We are a subcontractor, not a prime. Does CMMC still apply to us?

Yes, if you receive, store, process, or transmit FCI or CUI in support of a DoD contract. CMMC requirements flow down from prime contractors to the subcontractors and suppliers they rely on. A prime cannot meet its own obligations if the subcontractors handling controlled information on its behalf are not at the required level, so primes increasingly require their subcontractors to demonstrate readiness before awarding work. Subcontractors that prepare early protect their place in the supply chain and their ability to compete for new work.

What is the SPRS score, and how is it calculated?

For Level 2, contractors use the NIST SP 800-171 DoD Assessment Methodology to score their implementation of the 110 requirements. The methodology starts from a maximum score and subtracts weighted point values for requirements that are not fully met, so the result reflects the security posture of your environment. The score is posted in the Supplier Performance Risk System (SPRS), the government's repository for supplier assessment data. The affirming official's representation must be accurate, because it is relied on by the government. Cyber One Solutions helps you implement the controls, compute the score correctly, document the methodology, and post it, so the number reflects reality and stands up to scrutiny.

How does Cyber One Solutions help with CMMC compliance?

We implement and manage the security program CMMC requires. That includes scoping your environment and identifying FCI and CUI, designing and deploying a compliant architecture (often a dedicated CUI enclave), enforcing access control and multi-factor authentication, operating a 24/7 Security Operations Center with centralized logging and monitoring, deploying endpoint detection and response, managing patching and vulnerability remediation, configuring encryption for data in transit and at rest, writing and maintaining the System Security Plan and POA&M, helping you compute and post an accurate SPRS score, and conducting a readiness assessment that mirrors a real evaluation. We then prepare your team for the self-assessment or C3PAO assessment your contract requires. Cyber One Solutions is not a C3PAO and does not issue the certification; an accredited C3PAO, or the government at Level 3, performs the assessment. We serve defense contractors and subcontractors across Texas, Tennessee, and the United States.

CMMC Compliance for Defense Contractors: NIST 800-171 Controls Managed

Q: What are the System Security Plan (SSP) and Plan of Action and Milestones (POA&M)?

The System Security Plan is the document that describes your in-scope environment and how each applicable NIST SP 800-171 security requirement is implemented. It is the central artifact an assessor reviews. The Plan of Action and Milestones tracks any requirement that is not yet fully implemented, with the responsible owner and a target completion date. Under CMMC, a limited set of requirements may be addressed through a POA&M with conditional outcomes and a defined closeout window, while certain high-weighted requirements must be fully met. Cyber One Solutions writes and maintains both documents and keeps them aligned with your live environment so they hold up at assessment.

CMMC Compliance for Defense Industrial Base Contractors and Subcontractors.

Defense contractors, subcontractors, and suppliers across the Defense Industrial Base (DIB) handle Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) that the U.S. Department of Defense (DoD) requires them to protect. The Cybersecurity Maturity Model Certification (CMMC) program is the DoD mechanism for verifying that protection. CMMC 2.0 defines three levels: Level 1 (Foundational) covers 17 practices that safeguard FCI and is met through an annual self-assessment; Level 2 (Advanced) aligns with the 110 security requirements of NIST SP 800-171 and protects CUI, met by self-assessment or by a CMMC Third-Party Assessment Organization (C3PAO) assessment depending on the contract; and Level 3 (Expert) builds on NIST SP 800-172 and is assessed by the government through the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). The CMMC Program rule (32 CFR Part 170) has been finalized, and the certification requirement is being phased into DoD contracts.

Cyber One Solutions implements, operates, and manages the security controls CMMC requires. We map your environment to NIST SP 800-171, deploy and run the technical controls, write the System Security Plan (SSP), build and track the Plan of Action and Milestones (POA&M), help you compute and post your self-assessment score in the Supplier Performance Risk System (SPRS), and prepare your organization for a self-assessment or a C3PAO assessment. We do the work, manage the systems, and document the evidence. Cyber One Solutions is not a C3PAO and does not issue the certification: an accredited C3PAO (or the government, at Level 3) performs that assessment. Our job is to get you assessment-ready and keep you there as your contracts and environment change.

Who must comply with CMMC, and what does it require?

CMMC (Cybersecurity Maturity Model Certification) is a U.S. Department of Defense program that verifies Defense Industrial Base contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC 2.0 has three levels: Level 1 (17 practices, annual self-assessment) for FCI; Level 2 (the 110 requirements of NIST SP 800-171, met by self-assessment or a C3PAO assessment) for CUI; and Level 3 (based on NIST SP 800-172, assessed by the government) for the highest-priority programs. Cyber One Solutions implements and manages the controls, writes the SSP and POA&M, helps post the SPRS score, and prepares you for assessment. We are not a C3PAO and do not issue the certification.

Three levels: Level 1 (FCI), Level 2 (CUI), Level 3 (highest-priority programs)

Level 2 aligns with the 110 security requirements of NIST SP 800-171

System Security Plan (SSP) and Plan of Action and Milestones (POA&M)

SPRS self-assessment score for Level 2 contracts

Independent C3PAO assessment, or government assessment at Level 3

Core Requirements Every Defense Contractor Must Implement.

