CMMC 2.0 is the Department of Defense's tiered cybersecurity verification program that maps three compliance levels to specific federal requirement sets — FAR 52.204-21, NIST SP 800-171 Rev 2, and selected NIST SP 800-172 requirements — and makes achieving a required CMMC Status a condition of contract award once implemented. Your immediate next step: check the solicitation for the required CMMC Status, confirm your organization's SPRS entry reflects the correct self-assessment score or certification, and start a gap assessment if you have not already.
Fastest triage actions right now:
- Check the solicitation for the specific CMMC Status required (Level 1, 2, or 3)
- Log into the Supplier Performance Risk System (SPRS) and confirm your current score and assessment date are accurate
- Commission or run a gap assessment against the applicable control set before you bid
Key Takeaways
CMMC 2.0 maps three compliance levels to specific federal requirement sets, and your SPRS entry is the mechanism contracting officers use to verify your status before award.
| Point | Details |
|---|---|
| Level-to-standard mapping | Level 1 = 15 FAR 52.204-21 requirements; Level 2 = 110 NIST SP 800-171 Rev 2 controls; Level 3 adds selected NIST SP 800-172 items. |
| SPRS is a procurement gate | Contracting officers check SPRS before award; an outdated or missing score can disqualify you regardless of actual compliance. |
| Assessment type determines rigor | Level 1 uses annual self-assessment; Level 2 allows self or C3PAO (three-year validity); Level 3 requires DIBCAC government assessment. |
| SSP and POA&M are non-negotiable | Every contractor needs a current System Security Plan; open POA&M items must be actively managed and closed within DoD-set limits. |
| Ventis Consulting Group | Provides gap assessments, SSP/POA&M support, remediation planning, and managed security for SMB contractors pursuing CMMC Status. |
Table of Contents
- What is CMMC security and why did DoD create it?
- What information triggers CMMC requirements?
- How do the three CMMC levels map to federal requirements?
- How do CMMC assessments and SPRS verification work?
- Step-by-step: how to get your organization CMMC-ready
- What drives CMMC compliance costs and timelines?
- How CMMC requirements flow down to subcontractors
- Maintaining your CMMC status after assessment
- Pre-bid readiness checklist for solicitations with CMMC requirements
- What Ventis Consulting Group recommends for SMB contractors
- Ventis Consulting Group helps contractors get CMMC-ready
- Sources
What is CMMC security and why did DoD create it?
The Cybersecurity Maturity Model Certification program, commonly called CMMC, exists because the Defense Industrial Base has been a persistent target for adversaries seeking Federal Contract Information and Controlled Unclassified Information. DoD created CMMC to move beyond self-reported compliance and add independent verification to the mix.
CMMC 2.0 has three defining features: a tiered model that scales requirements to the sensitivity of the information handled, a verification requirement that ranges from annual self-assessments to government-led audits, and a phased implementation plan that rolls CMMC into solicitations over time. The DoD final rule published in the Federal Register on October 15, 2024 formally established the CMMC Program under 32 CFR Part 170 and tied it to the acquisition system through companion DFARS rules, making CMMC Status a potential condition of contract award.
Phase I is active: contractors handling CUI must submit NIST SP 800-171 Rev 2 self-assessments and upload scores to SPRS. As of July 13, 2026, DoD paused Phase II while a reform review is underway, but Phase I self-assessment requirements remain in force. If you are responding to solicitations today, Phase I obligations apply to you now.
CISA also recognizes CMMC 2.0 as a program aligned to NIST cybersecurity standards and offers supplemental resources for supply-chain security context.
What information triggers CMMC requirements?
Understanding what type of information you handle is the fastest way to determine which CMMC level applies to your contract.
Federal Contract Information (FCI) is information provided by or generated for the government under a contract to develop or deliver a product or service. Think purchase order data, contract performance reports, or transactional correspondence with a contracting officer. FCI is the lower-sensitivity category.
Controlled Unclassified Information (CUI) is a broader and more sensitive category. It includes technical data, engineering drawings, export-controlled research, personally identifiable information tied to defense programs, and dozens of other categories defined by the DoD CUI Registry. If your work touches program-specific technical specifications, test data, or acquisition-sensitive information, you are almost certainly handling CUI.
The practical rule: FCI alone typically triggers Level 1; CUI triggers Level 2 or higher. Always read the solicitation carefully because the contracting officer specifies the required level. The National Archives CUI Registry is the authoritative source for category definitions.
Quick classification scan:
- Receiving contract performance data with no technical specifications? Likely FCI only, Level 1.
- Receiving engineering drawings, test reports, or program-specific technical data? Almost certainly CUI, Level 2 minimum.
- Working on advanced research or high-value defense programs? Evaluate for Level 3.
- Unsure? Ask the contracting officer before you bid.
How do the three CMMC levels map to federal requirements?
