There are other controls in most contracts that relate to FARS, DFARS, ITAR and FCI. Sure you might think you meet the 800-171 controls (most dont) but you will neglect to see the other stuff that can bite you. This is a whole ecosystem of controls and hard to manage without someone knowledgeable in the field. This wont be like say a SOX audit where you fill out some paperwork and some basic screenshots. Prepare to have your salad tossed and spend money. There are a lot of snake oil CMMC miracle cures out there. You wont get CMMC ready in a week, or a month. No one product will fix it. The reality is you should have been working on it the last 2 years. Good luck all. Happy to answer any questions, Ive been through the fire and came out the other side.