The DoD is replacing “trust us” with “show us.”
For years, defense contractors self-attested that they safeguarded sensitive government data. Repeated breaches across the supply chain proved self-attestation was not enough. CMMC makes verified cybersecurity a condition of doing business with the Department of Defense.
The mandate protects two kinds of government information: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). If your contracts touch either, a CMMC requirement will appear in them — and at the required level, no certification means no eligibility to win or keep the award.
Now codified in federal rule and phasing into DoD contracts, CMMC applies across every tier of the Defense Industrial Base — from primes to the smallest subcontractor.
FCI
Federal Contract Information — information provided for or generated under a contract, not intended for public release.
CUI
Controlled Unclassified Information — sensitive government information that requires safeguarding under federal law and policy.
Three levels. Rising assurance.
CMMC 2.0 scales the required rigor to the sensitivity of the information you handle. Your contracts determine which level you must reach.
Foundational
Basic safeguarding of Federal Contract Information — access control, identification, media handling, and physical protection. The entry tier for contractors that handle FCI but not CUI.
Advanced
Full protection of Controlled Unclassified Information, implementing all 110 NIST SP 800-171 controls across 14 domains. This is the level most of the defense supply chain will need to certify to.
Expert
The 110 NIST SP 800-171 controls plus a subset of enhanced NIST SP 800-172 requirements, defending the highest-priority programs against advanced persistent threats.
The 14 control domains of NIST SP 800-171.
Level 2 implements all 110 controls across these fourteen families — the same control set that underpins most US federal compliance. We assess and remediate every domain.
From scoping to certified.
A clear, sequenced path to certification — with the remediation phase that, for most contractors, carries the weight. Durations are indicative for a mid-market environment.
If you’re pursuing CMMC, start here.
Certification is won or lost in the decisions you make before remediation begins. Get scope and level right, and the path is direct and predictable. Get them wrong, and cost and timeline balloon. These are the three things to get right first.
Confirm what data you handle
Whether your contracts involve Federal Contract Information, Controlled Unclassified Information, or both decides your required level. Get this wrong and you either over-invest or fail to qualify.
Define — and shrink — your scope
A tightly bounded CUI enclave is the single biggest lever on cost and timeline. We help you isolate where CUI lives so the assessment covers what it must and nothing more.
Assess honestly, then remediate
A candid gap assessment against NIST SP 800-171 is worth more than an optimistic one. We score every control, prioritize by risk, and close gaps before an assessor ever sees them.
What you walk away with.
Every CMMC engagement produces the concrete artifacts an assessor expects — and a program that keeps generating them long after certification.
System Security Plan (SSP)
The authoritative document describing your environment, scope, and how each required control is implemented — the backbone of any CMMC assessment.
Plan of Action & Milestones
A tracked, dated plan for closing any control not yet fully met, with owners and target dates an assessor can review.
SPRS score & submission
Your NIST SP 800-171 self-assessment score, calculated and submitted to the Supplier Performance Risk System as the rules require.
Evidence package
Policies, procedures, configurations, and artifacts mapped control-by-control — organized so the assessment runs on prepared evidence, not a scramble.
Mock assessment results
A full pre-assessment run by a reviewer independent of your implementation team, with an exception log and corrective actions before the real assessment.
Certification & coordination
Coordination with your authorized C3PAO (or DIBCAC for Level 3) through assessment, findings closure, and the certification itself.
Good to know before we start.
Questions on scope, levels, or the C3PAO assessment? A senior practitioner will walk you through it.
Get certification-ready before the assessment slots run out.
Tell us what you build and which contracts you hold. We'll confirm your level, scope your environment, and lay out a fixed-price path to a certification-ready program — and through the assessment itself.