CMMC compliance for the U.S. defense contractors who can’t afford to lose the contract.

FAQ

Frequently asked

Don't see your question? Talk to a real person — we're 833-92-CYBER.

• When does CMMC 2.0 actually start affecting my contracts?

  The CMMC final rule was published December 16, 2024. Phase 1 enforcement began November 10, 2025, with self-assessment requirements appearing in new DoW solicitations. Full compliance — including Level 2 third-party assessment requirements — phases in through November 10, 2026. If you bid on DoW work touching CUI, the runway is shorter than most prime contractors realize.

• What level do I need?

  If you handle Federal Contract Information (FCI) only — Level 1 (17 controls, annual self-assessment). If you handle Controlled Unclassified Information (CUI) — Level 2 (110 controls from NIST 800-171, third-party C3PAO assessment for most). Level 3 is for the highest-priority programs and is rare for subcontractors. We do a 1-hour scoping call to confirm.

• What does a CMMC engagement actually look like?

  Four phases: (1) Scoping — define the CUI boundary, identify in-scope assets, classify data flows. (2) Gap assessment — current-state against all 110 controls, scored. (3) Remediation — close gaps, deploy GCC High where required, harden M365, build SOC + VM + IR programs. (4) Documentation & assessment prep — SSP, POA&M, evidence library, mock assessment. Typical duration: 6–12 months depending on starting maturity.

• What does a CMMC readiness partner actually do?

  A CMMC readiness partner does the work most defense contractors can’t staff in-house: scoping the CUI boundary, running the gap assessment against NIST SP 800-171, authoring the System Security Plan, maintaining the POA&M, posting and defending the SPRS score, and operating the long-term controls — SIEM, 24/7 SOC, vulnerability management, and incident response — that DFARS 252.204-7012 expects you to keep running. We do this for U.S. defense contractors and government subcontractors nationwide, with U.S.-based analysts handling CUI.

• Do you produce the SSP and POA&M, or just review what we have?

  Both. Most engagements include authoring the System Security Plan from scratch (or a substantial rewrite) and standing up a working POA&M with quarterly review. We produce evidence-ready documentation that matches what your C3PAO will request — not generic templated language.

• Can you operate the long-term controls (SOC, VM, IR)?

  Yes — that is the most cost-effective model. Continuous monitoring (SI.L2-3.14.6), audit logging (AU family), and incident response (IR family) are the controls medium and large contractors most often lack. Our managed SOC, vulnerability management, and IR retainer satisfy all three with one provider, US-based, and assessment-mapped. See SOC as a Service.

• What about GCC High?

  If you handle CUI in Microsoft 365, you almost certainly need GCC High — commercial M365 will not satisfy DFARS 252.204-7012 by itself. We scope, license, migrate, and document the tenant. See Microsoft 365 services.

• How much does this cost?

  Honest answer: it depends on size and starting maturity. A 25-person defense subcontractor starting from minimal NIST 800-171 maturity typically invests $80K–$180K across 9–12 months for full Level 2 readiness, plus ongoing managed services. We scope to the environment — not a fixed package. Lost contract revenue from non-compliance is a much bigger number.