32 CFR § 170.14 defines the exact mapping. Each level builds on the one below it.
| Level | Requirement Count | Primary Standard | Typical Use Case | Assessment Options |
|---|---|---|---|---|
| Level 1 | 15 requirements | FAR 52.204-21 | FCI only, basic federal contracts | Annual self-assessment |
| Level 2 | 110 requirements | NIST SP 800-171 Rev 2 | CUI on most DoD programs | Self-assessment (Self) or C3PAO third-party |
| Level 3 | 110 + selected SP 800-172 items | NIST SP 800-172 (with DoD parameters) | High-value CUI, critical programs | DIBCAC government assessment |
Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21. These are foundational controls: limit information system access, sanitize media, protect physical systems. Most small contractors handling only FCI land here.
Level 2 is where most of the Defense Industrial Base sits. The 110 security requirements in NIST SP 800-171 Rev 2 span 14 control families including access control, audit and accountability, configuration management, incident response, and system and communications protection. DFARS 252.204-7012 already requires these controls for CUI, so if your organization has been complying with DFARS, you have a head start.
Level 3 adds selected requirements from NIST SP 800-172 on top of the full 110-control Level 2 set. DoD applies organization-defined parameters to those SP 800-172 items. This level targets contractors on high-value or critical programs where adversary interest is highest.
For small contractors, Level 2 is the most common target. Scoping matters here: the CMMC Model Overview v2.13 explicitly supports enclave-based scoping, meaning you can limit CMMC scope to the specific systems and networks where CUI is processed and stored rather than applying controls enterprise-wide. That distinction can cut your remediation cost and timeline significantly.
How do CMMC assessments and SPRS verification work?
Assessment type depends on your required level. Here is how each works in practice.
Level 1 (Self): You conduct an annual self-assessment against the 15 FAR 52.204-21 requirements, affirm the results, and enter your score in SPRS. No third party is involved, but the affirmation carries legal weight.
Level 2 (Self): Available for a subset of Level 2 programs where DoD determines third-party assessment is not required. You assess against all 110 NIST SP 800-171 Rev 2 controls, score yourself using the DoD assessment methodology, and upload to SPRS. Valid for three years with annual affirmation.
Level 2 (C3PAO): A CMMC Third-Party Assessment Organization certified by the CMMC Accreditation Body conducts the assessment. The C3PAO reviews your evidence, interviews personnel, and tests controls. Results are submitted to SPRS. Valid for three years.
Level 3 (DIBCAC): The Defense Industrial Base Cybersecurity Assessment Center, part of DCSA, conducts a government-led assessment. This is the most rigorous option and is reserved for contractors on critical programs.
Contracting officers check SPRS before award. Your SPRS entry is not a formality — it functions as a condition-of-eligibility signal. A missing or outdated score can disqualify you from award even if your systems are technically compliant.
Required artifacts and evidence for assessments:
- System Security Plan (SSP): Documents your system boundary, hardware/software inventory, and how each control is implemented. Required at every level.
- Plan of Action and Milestones (POA&M): Documents controls not yet fully implemented and your remediation timeline. Permitted under certain conditions at Level 2; not a permanent workaround.
- Implementation evidence: Configuration screenshots, access control logs, MFA enrollment records, patch management reports, audit logs.
- Assessment artifacts: Network diagrams, data flow diagrams, policy documents, and procedure records that map to specific NIST requirement IDs.
Pro Tip: Before a C3PAO visit, organize your evidence into a read-only repository with one folder per NIST control family. Include a short narrative for each artifact explaining what it proves and which requirement ID it satisfies. Pre-hash the files so the assessor can verify integrity. This single step reduces assessment time and signals organizational maturity.
Step-by-step: how to get your organization CMMC-ready
This sequence works for most small and mid-sized contractors. Some steps can run in parallel once you have your scope defined.
- Run a gap assessment. Measure your current controls against the applicable requirement set (15, 110, or 110 + SP 800-172 items). Use the DoD assessment methodology scoring guide for Level 2. A cybersecurity assessment checklist built for SMBs can accelerate this step.
- Define your scope. Map where FCI and CUI flow, are processed, and are stored. Draw an information flow diagram. Then define the minimal enclave that touches that data. Smaller scope means fewer controls to implement and lower assessment fees.
- Author your SSP. Document the system boundary, asset inventory, and control implementation status for every requirement. The SSP is the foundation of your assessment package.
- Create your POA&M. List every gap from step 1, assign an owner, set a remediation date, and prioritize by risk. High-severity gaps (missing MFA, no audit logging, unpatched systems) go first.
- Execute remediation sprints. Work through the POA&M in priority order. For SMBs, focus first on access control (AC), identification and authentication (IA), audit and accountability (AU), and configuration management (CM) — these four families cover the controls most frequently cited in assessments.
