CMMC for the contractor who just won their first DoD subcontract

CMMC governs the security posture of organizations handling Controlled Unclassified Information or Federal Contract Information for the Department of Defense.

The level matters

Not everyone needs Level 3. Most subcontractors handling FCI but not CUI fall under Level 1, which has 17 controls and a simple self-attestation. CUI handlers move to Level 2.

Scope the environment first

Before you spend a dollar on tooling, map the systems where CUI actually flows. Anything that does not touch CUI is out of scope and stays out.

What we help with

For first-time customers, we typically help with scoping, the System Security Plan, and the technical controls that need new tooling. We do not perform the C3PAO assessment itself.