The most reliable way to get CMMC consulting clients is direct outbound to small defense subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). They need a CMMC status to keep bidding on defense work, and the Redspin survey below suggests many are not ready for it.
Put the owner at the top of each account, with the contracts and IT people next to them. Offer a short readiness conversation as the entry point, then follow up until someone talks to you. My team works mostly through cold email and LinkedIn, so that is the lens here.
Who needs CMMC help right now?
The Department of Defense finalized the CMMC program in a 32 CFR part 170 rule published on October 15, 2024. It verifies that contractors protect FCI and CUI, and it reaches past the prime: primes must require compliance from subcontractors at every tier where that information is processed, stored or transmitted.
Contract rules turn this into a buying deadline. Under DFARS subpart 204.75, a contracting officer may not award to a bidder without a current CMMC status at the level the solicitation requires, though a conditional status can be enough at Levels 2 and 3.
The DFARS 252.204-7021 clause then makes the contractor hold that status for the life of the contract and pass the right level down to its own subcontracts. The same rule rolls all of this out in four phases across three years, from self-assessments to full implementation.
For outreach, read that as a timing signal. A supplier starts caring about CMMC the day a prime sends a subcontract with a level written into it. Before that, the topic sits on a "later" pile. After it, someone inside the company has a deadline and no plan.
DefenseScoop's report on a Redspin survey of 107 defense contractors in September 2024 found 58% were not ready for the final CMMC rule, and 13% had taken no preparatory action.
Demand splits by level, and each buyer wants something different from you:
| Level 1 buyer | Level 2 buyer | |
|---|---|---|
| Information it handles | FCI | CUI |
| How it is assessed | Self-assessment | Self-assessment or a certification assessment by a C3PAO, depending on the contract |
| What it usually lacks | Someone to read the requirements and document what is already done | A full set of controls, evidence and an assessor-ready setup |
| What it buys from you | A short, fixed piece of help | A longer project, often followed by ongoing support |
Information and assessment rows come from the Federal Register rule. The other two rows are my sales read of these buyers, so check them against your own deals.
Level 2 holds the larger projects. NIST SP 800-171 Revision 3, published in May 2024, sets recommended requirements for keeping CUI confidential in nonfederal systems, in families such as access control, incident response and risk assessment. The CMMC rule as published assesses Level 2 against the 110 requirements of Revision 2, so quote controls from that edition.
When a contract demands a third-party assessment, the supplier must hire a C3PAO (certified third-party assessment organization), and the rule sends it to the CMMC Accreditation Body Marketplace to find one. A company that has already budgeted for an assessor is an easy conversation about preparing for that visit.
Small subcontractors are the easiest part of this market to reach. They are also most of it. A Bass, Berry & Sims summary of the DoD final rule reports that DoD estimates nearly 338,000 unique entities will be covered, about 68% of them small businesses.
In a small owner-run shop there is often no compliance department to forward your note to, so the owner may read it themselves.
How do I find defense contractors that need CMMC?
Start with the clients you already have. Before anyone opens a lead tool, I look at past and current clients and then hunt for lookalikes. For a CMMC practice, write one row per client: what they make, headcount, whether they sell to DoD directly or through a prime, and the level they needed. A short table like that usually shows a pattern, and companies matching it become your first segment.
Look for an obligation. A company that says it cares about security is a weak prospect. A company handling FCI or CUI on defense work has a contract that forces it to act, the kind of event that opens a security budget. Before a company goes on the list, check its website for:
- Named defense or aerospace customers
- Parts or services built to customer drawings for military end use
- Quality certifications that show the team already lives with audits
Segment by compliance need. "Manufacturing" is too wide to write for. "Precision machine shops under 100 staff that supply aerospace and defense primes and probably need Level 2" is a group one message can speak to. Every segment gets its own message.
Pick the first segment where you have a real past client as proof and the title map is clearest. Start there before widening.
Count the market before you commit. Multiply the companies in a segment by the plausible buyers in each. If the total is small, keep the target and change the approach: more roles per account, longer sequences or a neighboring segment. Pushing volume into a market that cannot carry it just burns the list.