- Collect and organize evidence. As each control is implemented, capture the evidence immediately. Do not wait until the week before assessment.
- Conduct an internal pre-assessment review. Walk through your SSP and evidence package as if you were the assessor. Identify gaps in documentation before the C3PAO does.
- Submit your SPRS score. For self-assessments, calculate your score using the DoD methodology and upload it with your affirmation before the solicitation deadline.
- Schedule your formal assessment. For Level 2 (C3PAO) or Level 3 (DIBCAC), engage the assessor early. C3PAO schedules fill up, and lead times can run several months.
Timeline estimates by organization type:
- Small contractor with limited CUI and few gaps typically take several months
- SMB with moderate gaps and no prior NIST 800-171 work may require a longer timeline
- Complex programs or Level 3 requirements generally take the longest to prepare
Steps 2 and 3 (scoping and SSP authoring) can run in parallel with early remediation on obvious gaps. Organizations that already have solid cybersecurity compliance practices in place will move through this faster.
Pro Tip: For small businesses, define your CUI enclave before touching a single control. A tightly scoped enclave with 20 assets is far easier to certify than an enterprise environment with 200. The DoD explicitly supports this approach in the CMMC scoping guidance.
What drives CMMC compliance costs and timelines?
Cost varies widely, and anyone quoting you a flat number without seeing your environment is guessing. Here are the primary drivers.
Primary cost factors:
- Remediation labor: The largest variable. Closing gaps in access control, logging, and endpoint configuration takes engineering time, and the hours depend entirely on your starting point.
- C3PAO or DIBCAC assessment fees: Third-party assessment fees depend on scope size, assessor, and complexity. Larger environments with more assets cost more to assess.
- MSP or consultant support: If you lack internal IT staff with NIST 800-171 experience, you will need outside help for gap assessment, SSP authoring, and remediation planning.
- Cloud service provider changes: If your CUI lives in a cloud environment that does not meet FedRAMP Moderate or equivalent, migrating or reconfiguring that environment adds cost. DFARS 252.204-7012 is explicit on this requirement.
- Evidence preparation: Organizing artifacts, writing narratives, and maintaining the evidence repository takes time that is easy to underestimate.
Scenario-based timeline ranges:
- Small contractors handling FCI only at Level 1 typically require a few weeks with focused effort
- SMBs handling CUI at Level 2 Self with moderate gaps may need several months
- SMBs handling CUI at Level 2 with C3PAO assessments and significant gaps generally need more months for preparation
- Large or complex programs at Level 3 are expected to require the longest preparation times
Existing NIST SP 800-171 maturity is the single biggest schedule accelerator. Contractors who have been complying with DFARS 252.204-7012 in good faith, maintaining an SSP, and scoring themselves in SPRS will face a much shorter path than those starting from zero.
How CMMC requirements flow down to subcontractors
If you are a prime contractor, CMMC does not stop at your door. The flow-down obligation means you must ensure that any subcontractor processing FCI or CUI meets the applicable CMMC level or is appropriately isolated from that information.
The practical implication: if your sub touches CUI, they need the same CMMC Status you do for that work. If you can isolate them from CUI entirely, they may only need Level 1. The DFARS 252.204-7012 clause already requires flow-down of NIST SP 800-171 requirements to subcontractors handling covered defense information.
What primes should do:
- Review solicitation language for CMMC flow-down clauses (look for DFARS 252.204-7019 and 252.204-7020 references alongside 252.204-7012)
- Require subcontractors to provide their SPRS score and assessment date before award
- Include CMMC Status requirements in subcontract agreements
- Request a copy of the sub's SSP summary or a self-assessment affirmation letter
What subcontractors should prepare:
- A current SPRS entry with an accurate self-assessment score
- An SSP covering the systems that process or store FCI/CUI
- Documentation showing which controls are implemented and which have open POA&M items
- Readiness to provide evidence if the prime or a contracting officer requests it
Solicitation language you are likely to see includes references to DFARS 252.204-7012 (CUI safeguarding), 252.204-7019 (NIST SP 800-171 assessment requirements), and 252.204-7020 (NIST SP 800-171 DoD assessment requirements). When all three appear together, CMMC Status is almost certainly a condition of award.
Maintaining your CMMC status after assessment
Getting assessed is the milestone. Staying assessed is the ongoing job.
Ongoing obligations after gaining CMMC Status:
- Annual affirmation: Contractors must annually affirm that their CMMC Status remains accurate. Missing an affirmation can lapse your status.
- POA&M closeout: Open POA&M items are not permanent. DoD sets limits on how long items can remain open, and assessors check POA&M progress during re-assessments.
- Continuous monitoring: Maintain audit logs, review access controls, patch systems on schedule, and document changes to the environment that affect your SSP.
