Cuick Trac CMMC Profile: What It Covers, What It Costs, and What You Still Own

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance · Last verified September 2026

Cuick Trac is Beryllium InfoSec's managed virtual desktop for work on Controlled Unclassified Information (CUI). For readers searching for a Cuick Trac CMMC review, the direct answer is this: set up and enforced correctly, it may let company laptops qualify as Out-of-Scope Assets for Cybersecurity Maturity Model Certification (CMMC). Beryllium says it inherits 264 of 320 Level 2 assessment objectives. You still own or share the other 56, and CMMC assesses your company's information system, not the product.

Know this first: we found no independent hands-on test in the sources and results checked, and we did not test it either. What we did was check Beryllium's public claims against the rules behind them, read its published contract terms and service-level language, and map the three places buyers can get surprised — the endpoints, the 56 shared or customer-managed objectives, and published terms that do not allow termination for convenience unless your Order Form changes them.

CMMC status, checked September 23, 2026. The Department of War — the name current official sites use alongside Department of Defense (DoD) — suspended CMMC Phase II on July 13, 2026. Phase II had been scheduled for November 10, 2026 and would have introduced Level 2 (C3PAO) requirements as a condition of award for applicable contracts. Phase I self-assessment requirements remain, and current suspension procedures limit new solicitations to Level 1 (Self) or Level 2 (Self). We found no official replacement Phase II date. The acquisition rule's broader clause-insertion schedule still contains a November 10, 2028 milestone; official sources checked did not identify that as a Phase II restart. See what changed and what still binds you.

For an enclave buyer, the suspension changes the immediate assessment timing, not the underlying cybersecurity work. Where DFARS 252.204-7012 applies, an external cloud service provider that stores, processes, or transmits covered defense information must meet the FedRAMP Moderate baseline or equivalent and support the clause's cyber-incident duties. Any self-assessment, CMMC status, SPRS record, or annual affirmation you submit must match the system you actually operate.

This page is for you if you handle CUI, you are considering Cuick Trac, and you want to know what it really covers before you sign.

It is not the right page if you only handle Federal Contract Information (FCI) — start with our Level 1 self-assessment checklist — or if you are choosing an assessor for a formal assessment. For that, see how to verify CMMC provider roles.

Before any demo, answer three quick questions:

1. Does your contract or your prime's flow-down include DFARS 252.204-7012, or has an authorized source identified information you receive or create as CUI? If you cannot answer that, read FCI vs. CUI first.
2. Do only a handful of your people touch CUI — not most of the company?
3. Can that CUI work happen in Windows programs on a remote desktop, instead of requiring local processing on shop-floor or engineering systems?

Three yeses mean Cuick Trac is worth a demo. A "no" anywhere means read the fit section below before you book one.

Cuick Trac at a glance

Cuick Trac is a managed CUI enclave: a locked-down Windows virtual desktop, run by Beryllium InfoSec, that CUI users log into for email, files, and approved programs. It is a cloud service offering, not a C3PAO assessment, and it does not give a customer CMMC status. Here is what we could confirm and how sure we are.

Cuick Trac's claims, checked against the record

Most of Cuick Trac's big claims are plausible, but most are company-stated, one public label it used was retired, and its own pages describe its coverage and schedule several different ways. The claim that matters most — FedRAMP Moderate equivalency — is one you must verify with documents, because the contractor remains responsible for confirming that its cloud use satisfies the clause.

Whether Cuick Trac is the right buy depends on facts no company profile can see: your required CMMC level and assessment type, whether you handle FCI or CUI, where CUI actually goes, your applications and IT environment, and your contract timeline. The contract clause sets your level, not a checklist. Because a general answer cannot resolve those facts for you, use The Defense Compliance Report's Find My CMMC Path tool to see whether a managed enclave, GCC High, an encrypted email-and-file tool, readiness help from an RPO, or a Managed Security Service Provider (MSSP) fits your situation before you request quotes — and do not submit CUI, drawings, or sensitive contract details.

FedRAMP "Ready," "Equivalent," and "Certified": which one counts?

For a cloud service handling covered defense information under DFARS 252.204-7012, the relevant paths are FedRAMP Certification at Moderate or higher, or an equivalency package that satisfies DoD policy. Beryllium claims equivalency. Ready and Legacy FedRAMP Ready are not either path.

Think of it like buying a used truck. "Ready" was a pre-inspection label. "Equivalent" is an evidence package showing a full inspection against the required baseline, but it is not a FedRAMP certification and you still have to inspect the report. Our guide to FedRAMP equivalency for cloud providers walks through the evidence.

