO for compliance reps a generalist does not have.
DCAA found $15.9 billion in audit exceptions in FY24. What separates the contractors who get caught is not price. It is whether their provider passes the 18-criteria DFARS test.
Nobody asking this wants the cheapest hourly rate. They want to stay out of a DCAA finding. Five criteria separate the accountants who deliver that from the ones who cannot.
What a CMMC assessment costs at each level, whether the fee is allowable under FAR 31.201-2, and how to recover it on cost-plus and fixed-price contracts.
The TINA threshold rose to $2.5M on 1 October 2025 and jumps to $10M after 30 June 2026. All three active thresholds, the four exceptions, and the pre-certification sweep.
Section 174A lets eligible small contractors recover unamortized 2022-2024 domestic R&D before 6 July 2026. The adjustment also lands on FAR 31.205-18 pool reporting.
DCAA audits the incurred cost submission. DCMA negotiates the final rate agreement. Form 1 responses, quick-closeout thresholds, and the appeal route to ASBCA.
FAR 31.205-18 lets you recover every reasonable dollar of B&P effort through your rates, if you clear the allowability test and the marketing boundary.
DCAA defective pricing audits arrive years after award. The three-prong test auditors use, what triggers a TINA sweep, and how to protect your position.
Before You Go
Get the Unallowable Cost Quick Reference, every FAR 31.205 category organized by risk level. Plus new compliance work as we publish it. Unsubscribe anytime.
We respect your privacy. Unsubscribe with one click.