CMMC (Cybersecurity Maturity Model Certification)
CMMC exists because the DoD got tired of taking contractors' word for it. For years, defense suppliers self-attested to security requirements under DFARS, and the results were uneven — some took it seriously, plenty didn't, and sensitive information kept leaking out through the weakest link in the supply chain. CMMC 2.0 replaces that honor system with actual verification, tied to the controls in NIST SP 800-171 at the level that covers most contractors (Level 2), with a lighter tier for companies that only handle Federal Contract Information (Level 1) and a government-assessed tier for the most sensitive work (Level 3).
If your contract requires CMMC, it's not optional and it's not negotiable with your customer — it's a condition of the award. The practical question isn't whether to comply, it's how to get there without blowing your budget or your timeline, and without certifying scope that's wider than it needs to be.
What I actually do
Most of the work is unglamorous and exactly where the risk hides. I assess your environment against the relevant control set, honestly — not a checkbox pass that tells you what you want to hear, but a real look at where your current practices meet the bar and where they don't. I help you scope correctly, which is usually where the biggest cost savings live: a lot of companies over-scope their CUI boundary by default and end up trying to secure systems that never needed to carry sensitive data in the first place. Then it's a remediation plan ordered by what actually reduces risk and unblocks certification fastest, plus the System Security Plan and Plan of Action and Milestones that turn your practices into something a C3PAO assessor — or your own self-assessment — can stand behind.
I don't run the certification itself; that's the accredited assessor's job. What I do is make sure that by the time you're in front of one, there are no surprises.
Who this is for
Primes and subs anywhere in the defense supply chain who are staring at a CMMC clause and need to know, concretely, what it will take to meet it — whether you're starting from a strong security program that just needs documentation and scoping discipline, or starting closer to zero.
If a contract or a prime is asking about your CMMC status, get in touch and let's talk about where you stand and what the path looks like.