The Cybersecurity Maturity Model Certification (CMMC) is a mandatory DoD requirement that every defense contractor and subcontractor handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must meet to win and maintain contracts. If you’re in the defense supply chain and haven’t started preparing, you’re already behind. CMMC assessments are happening now, and failing means losing your ability to bid on DoD work.
This guide covers what CMMC 2.0 requires, how to prepare for your assessment, where most contractors get stuck, and how CMMC consulting services help you get audit-ready without pulling your team off their day jobs.
What CMMC 2.0 Actually Requires
CMMC 2.0 replaced the original five-level model with a streamlined three-level structure. Your required level depends on what type of federal data your organization handles.
Level 1 — Foundational. Applies to organizations handling FCI only. Requires 17 basic cybersecurity practices drawn from FAR 52.204-21. Compliance is demonstrated through annual self-assessment. This is the floor — basic cyber hygiene that every contractor should already have in place.
Level 2 — Advanced. Applies to organizations handling CUI. This is where most defense contractors land. It requires full implementation of all 110 security practices from NIST SP 800-171 Rev 2. For organizations handling critical CUI, a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO) is required every three years. For non-critical CUI, an annual self-assessment may suffice.
Level 3 — Expert. Applies to the most sensitive DoD programs. Builds on Level 2 by adding controls from NIST SP 800-172 to protect against Advanced Persistent Threats (APTs). Assessment is conducted by the government (DIBCAC). Most contractors won’t need Level 3 unless specifically identified.
The 7 Things You Must Have Ready Before Your Assessment
Whether you’re doing a self-assessment for Level 1 or preparing for a C3PAO assessment at Level 2, these are the foundational elements you need in place.
1. A clear scope definition. Know exactly which systems, networks, and people are in scope for CUI or FCI handling. Scoping errors are the most common reason assessments go sideways. If your CUI touches every system in your environment, your entire infrastructure is in scope. Smart organizations segment their CUI environment to reduce scope and cost.
2. A completed System Security Plan (SSP). Your SSP documents how your organization meets each NIST 800-171 requirement. It describes your system boundaries, security controls, implementation details, and the people responsible. The SSP is the single most scrutinized document in any CMMC assessment.
3. A Plan of Action and Milestones (POA&M). If you have gaps — and most organizations do — the POA&M documents what those gaps are, what you’re doing to fix them, who’s responsible, and when each fix will be completed. POA&Ms are acceptable for Level 2, but they must show genuine progress, not a wishlist of intentions.
4. Technical controls implemented and documented. Multi-factor authentication, encryption at rest and in transit, access control based on least privilege, audit logging, endpoint protection, and vulnerability management. These aren’t just policies on paper — the assessor will verify they’re implemented and functioning.
5. Incident response capability. You need a documented, tested incident response plan that includes procedures for reporting cyber incidents to the DoD within 72 hours. Table-top exercises demonstrating your team knows the plan are increasingly expected.
6. Evidence and artifacts. Assessors need proof. Screenshots, configuration exports, policy documents, training records, audit logs, and system architecture diagrams. Organizations that scramble to collect evidence during the assessment fail. Those who maintain evidence continuously pass.
7. Trained personnel. Your team needs to understand their security responsibilities. Security awareness training records, role-based training documentation, and evidence that personnel handling CUI have been trained on proper handling procedures.
Where Most Defense Contractors Get Stuck
Underestimating scope. Many contractors assume CMMC only applies to a few systems. In reality, any system that processes, stores, or transmits CUI — including email, file shares, cloud storage, and collaboration tools — is in scope. Without proper network segmentation, your entire IT environment may be subject to assessment.
Treating the SSP as a checkbox. A generic SSP template downloaded from the internet won’t survive an assessment. Assessors look for specific, accurate descriptions of how YOUR organization implements each control in YOUR environment. Generic language is a red flag.
Ignoring the supply chain. CMMC flows down through the supply chain. If you pass CUI to subcontractors, they need CMMC certification too. You’re responsible for ensuring your supply chain meets requirements, which means evaluating subcontractor compliance.
Starting too late. Achieving Level 2 readiness typically takes 6–12 months, depending on your starting point. Organizations that begin preparation three months before a contract deadline are setting themselves up to fail. The technical controls, documentation, and evidence collection take time.
