// CMMC2.jsx — Verigo Global: dedicated CMMC 2.0 certification + support page const { V: CV, MAXW: CMW, FONT: CFT } = window; /* ── DATA ─────────────────────────────────────────────────── */ const LEVELS = [ { lvl: 'Level 1', name: 'Foundational', icon: 'lock', controls: '17 practices', protects: 'FCI', assess: 'Annual self-assessment & affirmation', focus: 'Basic safeguarding of Federal Contract Information — access control, identification, media handling, and physical protection. The entry tier for contractors that handle FCI but not CUI.', }, { lvl: 'Level 2', name: 'Advanced', icon: 'shield', controls: '110 controls', protects: 'CUI', assess: 'C3PAO assessment every 3 years (self-assessment for select programs)', focus: 'Full protection of Controlled Unclassified Information, implementing all 110 NIST SP 800-171 controls across 14 domains. This is the level most of the defense supply chain will need to certify to.', highlight: true, }, { lvl: 'Level 3', name: 'Expert', icon: 'star', controls: '110 + enhanced', protects: 'CUI (priority)', assess: 'Government (DIBCAC) assessment', focus: 'The 110 NIST SP 800-171 controls plus a subset of enhanced NIST SP 800-172 requirements, defending the highest-priority programs against advanced persistent threats.', }, ]; const DOMAINS = [ ['lock', 'Access Control'], ['users', 'Awareness & Training'], ['file', 'Audit & Accountability'], ['cpu', 'Configuration Management'], ['shield', 'Identification & Authentication'], ['zap', 'Incident Response'], ['refresh', 'Maintenance'], ['server', 'Media Protection'], ['briefcase', 'Personnel Security'], ['building', 'Physical Protection'], ['target', 'Risk Assessment'], ['clipboard', 'Security Assessment'], ['network', 'System & Communications'], ['activity', 'System & Information Integrity'], ]; const ROADMAP = [ ['search', 'Scope & level', '2–3 wks', 'Map FCI and CUI flows; confirm the level your contracts require.'], ['target', 'Gap assessment', '3–5 wks', 'Measure your environment against every required practice and control.'], ['layers', 'Remediate', '3–9 mo', 'Implement controls, write policies, and stand up the CUI enclave.'], ['file', 'SSP & POA&M', '2–4 wks', 'Document the System Security Plan and Plan of Action & Milestones.'], ['gauge', 'Score & rehearse', '2–4 wks', 'Submit your SPRS score and run a full mock assessment.'], ['award', 'Assess & certify', '4–8 wks', 'C3PAO (or DIBCAC) assessment, findings closure, and certification.'], ]; const SEEKING = [ ['file', 'Confirm what data you handle', 'Whether your contracts involve Federal Contract Information, Controlled Unclassified Information, or both decides your required level. Get this wrong and you either over-invest or fail to qualify.'], ['target', 'Define — and shrink — your scope', 'A tightly bounded CUI enclave is the single biggest lever on cost and timeline. We help you isolate where CUI lives so the assessment covers what it must and nothing more.'], ['shield', 'Assess honestly, then remediate', 'A candid gap assessment against NIST SP 800-171 is worth more than an optimistic one. We score every control, prioritize by risk, and close gaps before an assessor ever sees them.'], ]; const PREPARE = [ 'A defined assessment scope and CUI data-flow diagram', 'A complete System Security Plan (SSP)', 'A Plan of Action & Milestones (POA&M) for any open items', 'A current SPRS self-assessment score on record', 'Evidence mapped to each of the 110 controls', 'Named control owners ready for assessor interviews', ]; const OUTPUTS = [ ['file', 'System Security Plan (SSP)', 'The authoritative document describing your environment, scope, and how each required control is implemented — the backbone of any CMMC assessment.'], ['clipboard', 'Plan of Action & Milestones', 'A tracked, dated plan for closing any control not yet fully met, with owners and target dates an assessor can review.'], ['gauge', 'SPRS score & submission', 'Your NIST SP 800-171 self-assessment score, calculated and submitted to the Supplier Performance Risk System as the rules require.'], ['layers', 'Evidence package', 'Policies, procedures, configurations, and artifacts mapped control-by-control — organized so the assessment runs on prepared evidence, not a scramble.'], ['search', 'Mock assessment results', 'A full pre-assessment run by a reviewer independent of your implementation team, with an exception log and corrective actions before the real assessment.'], ['award', 'Certification & coordination', 'Coordination with your authorized C3PAO (or DIBCAC for Level 3) through assessment, findings closure, and the certification itself.'], ]; const CMMC_FAQ = [ ['Does CMMC apply to my company?', 'If your organization is part of the Department of Defense supply chain and handles Federal Contract Information or Controlled Unclassified Information — as a prime or at any subcontractor tier — a CMMC requirement will appear in your contracts. Roughly 300,000 companies across the Defense Industrial Base are in scope. If you are unsure whether you handle CUI, that determination is the first thing we help you make.'], ['Which level do we need?', 'Your required level is driven by the data your contracts involve. Level 1 covers basic protection of Federal Contract Information. Level 2 — the level most of the supply chain will need — requires all 110 NIST SP 800-171 controls to protect Controlled Unclassified Information. Level 3 adds enhanced NIST SP 800-172 requirements for the highest-priority programs. We confirm your level during scoping so you neither over-build nor under-qualify.'], ['What is a C3PAO and when do we need one?', 'A Certified Third-Party Assessment Organization is an authorized firm that performs Level 2 assessments. Most Level 2 contractors must pass a C3PAO assessment every three years, while select programs may self-assess. Level 3 is assessed by the government\u2019s DIBCAC. Verigo prepares you for and coordinates that assessment, but to protect its integrity we are never the assessor for the controls we helped implement.'], ['How long does certification take?', 'For a mid-market contractor, expect roughly six to twelve months end to end, driven mostly by remediation. A tightly scoped CUI enclave shortens it considerably; a sprawling environment lengthens it. We give you a firm, scoped timeline after the gap assessment.'], ['Why start now if assessments phase in later?', 'Because demand far outstrips supply. With an estimated need for thousands of assessors and only a few hundred authorized today, assessment slots are scarce and remediation takes months. Contractors that certify early protect their eligibility — and can win work that competitors cannot yet bid on.'], ]; /* ── BREADCRUMB ───────────────────────────────────────────── */ const CCrumb = ({ onNav }) => (
/ / CMMC 2.0
); const cCrumbBtn = { background: 'none', border: 'none', cursor: 'pointer', color: '#7A7A8A', fontSize: 13, fontWeight: 600, padding: 0, fontFamily: "'DM Sans', system-ui, sans-serif" }; /* ── HERO ─────────────────────────────────────────────────── */ const CHero = ({ onNav }) => (
US DoD Mandate Level 1–3

