Disclaimer

Purpose of this site

Meridian Compass is an independent, buyer-side reference for small and mid-sized defense contractors evaluating CMMC cost, readiness, and provider fit. The site is published by Meridian Compass LLC, a Wyoming limited liability company.

Meridian Compass is not a regulated provider

Meridian Compass is not, and does not hold itself out as, any of the following:

• a Certified Third-Party Assessment Organization (C3PAO);
• a Registered Practitioner Organization (RPO) or Registered Practitioner (RP);
• a Managed Service Provider (MSP), Managed Security Service Provider (MSSP), or CUI enclave operator;
• a law firm, contracting firm, or accounting firm; or
• a Certified CMMC Professional (CCP), Certified CMMC Assessor (CCA), or any other Cyber AB-certified individual or organization.

Meridian Compass does not certify, assess, audit, or guarantee compliance for any buyer. Meridian Compass cannot issue, deny, or revoke any CMMC certification at any level.

No government affiliation

Meridian Compass is an independent commercial publisher. It is not affiliated with, endorsed by, sponsored by, or in any way officially connected to the United States Department of Defense, the Cyber AB, any C3PAO, or any other federal, state, or local agency or instrumentality. References to agencies, programs, clauses, or organizations are descriptive only and do not imply endorsement.

Not professional advice

Nothing on this site — including readouts produced by the Cost & Fit Check, Quote Decoder, RFP Decoder, or Provider Matcher, the editorial guides, the provider records, and any future paid deliverables — constitutes legal, tax, accounting, auditing, lobbying, investment, compliance, export, regulatory, FAR/DFARS compliance, or cybersecurity certification advice. Nothing on the site is a substitute for advice from a duly licensed professional with knowledge of your specific situation.

The site does not establish an attorney-client relationship, a consultant relationship, or a fiduciary relationship of any kind. If your situation has legal, regulatory, or financial consequences, consult a qualified advisor.

Cost bands are planning ranges, not quotes

First-year cost bands and provider-mix estimates produced by the Services are wide planning ranges drawn from public vendor pricing pages and published industry write-ups. They are not quotes, contracts, or binding estimates. Actual pricing depends on your specific environment, scope, and the providers you ultimately engage, and will frequently fall outside the published range.

Provider directory is editorial, not endorsement

Inclusion of a provider in the directory is editorial. It is not an endorsement, a recommendation, or a representation that the provider is qualified to perform any specific service for you. Each record cites public sources with retrieval dates; you should independently verify any claim, including by checking the Cyber AB Marketplace and the provider’s own website, before relying on it.

Do not paste CUI

The decoders accept sanitized text inputs only. Do not paste Controlled Unclassified Information (CUI), classified material, signed contracts, unredacted proposals, personal identifiers, or any content you are not authorized to share. You are solely responsible for sanitizing inputs before submission. Meridian Compass does not accept liability for content you submit in violation of this policy or in violation of applicable law or contract.

Status of paid products

The CMMC Quote & Readiness Decision Pack and the per-decoder PDF exports are marketed on this site at $249 and $99, respectively. As of the date above, paid checkout is not yet active. No payment is processed and no paid deliverable is dispatched. When paid checkout is activated, the applicable pricing, refund, and delivery terms will be published at the point of purchase and incorporated into the Terms of Service.

Changes

The site is updated periodically. Cited source pages may change after their listed retrieval date; in case of conflict, the provider’s authoritative source controls. Last updated date applies to this disclaimer page; individual records carry their own retrieval dates.