CMMC isn't a checkbox. It's contract eligibility.
- Contract eligibility. No qualifying CMMC assessment on record means no DoD award, and no keeping the contracts you already hold.
- Mandatory, not optional. 32 CFR Part 170 makes CMMC a condition of doing business across the defense industrial base.
- The affirmation carries liability. A senior official signs annually, and a false affirmation is False Claims Act exposure that reaches the signer.
- The level sets the lift. Level 1 is 17 FCI safeguards; Level 2 is all 110 NIST SP 800-171 controls, assessed by a C3PAO.
- Your score is visible. The SPRS score is posted where the DoD and your primes can see it before they award.
Context
CMMC is not a certificate you frame on the wall. It is the gate that decides whether you can win or keep a DoD contract. No qualifying assessment on record, no award. For Level 2, that means a C3PAO assessment against all 110 NIST SP 800-171 controls, a score posted to SPRS, and an annual affirmation a senior official signs personally. That signature is the real exposure. Under the False Claims Act, an affirmation the program cannot actually back is a liability that reaches the person who signed and the company that bid. The work is not passing once. It is being able to prove, every year, that the program is real.
CMMC is eligibility,
not paperwork
One assessed program.
Every safeguard defensible.
- Level 1: FCI
- Level 2: CUI
- Level 3: enhanced
- System Security Plan
- C3PAO assessment
- Annual affirmation
- SPRS score
- FCA exposure
CMMC holds when the program is assessed and defensible, not assembled the quarter before a bid.
Controlled unclassified information, defended.
What CMMC actually is, in plain English.
A verification regime that proves you actually run the safeguards you've claimed since 2017 — self-assessed, C3PAO-assessed, or DoD-assessed, then posted to SPRS with a senior-official affirmation.
The three levels, in detail
CMMC is the DoD's program for verifying that defense-industrial-base contractors have actually implemented the safeguards they have, on paper, claimed to implement since the 2017 DFARS clause. The 2024 final rule (32 CFR Part 170) put a verification regime behind the requirement: depending on the type of information you handle and the contract you're bidding, you will either self-assess, get assessed by an authorized third-party (C3PAO), or be assessed by DoD's own DIBCAC. The result posts to the Supplier Performance Risk System as a numerical score and a senior-official affirmation.
The model has three levels. Level 1 covers Federal Contract Information (FCI) and maps to 17 basic safeguards from FAR 52.204-21: annual self-assessment, annual affirmation. Level 2 covers Controlled Unclassified Information (CUI) and maps to all NIST SP 800-171 r2 110 controls, with a triennial third-party assessment for most CUI contracts, with annual affirmation between assessments. Level 3 adds a subset of NIST SP 800-172 enhanced controls and is assessed by DoD directly. Phased contractual enforcement began with rule effectiveness on December 16, 2024 and ramps through 2028.
You want DoD work.
The opportunity is real, but access is gated. Interest alone does not make you eligible to win or keep the contract.
Which level applies to you?
Two information categories drive almost everything. Most contractors over-scope CUI on first read; under-scope FCI on second.
CMMC level scoping check
The three CMMC maturity levels.
CMMC 2.0 collapsed the original five-level model to three. The middle level, Level 2, is where the bulk of the DIB sits and where the actual third-party assessment regime lives.
Level 1 · Annual selfFoundational: FCI safeguards
Level 1 is the floor for any DoD contractor handling FCI. Annual self-assessment against the 17 safeguards in FAR 52.204-21. No third-party required. Senior official affirmation in SPRS. The lift is real but bounded. Most well-run small businesses are 70%+ there already.
View the 6 control families
Level 2 · Triennial C3PAOAdvanced: 110 NIST 800-171 controls
Level 2 is the meaningful one. Most DoD contracts with CUI flow-down land here. Triennial assessment by an authorized C3PAO; annual affirmation in years 2 and 3. The 110 controls span 14 families covering access, audit, awareness, configuration, identification, incident response, maintenance, media, personnel, physical, risk, security assessment, system & comms, system & integrity.
