⚡ TL;DR

CMMC Is Now a Contract Requirement

To stay eligible for DoD work, your organization must meet the CMMC level that matches the sensitivity of the information you handle. Period.

This isn't a future concern. Requirements are appearing in solicitations today. Here's the structured path to get there:

  1. Conduct a Readiness Assessment

    Evaluate your current cybersecurity posture against the CMMC framework. Identify the gaps between where you are and where you need to be.

  2. Define Scope and Boundaries

    Identify the systems, processes, and people that touch Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Tighter scope means lower cost and less complexity.

  3. Develop Required Documentation

    Create or update your cybersecurity policies, procedures, and System Security Plan (SSP). Documentation isn't a checkbox — it's evidence that your controls are real and consistently followed.

  4. Implement Technical Controls

    Close the gaps. Deploy access management, encryption, incident response, and the rest of the NIST 800-171 control set. Every control needs to be implemented, not just planned.

  5. Conduct Internal Testing

    Run internal reviews or a mock audit before the real thing. Validate that your controls work, your documentation holds up, and your team knows the drill.

  6. Engage a C3PAO

    Schedule your formal assessment through an authorized Certified Third-Party Assessor Organization (C3PAO). Show up with your evidence organized and your house in order.

  7. Maintain Ongoing Compliance

    Certification isn't a one-time event. Monitor, update, and improve your cybersecurity practices continuously to stay compliant and contract-eligible.

Understanding the Three CMMC Levels

If your organization does business with the DoD, you need to know which level applies to you. The answer depends on what type of information you handle.

Level 1

Foundational

  • Who it's for: Organizations handling only Federal Contract Information (FCI)
  • What's required: 15 basic safeguarding practices from FAR 52.204-21, annual self-assessment, and a senior official affirmation
  • Assessment: Self-assessed. No C3PAO needed.
Level 2

Advanced

  • Who it's for: Most contractors handling Controlled Unclassified Information (CUI) — the majority of the defense industrial base
  • What's required: All 110 security controls from NIST SP 800-171 Rev 2, compliance with DFARS 252.204-7012, plus incident reporting and CUI safeguarding procedures
  • Assessment: Either self-assessment or C3PAO certification, depending on the contract. If CUI is critical to national security, expect a third-party audit.
Level 3

Expert

  • Who it's for: Contractors on high-priority or sensitive DoD programs
  • What's required: Everything in Level 2, plus additional enhanced security requirements from NIST SP 800-172
  • Assessment: Conducted directly by DIBCAC (Defense Industrial Base Cybersecurity Assessment Center). This is government-led.
Most contractors reading this need Level 2. If you handle CUI in any form, that's your target. If you're unsure, start with a gap assessment and find out.

DoD Phased Implementation Timeline

The DoD is rolling this out in stages. That's the good news. The bad news: the timeline is already in motion.

Phase 1 — Starting 2025

Enforcement begins. Self-assessments for Level 1 and certain Level 2 contracts. CMMC requirements start appearing in new solicitations. This is happening now.

Phase 2 — 2026

Third-party certifications expand. C3PAO-led Level 2 assessments required for a broader set of contracts. If you've been self-assessing, the bar goes up.

Phase 3 — 2027

Level 3 requirements expand. Certification requirements grow across more programs. Third-party assessments become standard operating procedure.

Phase 4 — 2028

Full implementation. All applicable DoD contracts require full CMMC compliance. No exceptions, no extensions.

What This Means for You

The Six-Phase Compliance Journey

Achieving CMMC Level 2 compliance isn't something you improvise. It's a structured process with clear phases. Here's how Altivus guides organizations through it, from first assessment to ongoing operations.

Phase 1

Gap Assessment

Evaluate your current security posture against NIST SP 800-171 and CMMC Level 2 requirements. Identify every control gap and establish your baseline SPRS score. This is where you find out exactly how far you have to go.

Phase 2

System Security Plan & Responsibility Matrix

Define your system boundaries, in-scope assets, and security controls in a formal SSP. Build a responsibility matrix that makes accountability clear: what's on you, what's on your MSSP, what's on your cloud providers.

