# Contractors Assess CMMC Enclave Providers

A customer discussion about C3, also identified as Steel Root/C3, presents mixed reported experiences with managed services for CMMC enclaves: some customers and assessors praise its support and assessment preparation, while others describe billing discrepancies, costly add-on services, and challenges obtaining documentation or transitioning providers. One customer reports $55,000 per month for services covering nine business units and about 4,000 employees; commenters also cite a $29,000 assessment-preparation engagement and a dispute over a $5,000 FutureFeed charge. These are individual accounts, not independently verified procurement findings. For organizations selecting or renewing an enclave services provider, the discussion highlights the value of defining responsibilities, validating charges, and documenting transition arrangements before award or renewal.

- Require a shared responsibility matrix that identifies control and assessment tasks, ownership, and documentation responsibilities.
- Validate software quantities, licensing credits, and add-on fees against the proposed scope; the thread includes customer-reported billing concerns involving CrowdStrike services and GRC platform charges.
- Specify ownership, access, and handoff procedures for assessment artifacts and other documentation, along with exit and transition terms. Commenters distinguish the certification period from artifact-retention obligations but disagree on whether changing providers affects certification, so verify applicable program requirements rather than relying on forum claims.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 22, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

### Vendors
- C3 (also referred to as Steel Root/C3) (CMMC enclave managed service provider)
- Sysarc (replacement managed service provider)
- FutureFeed (GRC platform provider)
- IntelliGRC (GRC platform provider)
- CrowdStrike (cybersecurity software provider)

### Key Quotes
> Everyone should be asking for a shared responsibility matrix that shows every single required control, objective, and who does what to fully meet it, in addition to outlining details around who owns what leading up to and preparing for an assessment/audit.
> — Commenter

> The billing quantities get funky on one of our crowdstrike services and I had to do substantial research to find the cause of the issue.
> — Commenter (C3 customer)

### Sources
- [For anyone looking for an MSP to help with your enclave, avoid C3 (C3isit.com)](https://www.reddit.com/r/CMMC/comments/1xcjupn/for_anyone_looking_for_an_msp_to_help_with_your) - reddit-cmmc