View the 6 control families
Level 3Expert: NIST 800-172 enhancements
Level 3 is rare. Required for programs with CUI critical to national security and APT-grade threat models. Adds a subset of NIST SP 800-172's enhanced security requirements on top of all 110 800-171 controls. Assessed by DoD DIBCAC, not a C3PAO.
View the 4 control families
RequiredSystem Security Plan: the assessor's map
The SSP is the single document the C3PAO reads first. Per-control implementation statement; per-control evidence reference; system boundary; data flows; CUI inventory. A weak SSP guarantees a long assessment. We write SSPs surgically, not exhaustively, and treat them as living documents.
View the 3 control families
180-day close-outPOA&M: limited not-yet-implemented
CMMC permits a Plan of Action & Milestones for a limited subset of controls, none worth more than 1 point in the SPRS scoring, none on the “not POA&M-able” list, and a minimum SPRS score of 88 to qualify. All POA&M items must close within 180 days of conditional certification. Items that don't close convert to denial.
View the 3 control families
Self vs C3PAO: which applies?
The contracting officer specifies the level required by the contract. For most CUI work, Level 2 with C3PAO assessment is the path. A small subset of L2 work permits self-assessment when the CUI is non-critical and DoD has opted in.
L2 Self-Assessment
Permitted only on contracts the DoD has specifically designated as eligible. Annual self-assessment against all 110 controls. Senior official affirmation. Same SSP, same evidence quality bar: same FCA exposure on the affirmation. Cheaper at sticker price; identical liability if you get it wrong.
View the 7 attributes
- CycleAnnual self-assessment
- FormatInternal · senior-official signed
- Posted toSPRS · numerical score
- FCA exposureFull · false affirmation = treble
- CostInternal labor + readiness fees
- EligibilityContract-specific · DoD-designated only
- Recommended forNon-critical CUI · small surface
L2 C3PAO Assessment
A Cyber AB-authorized C3PAO conducts a triennial assessment with one or more Certified CMMC Assessors (CCAs). On-site / hybrid · sampling · interviews · evidence review · remediation window. Result is a final assessment, scoring, and certificate at L2.
View the 7 attributes
- CycleTriennial · annual affirmation between
- FormatOn-site / hybrid · CCA-led
- ResultFinal, conditional, or not-met
- Cost$45 – 200k+ depending on scope
- AuthorityCyber AB authorizes C3PAOs & CCAs
- POA&MPermitted for limited controls · 180 days
- Recommended forAll CUI contracts unless self is permitted
A control is implemented.
The control operates in the environment. On its own, it is a fact no one outside the team can yet stand behind.
A first-time Level 2, realistically: 9 to 15 months.
Most contractors underestimate scoping and CUI inventory; both are the gate to everything downstream. The C3PAO doesn’t cause the delay. Your data flows do.
A Certified CMMC Professional on every engagement.
A Cyber AB Certified CMMC Professional reads every engagement we lead, signs off on the SSP and affirmation packet before either reaches your senior official. Not a junior consultant, not a SaaS portal.
Methodology detail
Our founder is a Cyber AB Certified CMMC Professional with prior service as a USAF nuclear-security engineer and DoD-cleared roles at Raytheon Technologies. Every CMMC engagement we lead is read by a CCP, who signs off on the SSP and the affirmation packet before either reaches your senior official. Read our methodology.
We build for the affirmation, not just the assessment. Annual senior-official affirmations are the FCA exposure surface. We instrument continuous monitoring against all 110 controls, document the SSP as a living artifact, and pre-stage the affirmation packet so the senior official is signing on evidence, not on hope. More on ConMon »
For multi-cloud or hybrid environments, we’ll architect a CUI enclave (typically Microsoft 365 GCC High or AWS GovCloud) and write the shared-responsibility section of the SSP, the place most C3PAO findings cluster. We do not resell licenses; we have no kickback from any CSP. See engagement outcomes.
Independent of the C3PAO: by design.
The Cyber AB ecosystem distinguishes RPOs (readiness) from C3PAOs (assessment); the same firm cannot do both on the same engagement. We are aligned with the RPO model and will not assess clients we readied. We’ll introduce you to three C3PAOs with active assessor relationships, calibrated to your sector and timeline. C3PAO relationships »
Six places a CMMC goes sideways.
