The Cybersecurity Maturity Model Certification (CMMC 2.0) is now a contract-keeping requirement for defense contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Understanding where you fall — and how to prepare — is the difference between keeping and losing a DoD contract.
Level 1 vs. Level 2
CMMC Level 1 protects Federal Contract Information (FCI) and aligns to 17 basic safeguards. It is self-assessed.
CMMC Level 2 protects Controlled Unclassified Information (CUI) and aligns to the 110 controls of NIST SP 800-171. Higher-value Level 2 contracts require a C3PAO assessment — a third-party assessment by a Certified Third-Party Assessment Organization.
What the assessment actually measures
A CMMC assessment verifies that your 110 controls are not only documented but implemented and operating. Assessors review your System Security Plan (SSP), your Plan of Action and Milestones (POA&M), your CUI boundary, and the evidence supporting each control.
How to prepare
- Run a gap assessment against the 110 NIST SP 800-171 controls.
- Rewrite your SSP and POA&M so they accurately reflect your environment.
- Implement the remaining technical controls and stand up a CUI enclave.
- Run a mock assessment before your C3PAO visit.
BLACKSAND is a CMMC Registered Provider Organization (RPO). Our practitioners guide defense contractors from gap assessment to C3PAO readiness — typically in 90 to 180 days. To start your CMMC compliance roadmap, request a consultation.