Hawaii · Guam · Pacific Islands

CMMC compliance for Hawaii, Guam &
the Pacific.

Pacific Cyber Compliance gives prime contractors on Oʻahu, Maui, Guam, and across the Pacific a ready-to-run CMMC Level 1 program for their subcontractors — and gives subs a plain-English path to getting compliant.

I'm a prime contractor → I'm a subcontractor →
By the numbers
$23B
NAVFAC Pacific contracts awarded in 2025 — every one carries CMMC requirements
$52M
DOJ cybersecurity False Claims Act settlements recovered last fiscal year
68%
Of DoD contract work requiring Level 1 compliance
$13K+
False Claims Act penalty per violation, per claim

New: Pacific CMMC Intelligence Issue 005 — Guessing at your numbers is guessing at your compliance. Read the brief →

Who PCC serves

TWO AUDIENCES.
ONE PROGRAM.

PCC isn't a cybersecurity consultancy. We give primes a structured compliance program to run across their supply chain — and subs plain-English tools that make CMMC understandable at a non-technical level, so they can complete their assessment themselves without outside help.

Prime contractors

Get your entire sub supply chain compliant — without hiring a consultant for each one

You get a branded, documented compliance program you deploy to your subcontractors. We provide everything: assessment tools, onboarding packets, tracking, and verification. You run the program. We built it.

  • ✓ Covers unlimited subs at a flat annual fee
  • ✓ Documented evidence trail for DoD audits and contract renewals
  • ✓ Reduces False Claims Act exposure across your supply chain
  • ✓ Built for NAVFAC Pacific and MILCON prime workflows
Check my exposure →
Subcontractors

Complete your CMMC Level 1 self-assessment — without an IT department

If your prime sent you here, or you received a letter asking about compliance, you're in the right place. PCC walks you through every step in plain English. No jargon. No tech knowledge required.

  • ✓ Written for electricians, plumbers, HVAC crews, and welders
  • ✓ Covers all 15 FAR 52.204-21 practices
  • ✓ All assessment documentation drafted for you — policy templates, System Security Plan, and SPRS submission preparation included
  • ✓ Annual renewal reminder built in
Check my compliance →

Why PCC

BUILT FOR THE PACIFIC.
BUILT FOR TRADE SUBS.

CMMC consultants bill by the hour and by the sub. PCC gives you a program you own — so adding a new subcontractor to your supply chain costs you nothing extra.

01

Pacific-only focus

Hawaii, Guam, and throughout the Pacific. We know NAVFAC Pacific, NAVFAC Marianas, and the MILCON contractors operating here. Mainland vendors don't.

02

A program, not a consultant

Flat fee. Unlimited subs. No billable hours. CMMC consultants charge $3,000–$8,000 per sub assessment. PCC covers your entire supply chain at one annual price.

03

Plain English, always

Every document is written for a small business owner — not a CISO. No acronyms without definitions. No assumptions about IT knowledge.

04

Built for small trades

Calibrated for the 5–25 person electrical, plumbing, HVAC, and roofing contractor. Works with Gmail, Google Drive, and a standard business internet connection.

PCC was built by someone with deep roots in Pacific defense and cybersecurity. Learn about the background behind the program →

How we compare

PCC VS. OTHER
HAWAII CMMC OPTIONS

There are qualified CMMC consultants in Hawaii and across the region. The difference with PCC is the model — you get a program you operate yourself, not billable hours that scale with your sub count.

Capability PCC Local IT / MSP consultants Mainland vendors
Flat fee covering unlimited subs ✓ Yes ✗ Billed per sub engagement ✗ Per-seat SaaS pricing
Prime-deployable compliance program ✓ You run it ✗ They run it for you ✗ Sub-direct only
Hawaii, Guam, and Pacific Islands presence ✓ Pacific-only — Hawaii only ✗ Remote only
Written for trade subcontractors ✓ Plain English — Assumes IT knowledge ✗ Enterprise-first
FCA documentation and evidence trail ✓ Built in — Limited — Varies by platform
Annual renewal managed for prime ✓ 10-month triggers ✗ Separate engagement — Sub self-manages

Coverage area

A CMMC PROGRAM
BUILT FOR THE PACIFIC

Serving the defense supply chain where NAVFAC Pacific and MILCON contractors operate — across Hawaii, Guam, and the Commonwealth of the Northern Mariana Islands.

Primary market

HAWAII

NAVFAC Pacific HQ and NAVFAC Hawaii on Oʻahu. Joint Base Pearl Harbor-Hickam, Schofield Barracks, Tripler AMC, and major MILCON programs across Honolulu, Kāneʻohe, and the neighbor islands.

CMMC compliance in Hawaii →

Bidding MILCON work? Check prevailing wage rates →

Secondary market

GUAM

Guam is at the center of the largest military buildup in the Pacific in a generation. Every DoD contract here carries CMMC requirements — and few compliance resources are calibrated to the Pacific contracting environment. PCC serves Guam contractors remotely from our Pacific base in Hawaii.