Confusing IT with security. Having a managed IT provider doesn’t mean you’re CMMC compliant. IT providers manage infrastructure. CMMC requires a security program — policies, risk management, incident response, access governance, and continuous monitoring. These are fundamentally different disciplines.
What CMMC Consulting Services Actually Do
A CMMC consulting engagement typically follows a structured process designed to take you from wherever you are to assessment-ready.
Gap assessment. The consultant evaluates your current security posture against all applicable NIST 800-171 controls. This produces a clear picture of what’s in place, what’s missing, and what needs to be fixed. The output is a prioritized remediation roadmap.
SSP and POA&M development. Building or refining your System Security Plan, Plan of Action, and Milestones. These are living documents that must accurately reflect your environment and controls.
Control implementation. This is where advisory-only consultants fall short. Implementation means actually configuring technical controls, writing policies, building processes, and deploying solutions — not just recommending them. For organizations without internal security staff, this distinction is critical.
Evidence preparation. Organizing and maintaining the artifacts an assessor will request. This includes policy documents, configuration screenshots, training records, audit logs, and network diagrams. Good consulting firms help you build an evidence management system that stays current.
Assessment preparation. Mock assessments or readiness reviews that simulate the C3PAO assessment process. This identifies any remaining gaps and prepares your team for the questions and evidence requests they’ll face.
Self-Assessment vs. Third-Party Assessment
For Level 1 and some Level 2 scenarios, self-assessment is permitted. But there’s a catch: self-assessments must be accurate and are subject to government review. False claims of compliance can result in False Claims Act liability, with penalties up to three times the amount of damages.
If you’re handling CUI on contracts designated as requiring third-party assessment, you’ll need a C3PAO. These are organizations certified by the Cyber AB (formerly the CMMC Accreditation Body) to conduct official CMMC assessments. The demand for C3PAOs currently exceeds supply, so booking your assessment early is important.
Regardless of the assessment type, the preparation work is the same. You need a complete SSP, functioning controls, documented evidence, and trained personnel.
Timeline: How Long Does CMMC Preparation Take?
If you have a mature security program (NIST 800-171 already substantially implemented): 2–4 months to close gaps, refine documentation, and prepare evidence.
If you have a basic security program with significant gaps: 6–9 months to implement controls, build documentation, and establish evidence collection processes.
If you’re starting from scratch: 9–12+ months. You need to build the entire security program — policies, technical controls, governance, training, and monitoring — before you can demonstrate compliance.
The earlier you start, the less expensive and disruptive the process will be. Rushing CMMC preparation invariably costs more and produces weaker results.
How CISOSHARE Supports CMMC Readiness
CISOSHARE is a Registered Provider Organization (RPO) for CMMC, meaning they are recognized by the Cyber AB to provide CMMC consulting services. Their approach follows a proven methodology to assess your current capability maturity against CMMC requirements, build the security program and controls needed to close gaps, and operate and manage the program through assessment and beyond.
What sets CISOSHARE apart is implementation. Their team doesn’t just identify gaps and hand you a report. They build the SSP, implement the controls, prepare the evidence, and get your organization audit-ready. Their CISO-as-a-Service model provides the security leadership and execution team that most defense contractors don’t have internally.
With 20+ years of experience helping organizations across regulated industries build and maintain security programs, CISOSHARE brings the depth and methodology needed to navigate CMMC efficiently.
FAQ
How much does CMMC consulting cost?
Costs vary based on your current maturity and required level. Level 1 preparation for a small contractor may cost $10,000–$25,000. Level 2 preparation typically ranges from $30,000 to $150,000+, depending on the scope and severity of the gap. Ongoing management adds to this but is essential for maintaining compliance.
Is CMMC required right now?
Yes. The CMMC 2.0 final rule took effect in late 2024, and CMMC requirements are being included in new DoD contracts. If you bid on DoD work, preparation should be underway.
What’s the difference between a Registered Provider Organization and a C3PAO?
An RPO (like CISOSHARE) provides consulting to help you prepare for your assessment. A C3PAO conducts the official assessment. They serve different roles — one helps you study for the test, the other administers the test. Your consulting firm cannot also be your assessor.
Can I use my SOC 2 or ISO 27001 to satisfy CMMC?
Not directly. However, there is significant control overlap. Organizations with existing SOC 2 or ISO 27001 certifications will have a head start on many CMMC requirements, particularly around access control, risk management, and incident response.