Will Cuick Trac keep your laptops out of CMMC scope?

It can, but only if the virtual desktop is configured and used so the endpoint does not process, store, or transmit CUI beyond keyboard, video, and mouse. The CMMC rule allows that endpoint to be treated as an Out-of-Scope Asset, and DoD says the configuration must be verified. A download, local cache, redirected drive, uncontrolled clipboard path, local application, or other CUI path changes the answer.

Here is why. An enclave works like a locked room inside your building where the CUI work happens. Watching the work through a window does not put the laptop in the room. Carrying a drawing out does.

A hypothetical to make it concrete. Say you run a 40-person machine shop, and six people handle drawings from a prime. The drawings arrive in the enclave's secure email, and your engineers review them there. Their laptops may stay out of scope if the verified client remains KVM-only. But the moment a drawing lands on the CAM station that writes the machine program, that station is a CUI Asset. CNC machines or test equipment that receive the data may qualify as Specialized Assets depending on their characteristics and use; at Level 2, they still must be inventoried and documented, but are not assessed against the other CMMC security requirements. The enclave shrinks the job. It does not erase the shop floor. Our guide for machine shops and Level 2 scoping guide go deeper.

What you still own with Cuick Trac

By Beryllium's own contact-page count, you own 35 of the 320 Level 2 assessment objectives and share 21 more. Because a requirement is MET only when every applicable objective is MET, those 56 objectives can affect more of the 110 requirements than a single percentage suggests. The document that settles the split is the Customer Responsibility Matrix — the line-by-line record of who implements each objective and who produces the evidence.

First, the numbers. Beryllium's pages do not describe the split the same way.

The only public split that reconciles numerically is 264 inherited + 21 shared + 35 customer-managed = 320. That does not mean Beryllium alone "handles 285" or that 82.5% of the work disappears: shared objectives still require customer action and evidence, and effort is not distributed evenly across objectives. Get the current CRM itself.

Why does that matter? Each of the 110 requirements has one or more assessment objectives. If one applicable objective is NOT MET, the parent requirement is NOT MET. Some parent requirements carry 5 points in the DoD Assessment Methodology, but the points belong to the requirement, not to each objective. Ask for the matrix mapped to all 110 requirements and 320 objectives, with the parent requirement's score value beside every shared or customer-managed objective. Our guide to responsibility matrices shows what a defensible one contains.

Here is how the work splits, based on Beryllium's public description and the rule:

Who Cuick Trac fits — and who should look elsewhere

Cuick Trac is a plausible fit for a small CUI team whose work is mainly documents, email, files, and supported Windows programs at a company that wants a managed technical boundary. It is a weaker fit when CUI must be processed locally on shop-floor or engineering systems, when most staff work in CUI all day, when after-hours staffed support is essential and not contracted, or when the company needs the freedom to cancel. The deciding factor is where CUI actually goes.

If Cuick Trac does not fit, the answer is usually a different category, not a different logo:

No web page — including this one — can tell you whether Cuick Trac fits your company. That turns on where your CUI goes, and only you can map and validate it. The good news is that one well-run demo using a realistic but non-sensitive workflow will answer most of the operational questions. The checklist further down shows exactly how.

If a row above came out "it depends," sort out the category before you book a demo. The tool asks about your contract, FCI or CUI, environment, timeline, and budget, and shows which kind of path and help fit.

What Cuick Trac costs

Beryllium does not publish a current per-seat price; it quotes after a consultation. Its own comparison page, updated in August 2026, estimates $75,000-$100,000 in first-year cost for 50 users — about $125 to $166.67 per user per month if the total is spread evenly across 50 users and 12 months. That is our arithmetic on Beryllium's estimate, not a quote or independent market range, and the public page does not establish that every buyer receives the same scope.

One older data point: a 2021 marketplace listing attributed to Beryllium put the starting price at $295 per enclave user per month. It is a dated signal, not a current price.

The public Terms add a 5% annual increase unless the parties agree otherwise in writing. The published SLA lists support outside 8:00 a.m.-6:00 p.m. CST at $200 per hour with a two-hour minimum, support from 11:00 p.m.-6:00 a.m. CST at $500 per hour, and onsite support at $2,000 per day plus expenses. Neither public number captures onboarding, application hosting, storage or compute upgrades, advisory work, your staff time, MSP work on endpoints and interfaces, extra assessment support, formal assessment costs when applicable, or exit and migration. The calculator below keeps those buckets separate so nothing gets counted twice or silently becomes zero. For category-wide numbers, see our CMMC enclave cost guide.