CMMC compliance in Guam →

Managing a multi-task-order pipeline? Track your retainage exposure →

Tertiary market

Pacific Islands

Commonwealth of the Northern Mariana Islands. Growing defense investment in a remote Pacific environment where purpose-built compliance programs are rare. PCC's Pacific-calibrated model extends to CNMI contractors.

Pacific CMMC Intelligence

MARKET INTELLIGENCE
FOR PACIFIC PRIMES

PCC tracks NAVFAC Pacific contract activity, DoD regulatory changes, and enforcement trends so you don't have to. Periodic briefings — written for prime contractors, not IT departments.

Issue 005 June 2026 New

Guessing At Your Numbers Is Guessing At Your Compliance.

Pacific trade subs who can't calculate their true burden rate or Davis-Bacon wage obligations are statistically the same subs with no SPRS score on file. Same root cause, two different risks — and four free tools that help close both.

Sub Financial Risk · Davis-Bacon · Compliance Documentation
Read the brief →
Issue 004 June 2026

You Cannot Strip Your Way Out of CMMC.

Some prime contractors believe they can remove CUI markings from data packages to avoid flowing CMMC Level 2 requirements down to subcontractors. They cannot. Primes are authorized holders, not data owners — only the government can decontrol CUI.

CUI Flow-Down · FCA Exposure · Prime Liability
Read the brief →
View all briefs (5) →

Frequently asked questions

COMMON QUESTIONS
ANSWERED PLAINLY

If you don't see your question here, send it directly — we'll answer it and may add it to this page.

Yes — and this is the most important thing a prime contractor needs to understand. Under the False Claims Act (FCA), submitting a contract invoice while a known compliance requirement is unmet can constitute a false claim. You don't have to know about the non-compliance to be at risk — the standard is what you reasonably should have known. Prime contractors who fail to verify subcontractor compliance are exposed to treble damages, contract termination, and potential debarment. The FCA has no cap on liability, and DoD is actively pursuing cases. Your sub's compliance is your problem.
The white-label program gives you everything you need to run CMMC Level 1 compliance across your entire sub supply chain — without hiring a consultant for each sub. It includes: a plain-English sub onboarding packet (cover letter, self-assessment workbook, SPRS submission guide, policy templates, and a 5 quick habits reference card), a Sub Compliance Tracker spreadsheet to monitor status across all subs, a Prime Rollout Playbook with a 60-day timeline and communication templates, and the Sub Compliance Confirmation Form that subs return to you as evidence. Everything is branded to PCC and ready to distribute the day you close.
Unlimited. The PCC program is a flat-fee deployment — there is no per-sub charge and no cap on the number of subs you can onboard. Whether you have 5 subs or 50, the program cost is the same. This is a fundamental difference from CMMC consultants, who typically charge $3,000–$8,000 per subcontractor assessment. A prime with 20 subs using a consultant could spend $60,000–$160,000. The PCC program covers all 20 at a flat rate.
The PCC program creates a documented compliance record — the Sub Compliance Confirmation Form and the evidence gathered during the assessment. This documentation demonstrates that you, as the prime, exercised reasonable oversight of your supply chain. A documented compliance effort with identified gaps and a remediation plan is a materially different legal position than no compliance effort at all. We are not lawyers and this is not legal advice — if you have specific FCA exposure concerns, consult a federal contracts attorney. What we can tell you is that documented oversight is the foundation of any defensible compliance posture.
Almost certainly yes — but your level depends on the type of information you handle. If you handle Federal Contract Information (FCI) only, you need Level 1 (15 practices, annual self-assessment). If you handle Controlled Unclassified Information (CUI), you need Level 2 (110 practices, third-party assessment through a C3PAO). Most prime contractors on military construction projects handle CUI — plans, specifications, and site information frequently carry CUI markings. PCC focuses on Level 1 compliance for trade subcontractors. If you need Level 2 assistance, we can refer you to the appropriate resources in the Pacific region.
If you work on any DoD-funded project — directly or through a prime contractor — and you receive, process, or store any Federal Contract Information, yes. This includes most trade work on military construction projects: electrical, HVAC, roofing, welding, fencing, mechanical, and similar trades. The requirement comes from FAR 52.204-21, which applies to any contract that involves FCI. Your prime contractor is required to flow this down to you. If you're unsure whether your work triggers the requirement, the free Subcontractor CMMC Risk Check at pacificcybercompliance.com/sub-risk-check can help you find out in about 3 minutes.
Level 1 covers 15 basic cybersecurity practices from FAR 52.204-21. Most of them are things a small business should already be doing: using strong passwords, limiting who has access to contract-related files, keeping software updated, and not sharing login credentials. You don't need specialized IT equipment or a dedicated security team. The PCC self-assessment tool walks you through all 15 practices in plain English, generates your System Security Plan (SSP) automatically, and tells you exactly what you need to fix before submitting your score to the SPRS database.
Most small businesses complete the PCC self-assessment in 60–90 minutes on the first pass. If you identify gaps that require remediation — a software update, a password policy, removing a shared login — fixing those items before submitting your SPRS score may take additional time depending on what needs to change. The assessment itself is not the hard part. The hard part is actually making the changes. Our sub onboarding packet includes a plain-English action plan that walks you through each gap step by step, written for a business owner without IT staff.
Yes. Pacific Cyber Compliance provides compliance programs to prime contractors, who then distribute them to their subcontractors. If your prime sent you a PCC onboarding packet, they are using the PCC program to manage supply chain compliance across their sub base. You should complete the PCC self-assessment referenced in the packet, return the Sub Compliance Confirmation Form to your prime, and keep a copy of your completed SSP for your own records. If you have questions about the process, you can contact PCC directly at matt@pacificcybercompliance.com.
Level 1 applies to contractors handling Federal Contract Information (FCI) — basic contract data, project files, invoices. It requires 15 practices from FAR 52.204-21 and an annual self-assessment. No third-party auditor is required.