Which titles should you target first?
The best title map comes from deals you already closed. Go back through past projects, write down who actually approved each one, and use the exact titles that niche uses. A vague "manager" filter in a lead tool fills the list with people who cannot say yes.
Here is a starting map for a small defense supplier, until your own deals correct it:
| Role | Part in a CMMC decision | Signer or champion |
|---|---|---|
| Owner, president or CEO | Owns the risk of losing defense revenue and signs the check | Signer, contact first |
| VP of operations or general manager | Runs the plant and feels every disruption a project causes | Signer in larger shops, champion in smaller ones |
| Contracts manager or director of contracts | Often sees the CMMC clause in the subcontract first | Champion |
| IT director or IT lead | Does or oversees the technical work | Champion, sometimes a blocker |
| Quality manager | Already runs audits and documentation | Champion |
| Assistant, associate, untitled "manager" | No authority over the decision | Exclude |
Signers and champions get separate messages. The owner wants to keep defense revenue. The contracts manager wants a way through the clause on their desk. The IT lead wants to know scope and hours.
MSPs need one extra step. An in-house IT lead can read your note as a plan to replace them. Reach the owner first, and pitch the IT lead on taking assessment prep off their plate.
What does a good CMMC lead list look like?
Two lists can look identical in a spreadsheet and behave very differently in an inbox. Cheap lists bought from freelancers bring bounces and silence. A list built in proper prospecting tools and filtered through your segment and title map does far better than anything scraped.
Volume still matters in a niche this specialized. With 50 to 100 ideal prospects a month, you are betting that none of them is busy, distracted or unready this quarter. That bet usually loses, so plan for fit and for enough names. Volume negates luck.
I build lists in a fixed order: clean the titles, pick the sources, add lookalikes, then verify every address and keep the bounce rate under 0.5% before anything is sent. Before launch, the list passes four checks:
- The segment fits in one sentence: what they do, their size, prime or sub, and the likely level
- Every title comes from your signer map
- Small accounts carry two or three roles each
- Current clients, open deals and anyone who has opted out are removed
How should a CMMC consultant word the first message?
Message one has a single job: earn a call. Pitch a compliance program to a stranger in line one and you get ignored. Period.
A free call still costs a plant owner an hour of a busy week, so tell them what they walk away with. Put proof inside the message: one real past client and the result.
Describe an outcome. "Gap assessment, policy writing, SSP support, vCISO" is a service menu, and owners skim past menus. "Know which systems are in scope and what to fix first, before your prime asks" is something an owner can picture.
Here is a made-up example of the shape. Swap in your own real client:
Subject: the CMMC level in your next subcontract
Hi Dana, primes have to flow CMMC levels down to suppliers that handle CUI. [One line on a real client of yours and the result.] Worth 20 minutes? You would leave with a short list of what is in scope and what to fix first.
Consultants and MSPs win different work, so they should open differently:
| CMMC consultant | MSP | |
|---|---|---|
| Entry offer | A scoping call that ends with what is in scope and what to fix first | A readiness call that ends with which systems would need to change |
| Strongest proof | A supplier that reached its required status | A supplier whose environment you now run |
| Follow-on work | Documentation and assessment preparation | Implementation and ongoing management |
If referrals already feed you
Referral clients arrive already trusting you. Cold prospects do not, so the outbound offer has to be smaller and clearer than anything you sell through referrals.
Packaging decides whether any outreach tactic works, as it does when consultants look for clients with outbound. One entry offer. One audience. Keep both for 12 months. A message written for everyone gets an answer from nobody. Use your referral clients as proof lines and as the pattern for your first segment.
Should CMMC outreach use email, LinkedIn, or both?
Both, with LinkedIn first. Buyers check you out before they answer. A connection request or a profile visit puts your name in front of them, so the email that follows lands as a second touch.
Plan at least 5 to 6 touchpoints split across the two channels, with several days between them. One or two messages rarely start anything. In the campaigns my team runs, the third follow-up, with real time before it, is usually the one that earns the reply.