Phase 3

Implementation, Remediation & Documentation

Close the gaps. Implement the required controls, fix the deficiencies, and document everything with evidence that maps directly to CMMC assessment criteria. This is the heaviest lift, and it's where most organizations need the most help.

Phase 4

Mock Assessment

Simulate the formal C3PAO audit under realistic conditions. Review documentation, test controls, interview stakeholders. Find problems before the assessor does.

Phase 5

C3PAO Assessment Support

Get expert guidance during the real assessment. Help with evidence presentation, stakeholder preparation, and subject matter questions. You shouldn't face the audit alone.

Phase 6

Ongoing Compliance Monitoring

Certification isn't the finish line. Maintain continuous compliance by monitoring control effectiveness, updating your SPRS score, and adapting to evolving requirements.

Phase 1 Deep Dive: Gap Assessment

This is where everything starts. The gap assessment gives you clarity on what's in scope, how your environment measures up, and where your cybersecurity posture needs work. It also sets the stage for smarter investments and potential cost savings through scope reduction.

Determine Scope & Certification Level

Establish which CMMC level applies and define exactly which systems, users, and environments fall under the compliance umbrella.

Conduct Comprehensive Discovery

Map where FCI and CUI are created, stored, processed, and transmitted. That includes cloud environments, on-prem infrastructure, SaaS platforms, and third-party connections.

Inventory Critical Assets & Identities

Catalog every endpoint, server, cloud workload, user account, service account, and application that touches sensitive data. You can't protect what you haven't identified.

Assess Controls Against NIST 800-171

Perform a detailed, control-by-control evaluation using DoD methodology. Determine current implementation status for each control and collect supporting evidence.

Develop a Risk-Based POA&M

Document each gap with its associated risk, required remediation steps, responsible parties, and realistic timelines. The Plan of Action & Milestones is your roadmap to closing gaps.

Establish a Baseline SPRS Score

Generate your initial NIST 800-171 score and prepare for SPRS submission. This score is required and reported to the DoD, so accuracy matters.

Phases 2 & 3: Building Your Security Foundation

Phase 2: System Security Plan

Turn your assessment findings into actionable documentation. The SSP defines how every control is implemented and who owns it.

Phase 3: Implementation & Remediation

This is where controls go from documented to deployed. Every control must be implemented, validated, and backed by evidence.

Phase 4: Mock Assessment Readiness

Before you sit across from a C3PAO assessor, rehearse under real conditions. Surprises during a formal audit are expensive.

Document & Evidence Review

Go through every core compliance document: SSP, POA&M, Responsibility Matrix, policies, and procedures. Confirm evidence is present, current, and relevant.

Technical Verification & Sampling

Spot-check actual configurations on endpoints, servers, network devices, and cloud platforms. Verify that what's deployed matches what's documented.

Stakeholder Interviews

Run interview sessions with leadership, IT, InfoSec, system admins, HR, Legal, and Contracts. Use C3PAO-style questions about access control, incident response, onboarding, and offboarding.

Scoring & Findings

Score your implementation using NIST 800-171A assessment objectives. Classify findings as must-fix, should-fix, or nice-to-fix. Deliver a Mock Assessment Report with clear remediation guidance.

Phases 5 & 6: Sustaining Compliance

Earning your CMMC certification is a milestone. It is not the finish line. Compliance is an ongoing operation, not a one-time project.

Your Path to CMMC 2.0 Compliance

The compliance lifecycle in six steps:

1

Assess

Identify gaps and establish your baseline

2

Plan

Develop your SSP and responsibility matrix

3

Implement

Deploy controls and document evidence

4

Validate

Conduct a mock assessment and remediate

5

Certify

Complete your C3PAO assessment

6

Maintain

Monitor compliance continuously

Ready to Get Started?

CMMC enforcement is underway. The contractors who act now will keep winning DoD work. The ones who wait will lose contracts to competitors who didn't.

Altivus specializes in CMMC compliance for defense contractors. We've built a proven six-phase process that takes you from gap assessment to certification and beyond — without the overhead of building a compliance team from scratch.

Schedule a Consultation →

Don't wait for a solicitation to force your hand. Get ahead of the requirement.