CMMC 2.0 organizes its requirements by level and ties them to established federal standards: 17 practices at Level 1, the 110 security requirements of NIST SP 800-171 at Level 2, and the enhanced controls of NIST SP 800-172 at Level 3. These are the elements a contractor must have in place, documented, and operating, and the work we deliver against each one.

If you handle DoD contract information, CMMC is becoming a condition of award.

CMMC applies to organizations in the Defense Industrial Base that handle Federal Contract Information or Controlled Unclassified Information, including prime contractors, subcontractors, and suppliers down the supply chain. The level you must meet depends on the information your contracts involve. As the requirement is phased into DoD solicitations, the certification level appears as a condition of contract award, so the contractors who prepare early protect their eligibility to bid and win.

The Defense Industrial Base includes far more than prime contractors.

The Defense Industrial Base spans prime contractors, subcontractors, manufacturers, software vendors, professional service firms, and suppliers of parts and materials. If your organization receives, creates, stores, or transmits Federal Contract Information or Controlled Unclassified Information in support of a DoD contract, CMMC applies to you, and the requirement flows down from primes to the subcontractors they rely on.

Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information is a broader category of sensitive but unclassified government information, such as technical data, specifications, and certain export-controlled information, that requires safeguarding under federal policy.

Subcontractors often assume CMMC is only the prime's problem. It is not. A prime cannot meet its obligations if the subcontractors handling CUI on its behalf are not at the required level, so the requirement is enforced down the supply chain through flow-down clauses.

The three CMMC levels map to established federal standards.

Level 1 (Foundational) covers 17 practices that protect Federal Contract Information and is demonstrated through an annual self-assessment with an affirmation by company leadership. It is the baseline for contractors that handle FCI but not CUI.

Level 2 (Advanced) aligns with the 110 security requirements of NIST SP 800-171 and protects Controlled Unclassified Information. Depending on the contract, Level 2 is met either by self-assessment or by an assessment performed by a C3PAO accredited under the Cyber AB, the program's Accreditation Body.

Level 3 (Expert) builds on the enhanced security requirements of NIST SP 800-172 for the highest-priority programs and is assessed by the government through the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Knowing which level your contracts require is the first decision that shapes the entire program.

CMMC is verified by independent parties, not by the contractor's own claim alone.

At Level 1 and for some Level 2 contracts, the contractor performs a self-assessment and a senior official affirms the results in the Supplier Performance Risk System. The honesty and accuracy of that affirmation matter: it is a representation to the government, and inaccurate self-assessments carry real legal exposure under the False Claims Act.

For Level 2 contracts that require it, an accredited C3PAO conducts the assessment and the result feeds the certification. At Level 3, the government itself assesses through DIBCAC. In every case, an independent party verifies; the contractor implements and evidences the controls.

This is exactly where Cyber One Solutions fits. We implement, operate, and document the controls, build the SSP and POA&M, and help you compute and post an accurate SPRS score, then prepare you for the assessment. We are not a C3PAO and do not issue the certification. The independent assessor or the government does that.

Frequently asked questions.

How do we know which CMMC level we need to meet?

The level is driven by the information your contracts involve. If you handle Federal Contract Information but not Controlled Unclassified Information, Level 1 (17 practices, annual self-assessment) is typically the target. If you handle CUI, you are looking at Level 2, which aligns with the 110 requirements of NIST SP 800-171 and is met by self-assessment or a C3PAO assessment depending on the specific contract. Level 3 applies to a small set of the highest-priority programs and is assessed by the government. The most reliable signal is the language in your DoD contracts and solicitations and the requirements your prime flows down to you. We help you confirm your scope and target level during onboarding.

What is the difference between NIST SP 800-171 and CMMC?

NIST SP 800-171 is the federal standard that defines the 110 security requirements for protecting Controlled Unclassified Information in non-federal systems. CMMC is the DoD program that verifies a contractor actually meets those requirements. Put simply, NIST SP 800-171 is the control set, and CMMC Level 2 is the mechanism that assesses and confirms implementation of that control set. Many DIB contractors were already contractually obligated to NIST SP 800-171 under DFARS 252.204-7012; CMMC adds the verified assessment on top of that existing obligation.

CMMC Compliance for Defense Industrial Base Contractors and Subcontractors.

Who must comply with CMMC, and what does it require?

Core Requirements Every Defense Contractor Must Implement.

Scope, FCI, and CUI Identification

Access Control and Multi-Factor Authentication

Audit, Accountability, and Monitoring

Configuration Management and System Integrity

System Security Plan (SSP) and POA&M

SPRS Score and Assessment Readiness

If you handle DoD contract information, CMMC is becoming a condition of award.

The Defense Industrial Base includes far more than prime contractors.

The three CMMC levels map to established federal standards.

CMMC is verified by independent parties, not by the contractor's own claim alone.

Frequently asked questions.

CMMC Compliance, Answered.

Related Services.