Schedule a Discovery Call

What CMMC Level 2 Actually Requires

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense framework for verifying that defense contractors protect Controlled Unclassified Information (CUI). Level 2 requires full alignment with all 110 security requirements across 14 domains, verified by an independent third-party assessor from an accredited C3PAO.

Every requirement is scored as Met or Not Met. There is no partial credit.

APPLIES TO
Defense contracts that involve CUI

ASSESSMENT TYPE
Independent third-party assessment by an accredited C3PAO

CYCLE LENGTH
Reassessed every 3 years — maintaining compliance between assessments matters as much as the initial certification

GOVERNING STANDARD
NIST SP 800-171 Rev. 2

Who We Work With

We work with defense contractors at every stage of the CMMC certification process. You are in the right place if any of these match your situation:

✅ Your defense contracts involve CUI and CMMC Level 2 certification is now a requirement

✅ You have talked to compliance firms that cannot manage your IT, or IT providers that cannot handle CMMC, and need one team that does both

✅ You are a prime contractor responsible for your supply chain’s CMMC readiness

✅ You are a subcontractor whose prime requires Level 2 certification and your scope needs to be defined

✅ You are a small or mid-sized defense contractor who needs a hands-on technical partner, not a consultant who hands you a report and disappears

What the Work Actually Looks Like

CMMC Level 2 is an IT project as much as a compliance project. Here is what that typically involves:

Scoping and Gap Analysis
Everything starts with defining your CUI boundary and assessing your current controls against all 110 requirements. The output is your System Security Plan (SSP) and a remediation roadmap that reflects where you actually stand — not where you hope you stand.

Technical Remediation and Evidence Collection
Closing gaps requires both IT configuration and documented proof. Network segmentation, access controls, endpoint protection, and audit logging need to be in place. Every control needs traceable evidence an assessor can verify: configuration records, access logs, policy documents, and audit trails.

Assessment Readiness
A mock review surfaces remaining issues before the official certification assessment. When the C3PAO assessor arrives, your technical controls and your documentation need to tell the same story. I stay involved through that entire process.

Ongoing Compliance Maintenance
After certification, your SSP is a living document and your controls need to hold as your organization evolves. I stay embedded as your IT management partner, keeping your compliance posture current so your next 3-year assessment is not a scramble.

Why This Is Different

We are in your environment, not reviewing it from the outside.
The same organization managing your IT infrastructure is preparing your CMMC program. When your assessor reviews a control, the person who configured it is the person who documented it. That accountability shortens your path and simplifies your assessment.

We have qualified CISSPs with hands-on CMMC L2 assessment experience.
This is not a compliance checkbox service built on top of a generic MSP. We are currently supporting defense contractors through active CMMC Level 2 assessments and understand what assessors actually look for.

We work with small and mid-sized contractors.
Large compliance firms are built for enterprise. We are built for the defense contractor who has 25 to 250 employees, real CUI obligations, and needs a technical partner who can get into the weeds with them.

Common Questions

Do you conduct the official CMMC assessment?
No. A C3PAO conducts the certification assessment — that has to be an independent, accredited organization. We prepare you to pass it. We handle the gap assessment, documentation, technical remediation, and audit readiness. The C3PAO assesses you. We make sure you are ready for them.

We already have an IT provider. Can you still help?
Maybe. We can work alongside your existing provider as the compliance layer they cannot provide, or take over the full environment. The discovery call is where we figure out which fits your situation.

How do we know if we are even in scope for CMMC Level 2?
If your contracts involve CUI, you are likely in scope. Scope determination is one of the first things we work through on a discovery call — it is not something you should guess at.

How long does this take?
Most organizations need 6 to 18 months from gap assessment to Final Level 2 Status, though we’ve seen some organizations complete it in a shorter timeline.  Your timeline depends on your current posture and the scope of your gaps. Starting now gives you the most options ahead of DoD contract requirements expected after November 2026.

What does it cost?
It depends on where you are starting from. An organization with strong existing controls has a different path and cost than one building from the ground up. We size engagements based on your actual situation. The discovery call gives us what we need to provide an honest estimate.

Let’s Talk About Your CMMC Timeline

If your contracts involve CUI, the time to start is now. Fill out the form below or schedule a call directly — we will talk through your scope, your current gaps, and what a realistic path to Level 2 certification looks like for your organization.

Schedule a Discovery Call