Worked example. Every price here is made up for illustration — it is not a Cuick Trac quote or a market estimate. Say you get a quote for six seats at $200 per user per month, on a 12-month initial term, and you plan across three years. Your staff will spend 100 hours getting started and about four hours a month after that, at a loaded cost of $75 an hour. The quote does not say whether there is an onboarding fee. For this fictional horizon, formal assessment is marked not applicable.

Notice two things. The 5% increase adds $2,196 over three years compared with a flat per-seat price. And the total stays marked incomplete until you get the onboarding number — because an unknown is not zero.

The contract terms to read before you sign

Beryllium's published Terms of Service, Version 2.0 and last updated June 11, 2026, are strict in several places. They do not allow termination for convenience, do not permit seat reductions during a Subscription Period, increase fees 5% annually unless the parties agree otherwise, and require the customer to retrieve its data before service ends. Your Order Form, statement of work, and responsibility matrix rank above the general Terms, so that is where to change what matters.

We read the full Terms of Service and the published Service Level Agreement on September 23, 2026. These are the provisions that affect money, support, risk, and exit:

Two other terms worth knowing: the published Terms cap liability at 12 months of fees and exclude fines and penalties under §24, and they send disputes to binding arbitration in the Dallas area under §29.4. Those provisions can matter more than a product feature if an incident, missed deadline, or failed transition causes a contract loss.

The enclave handles a large part of the technical environment. Training, policies, your SSP, customer and shared objectives, workflow enforcement, and assessment preparation remain yours — and who should help with them depends on your level, team, and timeline.

How to verify Cuick Trac before you sign

Ask for documents before you rely on labels, and run your actual workflow in the demo with made-up files. A capable provider should have most of this ready. Some evidence — especially the body of evidence behind an equivalency claim — may require a nondisclosure agreement or controlled review. That is reasonable only if there is a real path for you, your adviser, and your eventual assessor to inspect what they need.

Copy this request and send it before your demo:

We are evaluating Cuick Trac for our CUI work and need to check it against our contract, data flows, applications, and assessment scope. Please send, or arrange secure review of, the items below. We will not send CUI, drawings, contract numbers, or sensitive system details by regular email.

1. Your current Customer Responsibility Matrix, dated and versioned, mapped to all 110 NIST SP 800-171 Revision 2 requirements and all 320 assessment objectives. Show the implementation owner, evidence owner, SSP reference, and parent requirement's DoD Assessment Methodology point value for every shared or customer-managed objective.
2. Which published coverage statement governs — 264 inherited / 21 shared / 35 customer-managed, 82% / 18%, 82% / 22%, or 80% of technical requirements — and a written reconciliation of the differences.
3. Your current 3PAO attestation for FedRAMP Moderate equivalency: assessor legal name and current recognition, assessment date, assessed service and boundary, exceptions or open findings, and the secure process by which we and our assessor can inspect the body of evidence.
4. Your current FedRAMP Marketplace product record, if any, showing the live product name, status, date, and package identifier.
5. A current boundary and data-flow diagram showing what Microsoft, Beryllium, our company, our MSP, and any other external service provider each cover.
6. The exact virtual-desktop settings and evidence for downloads, clipboard, screenshots, drive mapping, printing, scanning, USB, browser upload/download, offline access, mobile access, and local cache — plus every supported exception.
7. Whether our exact applications, versions, license servers, plug-ins, file sizes, GPU needs, printers, scanners, plotters, machine interfaces, and supplier portals run inside the enclave; what each costs; and what support is contracted.
8. Your incident-response RACI: monitoring and escalation, the initial-notice deadline, who submits any DoD report, DoD medium-assurance certificate responsibility, malicious-software submission, 90-day preservation, forensic access, and damage-assessment support under DFARS 252.204-7012 paragraphs (c) through (g).
9. Monitoring, patching, vulnerability management, backup, restore, change-management, log-retention, and evidence-export details mapped to the CRM.
10. The controlling SLA and SOW: staffed monitoring and support hours, 24/7 on-call coverage if any, P1 response and resolution targets, after-hours rates, maintenance windows, availability calculation, service credits, and every difference from the public SLA.
11. A three-year price in writing, including the 5% annual increase or negotiated cap, minimum seats, base fee, storage, compute/GPU, applications, integrations, onboarding, migration, advisory work, MSP work, after-hours support, extra audit support, travel, overages, and exit assistance.
12. The minimum seat count, when seats may be added, when they may be reduced, and the price and notice rule at each renewal.
13. A written exit plan: production data, backups, logs, CRM, SSP-ready statements, and assessment evidence; export formats; timing; transition help; overlap period; fees; deletion; residual retention; and destruction confirmation.
14. Your current Cyber AB Marketplace organization record and the current names, roles, and credential status of the RP, CCP, or CCA personnel assigned to us.
15. If available and lawful to share, references from organizations with a comparable scope that completed the applicable Level 2 assessment using the enclave. State the assessment type and date without exposing their sensitive information.
16. Your U.S.-person, administrative-access, subprocessor, and U.S.-location commitments in contract language, plus notification and approval rules for changes.
17. Please opt us out in writing from customer-name, logo, case-study, and publicity use under Terms §25.1.