CMMC 2.0, your path to eligibility.

The Department of Defense now requires verified cybersecurity across its supply chain. Verigo takes defense contractors from scoping and gap assessment to a certification-ready program — and through the C3PAO assessment itself.

onNav('contact')}>Start a Conversation onNav('toolkit:cmmc')}>Explore the CMMC 2.0 toolkit document.getElementById('roadmap')?.scrollIntoView({ behavior: 'smooth', block: 'start' })}>See the roadmap
At a glance
{[ ['building', 'Authority', 'US Department of Defense'], ['shield', 'Protects', 'FCI & CUI'], ['layers', 'Levels', '1 Foundational · 2 Advanced · 3 Expert'], ['gauge', 'Typical timeline', '6–12 months to certified'], ].map(([ic, k, val], i) => (
{k}
{val}
))}
); /* ── STATS STRIP ──────────────────────────────────────────── */ const CStats = () => (
{[ ['300K+', 'DIB contractors in scope'], ['Nov 2026', 'Level 2 assessments phase in'], ['~600', 'Certified assessors available'], ['110', 'NIST 800-171 controls at Level 2'], ].map(([v, l], i) => (
{v} {l}
))}
); /* ── THE MANDATE / WHY CMMC ───────────────────────────────── */ const Mandate = () => (
Why CMMC exists

The DoD is replacing “trust us” with “show us.”

For years, defense contractors self-attested that they safeguarded sensitive government data. Repeated breaches across the supply chain proved self-attestation was not enough. CMMC makes verified cybersecurity a condition of doing business with the Department of Defense.

The mandate protects two kinds of government information: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). If your contracts touch either, a CMMC requirement will appear in them — and at the required level, no certification means no eligibility to win or keep the award.

Now codified in federal rule and phasing into DoD contracts, CMMC applies across every tier of the Defense Industrial Base — from primes to the smallest subcontractor.

Phase-in has begun

Why waiting is the expensive option.

Level 2 third-party assessments phase in from November 2026. With roughly 300,000 contractors in scope and only a few hundred certified assessors available, assessment slots are scarce and remediation takes months. Certifying early protects your eligibility — and opens work competitors cannot yet bid on.

{[ ['file', 'FCI', 'Federal Contract Information — information provided for or generated under a contract, not intended for public release.'], ['lock', 'CUI', 'Controlled Unclassified Information — sensitive government information that requires safeguarding under federal law and policy.'], ].map(([ic, t, d], i) => (

{t}

{d}

))}
); /* ── LEVELS ───────────────────────────────────────────────── */ const Levels = () => (
{LEVELS.map((l) => (
{l.highlight && Most common}
{l.lvl}

{l.name}

{l.controls} Protects {l.protects}

{l.focus}

How it’s assessed
{l.assess}
))}
); /* ── COVERAGE ─────────────────────────────────────────────── */ const Coverage = () => (
{DOMAINS.map(([ic, name], i) => (
{name}
))}
); /* ── ROADMAP ──────────────────────────────────────────────── */ const Roadmap = () => (
{ROADMAP.map(([ic, t, dur, d], i) => (
{dur}
{t}
{d}
))}
); /* ── FOR ORGANIZATIONS SEEKING CERTIFICATION ──────────────── */ const Seeking = ({ onNav }) => (
Seeking certification

If you’re pursuing CMMC, start here.

Certification is won or lost in the decisions you make before remediation begins. Get scope and level right, and the path is direct and predictable. Get them wrong, and cost and timeline balloon. These are the three things to get right first.

{SEEKING.map(([ic, t, d], i) => (

{t}

{d}

))}
); /* ── OUTPUTS ──────────────────────────────────────────────── */ const Outputs = () => (
{OUTPUTS.map(([ic, t, d], i) => (

{t}

{d}

))}
); /* ── FAQ ──────────────────────────────────────────────────── */ const CFAQ = ({ onNav }) => { const [open, setOpen] = React.useState(0); return (
CMMC questions

Good to know before we start.

Questions on scope, levels, or the C3PAO assessment? A senior practitioner will walk you through it.

onNav('contact')}>Start a Conversation
{CMMC_FAQ.map(([q, a], i) => { const isOpen = open === i; return (
{isOpen && (

{a}

)}
); })}
); }; /* ── PAGE ─────────────────────────────────────────────────── */ const CMMC2Page = ({ onNav }) => (
); Object.assign(window, { CMMC2Page });