CMMC FAQs

The cybersecurity maturity model certification (CMMC) is a department of defense program designed to verify that contractors and subcontractors can adequately protect federal contract information (FCI) and controlled unclassified information (CUI). It standardizes cybersecurity requirements across the defense industrial base.

Any prime contractor or subcontractor whose DoD contract requires handling FCI or CUI on non-federal systems. Requirements are specified in solicitations, and compliance is becoming a condition for contract award.

The final DFARS rule took effect in late 2025, with CMMC requirements now flowing into select DoD solicitations. Many organizations are preparing now because primes and the government are beginning to include these clauses.

CMMC 2.0 has three levels. Level 1 focuses on basic safeguarding of FCI (self-assessment). Level 2 (the most common for many contractors) requires third-party assessment for organizations handling CUI. Level 3 is supported as a custom solution. The specific level is determined by the contract solicitation.

Yes — this is one of the most recommended first steps. A readiness assessment helps identify gaps, clarify scope, and create a realistic remediation plan, significantly reducing the risk of issues during a formal assessment.

Compliance is a collaborative effort because it touches real business operations. Your team will need to participate in regular meetings (typically weekly) to provide business context, make key decisions, and review progress. You'll also be asked to help gather relevant data, documentation, and information about how your systems and processes currently operate.

Our experts handle the majority of the technical heavy lifting — including control mapping, policy development, evidence collection, and automation through our platform. This structure keeps the burden on your internal team manageable while ensuring decisions are made efficiently and the project stays on track.

Costs vary significantly depending on your current security posture, the scope of systems involved, and whether you handle CUI. Common discussions among contractors highlight investments in people, processes, technology, and potential tool changes. A hybrid model using automation plus expert support can help control total lifecycle costs compared to fully manual approaches.

Timelines vary widely based on organizational size, existing controls, and complexity. Many contractors report preparation taking several months to over a year. Using automation for repetitive tasks (such as control mapping and evidence collection) combined with expert guidance can accelerate progress.

Scoping involves identifying where FCI and CUI are stored, processed, or transmitted and which systems, networks, and people are in scope. Common questions include whether commercial tools (like certain Office 365 configurations) can be used and how to handle enclaves or boundaries. Proper scoping is critical to avoid over- or under-investing in compliance.

Many contractors discover they handle more sensitive information than they initially thought. FCI is common in most DoD-related communications. CUI is more specific and tied to certain categories. A proper assessment helps clarify this.

Yes. If your prime contract includes CMMC requirements, they typically flow down to subcontractors who handle relevant information. Many in the supply chain are actively preparing for this.

Non-compliance can result in loss of contract eligibility, potential false claims act exposure, and other enforcement actions. Contractors frequently discuss the business impact of being unable to bid on or perform DoD work.

Preparation usually includes conducting a gap analysis, implementing required controls, documenting policies and procedures, gathering evidence, and performing internal assessments. Your team will be involved in providing operational information and participating in decision-making meetings.

Many organizations benefit from expert support to interpret requirements, streamline documentation, and manage the project rhythm (including regular check-ins), so internal resources stay focused on their core responsibilities.

Yes. Automation platforms can handle repetitive tasks like control mapping, evidence collection, and continuous monitoring, while experts provide strategic guidance, interpretation, and accountability. This combination often helps organizations achieve compliance faster and at a lower overall lifecycle cost than traditional consulting-only or software-only approaches.

Certification is not a one-time event. You'll need to maintain controls, monitor for changes, and be prepared for potential reassessments. Ongoing support for evidence maintenance and continuous compliance helps reduce risk of drift.

In many cases, you can continue using current tools if they meet the requirements (sometimes with configuration changes or compensating controls). Questions about tools like commercial cloud services or existing infrastructure are very common. An assessment helps determine what can stay and what needs adjustment.