Then, in the demo, test the work your people actually do. Use made-up files only.

Finally, define the milestones in writing, because Beryllium's public timelines range from 10 business days to 3-6 months depending on what is being measured:

What a Cuick Trac CMMC review can — and cannot — verify

We found no independent hands-on review of Cuick Trac in the sources and results checked. What turns up is vendor pages, role-only testimonials, software-directory listings that repeat sales copy, reseller pages, and press releases — plus one checkable government record, the Army NCODE contract announcement.

How we built this profile

We read Cuick Trac's public product pages, its full published Terms and SLA, Beryllium's company announcements, and the primary rules and official records behind the consequential claims. We dated the checks. We did not use the product, inspect private evidence, review a customer Order Form or SOW, run an application test, or interview customers. Every claim that comes from Beryllium remains attributed to Beryllium.

What we verified — September 23, 2026

• Read from primary authorities: DFARS 252.204-7012; 32 CFR Part 170, including § 170.19 scoping; NIST SP 800-171 Revision 2 and SP 800-171A; the DoD Assessment Methodology; FedRAMP notice NTC-0008; the Cyber AB Code of Professional Conduct v2.0 and CMMC Assessment Process v2.0.
• Checked against current official records: the DoW CMMC status pages; the July 13, 2026 suspension release; the DARS class-deviation index showing 2026-O0025 Revision 3 dated September 3, 2026; the May 5, 2026 NCODE contract announcement; and the Army NCODE page.
• Read as company documents: the Cuick Trac homepage, CTME, compliance, contact, demo, and comparison pages; Beryllium's Terms of Service v2.0; and its published SLA.
• Company-stated, not independently proven: FedRAMP Moderate equivalency; Beryllium's own Level 2 result; the 264/21/35 split; GCC High basis; U.S.-person operation; application fit; timelines; price estimates; and Cyber AB RPO role.
• Could not independently confirm: Cuick Trac's current FedRAMP Marketplace status or package identifier; Beryllium's current Cyber AB Marketplace role; the equivalency 3PAO's identity and private evidence package; any customer outcome; current buyer pricing; or the terms of any buyer-specific Order Form or SOW.
• Source-access limitation: the official December 21, 2023 FedRAMP-equivalency memo remains linked as the authority, but its PDF did not render during this audit pass. The page therefore does not claim a fresh line-by-line re-read and tells the buyer to inspect the current attestation and body of evidence.

Frequently asked questions

Is Cuick Trac CMMC certified?

No product is assigned CMMC status. CMMC status belongs to the organization seeking assessment and its assessed information system. Beryllium says its own system, running on Cuick Trac, completed a third-party Level 2 assessment in 2025; that does not determine your scope, implementation, evidence, or outcome.

Is Cuick Trac FedRAMP authorized?

Beryllium claims FedRAMP Moderate equivalency, not FedRAMP authorization. It says an independent 3PAO assessed the offering in January 2025. Equivalency can satisfy the DFARS cloud security-baseline path only if the current package meets DoD policy; ask for the attestation, assessment scope, current exceptions, and body-of-evidence access rather than relying on the label.

Is Cuick Trac monitored 24/7?

Cuick Trac's product copy describes 24/7 logging, alerting, and monitoring. Beryllium's published SLA describes personnel monitoring Monday-Friday, 8:00 a.m.-6:00 p.m. CST, and business-hours remediation unless the SOW says otherwise. It lists $200 per hour with a two-hour minimum outside service hours and $500 per hour from 11:00 p.m.-6:00 a.m. CST. Treat 24/7 automated capability and 24/7 staffed response as different promises, and put the required staffing, escalation, and pricing in the SOW.

If I use Cuick Trac, do I still need a C3PAO assessment?

The enclave does not change the assessment type set by the applicable solicitation, contract, or modification. A C3PAO assessment is required when Level 2 (C3PAO) applies; under the current suspension procedures, new solicitations are limited to Level 1 (Self) or Level 2 (Self), while existing obligations and voluntary or government-led activity may still matter. Read the actual clause in your paperwork and the current official implementation direction.

Can Cuick Trac hold ITAR data?

