Question 1

What is CMMC and why is it required for defense contractors?

Accepted Answer

CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense's program for verifying that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The protections themselves are already contract requirements: FAR 52.204-21 for FCI, and DFARS 252.204-7012, which requires NIST SP 800-171, for CUI. CMMC adds an assessment of them. Since DoD paused Phase 2 on July 13, 2026, contracts can only require a Level 1 or Level 2 self-assessment while the program is under review.

Question 2

How long does CMMC Level 2 take?

Accepted Answer

It depends on how many of the 110 NIST SP 800-171 requirements you already meet. A gap analysis answers that first: it scores you against all 110 the way DoD's assessment method does and turns each gap into a task with an owner and a date. Technical controls such as multi-factor authentication, logging and separating CUI from the rest of your network set the timeline.

Question 3

How much does CMMC cost?

Accepted Answer

DoD's own estimates in the CMMC rule, for a small business, are about $6,000 a year for a Level 1 self-assessment, and about $37,000 for a Level 2 self-assessment or $105,000 for a Level 2 C3PAO assessment, each over a three-year cycle. Those figures cover the assessment only. Putting the 110 NIST SP 800-171 requirements in place is a separate cost, and it depends on what you already have.

Question 4

What's the difference between CMMC Level 1, 2, and 3?

Accepted Answer

Level 1 covers the 15 basic safeguards in FAR 52.204-21 for Federal Contract Information and is a yearly self-assessment. Level 2 covers the 110 requirements of NIST SP 800-171 for Controlled Unclassified Information and is assessed every three years, either by self-assessment or, where a contract requires it, by a C3PAO. Level 3 adds 24 requirements from NIST SP 800-172 and is assessed by DoD. Since July 13, 2026, while DoD reviews the program, contracts can only require Level 1 or Level 2 self-assessments.

Question 5

Will CMMC replace DFARS 252.204-7012 compliance?

Accepted Answer

No. DFARS 252.204-7012 still applies in full, including NIST SP 800-171 and reporting cyber incidents to DoD within 72 hours. CMMC sits on top of it as a way to check compliance: a self-assessment, or a C3PAO assessment where a contract requires one. While DoD reviews the program, contracts can only require self-assessments.

Question 6

What is a C3PAO and how does the assessment work?

Accepted Answer

A C3PAO (Certified Third-Party Assessor Organization) is an organization authorized to conduct CMMC Level 2 assessments. Its assessors review your documentation, interview your staff and test your controls against the 110 NIST SP 800-171 requirements. Since DoD paused Phase 2 on July 13, 2026, contracts cannot require a C3PAO assessment while the program is under review. We prepare you through gap analysis, remediation and mock assessments, so the same evidence works for a self-assessment now and a C3PAO later.

Question 7

Do subcontractors and suppliers need CMMC?

Accepted Answer

Yes, if they handle FCI or CUI. Prime contractors must flow the CMMC requirement down to subcontractors at the level the information requires, and DFARS 252.204-7012 flows down with it. While DoD reviews the program, that requirement can only be a Level 1 or Level 2 self-assessment.

Question 8

What is NIST SP 800-171 and how does it relate to CMMC?

Accepted Answer

NIST SP 800-171 is the federal standard for protecting Controlled Unclassified Information in nonfederal systems: 110 security requirements across 14 families. DFARS 252.204-7012 requires it for any contract that handles CUI, and CMMC Level 2 assesses it. Your score under DoD's assessment method goes into SPRS, the system contracting officers check. We help you implement the technical and administrative controls and keep the evidence behind each one.

Question 9

Can we use cloud services and still meet CMMC requirements?

Accepted Answer

Yes. A cloud service that stores or processes CUI must be FedRAMP Moderate authorized, or meet the FedRAMP Moderate equivalent standard that DFARS 252.204-7012 requires. AWS GovCloud, Azure Government and Google Cloud have FedRAMP authorizations. You still own the controls the provider does not cover, and we help you map which ones those are.

Question 10

How long is a CMMC assessment valid and what's required to maintain it?

Accepted Answer

A Level 2 assessment, self or C3PAO, is valid for three years, and a senior official must affirm compliance in SPRS every year. Level 1 is a self-assessment and affirmation every year. In between, you keep the controls running, report cyber incidents to DoD within 72 hours under DFARS 252.204-7012, and update your System Security Plan when your systems change. We support the annual affirmation and keep your evidence current.

CMMC Level 2
Readiness for DoD Contractors

The deadline moved. The requirement didn't.

What is CMMC Certification?

Why CMMC still matters during the pause:

Core Benefits

DoD Contract Eligibility & Business Continuity

CUI & Information Protection

Cybersecurity & Risk Management

Regulatory & Legal Compliance

Technology & Infrastructure Benefits

Operational & Organizational Benefits

Industries We Serve

Manufacturing

Healthcare

Technology

Construction

Aerospace

Automotive

Energy

Food & Beverage

Services

Readiness Process

Free Consultation

Gap Analysis

Implementation

Internal Audit

Self-Assessment

Frequently Asked Questions

Testimonials

Contact

CMMC Level 2 Readiness for DoD Contractors