Cybersecurity Maturity Model Certification (CMMC)

Level 1 contractors handle FCI (Federal Contract Information) and must complete a self-assessment of 15 different CMMC controls. You’re also required to annually attest their CMMC compliance. 

Whether you're new to CMMC or have no security-framework background, SecurityMetrics guides you from start to finish.

Trained CMMC experts can help you fulfill CMMC deadlines, report your compliance status to the Supplier Performance Risk System (SPRS) website, and connect with Prime contractors.

Level 2 contractors handle CUI (Controlled Unclassified Information) and must complete at least a self assessment of 110 different CMMC controls, which assists in your preparation for a full audit with a C3PAO.

CMMC Audit controls are based entirely on the 110 controls in the NIST SP 800-171 framework. 

Our audit team can assist with all of these controls and requirements. We have extensive experience with NIST frameworks and can perform a CMMC Readiness Assessment to efficiently scope your CMMC environment and conduct a thorough Gap Analysis.

As a prime contractor, you must be able to verify that all of their subcontractors are also CMMC compliant. 

We offer Prime contractors a compliance management database and platform that tracks and verifies the CMMC status of all subcontractors, making your CMMC program simple to organize and manage.

The Cybersecurity Maturity Model Certification (CMMC) is a Department of War program designed to validate that private companies working with the military have strong cybersecurity. The DoW is moving to a "verify before you trust" model to stop foreign adversaries from stealing intellectual property and national security data from the defense supply chain.

• This assessment is conducted directly by government officials. The program works in a tiered system based on the type of data you handle:
  • Level 1: For companies handling Federal Contract Information (FCI). This involves standard practices like passwords and antivirus software.
  • Level 2: For companies handling Controlled Unclassified Information (CUI). This requires strict protocols (NIST standards) and an audit by a CMMC authorized private third party (C3PAO).‍
  • Level 3: For a small subset of companies working on critical programs.
  If you’re unclear what level you are, take our CMMC level quiz.

For most companies, the answer is no. The biggest change under CMMC is the move away from the "honor system" where you could simply sign a paper claiming you followed the rules.

Since November 10, 2025, Level 2s are encouraged to Self-Assess and attest to this in SPRS (unless their DoW contract states otherwise). Level 2s should expect to be asked to assess once every 3 years by a certified C3PAO assessor. They must also affirm in SPRS annually (years between C3PAO assessment). The DoW reserves the right to delay Level 2 requirements in a given contract at their discretion. But generally new contracts from the DoW will include the Level 2 assessment requirements as stated above.

You should prepare now. The phased rollout has begun, and these requirements are already appearing in contracts. CMMC is a "go/no-go" requirement; without the certification in hand, you cannot be awarded the contract and may be passed over for other contractors who are compliant. You must determine your level and prepare for assessment to ensure you can win future bids.

Yes. If you share Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) with subcontractors to fulfill a contract, they must also achieve the appropriate CMMC level. The program is designed to secure the entire supply chain, meaning you are responsible for ensuring your partners and vendors meet these requirements before sharing data with them.

It varies by level. Level 1 requires an annual self-assessment and affirmation. Level 2 and Level 3 certifications are generally valid for three years. However, you are still required to submit an "annual affirmation" in the SPRS to verify that your security remains compliant during the years between your full assessments.

It depends on the severity. For Level 1, you must pass 100% of the requirements immediately; no exceptions are allowed. For Level 2 and 3, if you miss certain non-critical requirements, you may be granted "Conditional" status. This allows you to continue working, but you must create a Plan of Action and Milestones (POA&M) and fix the issues within 180 days. If you do not close out these issues within that timeframe, your conditional certification will expire.