Phase I SBIR award
4 to 6 months
From notice of award to final report.
CMMC for SBIR Applicants
Your DoD SBIR award is held up by one missing line in SPRS.
The 2026 DoD SBIR BAA requires a current NIST 800-171 self-assessment score before any award. Most applicants do not have one. Brehon gets you there in weeks, not months.
- Built by a CISSP and CISM
- NIST 800-171 Rev. 2, all 110 controls
- SSP + POA&M + SPRS export
The 2026 BAA change
No SPRS score, no SBIR award.
On April 13, 2026 the SBIR and STTR programs were reauthorized through 2031. The 2026 DoD SBIR BAA that came with the restart added something most small businesses missed. Contracting officers are now required to check the Supplier Performance Risk System (SPRS) before making an award. The check is for a current NIST 800-171 self-assessment score.
If your SPRS entry is missing, expired, or scored below the contracting officer's bar, your award can be delayed or rescinded. The requirement exists for every SBIR Phase I, Phase II, and Direct-to-Phase II applicant. It is not optional. It is not waivable.
The math
Phase I is six months. CMMC takes twelve. Do the math.
CMMC Level 2 readiness, from zero
8 to 12 months
Average for a small business with no prior 800-171 work.
The gap
Phase II closes first
If you start CMMC after the Phase I win, you're already late.
A Phase I SBIR award runs four to six months. CMMC Level 2 readiness, the level most DoD topics now require for Phase II, takes the average small business eight to twelve months when started from zero.
If you win Phase I and start CMMC after the win, you will not be ready when Phase II opens. The Phase II window will close on you. You will have done the research and lost the contract.
The companies that win Phase II in 2026 are the ones who started their NIST 800-171 self-assessment before Phase I closed. Which is right now.
The platform
Brehon, by Solas AI.
One tool. Three jobs. All three required before a contracting officer will sign.
Walks you through the 110 controls.
Not a checklist PDF. An interactive workflow with plain-English explanations, decision trees, and small-business-specific guidance for every NIST SP 800-171 Rev. 2 control.
Captures the evidence.
Upload, link, or note. Every control has an evidence row. Every evidence row has an audit trail. When the assessor or contracting officer asks, you have the answer.
Generates the SSP, POA&M, and SPRS score.
Defensible documents in the format the government expects. The output is yours. Print it, hand it to a C3PAO, upload it to SPRS.
Pricing
Pricing built for a 12-person company, not a Fortune 500.
SPRS Sprint
For single-site teams comfortable with the work.
$2,497 one-time
7 to 14 days
- Full platform access for 30 days
- Self-paced 110-control workflow
- SSP, POA&M, and SPRS score export
- One 30-minute review call with David
Most popular
Guided SPRS
For teams that want it done with them.
$6,997 one-time
21 to 30 days
- Everything in SPRS Sprint
- Weekly 60-minute working sessions
- Hands-on evidence collection support
- POA&M strategy review
- Direct Slack channel with David
Phase II Readiness
For teams with a Phase II topic already in sight.
$14,997 program fee
90 days
- Everything in Guided SPRS
- C3PAO assessor matchmaking
- Mock assessment with gap report
- 90 days of post-assessment support
- Phase II proposal compliance review
All tiers include the SSP, POA&M, SPRS score package, and a defensible audit trail.
From the founder
Why I built this.
I'm David Moline. By day I run cybersecurity for a DoD contractor in Stuttgart, where I've spent the last several years watching small defense businesses get crushed by compliance requirements they had three months to figure out. I hold CISSP and CISM, I'm finishing graduate work at Johns Hopkins in generative and agentic AI, and I built Brehon because I kept seeing the same problem from the inside: the small business does not need a six-figure consulting engagement. It needs a tool that knows what to ask and what to do with the answer.
Brehon is that tool.
CISSP CISM AI Security+ Johns Hopkins, Generative AI Johns Hopkins, Agentic AI
David A. Moline Founder, Solas AI
Questions
Questions before you start.
Is Brehon a C3PAO?
No. C3PAOs perform the third-party assessment for Level 2 (high-risk). Brehon gets you ready for that assessment and handles the self-assessment side. We can refer you to assessors when you're ready.
What's the SPRS score I need?
SPRS scores run from -203 up to 110, where 110 means all 110 controls are met. There is no universal pass mark: under DFARS 252.204-7019 and 7020 you post whatever score your assessment produces, and each prime or contracting officer sets the floor they will accept, usually backed by a POA&M for anything not yet met. One number worth knowing: a score of at least 88 (80 percent of the 110 controls met) is what lets you claim a conditional Level 2 self-assessment under 32 CFR 170.21 while you close the rest on a POA&M. What primes actually scrutinize is the score together with an SSP and POA&M that hold up.
How long does SAM.gov registration take?
New registrations: 2 to 4 weeks. Renewals: 1 to 2 weeks. Build it into your timeline.
Can Brehon costs go on my SBIR award?
CMMC readiness costs are allowable on DoD SBIR contracts. TABA may apply. Talk to your contracting officer.
Two ways in
Get the guide. Or get on a call.
The guide is the cheapest way to find out where you stand. The call is the fastest way to find out what to do about it.
Self-serve
7-Day SPRS Sprint Guide
A PDF that walks you from zero to a defensible SPRS submission.
Talk first
15-minute fit call
Tell me your topic and your timeline. I'll tell you which tier fits, or that none of them do.
Book a 15-minute fit callDirect calendar. No SDR in between.