Core service · Government & Defense · Cybersecurity Maturity Model Certification
Issued by
US Department of Defense
Typical timeline
4-12 months to Level 2
Assessed by
Self / C3PAO / DIBCAC
Validity
3 years, annual affirmation
Overview
Who needs CMMC?
- 01Defense Industrial Base primes and subcontractors
- 02Manufacturers and engineering firms handling CUI
- 03IT and cloud providers to defense suppliers
What it proves
That a defense contractor protects contract and controlled unclassified information to the level its contracts require.
Asked for by
The Department of Defense, and the prime contractors who flow requirements down to suppliers.
Requirements
What the auditor looks for.
- 01Level 1, FoundationalBasic safeguarding of FCI with an annual self-assessment.
- 02Level 2, AdvancedThe 110 requirements of NIST SP 800-171, assessed by the company itself or by a C3PAO, depending on the contract.
- 03Level 3, ExpertSelected NIST SP 800-172 requirements, assessed by the government.
- 04CUI scopingWhich people, systems and facilities touch CUI, often with an enclave to shrink the boundary.
- 05SSP & POA&MDocumented implementation, and limited, time-bound plans of action for what is still open.
- 06SPRS scoreLevel 2 results are scored against the 110 requirements and recorded in the government's SPRS system.
Our approach
How we get you CMMC-ready.
What you get
What you walk away with.
- 01CUI flow map
- 02Scoping & enclave design
- 03System Security Plan
- 04SPRS score estimate
- 05POA&M
- 06Mock assessment
FAQ
Questions, answered.
The DFARS rule took effect on November 10, 2025 and phases CMMC in over several years. Phase 1 brought Level 1 and Level 2 self-assessments into contracts; from November 10, 2026, Phase 2 adds Level 2 certification assessments by a C3PAO. If you handle CUI, Level 2 readiness rarely takes less than a few months.
Only for certain lower-weighted requirements and above a minimum score. Open items go on a POA&M and must be closed within 180 days, so plan to fix most gaps before the assessment.
Level 1 is a self-assessment. Level 2 is a self-assessment or a C3PAO certification assessment, depending on the contract, and Level 3 is assessed by the government. We prepare you; the assessment stays independent.
Typical timeline: 4-12 months to level 2, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.
Yes, that's our specialty. CMMC shares substantial control overlap with CUI and NIST 800-53, so we build one control set and map evidence across all of them.
Next framework
CUI
End of the thread
A 30-minute call with a senior practitioner. You leave with a plan either way.
We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.