CMMC
CMMC readiness for defense contractors
If you handle Federal Contract Information or Controlled Unclassified Information for the Department of War, your contracts already require NIST SP 800-171. We get you to an SPRS score you can defend and a program that is ready when third-party assessments resume.
At a glance
Levels1 (FCI) or 2 (CUI)
Assessed bySelf-assessment today; C3PAO for Level 2 once Phase II resumes
Best forPrimes and subcontractors in the defense industrial base
Status, Nov 2026Phase I in force, Phase II suspended
Overview
What it is
The Cybersecurity Maturity Model Certification program checks that defense contractors protect FCI and CUI. Level 1 covers the 15 basic safeguarding requirements of FAR 52.204-21. Level 2 covers the 110 requirements of NIST SP 800-171 Rev 2, scored in the Supplier Performance Risk System (SPRS) from 110 down to a floor of −203.
Phase I took effect on 10 November 2025, which made self-assessments and SPRS affirmations a possible condition of award. On 13 July 2026 the Department suspended Phase II, which would have required C3PAO certification for most CUI contracts from 10 November 2026, pending a reform review. As of mid-October 2026 no restart date had been announced. DFARS 252.204-7012 and the obligation to implement 800-171 were not suspended, and an inaccurate SPRS affirmation still carries False Claims Act risk.
You need this if…
- A prime or a contracting officer asked for your SPRS score or CMMC status
- You hold CUI and your SPRS score was estimated rather than assessed
- You need to decide between a CUI enclave and protecting your whole environment
- You want to be ready when third-party assessments restart, not at the back of the C3PAO queue
The Lightwork Method
How we get you there
01
Scoping
Trace FCI and CUI flows and sort assets into CUI, security protection, contractor risk managed, specialized and out of scope.
02
Gap assessment
Assess all 110 requirements against the assessment objectives in NIST SP 800-171A.
03
SPRS score
Score with the DoD method and flag the gaps that can never go on a POA&M.
04
Remediation
Close gaps, 5-point requirements first; decide on an enclave or GCC High where that fits.
05
SSP and POA&M
System security plan, POA&M and evidence organized by assessment objective.
06
Assessment support
Self-assessment affirmation now, C3PAO preparation when Phase II resumes.
Deliverables
What you walk away with
- CUI scope and asset categorization
- Gap report against all 110 requirements
- SPRS score with the calculation shown
- System security plan (SSP)
- POA&M within the 32 CFR Part 170 limits
- Evidence binder organized by assessment objective
Timeline & pricing
Pricing depends on how many systems and sites handle CUI. Contact us for a fixed-price proposal.
Level 1 usually takes weeks. Level 2 typically takes several months, longer if CUI has to move to a new environment.
We will give you a realistic timeline after scoping.
Are you a C3PAO?
No. C3PAOs are authorized by the Cyber AB and may not assess companies they advised. We prepare you; a C3PAO of your choice does the assessment.
Phase II is suspended. Should we wait?
The suspension paused one way of checking, not the requirement. Contracts with DFARS 252.204-7012 already require NIST SP 800-171, and Phase I self-assessments still apply. Contractors who use the pause to remediate will be ahead when assessments restart.
What SPRS score do we need?
For Conditional Level 2 status the rule requires at least 88 of 110. Only certain 1-point requirements may sit on a POA&M, and they must be closed within 180 days.
Can we keep CUI in commercial Microsoft 365 or Google Workspace?
Cloud services that store CUI must meet FedRAMP Moderate or an equivalent. Many contractors move CUI to GCC High or a dedicated enclave instead of moving everything.
Bring your next audit into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.