Compliance / CMMC
Get ready for CMMC before it shows up in your next contract.
CMMC is now part of Department of Defense contracting. Since November 10, 2025, contracts can require a CMMC level as a condition of award, and the requirements phase in through November 2028.
We help prime contractors and subcontractors in Texas and across the defense industrial base work out which level applies, close the gaps against NIST SP 800-171 and prepare for a self-assessment or a C3PAO certification assessment.
At a glance
- Applies to
- DoD contractors and subcontractors that handle FCI or CUI
- Level 1
- 15 basic safeguarding requirements, annual self-assessment
- Level 2
- 110 requirements from NIST SP 800-171 Rev. 2, assessed by the contractor or a C3PAO every three years
- Level 3
- Level 2 plus 24 requirements from NIST SP 800-172, assessed by DCMA DIBCAC
- Rollout
- Four phases, November 10, 2025 to November 10, 2028
CMMC 2.0
What CMMC changes
CMMC adds few new security requirements. Most of them have been in DFARS clause 252.204-7012 and NIST SP 800-171 for years. What changes is verification. Instead of relying on a contractor's self-reported score in the Supplier Performance Risk System (SPRS), DoD now requires an assessment plus an annual affirmation by a senior official, and for many contracts the assessment comes from an authorized third party.
Accuracy matters. Affirmations are made to the federal government, and the Department of Justice has used the False Claims Act to pursue contractors that misrepresented their cybersecurity compliance.
One detail trips people up: CMMC Level 2 is assessed against Revision 2 of NIST SP 800-171, even though Revision 3 was published in May 2024.
How we help
Scoping and the CUI boundary
Decide exactly which systems, people and facilities are in scope.
The size of your assessment depends on where CUI flows. We map that flow, help you decide whether an enclave makes sense and categorize assets the way the CMMC scoping guidance requires.
- CUI data flow mapping
- Asset inventory and categorization
- Enclave design options
- Review of external service providers and cloud services, including FedRAMP Moderate equivalency
Gap assessment
Measure where you stand against all 110 requirements.
- Assessment against NIST SP 800-171 Rev. 2 and the 320 assessment objectives in SP 800-171A
- SPRS score calculation
- System Security Plan (SSP) review
- Plan of Action and Milestones (POA&M) review
- Prioritized remediation roadmap
Remediation
Close the gaps with practical fixes that fit your budget.
- Policy and procedure development
- Technical control implementation
- Microsoft 365 GCC High and enclave planning
- Multi-factor authentication, logging and encryption
- Incident response and DFARS 252.204-7012 reporting procedures
Mock assessment and readiness
Rehearse the real assessment before it counts.
- Mock assessment following the CMMC assessment process
- Evidence organized by assessment objective
- Interview preparation for staff
- Support during the C3PAO assessment
- POA&M closeout within the 180-day window
Who certifies you
Level 2 certification assessments are performed by C3PAOs authorized by the Cyber AB, and conflict-of-interest rules keep the firm that prepares you from also certifying you. We focus on readiness and work alongside the C3PAO you choose.
The path
A typical CMMC 2.0 engagement
- 01
Scope
Map CUI and define the assessment boundary.
- 02
Assess
Score every requirement and update the SSP and POA&M.
- 03
Remediate
Close gaps in priority order and collect evidence as you go.
- 04
Rehearse
Run a mock assessment and prepare staff for interviews.
- 05
Certify
Complete the self-assessment or C3PAO assessment and the annual affirmation.
Services that support this work
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
- Cloud, Application & Infrastructure SecuritySecure architecture and hands-on engineering for cloud platforms, applications, networks and endpoints.
- Identity & Data SecurityProtect identities, privileged access and the sensitive data they can reach.
- Penetration Testing & Offensive SecurityPenetration testing, red teaming and adversary simulation that show what an attacker could actually reach.
FAQ
Frequently asked questions
Which CMMC level do we need?
It depends on the information you handle. If you only handle Federal Contract Information, Level 1 usually applies. If you handle Controlled Unclassified Information, expect Level 2. Level 3 is reserved for a smaller set of higher-risk programs. Your contract and the DFARS clauses in it have the final word, and we can help you read them.
Can we use a POA&M for open items?
In limited cases. At Level 2 you can receive conditional status with some requirements on a Plan of Action and Milestones if you score at least 88 of 110 points, but certain high-value requirements cannot be deferred, and every open item has to be closed within 180 days.
Does Revision 3 of NIST SP 800-171 apply to CMMC?
Not yet. DoD has continued to assess CMMC Level 2 against Revision 2. Revision 3 is still worth reading, because it shows where the requirements are heading.
Find out where you stand on CMMC 2.0.
A readiness review shows what an assessor would find today and what it will take to close the gaps.