CMMC 2.0 is the US Department of Defense's Cybersecurity Maturity Model Certification a tiered program requiring contractors handling FCI and CUI to prove security maturity before they can win DoD work. Our hub maps Levels 1, 2, and 3 to NIST SP 800-171, outlines C3PAO assessments, and delivers a practical path to certification.
Free Assessment
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a tiered cybersecurity standard created by the US Department of Defense (DoD) to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the Defense Industrial Base (DIB). Under the final rule published in October 2024, every DIB contractor will need an appropriate CMMC level by mid-to-late 2026 to win DoD contracts.
If your company is a prime or sub on any DoD contract touching CUI, you cannot bid, accept, or renew work without an applicable CMMC level. The DIB has hundreds of thousands of suppliers the rollout is phased but certain. DFARS 252.204-7012 is already flowing down; CMMC 2.0 adds third-party assessments (Level 2+) and annual affirmations.
Prime and subcontractors in the Defense Industrial Base: aerospace, manufacturing, IT services, software vendors, professional services anyone touching FCI (Level 1) or CUI (Level 2 and 3). Roughly 220,000+ companies are in scope.
No certification = no DoD work. Primes are already flowing down CMMC readiness expectations to subs in RFQs and RFPs. A compliant program differentiates you in DIB proposals and reduces flow-down risk from primes. It's also a significant uplift for security maturity even outside DoD work.
Whether you’re evaluating CMMC for the first time, deep in implementation, or running a continuous program, start in the lane that matches your current maturity.
Beginner · Understand CMMC 2.0
Learn the levels, understand FCI vs CUI, and determine the level your contracts require.
Intermediate · Reach Level 2
Implement the 110 NIST SP 800-171 practices and prepare for a C3PAO assessment.
Advanced · Level 3 & Beyond
For programs requiring the highest maturity (APT resistance) implement NIST SP 800-172 safeguards.
The Cybersecurity Maturity Model Certification 2.0 streamlines the earlier five-level model into three tiers tied to the sensitivity of the Controlled Unclassified Information (CUI) you handle for the Department of Defense.
A tiered DoD cybersecurity standard enforcing NIST 800-171 (Level 2) and SP 800-172 (Level 3) on DIB contractors.
Level 1 (Foundational, 17 FCI safeguards), Level 2 (Advanced, 110 NIST 800-171 practices), Level 3 (Expert, 800-171 + 800-172).
CMMC 1.0 launched 2020 with 5 levels. CMMC 2.0 simplified to 3 levels. Final rule published October 2024. Phased enforcement began 2025.
All DIB contractors and subcontractors handling FCI or CUI. Level depends on contract clauses: 48 CFR and DFARS 252.204-7021.
FCI is any federal contract info not for public release. CUI is a specific category of sensitive-but-unclassified information defined by E.O. 13556.
DoD program offices build CMMC requirements into contracts. CIO/OSD oversees the ecosystem. DoD Cyber Crime Center (DC3) handles voluntary disclosures.
Level 2 is essentially NIST SP 800-171 with teeth. Your SPRS self-score, System Security Plan, and Plan of Action & Milestones are the three artefacts that drive contract eligibility.
17 safeguards from FAR 52.204-21, annual self-assessment + executive affirmation. Covers FCI only.
110 practices from NIST SP 800-171 Rev 2. Self-assessment for non-critical; C3PAO assessment for most CUI contracts.
Level 2 + selected 800-172 safeguards. DIBCAC (govt) led assessment. For the highest-impact programs.
Describes system boundary, CUI flow, and how each 110 practice is implemented. The #1 document every assessor starts with.
Lists unmet practices and remediation plan. CMMC 2.0 allows limited POA&M items at Level 2 but not for the most critical practices.
NIST 800-171 self-assessment score in the Supplier Performance Risk System. Required for most DoD contracts since 2020.
Level 1 lets you self-assess annually. Level 2 for critical contracts requires a C3PAO-led triennial assessment. Level 3 requires a government-led DIBCAC assessment.
Read your DFARS/CMMC clauses. Confirm FCI vs CUI in scope. Choose a realistic target.
Decide enclave (a small CUI environment) vs full environment. Most SMBs choose an enclave strategy to manage cost.
Run a structured self-assessment across all 110 practices. Document each control's status.
Encryption, access control, continuous monitoring, incident response, FIPS-validated crypto, supply-chain vetting.
A compliant SSP is 50–200+ pages. POA&M drives closure on remaining gaps.
Certified Third-Party Assessor Organization. Budget 3–6 months for scheduling and 2–4 weeks for fieldwork.
Executive-signed annual affirmation required post-certification. Re-assessment every 3 years.
CUI inventory, enclave design, and MFA are the three hurdles that sink the most first-time CMMC programs. Nail these and the other 14 domains start to follow.
Baseline all 110 NIST 800-171 practices. Score each Met, Partially Met, Not Met.