Beryllium says the environment is operated on U.S. soil by U.S. persons and supports ITAR data. That is a company representation, not a determination of your export authorization or data jurisdiction. Put location, citizenship/person status, administrative access, subprocessors, and change-control commitments in the contract and confirm applicability with qualified export counsel.

Does Cuick Trac replace my MSP?

Beryllium says no; it is designed to work alongside an existing MSP or internal IT team. Your MSP still operates systems and interfaces outside the enclave. If you intend to keep login endpoints out of scope, the endpoint must not process, store, or transmit CUI beyond keyboard, video, and mouse, and the configuration must be verified. Our guide to CMMC requirements for MSPs covers their side.

Can the Army's NCODE program pay for Cuick Trac?

The official record shows that Beryllium is one of eight firms competing for NCODE task orders. The public Army page does not promise a grant, reimbursement, subsidy, or cost share to an individual contractor. Eligible Army small businesses can register interest with NCODE to learn whether the acquisition route and an available task order apply.

What happens to my data if I leave?

The published Terms require you to retrieve your data. §15.1 says dedicated storage is wiped during deprovisioning after the last service day and cannot be recovered; §11.4 says the company may delete data after 90 days and may retain backups up to 12 months. Do not assume you have a recovery window: obtain a written exit runbook covering each data store, logs, evidence, backups, export assistance, deletion, and residual retention.

Can the same company prepare me and assess me?

A C3PAO may not conduct a CMMC assessment of an organization it helped prepare for any CMMC assessment during the prior three years, and it may not provide consulting to an organization it assessed for three years after the assessment, under the Cyber AB Code of Professional Conduct v2.0. Beryllium presents Cuick Trac and its advisory work as readiness services; verify every provider's current Marketplace role and keep the formal assessor independent. See RPO vs. C3PAO.

Still not sure which CMMC path fits your company? Use The Defense Compliance Report's Find My CMMC Path tool to see which path and kind of help fit your contract, CUI, environment, and timeline — before you hire anyone.

Sources

All checked September 23, 2026, unless noted.

Rules and official records

• 32 CFR Part 170, CMMC Program, eCFR, including § 170.19 scoping
• Federal Register, Cybersecurity Maturity Model Certification Program Final Rule
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
• DFARS 252.204-7021, Contractor Compliance With the CMMC Level Requirements
• DFARS 252.204-7025, Notice of CMMC Level Requirements
• NIST SP 800-171 Revision 2
• NIST SP 800-171A (2018 assessment procedures used by current CMMC Level 2)
• DoD Assessment Methodology, Version 1.2.1
• DoD CIO memorandum, FedRAMP Moderate Equivalency for Cloud Service Providers' Cloud Service Offerings, Dec. 21, 2023
• DoW CMMC current status page
• Department of War, Phase II suspension release, July 13, 2026
• Defense Acquisition Regulations System, class-deviation index
• Department of War, Contracts for May 5, 2026, NCODE
• U.S. Army, NCODE for Small Business
• FedRAMP notice NTC-0008, retirement of FedRAMP Ready
• FedRAMP Consolidated Rules for 2026 announcement
• Cyber AB Code of Professional Conduct v2.0
• Cyber AB CMMC Assessment Process v2.0
• Cyber AB Marketplace
• FedRAMP Marketplace

Company sources — company-stated unless the page quotes published contract language

• Cuick Trac homepage and FAQ
• Cuick Trac Managed Enclave page
• Cuick Trac contact-page FAQ
• Cuick Trac compliance page
• Cuick Trac comparison page, updated Aug. 11, 2026
• Cuick Trac demo page
• Beryllium InfoSec Terms of Service, Version 2.0, last updated June 11, 2026
• Beryllium InfoSec Service Level Agreement, last updated July 21, 2026
• Beryllium announcement: FedRAMP Moderate equivalency, Jan. 29, 2025
• Beryllium announcement: Level 2 assessment using Cuick Trac, May 14, 2025
• FutureFeed Marketplace listing, Cuick Trac CUI enclave, 2021

Our related guides

• Do I still need CMMC? What the 2026 suspension changed
• DFARS 252.204-7012 explained
• CMMC Level 2 scoping guide
• CMMC shared responsibility matrix
• CMMC enclave cost

---

About The Defense Compliance Report

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor's level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

We are not affiliated with the Cyber AB, DoD, DCMA DIBCAC, NIST, or any U.S. government agency. This page is educational research, not legal, contractual, or compliance advice — confirm scope and applicability with a CMMC Registered Practitioner (RP) or a qualified federal-contracts attorney. Read our Editorial & Advertising Policy and methodology.