Set the monthly goal at conversations started, not booked calls. Every client begins as a reply that turned into a conversation and then a call, so that number shows what works weeks before booked meetings do. Give every email a simple opt-out, and check a suppression list before each send so anyone who declined never hears from you again.
What results should CMMC consultants expect from outbound?
Reply rates usually sit around 1% across B2B outbound, and nearer 0.5% once a campaign sends thousands of emails a day. Between 10% and 50% of replies become booked meetings. Small, heavily researched campaigns can reach 15% to 17% replies, with about 75% of those repliers interested. These are my general planning ranges, not CMMC results.
For scale, a B2B tech client of ours booked 40+ qualified calls a month within 90 days, starting from zero. That was not a CMMC firm, and a narrow defense segment can move slower.
Remember: the bigger the volume, the lower the reply and meeting averages. For a CMMC segment the planning math looks like this: 2,000 owners and contracts managers contacted in a month -> about 20 replies -> 2 to 10 meetings that month. A narrow list with real research per account can beat that.
Meetings and signed contracts are separate numbers. Booking a call and closing a deal are different skills, and a weak discovery call only shows up faster once more meetings arrive. Test on a small batch first.
Now the part founders hate: wait. Sales cycles in B2B often take 6 to 12 months, so a deal from a month-one meeting can close four months or more after the call. A defense supplier may also wait until its prime forces the question. Judge month one on conversations and meetings.
What should you check before the first send?
Prospects rarely buy from an email. They look you up, and the decision forms during that check, well before any call. If the profile behind the message is empty, the best copy in the world gets ignored.
Run this preflight checklist before anything goes out:
- Headline. It says who you help and with what.
- Profile. It reads like a page for buyers, with proof of results.
- Featured section and recommendations. Thumbnails load and real recommendations are visible.
- Every seller's profile. Anyone a prospect might look up is optimized, including salespeople and partners. If your firm is listed on the Cyber AB Marketplace, that entry names the CMMC levels and services you cover.
- Sending domains. Outreach goes from separate domains, never the one your clients use to reach you.
- Authentication and warm-up. SPF, DKIM and DMARC are set, and new mailboxes are warmed up before volume.
- CRM. Every lead is tracked so nothing gets lost. Which CRM you pick matters far less than using one.
If any item is missing, hold the launch and fix it. Once a working setup produces replies, scale by adding LinkedIn or email accounts to it.
If the funnel does not convert at small numbers, more volume will not fix it. Fix the funnel first. Then scale.
Selling CMMC help and unsure who to write to first? Book a call and I will help you pick the first segment and the titles to start with.
Questions CMMC consultants ask
How long can a conditional CMMC status last?
Up to 180 days for Levels 2 and 3, according to DFARS subpart 204.75 at the time of writing. Within that window the supplier must close out its plan of action and milestones, so a conditional client is a project with a hard deadline.
Does the work end once a client passes?
No. Under the Federal Register rule, the contractor must keep its status current and affirm continuous compliance each year in SPRS (the Supplier Performance Risk System), and the DFARS 252.204-7021 clause carries that duty through the whole contract. Someone has to keep evidence fresh, track system changes and prepare that yearly affirmation. That duty is the natural basis for a retainer, and MSPs are well placed to sell it.
Where does Level 3 fit for a consultant?
Level 3 is checked by the government itself: the DoD CIO assessment guide says DCMA DIBCAC performs Level 3 certification assessments. The rule's Level 3 section draws extra requirements from NIST SP 800-172. Start outbound with Level 1 and Level 2 subcontractors, and let Level 3 work come once your reputation can carry it.
Is intent data worth buying for CMMC prospecting?
Only when the segment is large. If your target list is 2,000 machine shops and intent signals show up on about 10 of them, the data adds cost and little else. In that case I skip it and write an offer that makes sense to every company in the segment.
How many domains and mailboxes does a CMMC campaign need?
For cold email I plan 10 to 20 sending domains and 20 to 40 mailboxes, more for larger sales teams. Give each new mailbox 10 to 14 days of warm-up first, and raise sending volume only once that is done.