SSP complete, POA&M realistic, FIPS crypto deployed, CUI identified and tagged, training complete, IR plan tested.
SSP, POA&M, IR plan, vulnerability management program, configuration baselines, training records, incident log.
Isolate CUI into a dedicated environment (GCC High, Azure Government, AWS GovCloud) to reduce assessment scope.
Marking, storage, transmission, and disposal must follow 32 CFR 2002 / NARA CUI Registry.
Only C3PAOs listed in The Cyber AB marketplace can conduct Level 2 assessments. Choose one with DIB experience in your sector.
Microsoft GCC High / AWS GovCloud boundaries, compliance platforms like PreVeil, Exostar, Hyperproof, and dedicated SSP tooling together make Level 2 operationally feasible.
Manual: SharePoint SSPs, manual evidence. Automated: GRC tools that map to 800-171 and collect evidence continuously.
Easier SPRS scoring, evidence for the 110 practices, continuous POA&M updates, audit-ready binders.
Any Level 2 journey. Enclave + GRC + MDR is the minimum-viable stack.
PreVeil, Exostar, Kiteworks, Microsoft 365 GCC High, Azure Government, AWS GovCloud, Hyperproof, Apptega.
Automation matters less than enclave design. Pick the right CUI environment first; wrap GRC around it second.
Free CMMC Level 1 and Level 2 starter artefacts: SSP templates, POA&M trackers, and SPRS scoring worksheets.
Resource
SSP scaffold, POA&M template, 800-171 matrix
Template
50-page scaffold aligned to 32 CFR 170
Template
Structured milestone tracker
Playbook
How to tag and handle CUI
Checklist
Questions to ask before signing
Resource
From FCI to DIBCAC explained
Real business outcomes we see when clients adopt CMMC with the right implementation partner.
Primes with complex sub supply chains flow-down of CMMC requirements.
Managed services providers handling CUI on behalf of DIB clients.
Must operate in GCC High / Azure Government and reach Level 2.
Tier-2 and Tier-3 suppliers where enclave strategy is the only affordable path.
Patterns we’ve seen across 200+ CMMC engagements. Spot these early and you’ll spare yourself months of rework.
Most contractors can't tell you what CUI they actually hold or where it lives.
GCC High migrations are long, expensive, and break workflows.
Limited assessor ecosystem schedule 6+ months ahead.
Annual affirmations catch many teams unprepared after initial certification.
Keep learning — or put CMMC into action with a team that has done it before.
CMMC Fundamentals
CMMC Levels & Controls
CMMC Assessment & Cost
“ISpectra Technologies brought deep expertise in cybersecurity and DevSecOps to our projects, playing a crucial role in our EDR Tool implementations and SOC 2 compliance. Their solutions were tailored to our business and their proactive approach improved both our agility and security posture. ISpectra felt more like an extension of our team than an external vendor.”
“ISpectra Technologies brought deep expertise in cybersecurity and DevSecOps to our projects, playing a crucial role in our EDR Tool implementations and SOC 2 compliance. Their solutions were tailored to our business and their proactive approach improved both our agility and security posture. ISpectra felt more like an extension of our team than an external vendor.”
“Our Accounts Receivables have started to plummet since implementing RCMEdge. It provides electronic AR follow-up and identifies claims needing extra attention so we don't exhaust valuable resources on claims processing as normal. As a result, we're much more productive and cash flow favorable. Highly recommended!”
“The VAPT report was presented in a structured and professional manner with clear categorization of vulnerabilities by severity. The depth of technical findings, along with practical remediation suggestions, provided our team with valuable insights. The clarity of documentation made it easy for our internal teams to translate recommendations into actionable steps.”
“The VAPT assessment was thorough and well-documented, providing a clear view of identified vulnerabilities with practical remediation guidance. The prioritization of risks and actionable recommendations enabled our teams to take corrective measures with clarity and confidence. We truly appreciate the expertise and professionalism your team brought to this engagement.”
“We have successfully secured our ISO 27001 certification through GLOCERT, and ISpectra Technologies was pivotal throughout. Your team's contribution was exceptional — not only in navigating the audit process but in the structural refinement of our internal policies and the practical application of ISMS best practices. The attention to detail ensured that our procedures are not just compliant, but operationally sound. We value the high standard of consultancy ISpectra has maintained and look forward to a continued professional association.”
“On behalf of the entire team, thank you for your outstanding efforts in obtaining the ISO certificate. Your dedication, hard work, and commitment have been instrumental in achieving this important milestone. We sincerely appreciate all your support throughout the process. We would also like to extend our special thanks to Mr. Bharath Raj for his valuable contribution and support in achieving this certification. Thank you once again for your efforts and commitment.”
What Your Business Gets
No obligation · Results in 48 hours · 100% confidential
Pick a time that works for you
Our team responds within 24 hours
Our AI consulting and development team helps enterprises move from AI strategy to live production in 12 weeks, with MLOps, governance, and measurable ROI.