The pattern repeats. Almost every failed CMMC engagement we see was killed by scoping or affirmation hygiene, not by the controls themselves.
"Everything handles CUI."
"It’s only on that one share."
M365 commercial for CUI workloads.
Senior official signs without reading.
Subs not at your level.
SSP written once, never updated.
C3PAOs we’ve walked clean assessments with.
Cyber AB authorizes C3PAOs and the assessors (CCAs / CCPs) who work for them. The pool is small, a few dozen authorized firms in 2026 and growing, and bandwidth is constrained. Booking an assessor for a Q3 / Q4 contract deadline can require six months of lead time. We’ll introduce you to three C3PAOs with active relationships, calibrated to sector and turnaround.
If you already have a C3PAO
If you already have a C3PAO: we sit a pre-assessment alignment call with their lead CCA on scope, the SSP, and evidence format. We do not accept referral fees from any C3PAO, by policy. The Cyber AB code-of-conduct prohibits readiness firms from cross-referencing assessment work; we honor that absolutely.
CMMC against the rest of the stack.
CMMC L2 is built on NIST 800-171 r2, that’s the most direct overlap. Most other federal frameworks share substantial control DNA but require their own packaging.
CMMC against the rest of the stack.
CMMC L2 is the eligibility gate.
| Framework | Overlap with CMMC L2 | What you still need to do |
|---|---|---|
| NIST 800-171 r2 | ~100%: L2 IS 800-171 with C3PAO assessment. | The CMMC packaging: SSP rigor, affirmation, SPRS posting. |
| NIST 800-172 | ~30%: enhanced controls layered above 800-171. | L3 enhanced practices, threat hunting, dual auth, advanced detection. |
| FedRAMP Mod / High | ~70%: NIST 800-53 superset of 800-171. | 3PAO authorization, agency ATO, continuous monitoring per FedRAMP cadence. |
| SOC 2 Type 2 | ~60%: access, change, monitoring overlap. | AICPA system description, complementary user-entity controls, CPA firm engagement. |
| ISO 27001 | ~75%: most Annex A controls have CMMC equivalents. | ISMS scope, SoA, three-year cert cycle, internal audit program. |
| ITAR / EAR | Orthogonal: export controls, not security. | EAR/ITAR registration, export licenses, US-persons-only access, a separate regime. |
What the final rule changed.
The 2024 final rule (32 CFR Part 170, effective December 16, 2024) finalized the program after years of proposed-rule iteration. Key shifts:
- Five levels collapsed to three. CMMC 2.0 retired the original L2/L4 maturity-process tiers in favor of L1 (FCI), L2 (CUI), L3 (critical CUI).
- Conditional certification with POA&M. Limited POA&Ms are now permitted at L2 for 1-point controls, requiring SPRS ≥ 88 and a 180-day close-out.
- Affirmation regime. Senior-official affirmations are now codified between assessment cycles, and posted to SPRS.
- Phased contractual rollout. Phase 1 (post-rule) covers L1 / L2 self-assessment. Phase 2 (mid-2025) introduces L2 C3PAO. Full rollout by 2028.
- External Service Provider (ESP) clarity. MSPs / MSSPs handling CUI must themselves be at the contractor’s level, a major shift for managed-services arrangements.
Read our deeper take in Field Notes Vol. II: "The senior-official affirmation: where most CMMC FCA exposure is born."
CMMC is rarely the only ask.
Federal contractors usually carry two or three frameworks at once. We sequence them so the work compounds rather than duplicates.
Frequently asked.
When does CMMC actually start appearing in solicitations? +
How long does the first Level 2 take? +
What does it cost? +
Can we self-attest Level 2? +
Do our cloud providers need to be CMMC-certified too? +
What happens if a control fails at assessment? +
Does CMMC replace DFARS 7012? +
Field notes on CMMC.
Pieces from Nexurion Field Notes directly relevant to CMMC and the DIB.