CMMC Readiness

If you sell to the Department of Defense, or to a company that does, the Cybersecurity Maturity Model Certification (CMMC) decides whether you can keep bidding. Requirements started appearing in new defense solicitations in November 2025, and from November 2026 applicable contracts can require Level 2 certification by an independent assessor. Getting ready takes months, so the work has to start before a contract asks for it.

We prepare defense suppliers across Northeast Ohio for CMMC: machine shops and fabricators, engineering firms, construction contractors and the rest of the supply chain that handles controlled information. The first conversation is about scope, because scope drives the cost of everything after it.

What you handle, and where it lives, decides whether this is a contained project or a company-wide one. Then we assess you against the practices that apply, control by control, and give you a plain reading of what's in place and what isn't.

The gaps depend on each other, so the plan that comes out of the assessment has an owner and an order. CMMC readiness is part of our compliance services and follows the same control-by-control method as our security risk assessments.

The level follows the information that moves through your business, and company size doesn't change it. Your contracts and flow-down clauses tell you which level applies, and the markings on the documents you receive usually confirm it.

• Level 1 applies when you handle Federal Contract Information, meaning information provided by or generated for the government under contract that isn't meant for public release. It requires 15 basic safeguarding practices and an annual self-assessment that a senior company official affirms.
• Level 2 applies when you handle Controlled Unclassified Information (CUI), such as technical drawings and specifications. It requires all 110 security requirements in NIST SP 800-171. Most companies at this level need an assessment every three years by an authorized third-party assessment organization, called a C3PAO, with an annual affirmation in between.
• Level 3 adds selected requirements from NIST SP 800-172 for a small number of contractors on the most sensitive programs, and the government runs that assessment itself.
• If nothing in your contracts touches either kind of information, CMMC doesn't apply to you, and we'll tell you so.

Most small and mid-sized defense suppliers land at Level 1 or Level 2. Being two or three tiers down the supply chain doesn't take you out of it, and CMMC in plain English walks through the levels in more detail.

• December 2024: the CMMC program rule took effect, defining the levels and how assessments work.
• November 2025: the acquisition rule took effect, and CMMC requirements began appearing in new Department of Defense solicitations, starting with self-assessments.
• November 2026: phase two begins, and applicable new solicitations can require Level 2 certification by a C3PAO instead of a self-assessment.
• Through 2028: the requirements phase into essentially all applicable defense contracts.

Certification has to exist before a contract that requires it can be awarded to you. Assessors are a limited pool, and the implementation work has to be finished before the assessment, so for a company starting from a typical baseline the process takes months.

1. Find where controlled information lives. That means every system that holds or sends it, including field laptops and tablets on job sites, and where it goes when it leaves the company for subcontractors and outside engineers or architects.
2. Narrow the boundary. Every system inside the assessment scope carries the full weight of the control set, and every system outside it doesn't. Segmenting the network and consolidating where controlled information can sit usually costs less than certifying everything you own.
3. Record where you stand on every control, with the evidence that proves it or the work needed to close it. For Level 2 this produces the score that goes into the government's Supplier Performance Risk System (SPRS), which primes increasingly ask for before they send work.
4. Close the gaps in order of risk and cost. Multi-factor authentication, access reviews, session lockout, removing local administrator rights and switching on logging you already pay for usually come first, because they cost little. Segmentation and equipment replacement need budget and lead time, and so does managing field devices through mobile device management.
5. Write the System Security Plan and the plan of action, then keep the evidence current through the third-party assessment. CMMC allows a conditional status with some items on a plan of action, but they have to be closed within 180 days, and some requirements can't be deferred at all.

Across the 110 Level 2 requirements, most of the effort in a small business lands in four places: multi-factor authentication everywhere it's required, encryption that meets the standard, logging that would support an investigation, and documentation.

Documentation surprises people most. Plenty of companies do much of the right work and have almost none of it written down, and an assessor treats undocumented work as undone.

Owning a security tool doesn't satisfy a control on its own. The tool has to be configured to the standard and monitored, and you need evidence of both.

The annual affirmation is a legal commitment by a company officer that the requirements are still met. That means monitoring, patching, access reviews and evidence collection have to keep running between assessments.

We run that ongoing work on a managed IT agreement, or alongside your own IT staff through co-managed IT.

A Northeast Ohio construction company that bids government work as a prime contractor needed CMMC Level 2 to stay eligible. Nobody in the office could say which controls the business met, and outside advice ranged from "you are basically fine" to a program costing more than the contracts were worth.

After drawing the boundary, we assessed all 110 controls in writing and sequenced the fixes by risk and cost. The cheap, high-value fixes were separated from the ones that needed budget and lead time, and an open compliance question became a project with a scope and an order. The full write-up is in CMMC Compliance, Turned into a Project with an End.