- SSP updates: Any significant change to your system boundary, asset inventory, or control implementation requires an SSP update. Treat the SSP as a living document.
- Re-assessment cadence: Level 2 C3PAO and Level 3 DIBCAC assessments are valid for three years. Level 1 self-assessments are annual. Interim events (significant breaches, major system changes) can trigger earlier re-assessment.
What triggers interim assessments or rework? A reportable cyber incident under DFARS 252.204-7012, a material change to your system boundary, or a contracting officer's request based on SPRS anomalies. Build incident response procedures into your continuous monitoring plan so you are not scrambling when something happens.
Pro Tip: Keep assessment artifacts in a read-only archive for at least three years after the assessment date, matching the validity period of your certification. Pre-hash every file at the time of assessment and store the hash log separately. If your status is ever questioned, you can prove the artifacts have not been altered.
Pre-bid readiness checklist for solicitations with CMMC requirements
When a solicitation lands with CMMC language, you have a short window to determine whether you can bid compliantly. Work through this before you commit.
Pre-bid checklist:
- Confirm the specific CMMC Status required (Level 1 Self, Level 2 Self, Level 2 C3PAO, or Level 3 DIBCAC)
- Check your current SPRS score and confirm it meets or exceeds the required assessment score
- Determine whether the solicitation permits POA&Ms for Level 2 Self or requires full implementation
- Pull your current SSP and verify it covers the system boundary relevant to this contract
- Evaluate whether a scoped enclave approach reduces your compliance burden for this specific award
- Confirm your cloud service providers meet FedRAMP Moderate or equivalent if CUI will be hosted there
- Identify any subcontractors who will touch FCI or CUI and verify their SPRS status
Questions to ask potential assessors or MSPs:
- How many CMMC assessments have you completed or supported at this level?
- How do you define and document scope, and what is your process for enclave-based assessments?
- What does your evidence package look like, and can you share a sample deliverable?
- How do you handle SPRS entry and affirmation support?
- What is your typical timeline from kickoff to assessment-ready?
Bid response timeline (if awarded): Include a milestone schedule showing gap assessment completion (weeks 1–4), SSP authoring (weeks 3–6), remediation (weeks 4–20 depending on gaps), pre-assessment review (week 18–22), and formal assessment scheduling. Contracting officers want to see that you have a credible plan, not just a promise.
What Ventis Consulting Group recommends for SMB contractors
Working with small and mid-sized businesses on compliance and IT security, the pattern we see most often is this: contractors underestimate how much documentation work CMMC requires and overestimate how long remediation takes once scope is properly defined.
The fastest path to readiness for most SMBs is not to fix everything at once. Scope tightly first. Define the minimal enclave where CUI lives, document it in your SSP, and then harden the controls within that boundary. Start with the fundamentals: multi-factor authentication, audit logging, access control reviews, and patch management. These four areas cover the most common gaps and the controls assessors scrutinize most closely.
A few priorities Ventis Consulting Group recommends for SMBs:
- Scope before you spend. An information flow diagram drawn in week one can save months of remediation work on systems that never needed to be in scope.
- Document as you go. Evidence collected at implementation time is far stronger than evidence reconstructed before an assessment.
- Fix MFA and logging first. These two control areas appear across multiple NIST 800-171 families and are consistently cited in assessments. Getting them right early builds momentum.
- Treat SPRS as a live risk indicator. Your score is visible to contracting officers. An inaccurate or outdated entry is a procurement liability, not just a compliance gap.
For a deeper look at how security controls layer together for SMBs, the layers of a business security strategy resource walks through prioritization in plain terms.
Ventis Consulting Group helps contractors get CMMC-ready
Achieving CMMC Status requires gap assessments, SSP authoring, remediation planning, and ongoing managed security — and most small contractors do not have all of that in-house. Ventis Consulting Group delivers exactly those services for SMBs in Pittsburgh and surrounding areas, with a consultative approach that starts with your specific contract requirements, not a generic checklist.
Services that map directly to your CMMC readiness needs include gap assessments against FAR 52.204-21 or NIST SP 800-171 Rev 2, SSP and POA&M development, remediation project support, managed detection and response, and third-party assessment preparation. The goal is to get you to a defensible SPRS entry and a clean assessment package without overbuilding your environment.
Schedule a readiness consultation with Ventis Consulting Group through our managed IT and security services page and get a clear picture of where you stand before the next solicitation lands.
Sources
- Federal Register, Volume 89 Issue 199 (Tuesday, October 15, 2024)
- 32 CFR § 170.14 - CMMC Model. | LII / Legal Information Institute
- About CMMC - DoD CIO
- Cybersecurity Maturity Model Certification 2.0 Program | CISA
Read the solicitation first. The contracting officer's CMMC requirement is the binding document. Use the sources above to understand the underlying standards, then engage a qualified assessor or MSP to map your environment to the specific controls required.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.