Level 2 applies to contractors handling Controlled Unclassified Information (CUI) — sensitive technical data, specifications, and information that requires protection under federal law. It requires 110 practices from NIST SP 800-171 and, in most cases, a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO). Level 2 is significantly more complex and expensive than Level 1.

Most trade subcontractors on military construction projects qualify for Level 1. PCC specializes in Level 1 compliance for the Pacific defense supply chain.
SPRS (Supplier Performance Risk System) is the DoD database where contractors self-report their CMMC Level 1 compliance score. Your score ranges from -203 to +110. A score of +110 means all 15 practices are fully implemented. Negative scores reflect unimplemented practices. Prime contractors and contracting officers can look up your SPRS score as part of their vendor vetting process. A missing or negative score can disqualify you from contract awards. Submitting your score requires a SAM.gov registration, a CAGE code, and access to the PIEE portal — the PCC SPRS Submission Guide walks you through each step.
CMMC 2.0 was codified in 32 C.F.R. Part 170, which became effective December 16, 2024. Enforcement is rolling out in phases: Phase 1 (new contracts, now complete) required CMMC clauses in new DoD solicitations beginning early 2025. Phase 2 is active now — contract renewals and options exercised from November 2025 through October 2026 are subject to CMMC requirements. Phase 3 begins November 2026 and covers all remaining applicable contracts. If you are performing on an active DoD contract or bidding on new work, CMMC requirements apply to you today. Waiting until your next renewal to start is not a safe strategy — the self-assessment process and SPRS submission take time, and your prime may require proof of compliance before award.
Yes. Level 1 requires an annual self-assessment and affirmation. You must re-assess your practices every 12 months and resubmit your SPRS score. Your score can change — if you've made improvements, your score goes up; if practices have lapsed, it goes down. The PCC annual re-assessment package (included in all prime programs) is distributed to subs at month 10–11 of their compliance cycle, so they're renewed before their anniversary date. Missing your annual renewal creates a compliance gap that your prime contractor is responsible for catching — which is exactly why the PCC tracker includes automatic renewal calendar alerts.
Yes. CMMC requirements apply to all DoD contracts regardless of location. Contractors working on NAVFAC Marianas, USACE Pacific Ocean Division, and Joint Region Marianas projects in Guam and throughout the Pacific Islands are subject to the same FAR and DFARS requirements as Hawaii or mainland contractors. The compliance requirement doesn't change because you're in a remote Pacific location — and most compliance programs aren't designed with the Pacific contracting environment in mind. PCC is built specifically for prime contractors and subcontractors operating across Hawaii, Guam, and the Pacific Islands.
There are several cybersecurity firms in Hawaii with CMMC credentials, including CyberAB-listed practitioners. Most of them focus on IT-managed services bundled with compliance consulting — their solution typically requires an ongoing IT relationship at MSP pricing. None of them operate a prime-mediated white-label compliance program designed specifically for trade subcontractors. PCC is not a managed IT provider — it is a compliance program operator. A trade subcontractor using PCC does not need to change their IT setup or hire a consultant. They complete a self-assessment, implement any required fixes, and submit their SPRS score — all without outside help.
This is one of the most common misconceptions. CMMC Level 1 is not about protecting classified information — it's about protecting Federal Contract Information, which includes contract numbers, project names, schedules, bid documents, invoices, and any other information provided by or generated for a federal agency under a contract. If your company receives a purchase order from a prime contractor on a military project, stores a PDF of the contract, or sends an invoice for work on a DoD facility — you have FCI. The 15 Level 1 practices are designed to protect exactly this kind of everyday business information, not classified data. Most of them are basic digital hygiene practices your business should have regardless of CMMC.

READY TO PROTECT
YOUR CONTRACTS?

Schedule a 20-minute call. We'll show you the program, answer your questions, and tell you exactly what your subs need to do.

Schedule a demo → Request the prime brief