CMMC compliance consulting
CMMC, explained by someone who has worked in it.
If your company sells to the Department of Defense, or to a company that does, CMMC decides whether you can keep that work. Here is what it asks of a small supplier, in plain English, and the order to do the work in.
Sample data · “Your Business”, Oxford, AL
Quick answer
What is CMMC and who has to comply?
CMMC, the Cybersecurity Maturity Model Certification, is the Department of Defense program that checks whether contractors protect the government information they handle. It applies to prime contractors and flows down to subcontractors at every tier, based on the kind of information each one receives. The required level is written into the solicitation or contract.
Two kinds of information
FCI or CUI? The answer sets your level.
CMMC requirements follow the information. A supplier is in scope because of what lands on its systems, not because of its size.
Federal Contract Information (FCI)
Information the government provides, or that you create for the government, under a contract, and that is not meant for public release. Think purchase orders, delivery schedules and contract correspondence. A subcontractor that handles only FCI needs Level 1.
Controlled Unclassified Information (CUI)
Unclassified information that a law, regulation or government-wide policy says must be safeguarded. For a machine shop or fabricator this is often technical data: drawings, specifications and models marked as controlled. Handling CUI means Level 2 at a minimum.
Not sure which you hold? Look at the markings on what you receive and at the clauses in your contract, then ask your prime contractor or contracting officer in writing. Do not guess; the answer drives the whole project.
The levels
What Level 1 and Level 2 require.
These figures come from the CMMC program rule, 32 CFR part 170.
The basic safeguarding requirements in FAR clause 52.204-21.
- Self-assessment every year
- Every requirement must be met; no open items are allowed
- Result entered in the government’s Supplier Performance Risk System (SPRS)
- A senior company official affirms compliance each year
The security requirements in NIST SP 800-171 Revision 2.
- Self-assessment or an outside assessment, as the contract specifies
- Assessed every three years, with an affirmation every year
- A System Security Plan is required
- A short list of open items is allowed only under set conditions
A Level 3 also exists for the most sensitive work. It adds requirements from NIST SP 800-172 and is assessed by the government. This page covers Levels 1 and 2.
Who does the assessing
Self-assessment vs third-party assessment.
Self-assessment
- Your company assesses itself against every requirement
- Used for Level 1, and for Level 2 where the contract allows it
- Results go into SPRS
- A senior official signs an affirmation, and is accountable for it
Third-party assessment
- Carried out by a C3PAO, an authorized CMMC third-party assessment organization
- Used for Level 2 where the contract requires it
- The assessor examines documents, interviews staff and tests systems
- The assessor, not a consultant, decides the result
A consultant cannot certify you, and neither can we. Our work is getting you ready, with evidence that holds up.
Two documents
The SSP and the POA&M.
System Security Plan (SSP)
The written description of your environment: which systems are in scope, how they connect, and how each security requirement is met. Assessors read it first. If the SSP does not match what is really in the building, the assessment goes badly.
Plan of Action and Milestones (POA&M)
The list of requirements not yet met, with the task, the resources and the date for each. At Level 1 a POA&M is not permitted. At Level 2 one is allowed only if the score is high enough and the open items are not among the critical requirements, and it must be closed within 180 days.
The order of work
Five steps, and why the first one saves the most money.
Most of the cost of CMMC is decided at step one.
Scoping
Find exactly where FCI and CUI live and travel: which computers, which people, which cloud services. A smaller, well-separated scope means fewer systems to secure and assess.
Gap analysis
Compare what you have against every requirement at your level, and record what is met, partly met or missing, with evidence.
Remediation
Close the gaps: multi-factor sign-in, encryption, access controls, logging, training, physical security.
Documentation
Write the SSP and the policies and procedures that match how you actually operate.
Readiness review
A practice run against the assessment procedures before the self-assessment or the C3PAO visit.
Two scoping points catch small suppliers. A cloud service that stores CUI has to meet the FedRAMP requirements in DFARS clause 252.204-7012, which ordinary commercial email and file sharing may not. And an outside IT provider that handles your CUI becomes part of your assessment scope and must be described in your SSP. Ask any provider, including us, how they handle that.
Local
Close to the Anniston Army Depot supply chain.
Operation Buildup is based in Oxford, about 10 minutes from Anniston. Machine shops, fabricators and service companies in Calhoun County that supply the depot, or supply its suppliers, see these requirements arrive through a prime contractor’s questionnaire or a new contract clause.
Founder Cody Burgess is a U.S. Army veteran with 15+ years of IT leadership, including government and defense organizations. The work is done in person, on your floor, with the people who handle the drawings.
For the security work behind the paperwork, see cybersecurity services and cybersecurity in Anniston.
What it costs
Quoted per project, after scoping.
Priced in a written proposal once we know your level and your scope. Consulting only: we prepare you, and we do not issue or promise a certification.
- Scoping and data-flow review
- Level 1 and Level 2 gap analysis
- System Security Plan development
- Policy and procedure documentation
- Remediation support
- Pre-assessment readiness review
Many of the technical requirements are ongoing work: patching, monitoring, access control, training. Managed IT covers that day-to-day side. Minimum 5 users. Microsoft 365 licenses billed separately at Microsoft’s price.
- 24/7 monitoring and alerting
- Patch management
- Advanced security monitoring
- Security awareness training
- Backup monitoring and management
- Monthly reporting
Third-party assessment fees are charged by the C3PAO and are separate from consulting. So are any new equipment and licenses the gap analysis calls for; the proposal lists them as their own lines.
Questions
CMMC questions, plainly answered.
Does CMMC apply to subcontractors?
Yes. The rule applies to prime contractors and subcontractors at all tiers. A subcontractor that handles only FCI needs Level 1; one that handles CUI needs at least Level 2. Your prime is required to flow the requirement down to you.
What is the difference between CMMC Level 1 and Level 2?
Level 1 protects Federal Contract Information with the 15 basic safeguarding requirements in FAR 52.204-21 and an annual self-assessment. Level 2 protects Controlled Unclassified Information with the 110 requirements of NIST SP 800-171 Revision 2, assessed every three years by self-assessment or by a C3PAO, as the contract specifies.
Can a consultant certify us for CMMC?
No. For Level 1 and some Level 2 work, your own company self-assesses and a senior official affirms the result. Where a certification assessment is required, only an authorized C3PAO can perform it. A consultant prepares you; we do not promise an outcome.
How do I know which level my company needs?
It is stated in the solicitation or contract, or passed down by your prime contractor. It depends on whether you handle FCI only or CUI. If the paperwork is unclear, ask your prime or contracting officer in writing.
How long does it take to get ready?
It depends on your starting point and your scope. A company with a small, well-separated scope and good basic security has far less to do than one where controlled drawings sit on every computer. The gap analysis gives you a realistic list to plan against.
What is SPRS?
The Supplier Performance Risk System is the Department of Defense system where contractors enter self-assessment results and affirmations, and where contracting officers can look them up.
How much does CMMC consulting cost?
It is quoted per project in writing after scoping, because the level and the size of the scope drive the work. Assessor fees, equipment and licenses are separate from consulting.
Contact
Request an IT assessment.
A hands-on review of your computers, network, security and backups, quoted up front, with findings in plain English.